Add a couple of verification tests for GOST 34.10

Generating the test vectors found yet another inane (and, of course,
undocumented) behavior in the GOST implementation included in OpenSSL;
it treats the hash inputs as little endian. Just out of curiousity, I
checked RFC 5832, which supposedly specifies this algorithm; not a
peep about endian conversions.

The more I deal with standards coming out of the CryptoPro people, the
less confidence I have in them.

2 files changed, 49 insertions, 0 deletions

diff --git a/checks/pk.cpp b/checks/pk.cpp
index bc1308f1c..23ceda7fe 100644
--- a/checks/pk.cpp
+++ b/checks/pk.cpp
@@ -512,6 +512,34 @@ u32bit validate_ecdsa_sig(const std::string& algo,
    return 2;
    }
 
+u32bit validate_gost_ver(const std::string& algo,
+                         const std::vector<std::string>& str)
+   {
+   if(str.size() != 5)
+      throw std::runtime_error("Invalid input from pk_valid.dat");
+
+#if defined(BOTAN_HAS_GOST_34_10_2001)
+
+   EC_Domain_Params group(OIDS::lookup(str[0]));
+
+   PointGFp public_point = OS2ECP(decode_hex(str[1]), group.get_curve());
+
+   GOST_3410_PublicKey gost(group, public_point);
+
+   std::string emsa = algo.substr(13, std::string::npos);
+
+   PK_Verifier v(gost, emsa);
+
+   SecureVector<byte> msg = decode_hex(str[2]);
+   SecureVector<byte> sig = decode_hex(str[3]);
+
+   bool passed = v.verify_message(msg, msg.size(), sig, sig.size());
+   return (passed ? 0 : 1);
+#endif
+
+   return 2;
+   }
+
 u32bit validate_dsa_ver(const std::string& algo,
                         const std::vector<std::string>& str)
    {
@@ -820,6 +848,9 @@ u32bit do_pk_validation_tests(const std::string& filename,
          else if(algorithm.find("ECDSA/") == 0)
             new_errors = validate_ecdsa_sig(algorithm, substr);
 
+         else if(algorithm.find("GOST_3410_VA/") == 0)
+            new_errors = validate_gost_ver(algorithm, substr);
+
          else if(algorithm.find("RSAES_PKCS8/") == 0)
             new_errors = validate_rsa_enc_pkcs8(algorithm, substr, rng);
          else if(algorithm.find("RSAVA_X509/") == 0)
diff --git a/checks/pk_valid.dat b/checks/pk_valid.dat
index 40bd830c2..1190886e9 100644
--- a/checks/pk_valid.dat
+++ b/checks/pk_valid.dat
@@ -4200,6 +4200,24 @@ x962_p239v1:\
 2CB7F36803EBB9C427C58D8265F11FC5084747133078FC279DE874FBECB0\
 2EEAE988104E9C2234A3C2BEB1F53BFA5DC11FF36A875D1E3CCB1F7E45CF
 
+# ECC verification format is group name:public key:message:signature
+[GOST_3410_VA/EMSA1(GOST-34.11)]
+gost_256A:\
+0400B6F1D75EF48902B0C2302F52CCC71233EC55B903061673AAA586A2B5\
+864048EA2675E8FD8DB1FEDFC7DD40E3CF3A319EE3130E0BE9FDF994B625\
+BC1885F271:\
+:\
+AA3CB0563295A3E281BA368DF8471DE0A4150B3CFCEA575D8A9CC9779035EC36\
+FE406F383A54127453AED406FA9A3B610B28F89FC918C07A5A75289E97B3A991
+
+gost_256A:\
+04BFE0BA366BE575E45C5BBA339C51ACD75D517008A9D3169E3CCEA6EF08\
+046DA74312382D835BEEA1C561A75AFCAFDA0F75A4E5D9787F9DB2870A03\
+2AC1D90465:\
+:\
+B7AB61F33E0B70166C355963BB80B8F6DF54F7F6A43872295CD42B6ACF7DF678\
+F3AFCBE1398DDC01F0A9E4B45397F3ACD8F343399BD2805FB6293E9CB871123A
+
 # NR Format: p:q:g:y:x:message:k:output
 [NR/EMSA1(SHA-1)]
 # Trickiness: in some of these, we put a leading 0 digit on the nonce (k). This