4 ms·
> Are you maybe using the term "test vectors" differently than we are? I don't think so. Check out the test suite in my tarball, there are files named "vector
by loup-vaillant 10y ago
> Are you maybe using the term "test vectors" differently than we are?
I don't think so. Check out the test suite in my tarball, there are files named "vectors", with sets of inputs and expected outputs.
In addition, I have written consistency checks for all constructions (encryption-decryption roundtrip yields the original plaintext, legitimate messages are accepted, forgeries are rejected…)
I feel I should do more, but I'm not sure what exactly.
- tptacek 10y agoRight, then, so these aren't really security tests. I'm suggesting you reword that bit on your page; passing test vectors doesn't make something more trustworthy; it's table stakes. I'm not saying you shouldn't write tests for misuse cases! You should do that.
- loup-vaillant 10y agoOkay, what's a security test? How is it any different from a mere correctness test? Can you suggest some link to read up, or some tool to use?
- arnarbi 10y agoSee e.g. https://github.com/google/wycheproof https://github.com/google/wycheproof Fuzzing tests can also uncover weird bugs and edge cases that can lead to vulnerabilities.