35 lines
899 B
Go
35 lines
899 B
Go
package encrypt
|
|
|
|
import (
|
|
"bytes"
|
|
"testing"
|
|
)
|
|
|
|
func TestAESGCMRoundTripAndRandomNonce(t *testing.T) {
|
|
key := bytes.Repeat([]byte{7}, AESGCMKeySize)
|
|
plain := []byte("message encryption key")
|
|
aad := []byte("tenant:1:version:1")
|
|
first, firstNonce, err := AESGCMEncrypt(plain, key, aad)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
second, secondNonce, err := AESGCMEncrypt(plain, key, aad)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if bytes.Equal(firstNonce, secondNonce) || bytes.Equal(first, second) {
|
|
t.Fatal("repeated encryption must use a different nonce and ciphertext")
|
|
}
|
|
decoded, err := AESGCMDecrypt(first, firstNonce, key, aad)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !bytes.Equal(decoded, plain) {
|
|
t.Fatalf("unexpected plaintext: %q", decoded)
|
|
}
|
|
first[0] ^= 1
|
|
if _, err = AESGCMDecrypt(first, firstNonce, key, aad); err == nil {
|
|
t.Fatal("tampered ciphertext must fail authentication")
|
|
}
|
|
}
|