1 files changed, 70 insertions, 0 deletions
diff --git a/source/crypto/SelfTest.mc b/source/crypto/SelfTest.mc
new file mode 100644
index 0000000..0d7eae4
--- /dev/null
+++ b/source/crypto/SelfTest.mc
@@ -0,0 +1,70 @@
+// Author:  cirakg & claude ai
+// Summary: Start-up known-answer tests for every crypto primitive, so wrong firmware crypto never shows wrong codes.
+//
+// run() checks SHA-1, SHA-256, SHA-512, HMAC (generic and native), AES-128
+// and AES-256 CBC, PBKDF2, HKDF and HOTP against published values. The app
+// refuses to show codes when anything fails (README 7.10). The expected
+// values below are published test vectors, not secrets.
+
+import Toybox.Lang;
+
+module SelfTest {
+
+    // Name of the first failing check, or null when everything passed.
+    function run() as String? {
+        var abc = Bytes.fromUtf8("abc");
+        if (!check(Hashes.digest(Hashes.SHA1, abc), "a9993e364706816aba3e25717850c26c9cd0d89d")) { // lint: allow-literal
+            return "SHA-1";
+        }
+        if (!check(Hashes.digest(Hashes.SHA256, abc), "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad")) { // lint: allow-literal
+            return "SHA-256";
+        }
+        if (!check(Hashes.digest(Hashes.SHA512, abc).slice(0, 32), "ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a")) { // lint: allow-literal
+            return "SHA-512";
+        }
+        // RFC 2202 test case 1 (HMAC-SHA1) and RFC 4231 test case 1 (HMAC-SHA256).
+        var key = new [20]b;
+        for (var i = 0; i < 20; i++) {
+            key[i] = 0x0b;
+        }
+        var hiThere = Bytes.fromUtf8("Hi There");
+        if (!check(Hmac.generic(Hashes.SHA1, key, hiThere), "b617318655057264e28bc0b6fb378c8ef146be00")) { // lint: allow-literal
+            return "HMAC-SHA1";
+        }
+        var sha256Mac = "b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7"; // lint: allow-literal
+        if (!check(Hmac.nativeSha256(key, hiThere), sha256Mac) || !check(Hmac.generic(Hashes.SHA256, key, hiThere), sha256Mac)) {
+            return "HMAC-SHA256";
+        }
+        // NIST SP 800-38A F.2.1 and F.2.5, first block.
+        var iv = Bytes.fromHex("000102030405060708090a0b0c0d0e0f"); // lint: allow-literal
+        var block = Bytes.fromHex("6bc1bee22e409f96e93d7e117393172a"); // lint: allow-literal
+        if (!check(Aes.cbcRaw(Bytes.fromHex("2b7e151628aed2a6abf7158809cf4f3c"), iv, block, true), "7649abac8119b246cee98e9b12e9197d")) { // lint: allow-literal
+            return "AES-128";
+        }
+        var aes256Key = Bytes.fromHex("603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4"); // lint: allow-literal
+        if (!check(Aes.cbcRaw(aes256Key, iv, block, true), "f58c4c04d6e5f1ba779eabfb5f7bfbd6")) { // lint: allow-literal
+            return "AES-256";
+        }
+        // RFC 7914 section 11, first vector (first 32 bytes).
+        if (!check(Kdf.pbkdf2(Bytes.fromUtf8("passwd"), Bytes.fromUtf8("salt"), 1, 32), "55ac046e56e3089fec1691c22544b605f94185216dde0465e68b9d57c20dacbc")) { // lint: allow-literal
+            return "PBKDF2";
+        }
+        // RFC 5869 test case 3 (no salt, no info).
+        var ikm = new [22]b;
+        for (var i = 0; i < 22; i++) {
+            ikm[i] = 0x0b;
+        }
+        if (!check(Kdf.hkdf(ikm, []b, []b, 42), "8da4e775a563c18f715f802a063c5a31b8a11f5c5ee1879ec3454e5f3c738d2d9d201395faa4b61a96c8")) { // lint: allow-literal
+            return "HKDF";
+        }
+        // RFC 4226 Appendix D, counter 0.
+        if (!Otp.hotp(Hashes.SHA1, Bytes.fromUtf8("12345678901234567890"), 0l, 6).equals("755224")) {
+            return "HOTP";
+        }
+        return null;
+    }
+
+    function check(actual as ByteArray, expectedHex as String) as Boolean {
+        return Bytes.equal(actual, Bytes.fromHex(expectedHex));
+    }
+}