Fuzz: Fuzzing for kdf
@@ -8,7 +8,9 @@ use self::util::*;
fuzz_target!(|data: &[u8]| {
let mut rand_key = [0u8; 32];
+ let mut rand_salt = vec![0u8; 1];
apply_from_input_fixed(&mut rand_key, data, 32);
+ apply_from_input_heap(&mut rand_salt, data, rand_key.len());
// orion::aead
let aead_key = orion::aead::SecretKey::from_slice(&rand_key).unwrap();
@@ -36,5 +38,11 @@ fuzz_target!(|data: &[u8]| {
};
let password_hash = orion::pwhash::hash_password(&pwhash_password, c).unwrap();
- assert!(orion::pwhash::hash_password_verify(&password_hash, &pwhash_password, c).unwrap();)
+ assert!(orion::pwhash::hash_password_verify(&password_hash, &pwhash_password, c).unwrap());
+
+ // orion::kdf
+ let kdf_salt = orion::kdf::Salt::from_slice(&rand_salt).unwrap();
+ // TODO: Only fuzzed against a derived key length of 256
+ let derived_key = orion::kdf::derive_key(&pwhash_password, &kdf_salt, c, 256).unwrap();
+ assert!(orion::kdf::derive_key_verify(&derived_key, &pwhash_password, &kdf_salt, c).unwrap());
});
