|
1 Test suite from http://csrc.nist.gov/cryptval/shs.html |
|
2 |
|
3 Sample Vectors for SHA-1 Testing |
|
4 |
|
5 This file describes tests and vectors that can be used in verifying the correctness of |
|
6 an SHA-1 implementation. However, use of these vectors does not take the place of validation |
|
7 obtained through the Cryptographic Module Validation Program. |
|
8 |
|
9 There are three areas of the Secure Hash Standard for which test vectors are supplied: |
|
10 short messages of varying length, selected long messages, and pseudorandomly generated messages. |
|
11 Since it is possible for an implementation to correctly handle the hashing of byte-oriented |
|
12 messages (and not messages of a non-byte length), the SHS tests each come in two flavors. For |
|
13 both byte oriented and bit oriented messages, the message lengths are given in bits. |
|
14 |
|
15 Type I Test: Messages of Varying Length |
|
16 |
|
17 An implementation of the SHS must be able to correctly generate message digests for |
|
18 messages of arbitrary length. This functionality can be tested by supplying the implementation |
|
19 with 1025 pseudorandomly generated messages with lengths from 0 to 1024 bits (for an implementation |
|
20 that only hashes byte-oriented data correctly, 129 messages of length 0, 8, 16, 24,...,1024 bits |
|
21 will be supplied). |
|
22 |
|
23 Type II Test: Selected Long Messages |
|
24 |
|
25 Additional testing of an implementation can be performed by testing that the implementation |
|
26 can correctly generate digests for longer messages. A list of 100 messages, each of length > 1024, |
|
27 is supplied. These can be used to verify the hashing of longer message lengths. For bit oriented |
|
28 testing the messages are from 1025 to 103425 bits long (length=1025+i*1024, where 0<=i<100). For |
|
29 byte oriented testing the messages are from 1032 to 103432 (length=1032+i*1024, where 0<=i<100). |
|
30 |
|
31 Type III Test: Pseudorandomly Generated Messages |
|
32 |
|
33 This test determines whether the implementation can compute message digests for messages |
|
34 that are generated using a given seed. A sequence of 100 message digests is generated using this |
|
35 seed. The digests are generated according to the following pseudocode: |
|
36 |
|
37 procedure MonteCarlo(string SEED) |
|
38 { |
|
39 integer i, j, a; |
|
40 string M; |
|
41 |
|
42 M := SEED; |
|
43 for j = 0 to 99 do { |
|
44 for i = 1 to 50000 do { |
|
45 for a = 1 to (j/4*8 + 24) do M := M || ’0’; /*‘0' is the binary zero bit. */ |
|
46 M := M || i; /* Here, the value for ‘i’ is expressed as a 32-bit word |
|
47 and concatenated with ‘M’. The first bit |
|
48 concatenated with ‘M’ is the most significant bit of |
|
49 this 32-bit word. */ |
|
50 M := SHA(M); |
|
51 } |
|
52 print(M); |
|
53 } |
|
54 } |
|
55 |
|
56 NOTE: In the above procedure, || denotes concatenation. Also, M || i denotes appending the 32-bit |
|
57 word representing the value ‘i’, as defined in section 2 of the SHS. Within the procedure, M is a string |
|
58 of variable length. The initial length of 416 bits ensures that the length of M never exceeds 512 bits |
|
59 during execution of the above procedure, and it ensures that messages will be of a byte length. Each |
|
60 element printed should be 160 bits in length. |
|
61 |
|
62 |
|
63 File formats: |
|
64 |
|
65 There are two files included for each test type (bit-oriented and byte-oriented). One file contains |
|
66 the messages and the other file contains the hashes. |
|
67 |
|
68 The message files provided use "compact strings" to store the message values. Compact strings are |
|
69 used to represented the messages in a compact form. A compact string has the form |
|
70 z || b || n(1) || n(2) || ... || n(z) |
|
71 where z>=0 that represents the number of n, b is either 0 or 1, and each n(i) is a decimal integer |
|
72 representing a positive number. The length of the compact string is given by the summation of the n(i). |
|
73 |
|
74 The compact string is interpreted as the representation of the bit string consisting of b repeated n(1) times, |
|
75 followed by 1-b repeated n(2) times, followed by b repeated n(3) times, and so on. |
|
76 |
|
77 Example: |
|
78 M = 5 1 7 13 5 1 2 |
|
79 where z = 5 and b = 1. Then the compact string M represents the bit string |
|
80 1111111000000000000011111011 |
|
81 where 1 is repeated 7 times, 0 is repeated 13 times, 1 is repeated 5 times, |
|
82 0 is repeated 1 time, and 1 is repeated 2 times. |
|
83 |