Wycheproof 密码学测试工具：验证实现正确性，检测已知漏洞

wycheproof by trailofbits/skills

1,100 周安装量

3,900 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/trailofbits/skills --skill wycheproof

开发测试安全

🇨🇳中文介绍

Wycheproof

Wycheproof 是一个庞大的测试向量集合，旨在验证密码学实现的正确性并测试已知攻击。最初由 Google 开发，现在是一个社区管理的项目，贡献者可以为其特定的密码学构造添加测试向量。

背景

关键概念

概念	描述
测试向量	用于验证密码学实现正确性的输入/输出对
测试组	共享属性（密钥大小、IV 大小、曲线）的测试向量集合
结果标志	指示测试应通过（有效）、失败（无效）还是可接受
边界情况测试	针对已知漏洞和攻击模式进行测试

重要性

众所周知，密码学实现很难做到完全正确。即使是小错误也可能导致：

私钥泄露
允许签名伪造
实现消息解密
当不同实现接受/拒绝相同输入时产生共识问题

Wycheproof 已在包括 OpenJDK 的 SHA1withDSA、Bouncy Castle 的 ECDHC 以及 elliptic npm 包在内的主要库中发现了漏洞。

使用时机

在以下情况应用 Wycheproof：

测试密码学实现（AES-GCM、ECDSA、ECDH、RSA 等）
验证密码学代码是否正确处理边界情况
根据已知攻击向量验证实现
为密码学库设置 CI/CD
审计第三方密码学代码的正确性

在以下情况考虑替代方案：

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

场景	推荐方法	备注
AES-GCM 实现	使用 `aes_gcm_test.json`	44 个测试组中的 316 个测试向量
ECDSA 验证	对特定曲线使用 `ecdsa_*_test.json`	测试签名可延展性、DER 编码
ECDH 密钥交换	使用 `ecdh_*_test.json`	测试无效曲线攻击
RSA 签名	使用 `rsa_*_test.json`	测试填充预言攻击
ChaCha20-Poly1305	使用 `chacha20_poly1305_test.json`	测试 AEAD 实现

类别	算法
对称加密	AES-GCM, AES-EAX, ChaCha20-Poly1305
签名	ECDSA, EdDSA, RSA-PSS, RSA-PKCS1
密钥交换	ECDH, X25519, X448
哈希	HMAC, HKDF
曲线	secp256k1, secp256r1, secp384r1, secp521r1, ed25519, ed448

结果	含义
valid	测试用例应成功
acceptable	测试用例允许成功但包含非理想属性
invalid	测试用例应失败

阶段 1：将 Wycheproof 添加到您的项目

选项 1：Git 子模块（推荐）

将 Wycheproof 添加为 git 子模块可确保自动更新：

git submodule add https://github.com/C2SP/wycheproof.git

选项 2：获取特定测试向量

如果无法使用子模块，则获取特定的 JSON 文件：

#!/bin/bash

TMP_WYCHEPROOF_FOLDER=".wycheproof/"
TEST_VECTORS=('aes_gcm_test.json' 'aes_eax_test.json')
BASE_URL="https://raw.githubusercontent.com/C2SP/wycheproof/master/testvectors_v1/"

# Create wycheproof folder
mkdir -p $TMP_WYCHEPROOF_FOLDER

# Request all test vector files if they don't exist
for i in "${TEST_VECTORS[@]}"; do
  if [ ! -f "${TMP_WYCHEPROOF_FOLDER}${i}" ]; then
    curl -o "${TMP_WYCHEPROOF_FOLDER}${i}" "${BASE_URL}${i}"
    if [ $? -ne 0 ]; then
      echo "Failed to download ${i}"
      exit 1
    fi
  fi
done

阶段 2：解析测试向量

识别适用于您算法的测试文件并解析 JSON：

Python 示例：

import json

def load_wycheproof_test_vectors(path: str):
    testVectors = []
    try:
        with open(path, "r") as f:
            wycheproof_json = json.loads(f.read())
    except FileNotFoundError:
        print(f"No Wycheproof file found at: {path}")
        return testVectors

    # Attributes that need hex-to-bytes conversion
    convert_attr = {"key", "aad", "iv", "msg", "ct", "tag"}

    for testGroup in wycheproof_json["testGroups"]:
        # Filter test groups based on implementation constraints
        if testGroup["ivSize"] < 64 or testGroup["ivSize"] > 1024:
            continue

        for tv in testGroup["tests"]:
            # Convert hex strings to bytes
            for attr in convert_attr:
                if attr in tv:
                    tv[attr] = bytes.fromhex(tv[attr])
            testVectors.append(tv)

    return testVectors

JavaScript 示例：

const fs = require('fs').promises;

async function loadWycheproofTestVectors(path) {
  const tests = [];

  try {
    const fileContent = await fs.readFile(path);
    const data = JSON.parse(fileContent.toString());

    data.testGroups.forEach(testGroup => {
      testGroup.tests.forEach(test => {
        // Add shared test group properties to each test
        test['pk'] = testGroup.publicKey.pk;
        tests.push(test);
      });
    });
  } catch (err) {
    console.error('Error reading or parsing file:', err);
    throw err;
  }

  return tests;
}

阶段 3：编写测试工具

创建处理有效和无效测试用例的测试函数。

Python/pytest 示例：

import pytest
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

tvs = load_wycheproof_test_vectors("wycheproof/testvectors_v1/aes_gcm_test.json")

@pytest.mark.parametrize("tv", tvs, ids=[str(tv['tcId']) for tv in tvs])
def test_encryption(tv):
    try:
        aesgcm = AESGCM(tv['key'])
        ct = aesgcm.encrypt(tv['iv'], tv['msg'], tv['aad'])
    except ValueError as e:
        # Implementation raised error - verify test was expected to fail
        assert tv['result'] != 'valid', tv['comment']
        return

    if tv['result'] == 'valid':
        assert ct[:-16] == tv['ct'], f"Ciphertext mismatch: {tv['comment']}"
        assert ct[-16:] == tv['tag'], f"Tag mismatch: {tv['comment']}"
    elif tv['result'] == 'invalid' or tv['result'] == 'acceptable':
        assert ct[:-16] != tv['ct'] or ct[-16:] != tv['tag']

@pytest.mark.parametrize("tv", tvs, ids=[str(tv['tcId']) for tv in tvs])
def test_decryption(tv):
    try:
        aesgcm = AESGCM(tv['key'])
        decrypted_msg = aesgcm.decrypt(tv['iv'], tv['ct'] + tv['tag'], tv['aad'])
    except ValueError:
        assert tv['result'] != 'valid', tv['comment']
        return
    except InvalidTag:
        assert tv['result'] != 'valid', tv['comment']
        assert 'ModifiedTag' in tv['flags'], f"Expected 'ModifiedTag' flag: {tv['comment']}"
        return

    assert tv['result'] == 'valid', f"No invalid test case should pass: {tv['comment']}"
    assert decrypted_msg == tv['msg'], f"Decryption mismatch: {tv['comment']}"

JavaScript/Mocha 示例：

const assert = require('assert');

function testFactory(tcId, tests) {
  it(`[${tcId + 1}] ${tests[tcId].comment}`, function () {
    const test = tests[tcId];
    const ed25519 = new eddsa('ed25519');
    const key = ed25519.keyFromPublic(toArray(test.pk, 'hex'));

    let sig;
    if (test.result === 'valid') {
      sig = key.verify(test.msg, test.sig);
      assert.equal(sig, true, `[${test.tcId}] ${test.comment}`);
    } else if (test.result === 'invalid') {
      try {
        sig = key.verify(test.msg, test.sig);
      } catch (err) {
        // Point could not be decoded
        sig = false;
      }
      assert.equal(sig, false, `[${test.tcId}] ${test.comment}`);
    }
  });
}

// Generate tests for all test vectors
for (var tcId = 0; tcId < tests.length; tcId++) {
  testFactory(tcId, tests);
}

阶段 4：CI 集成

通过以下方式确保测试向量保持最新：

使用 git 子模块 : 在运行测试前更新 CI 中的子模块
获取最新向量 : 在测试执行前运行获取脚本
计划更新 : 设置每周/每月更新以获取新的测试向量

检测到的常见漏洞

Wycheproof 测试向量旨在捕获特定的漏洞模式：

漏洞	描述	受影响的算法	示例 CVE
签名可延展性	同一消息有多个有效签名	ECDSA, EdDSA	CVE-2024-42459
无效 DER 编码	接受非规范 DER 签名	ECDSA	CVE-2024-42460, CVE-2024-42461
无效曲线攻击	使用无效曲线点的 ECDH	ECDH	许多库中的常见问题
填充预言	填充验证中的时序泄露	RSA-PKCS1	历史上的 OpenSSL 问题
标签伪造	接受修改后的认证标签	AES-GCM, ChaCha20-Poly1305	各种实现

签名可延展性：深入探讨

问题： 不验证签名编码的实现可能接受同一消息的多个有效签名。

示例（EdDSA）： 在签名后追加或移除零：

Valid signature:   ...6a5c51eb6f946b30d
Invalid signature: ...6a5c51eb6f946b30d0000  (should be rejected)

# Add signature length check
if len(sig) != 128:  # EdDSA signatures must be exactly 64 bytes (128 hex chars)
    return False

影响： 当不同实现接受/拒绝相同签名时，可能导致共识问题。

相关的 Wycheproof 测试：

EdDSA: tcId 37 - "removing 0 byte from signature"
ECDSA: tcId 06 - "Legacy: ASN encoding of r misses leading 0"

案例研究：Elliptic npm 包

本案例研究展示了 Wycheproof 如何在流行的 elliptic npm 包（3000+ 依赖项，每周数百万次下载）中发现了三个 CVE。

elliptic 库是一个用 JavaScript 编写的椭圆曲线密码学库，支持 ECDH、ECDSA 和 EdDSA。在版本 6.5.6 上使用 Wycheproof 测试向量揭示了多个漏洞：

CVE-2024-42459 : EdDSA 签名可延展性（追加/移除零）
CVE-2024-42460 : ECDSA DER 编码 - 无效位放置
CVE-2024-42461 : ECDSA DER 编码 - 长度字段中的前导零

识别支持的曲线 : EdDSA 的 ed25519
查找测试向量 : testvectors_v1/ed25519_test.json
解析测试向量 : 加载 JSON 并提取测试
编写测试工具 : 创建参数化测试
运行测试 : 识别失败
分析根本原因 : 检查实现代码
提出修复方案 : 添加验证检查

EdDSA 问题（CVE-2024-42459）：

缺少签名长度验证
允许签名中存在尾随零
修复：添加 if(sig.length !== 128) return false;

ECDSA 问题 1（CVE-2024-42460）：

缺少对 DER 编码的 r 和 s 值中第一位为零的检查
修复：添加 if ((data[p.place] & 128) !== 0) return false;

ECDSA 问题 2（CVE-2024-42461）：

DER 长度字段接受前导零
修复：添加 if(buf[p.place] === 0x00) return false;

所有三个漏洞都允许单个消息有多个有效签名，导致不同实现之间的共识问题。

Wycheproof 能捕获细微的编码错误
可重用的测试工具能带来回报
测试向量注释和标志有助于诊断问题
即使是流行的库也能从系统性的测试向量验证中受益

技巧	为何有帮助
按参数过滤测试组	专注于与您的实现约束相关的测试向量
使用测试向量标志	理解正在测试的特定漏洞模式
检查 `notes` 字段	获取标志含义的详细解释
测试加密/解密和签名/验证	确保双向正确性
在 CI 中运行测试	捕获回归并受益于新的测试向量
使用参数化测试	通过 tcId 和 comment 获得清晰的失败消息

错误	为何错误	正确方法
仅测试有效用例	错过了接受无效输入的漏洞	测试所有结果类型：valid, invalid, acceptable
忽略 "acceptable" 结果	实现可能存在细微错误	将 acceptable 视为值得调查的警告
不过滤测试组	浪费时间在不支持的参数上	根据您的实现按 keySize, ivSize 等过滤
不更新测试向量	错过新的漏洞模式	使用子模块或计划获取
仅测试一个方向	加密/签名可能有效但解密/验证失败	测试两个操作

技能	在 Wycheproof 测试中的主要用途
pytest	用于参数化测试的 Python 测试框架
mocha	用于测试生成的 JavaScript 测试框架
constant-time-testing	用时序侧信道测试补充 Wycheproof
cryptofuzz	基于模糊测试的密码学测试，用于发现额外错误

技能	应用时机
coverage-analysis	确保测试向量覆盖密码学实现中的所有代码路径
property-based-testing	测试数学属性（例如，加密/解密往返）
fuzz-harness-writing	为密码学解析器创建工具（补充 Wycheproof）

技能	关系
crypto-testing	Wycheproof 是全面密码学测试方法中的关键工具
fuzzing	使用模糊测试发现 Wycheproof 未覆盖的错误（新的边界情况）

技能依赖关系图

                    ┌─────────────────────┐
                    │    wycheproof       │
                    │   (this skill)      │
                    └──────────┬──────────┘
                               │
           ┌───────────────────┼───────────────────┐
           │                   │                   │
           ▼                   ▼                   ▼
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│  pytest/mocha   │ │ constant-time   │ │   cryptofuzz    │
│ (test framework)│ │   testing       │ │   (fuzzing)     │
└────────┬────────┘ └────────┬────────┘ └────────┬────────┘
         │                   │                   │
         └───────────────────┼───────────────────┘
                             │
                             ▼
              ┌──────────────────────────┐
              │   Technique Skills       │
              │ coverage, harness, PBT   │
              └──────────────────────────┘

官方仓库包含：

testvectors/ 和 testvectors_v1/ 中的所有测试向量
schemas/ 中的 JSON 模式
Java 和 JavaScript 中的参考实现
doc/ 中的文档

pycryptodome 库在其测试套件中集成了 Wycheproof 测试向量，展示了 Python 密码学实现的最佳实践。

C2SP 社区 - 维护 Wycheproof 的密码学规范和标准社区
Wycheproof 问题跟踪器 - 报告测试向量中的错误或建议新的构造

Wycheproof 是根据已知攻击向量和边界情况验证密码学实现的重要工具。通过将 Wycheproof 测试向量集成到您的测试工作流程中，您可以：

捕获细微的编码和验证错误
防止签名可延展性问题
确保不同实现之间行为一致
受益于社区贡献的测试向量
防范已知的密码学漏洞

编写可重用测试工具的投资，将随着 Wycheproof 仓库中添加新的测试向量而通过持续验证获得回报。

🇺🇸English

Wycheproof

Wycheproof is an extensive collection of test vectors designed to verify the correctness of cryptographic implementations and test against known attacks. Originally developed by Google, it is now a community-managed project where contributors can add test vectors for specific cryptographic constructions.

Background

Key Concepts

Concept	Description
Test vector	Input/output pair for validating crypto implementation correctness
Test group	Collection of test vectors sharing attributes (key size, IV size, curve)
Result flag	Indicates if test should pass (valid), fail (invalid), or is acceptable
Edge case testing	Testing for known vulnerabilities and attack patterns

Why This Matters

Cryptographic implementations are notoriously difficult to get right. Even small bugs can:

Expose private keys
Allow signature forgery
Enable message decryption
Create consensus problems when different implementations accept/reject the same inputs

Wycheproof has found vulnerabilities in major libraries including OpenJDK's SHA1withDSA, Bouncy Castle's ECDHC, and the elliptic npm package.

When to Use

Apply Wycheproof when:

Testing cryptographic implementations (AES-GCM, ECDSA, ECDH, RSA, etc.)
Validating that crypto code handles edge cases correctly
Verifying implementations against known attack vectors
Setting up CI/CD for cryptographic libraries
Auditing third-party crypto code for correctness

Consider alternatives when:

Testing for timing side-channels (use constant-time testing tools instead)
Finding new unknown bugs (use fuzzing instead)
Testing custom/experimental cryptographic algorithms (Wycheproof only covers established algorithms)

Quick Reference

Scenario	Recommended Approach	Notes
AES-GCM implementation	Use `aes_gcm_test.json`	316 test vectors across 44 test groups
ECDSA verification	Use `ecdsa_*_test.json` for specific curves	Tests signature malleability, DER encoding
ECDH key exchange	Use `ecdh_*_test.json`	Tests invalid curve attacks
RSA signatures	Use `rsa_*_test.json`	Tests padding oracle attacks
ChaCha20-Poly1305	Use `chacha20_poly1305_test.json`

Testing Workflow

Phase 1: Setup                 Phase 2: Parse Test Vectors
┌─────────────────┐          ┌─────────────────┐
│ Add Wycheproof  │    →     │ Load JSON file  │
│ as submodule    │          │ Filter by params│
└─────────────────┘          └─────────────────┘
         ↓                            ↓
Phase 4: CI Integration        Phase 3: Write Harness
┌─────────────────┐          ┌─────────────────┐
│ Auto-update     │    ←     │ Test valid &    │
│ test vectors    │          │ invalid cases   │
└─────────────────┘          └─────────────────┘

Repository Structure

The Wycheproof repository is organized as follows:

┣ 📜 README.md       : Project overview
┣ 📂 doc             : Documentation
┣ 📂 java            : Java JCE interface testing harness
┣ 📂 javascript      : JavaScript testing harness
┣ 📂 schemas         : Test vector schemas
┣ 📂 testvectors     : Test vectors
┗ 📂 testvectors_v1  : Updated test vectors (more detailed)

The essential folders are testvectors and testvectors_v1. While both contain similar files, testvectors_v1 includes more detailed information and is recommended for new integrations.

Supported Algorithms

Wycheproof provides test vectors for a wide range of cryptographic algorithms:

Category	Algorithms
Symmetric Encryption	AES-GCM, AES-EAX, ChaCha20-Poly1305
Signatures	ECDSA, EdDSA, RSA-PSS, RSA-PKCS1
Key Exchange	ECDH, X25519, X448
Hashing	HMAC, HKDF
Curves	secp256k1, secp256r1, secp384r1, secp521r1, ed25519, ed448

Test File Structure

Each JSON test file tests a specific cryptographic construction. All test files share common attributes:

"algorithm"         : The name of the algorithm tested
"schema"            : The JSON schema (found in schemas folder)
"generatorVersion"  : The version number
"numberOfTests"     : The total number of test vectors in this file
"header"            : Detailed description of test vectors
"notes"             : In-depth explanation of flags in test vectors
"testGroups"        : Array of one or multiple test groups

Test Groups

Test groups group sets of tests based on shared attributes such as:

Key sizes
IV sizes
Public keys
Curves

This classification allows extracting tests that meet specific criteria relevant to the construction being tested.

Test Vector Attributes

Shared Attributes

All test vectors contain four common fields:

tcId : Unique identifier for the test vector within a file
comment : Additional information about the test case
flags : Descriptions of specific test case types and potential dangers (referenced in notes field)
result : Expected outcome of the test

The result field can take three values:

Result	Meaning
valid	Test case should succeed
acceptable	Test case is allowed to succeed but contains non-ideal attributes
invalid	Test case should fail

Unique Attributes

Unique attributes are specific to the algorithm being tested:

Algorithm	Unique Attributes
AES-GCM	`key`, `iv`, `aad`, `msg`, `ct`, `tag`
ECDH secp256k1	`public`, `private`, `shared`
ECDSA

Implementation Guide

Phase 1: Add Wycheproof to Your Project

Option 1: Git Submodule (Recommended)

Adding Wycheproof as a git submodule ensures automatic updates:

git submodule add https://github.com/C2SP/wycheproof.git

Option 2: Fetch Specific Test Vectors

If submodules aren't possible, fetch specific JSON files:

#!/bin/bash

TMP_WYCHEPROOF_FOLDER=".wycheproof/"
TEST_VECTORS=('aes_gcm_test.json' 'aes_eax_test.json')
BASE_URL="https://raw.githubusercontent.com/C2SP/wycheproof/master/testvectors_v1/"

# Create wycheproof folder
mkdir -p $TMP_WYCHEPROOF_FOLDER

# Request all test vector files if they don't exist
for i in "${TEST_VECTORS[@]}"; do
  if [ ! -f "${TMP_WYCHEPROOF_FOLDER}${i}" ]; then
    curl -o "${TMP_WYCHEPROOF_FOLDER}${i}" "${BASE_URL}${i}"
    if [ $? -ne 0 ]; then
      echo "Failed to download ${i}"
      exit 1
    fi
  fi
done

Phase 2: Parse Test Vectors

Identify the test file for your algorithm and parse the JSON:

Python Example:

import json

def load_wycheproof_test_vectors(path: str):
    testVectors = []
    try:
        with open(path, "r") as f:
            wycheproof_json = json.loads(f.read())
    except FileNotFoundError:
        print(f"No Wycheproof file found at: {path}")
        return testVectors

    # Attributes that need hex-to-bytes conversion
    convert_attr = {"key", "aad", "iv", "msg", "ct", "tag"}

    for testGroup in wycheproof_json["testGroups"]:
        # Filter test groups based on implementation constraints
        if testGroup["ivSize"] < 64 or testGroup["ivSize"] > 1024:
            continue

        for tv in testGroup["tests"]:
            # Convert hex strings to bytes
            for attr in convert_attr:
                if attr in tv:
                    tv[attr] = bytes.fromhex(tv[attr])
            testVectors.append(tv)

    return testVectors

JavaScript Example:

const fs = require('fs').promises;

async function loadWycheproofTestVectors(path) {
  const tests = [];

  try {
    const fileContent = await fs.readFile(path);
    const data = JSON.parse(fileContent.toString());

    data.testGroups.forEach(testGroup => {
      testGroup.tests.forEach(test => {
        // Add shared test group properties to each test
        test['pk'] = testGroup.publicKey.pk;
        tests.push(test);
      });
    });
  } catch (err) {
    console.error('Error reading or parsing file:', err);
    throw err;
  }

  return tests;
}

Phase 3: Write Testing Harness

Create test functions that handle both valid and invalid test cases.

Python/pytest Example:

import pytest
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

tvs = load_wycheproof_test_vectors("wycheproof/testvectors_v1/aes_gcm_test.json")

@pytest.mark.parametrize("tv", tvs, ids=[str(tv['tcId']) for tv in tvs])
def test_encryption(tv):
    try:
        aesgcm = AESGCM(tv['key'])
        ct = aesgcm.encrypt(tv['iv'], tv['msg'], tv['aad'])
    except ValueError as e:
        # Implementation raised error - verify test was expected to fail
        assert tv['result'] != 'valid', tv['comment']
        return

    if tv['result'] == 'valid':
        assert ct[:-16] == tv['ct'], f"Ciphertext mismatch: {tv['comment']}"
        assert ct[-16:] == tv['tag'], f"Tag mismatch: {tv['comment']}"
    elif tv['result'] == 'invalid' or tv['result'] == 'acceptable':
        assert ct[:-16] != tv['ct'] or ct[-16:] != tv['tag']

@pytest.mark.parametrize("tv", tvs, ids=[str(tv['tcId']) for tv in tvs])
def test_decryption(tv):
    try:
        aesgcm = AESGCM(tv['key'])
        decrypted_msg = aesgcm.decrypt(tv['iv'], tv['ct'] + tv['tag'], tv['aad'])
    except ValueError:
        assert tv['result'] != 'valid', tv['comment']
        return
    except InvalidTag:
        assert tv['result'] != 'valid', tv['comment']
        assert 'ModifiedTag' in tv['flags'], f"Expected 'ModifiedTag' flag: {tv['comment']}"
        return

    assert tv['result'] == 'valid', f"No invalid test case should pass: {tv['comment']}"
    assert decrypted_msg == tv['msg'], f"Decryption mismatch: {tv['comment']}"

JavaScript/Mocha Example:

const assert = require('assert');

function testFactory(tcId, tests) {
  it(`[${tcId + 1}] ${tests[tcId].comment}`, function () {
    const test = tests[tcId];
    const ed25519 = new eddsa('ed25519');
    const key = ed25519.keyFromPublic(toArray(test.pk, 'hex'));

    let sig;
    if (test.result === 'valid') {
      sig = key.verify(test.msg, test.sig);
      assert.equal(sig, true, `[${test.tcId}] ${test.comment}`);
    } else if (test.result === 'invalid') {
      try {
        sig = key.verify(test.msg, test.sig);
      } catch (err) {
        // Point could not be decoded
        sig = false;
      }
      assert.equal(sig, false, `[${test.tcId}] ${test.comment}`);
    }
  });
}

// Generate tests for all test vectors
for (var tcId = 0; tcId < tests.length; tcId++) {
  testFactory(tcId, tests);
}

Phase 4: CI Integration

Ensure test vectors stay up to date by:

Using git submodules : Update submodule in CI before running tests
Fetching latest vectors : Run fetch script before test execution
Scheduled updates : Set up weekly/monthly updates to catch new test vectors

Common Vulnerabilities Detected

Wycheproof test vectors are designed to catch specific vulnerability patterns:

Vulnerability	Description	Affected Algorithms	Example CVE
Signature malleability	Multiple valid signatures for same message	ECDSA, EdDSA	CVE-2024-42459
Invalid DER encoding	Accepting non-canonical DER signatures	ECDSA	CVE-2024-42460, CVE-2024-42461
Invalid curve attacks	ECDH with invalid curve points	ECDH	Common in many libraries
Padding oracle	Timing leaks in padding validation	RSA-PKCS1	Historical OpenSSL issues
Tag forgery	Accepting modified authentication tags	AES-GCM, ChaCha20-Poly1305	Various implementations

Signature Malleability: Deep Dive

Problem: Implementations that don't validate signature encoding can accept multiple valid signatures for the same message.

Example (EdDSA): Appending or removing zeros from signature:

Valid signature:   ...6a5c51eb6f946b30d
Invalid signature: ...6a5c51eb6f946b30d0000  (should be rejected)

How to detect:

# Add signature length check
if len(sig) != 128:  # EdDSA signatures must be exactly 64 bytes (128 hex chars)
    return False

Impact: Can lead to consensus problems when different implementations accept/reject the same signatures.

Related Wycheproof tests:

EdDSA: tcId 37 - "removing 0 byte from signature"
ECDSA: tcId 06 - "Legacy: ASN encoding of r misses leading 0"

Case Study: Elliptic npm Package

This case study demonstrates how Wycheproof found three CVEs in the popular elliptic npm package (3000+ dependents, millions of weekly downloads).

Overview

The elliptic library is an elliptic-curve cryptography library written in JavaScript, supporting ECDH, ECDSA, and EdDSA. Using Wycheproof test vectors on version 6.5.6 revealed multiple vulnerabilities:

CVE-2024-42459 : EdDSA signature malleability (appending/removing zeros)
CVE-2024-42460 : ECDSA DER encoding - invalid bit placement
CVE-2024-42461 : ECDSA DER encoding - leading zero in length field

Methodology

Identify supported curves : ed25519 for EdDSA
Find test vectors : testvectors_v1/ed25519_test.json
Parse test vectors : Load JSON and extract tests
Write test harness : Create parameterized tests
Run tests : Identify failures
Analyze root causes : Examine implementation code
Propose fixes : Add validation checks

Key Findings

EdDSA Issue (CVE-2024-42459):

Missing signature length validation
Allowed trailing zeros in signatures
Fix: Add if(sig.length !== 128) return false;

ECDSA Issue 1 (CVE-2024-42460):

Missing check for first bit being zero in DER-encoded r and s values
Fix: Add if ((data[p.place] & 128) !== 0) return false;

ECDSA Issue 2 (CVE-2024-42461):

DER length field accepted leading zeros
Fix: Add if(buf[p.place] === 0x00) return false;

Impact

All three vulnerabilities allowed multiple valid signatures for a single message, leading to consensus problems across implementations.

Lessons learned:

Wycheproof catches subtle encoding bugs
Reusable test harnesses pay dividends
Test vector comments and flags help diagnose issues
Even popular libraries benefit from systematic test vector validation

Advanced Usage

Tips and Tricks

Tip	Why It Helps
Filter test groups by parameters	Focus on test vectors relevant to your implementation constraints
Use test vector flags	Understand specific vulnerability patterns being tested
Check the `notes` field	Get detailed explanations of flag meanings
Test both encrypt/decrypt and sign/verify	Ensure bidirectional correctness
Run tests in CI	Catch regressions and benefit from new test vectors
Use parameterized tests	Get clear failure messages with tcId and comment

Common Mistakes

Mistake	Why It's Wrong	Correct Approach
Only testing valid cases	Misses vulnerabilities where invalid inputs are accepted	Test all result types: valid, invalid, acceptable
Ignoring "acceptable" result	Implementation might have subtle bugs	Treat acceptable as warnings worth investigating
Not filtering test groups	Wastes time on unsupported parameters	Filter by keySize, ivSize, etc. based on your implementation
Not updating test vectors	Miss new vulnerability patterns	Use submodules or scheduled fetches
Testing only one direction	Encrypt/sign might work but decrypt/verify fails	Test both operations

Related Skills

Tool Skills

Skill	Primary Use in Wycheproof Testing
pytest	Python testing framework for parameterized tests
mocha	JavaScript testing framework for test generation
constant-time-testing	Complement Wycheproof with timing side-channel testing
cryptofuzz	Fuzz-based crypto testing to find additional bugs

Technique Skills

Skill	When to Apply
coverage-analysis	Ensure test vectors cover all code paths in crypto implementation
property-based-testing	Test mathematical properties (e.g., encrypt/decrypt round-trip)
fuzz-harness-writing	Create harnesses for crypto parsers (complements Wycheproof)

Related Domain Skills

Skill	Relationship
crypto-testing	Wycheproof is a key tool in comprehensive crypto testing methodology
fuzzing	Use fuzzing to find bugs Wycheproof doesn't cover (new edge cases)

Skill Dependency Map

                    ┌─────────────────────┐
                    │    wycheproof       │
                    │   (this skill)      │
                    └──────────┬──────────┘
                               │
           ┌───────────────────┼───────────────────┐
           │                   │                   │
           ▼                   ▼                   ▼
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│  pytest/mocha   │ │ constant-time   │ │   cryptofuzz    │
│ (test framework)│ │   testing       │ │   (fuzzing)     │
└────────┬────────┘ └────────┬────────┘ └────────┬────────┘
         │                   │                   │
         └───────────────────┼───────────────────┘
                             │
                             ▼
              ┌──────────────────────────┐
              │   Technique Skills       │
              │ coverage, harness, PBT   │
              └──────────────────────────┘

Resources

Official Repository

Wycheproof GitHub Repository

The official repository contains:

All test vectors in testvectors/ and testvectors_v1/
JSON schemas in schemas/
Reference implementations in Java and JavaScript
Documentation in doc/

Real-World Examples

pycryptodome

The pycryptodome library integrates Wycheproof test vectors in their test suite, demonstrating best practices for Python crypto implementations.

Community Resources

C2SP Community - Cryptographic specifications and standards community maintaining Wycheproof
Wycheproof issues tracker - Report bugs in test vectors or suggest new constructions

Summary

Wycheproof is an essential tool for validating cryptographic implementations against known attack vectors and edge cases. By integrating Wycheproof test vectors into your testing workflow:

Catch subtle encoding and validation bugs
Prevent signature malleability issues
Ensure consistent behavior across implementations
Benefit from community-contributed test vectors
Protect against known cryptographic vulnerabilities

The investment in writing a reusable testing harness pays dividends through continuous validation as new test vectors are added to the Wycheproof repository.

Weekly Installs

1.1K

Repository

trailofbits/skills

GitHub Stars

3.9K

First Seen

Jan 19, 2026

Security Audits

Gen Agent Trust HubPass SocketPass SnykWarn

Installed on

claude-code992

opencode945

gemini-cli929

codex923

cursor900

github-copilot871

React 组合模式指南：Vercel 组件架构最佳实践，提升代码可维护性

102,200 周安装

Wycheproof 密码学测试工具：验证实现正确性，检测已知漏洞

🇨🇳中文介绍

Wycheproof

背景

关键概念

重要性

使用时机

相关 Skills

快速参考

测试工作流程

仓库结构

支持的算法

测试文件结构

测试组

测试向量属性

共享属性

唯一属性

实施指南

阶段 1：将 Wycheproof 添加到您的项目

阶段 2：解析测试向量

阶段 3：编写测试工具

阶段 4：CI 集成

检测到的常见漏洞

签名可延展性：深入探讨

案例研究：Elliptic npm 包

概述

方法论

主要发现

影响

高级用法

技巧与窍门

常见错误

相关技能

工具技能

技术技能

相关领域技能

技能依赖关系图

资源

官方仓库

真实世界示例

社区资源

总结

🇺🇸English

Wycheproof

Background

Key Concepts

Why This Matters

When to Use

Quick Reference

Testing Workflow

Repository Structure

Supported Algorithms

Test File Structure

Test Groups

Test Vector Attributes

Shared Attributes

Unique Attributes

Implementation Guide

Phase 1: Add Wycheproof to Your Project

Phase 2: Parse Test Vectors

Phase 3: Write Testing Harness

Phase 4: CI Integration

Common Vulnerabilities Detected

Signature Malleability: Deep Dive

Case Study: Elliptic npm Package

Overview

Methodology

Key Findings

Impact

Advanced Usage

Tips and Tricks

Common Mistakes

Related Skills

Tool Skills

Technique Skills

Related Domain Skills

Skill Dependency Map

Resources

Official Repository

Real-World Examples