Google GitGoogle Git
Sign in
qemu/edk2/a54d660ee7a3501273b33ddfb3bc68cf271afe2a/./CryptoPkg/Test/UnitTest/Library/BaseCryptLib
tree: a88acd8980bd5a2240535450dd7c866a8bf4832f [search]
  1. TestEKUCerts/
  2. AeadAesGcmTests.c
  3. AuthenticodeTests.c
  4. BaseCryptLibUnitTests.c
  5. BaseCryptLibUnitTestsMbedTls.c
  6. BlockCipherTests.c
  7. BnTests.c
  8. DhTests.c
  9. EcTests.c
  10. EdDsaTests.c
  11. GenerateSlhDsaSignatures.py
  12. HashTests.c
  13. HkdfTests.c
  14. HmacTests.c
  15. MlDsaTests.c
  16. MlDsaTestVectors.h
  17. OaepEncryptTests.c
  18. ParallelhashTests.c
  19. Pkcs5Pbkdf2Tests.c
  20. Pkcs7AttachedContentSignatures.h
  21. Pkcs7AttachedContentTest.c
  22. Pkcs7DecryptTests.c
  23. Pkcs7EkuTests.c
  24. Pkcs7EkuTestSignatures.h
  25. Pkcs7EncryptTestCert.h
  26. Pkcs7EncryptTests.c
  27. RandTests.c
  28. Readme.md
  29. RsaPkcs7Tests.c
  30. RsaPssTests.c
  31. RsaTests.c
  32. SlhDsaTests.c
  33. SlhDsaTestVectors.h
  34. TestBaseCryptLib.h
  35. TestBaseCryptLibHost.inf
  36. TestBaseCryptLibHostMbedTls.inf
  37. TestBaseCryptLibShell.inf
  38. TSTests.c
  39. UnitTestMain.c
  40. UnitTestMainHost.c
  41. X509Tests.c
CryptoPkg/Test/UnitTest/Library/BaseCryptLib/Readme.md

BaseCryptLib Host Unit Tests

SLH-DSA Precomputed Signatures

Background

SLH-DSA (FIPS 205, formerly SPHINCS+) is a stateless hash-based digital signature algorithm. Generating an SLH-DSA-SHAKE-256s signature involves evaluating millions of Keccak hash rounds across FORS and XMSS tree structures. On unoptimized or 32-bit builds (NOOPT / IA32), a single live signing operation takes several minutes of CPU time.

To maintain complete test coverage across all 18 test cases without excessive execution times, precomputed signature test vectors are stored in SlhDsaTestVectors.h and used for verification, tampering, context validation, and boundary checking tests.

Generated Test Vectors

SlhDsaTestVectors.h contains the following precomputed signatures matching mSlhDsaShake256sTestPemKey / mSlhDsaShake256sTestCert:

  • mSlhDsaShake256sTestSignature: Default test message without context.
  • mSlhDsaShake256sTestContextSignature: Default test message with context string "SLH-DSA test context".
  • mSlhDsaShake256sTestEmptyMsgSignature: Empty test message ("") without context.
  • mSlhDsaShake256sTestMaxContextSignature: Default test message with 255-byte maximum context.
  • mSlhDsaShake256sTestMsg2Signature: Secondary test message ("Second message") for multi-signature tests.

Regenerating Signatures

When test keys or test messages are updated, the signatures can be regenerated using GenerateSlhDsaSignatures.py:

Prerequisites

  • Python 3.10+
  • OpenSSL 3.5+ CLI with SLH-DSA support

Command

python GenerateSlhDsaSignatures.py --openssl /path/to/openssl --output new_signatures.h

Paste the generated arrays into SlhDsaTestVectors.h.