asmhatreandClaude Sonnet 5.5
eca73ad544
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_017ic4b7rnC7jppGGdHGESvy
29 lines
1.5 KiB
Python
29 lines
1.5 KiB
Python
#!/usr/bin/env python3
|
|
"""Third opinion: ask the `openssl kdf` command line tool (no Python crypto, no Java) for the RFC 5869 cases
|
|
and for the first rows of cases.tsv, and compare with the expected OKM."""
|
|
import subprocess, sys, re
|
|
|
|
def openssl_hkdf(digest, ikm, salt, info, length):
|
|
cmd = ["openssl", "kdf", "-keylen", str(length), "-kdfopt", f"digest:{digest}", "-kdfopt", f"hexkey:{ikm}",
|
|
"-kdfopt", f"hexinfo:{info}", "-kdfopt", "mode:EXTRACT_AND_EXPAND"]
|
|
if salt: cmd += ["-kdfopt", f"hexsalt:{salt}"]
|
|
cmd += ["HKDF"]
|
|
out = subprocess.run(cmd, capture_output=True, text=True, check=True).stdout.strip()
|
|
return out.replace(":", "").lower()
|
|
|
|
print(subprocess.run(["openssl", "version"], capture_output=True, text=True).stdout.strip())
|
|
ok = bad = 0
|
|
rfc = [("SHA256", "0b"*22, "000102030405060708090a0b0c", "f0f1f2f3f4f5f6f7f8f9", 42,
|
|
"3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865"),
|
|
("SHA256", "0b"*22, "", "", 42,
|
|
"8da4e775a563c18f715f802a063c5a31b8a11f5c5ee1879ec3454e5f3c738d2d9d201395faa4b61a96c8")]
|
|
rows = [tuple(l.rstrip("\n").split("\t")) for l in open(sys.argv[1])]
|
|
rows = [(h, i, s, n, int(L), o) for h, i, s, n, L, o in rows]
|
|
for h, i, s, n, L, o in rfc + rows[::10]:
|
|
got = openssl_hkdf(h, i, s, n, L)
|
|
if got == o: ok += 1
|
|
else:
|
|
bad += 1; print("MISMATCH", h, i[:16], L)
|
|
print(f"openssl kdf HKDF: {ok} of {ok+bad} cases match ({len(rfc)} RFC 5869 + every 10th row of cases.tsv)")
|
|
sys.exit(1 if bad else 0)
|