I am unsure if the output of running Cryptofuzz that I am getting is correct. Could any of you share any sample output (upon successful execution of cryptofuzz) to refer to ? Thank you !

While running cryptofuzz against openssl-3.0, I encountered an input that caused the program to crash. After further investigation, the 2 functions being called are in the ExpMod::Run class, specifically BN_mod_exp_mont_word and BN_mod_exp_mont_consttime.

Both of these functions take in 3 numbers, but BN_mod_exp_mont_consttime takes them in BIGNUM format, whereas BN_mod_exp_mont_word takes 1 unsigned long and 2 BIGNUMS:

int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
                         const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)

So, bn[0] gets converted to a ulong, and investigating with gdb shows that the conversion failed. In this case, bn[0] was 0000000000000013536853764361904580 and the output ulong is 14150647586910952635.

Later, during the result comparison, cryptofuzz fails as the 2 results are different. And in fact they are, since one input value varied between the 2 operations.

I'm adding support for CMAC and ciphers for TF-PSA-Crypto and I've run into something which I'm not sure is a feature or a bug. In OpCMAC(operation::CMAC& op), op.cipher.key.GetSize() can be incompatible with op.cipher.cipherType, e.g. a 5-byte key with CF_CIPHER("AES_128_ECB"). This would make sense if the operation was fuzzing an interface that includes validation. But as far as I understand, OpCMAC(operation::CMAC& op) returns either nullopt to mean “not supported” or the result of a successful operation.

I've looked at a couple of existing modules and if I understand correctly, they just return nullopt if the cipher is invalid. That works but it's likely to add errors, e.g. if the validation is too strict then we could silently be fuzzing nothing at all. Also it seems that every module has to do this validation.

So my understanding is:

• Either the interface intends to fuzz key validation, and there should be a way to report “I have concluded that the key is invalid”;
• Or the interface does not intend to fuzz key validation, and then Cryptofuzz itself should only pass valid keys to the modules.

But maybe I've missed something!

My current work: adding CMAC, running /cryptofuzz --force-module=PSA-Crypto --operations=cmac aborts with high probability on CF_ASSERT_PSA(operation.set_key(…)) because psa_import_key complains that the key size (e.g. 5 bytes) is not valid for the key type (e.g. AES).

Hi, when trying building cryptofuzz I got this error:
crypto.cpp:14:18: error: ‘__builtin_rotateleft32’ was not declared in this scope; did you mean ‘__builtin_roundf32’?
14 | #define ROL(x,n) __builtin_rotateleft32(x,n)

How to solve it please ?

The error message says:

Step #3 - "compile-afl-address-x86_64": /src/aflplusplus/afl-clang-fast++ -O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope  -stdlib=libc++ -D_GLIBCXX_DEBUG -I /src/cryptofuzz/fuzzing-headers/include -DCRYPTOFUZZ_BN_JS -DCRYPTOFUZZ_BIGNUMBER_JS -DCRYPTOFUZZ_CRYPTO_JS -DCRYPTOFUZZ_NSS -DCRYPTOFUZZ_MONOCYPHER -DCRYPTOFUZZ_TREZOR_FIRMWARE -DCRYPTOFUZZ_LIBTOMCRYPT -DCRYPTOFUZZ_SECP256K1 -DCRYPTOFUZZ_SYMCRYPT -DCRYPTOFUZZ_LIBGMP -DCRYPTOFUZZ_MPDECIMAL -I/src/cityhash/src -DCRYPTOFUZZ_CRYPTOPP -DCRYPTOFUZZ_MBEDTLS -DCRYPTOFUZZ_BOTAN -Wall -Wextra -std=c++17 -I ../../include -I ../../fuzzing-headers/include -DFUZZING_HEADERS_NO_IMPL -I /src/botan/build/include -fPIC -c module.cpp -o module.o
Step #3 - "compile-afl-address-x86_64": /src/aflplusplus/afl-clang-fast++ -O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope  -stdlib=libc++ -D_GLIBCXX_DEBUG -I /src/cryptofuzz/fuzzing-headers/include -DCRYPTOFUZZ_BN_JS -DCRYPTOFUZZ_BIGNUMBER_JS -DCRYPTOFUZZ_CRYPTO_JS -DCRYPTOFUZZ_NSS -DCRYPTOFUZZ_MONOCYPHER -DCRYPTOFUZZ_TREZOR_FIRMWARE -DCRYPTOFUZZ_LIBTOMCRYPT -DCRYPTOFUZZ_SECP256K1 -DCRYPTOFUZZ_SYMCRYPT -DCRYPTOFUZZ_LIBGMP -DCRYPTOFUZZ_MPDECIMAL -I/src/cityhash/src -DCRYPTOFUZZ_CRYPTOPP -DCRYPTOFUZZ_MBEDTLS -DCRYPTOFUZZ_BOTAN -Wall -Wextra -std=c++17 -I ../../include -I ../../fuzzing-headers/include -DFUZZING_HEADERS_NO_IMPL -I /src/botan/build/include -fPIC -c bn_ops.cpp -o bn_ops.o
Step #3 - "compile-afl-address-x86_64": bn_ops.cpp:1044:33: error: no member named 'ressol' in namespace 'Botan'
Step #3 - "compile-afl-address-x86_64":         const auto r = ::Botan::ressol(bn[0].Ref(), mod.Ref());
Step #3 - "compile-afl-address-x86_64":                        ~~~~~~~~~^
Step #3 - "compile-afl-address-x86_64": 1 error generated.
Step #3 - "compile-afl-address-x86_64": make: *** [Makefile:16: bn_ops.o] Error 1

Here is the link to full log:
https://oss-fuzz-build-logs.storage.googleapis.com/log-eb112847-a67a-43d1-870d-6b08964c8d1f.txt

I am following the cryptofuzz build manual and running manual.
to test it finds the crash or bug, i use the testcase on oss-fuzz

• oss-fuzz link:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19926&sort=-id&q=openssl%20type%3DBug-Security&can=1

• testcase:
  https://oss-fuzz.com/download?testcase_id=5738113498611712

i set git checkout as 5b428 for cryptofuzz and 26583 for openssl as mentioned in https://oss-fuzz.com/revisions?job=libfuzzer_asan_cryptofuzz&range=202001060241:202001070301

when i run cryptofuzz, it does not make any crash for the given testcase. How can i check to reproduce correctly on the test case?

• This is testcase information :

Cipherttype: AES_128_CBC_HMAC_SHA1
OpenSSL::OpSymmetricDecrypt_EVP
operation name: SymmetricDecrypt
ciphertext: {0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20} (16 bytes)
tag: nullopt
aad: nullopt
cipher iv: {0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0xff} (8 bytes)
cipher key: {0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20} (16 bytes)
cipher: AES_128_CBC_HMAC_SHA1
cleartextSize: 2105376

We are encountering the bellow error when running the generate_corpus against our customized aes in our Jenkins pipeline:

` generate_corpus ../tvt-fuzzing/tii_aes
AddressSanitizer:DEADLYSIGNAL

==139==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f3f32f9c521 bp 0x000000000001 sp 0x7ffcf1a84e10 T0)
==139==The signal is caused by a READ memory access.
==139==Hint: address points to the zero page.
#0 0x7f3f32f9c521 in fwrite (/lib/x86_64-linux-gnu/libc.so.6+0x72521)
#1 0x4390df in fwrite (/home/jenkins/cryptofuzz/generate_corpus+0x4390df)
#2 0x4d2e6a in write(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::__debug::vector<unsigned char, std::allocator > const&) /home/jenkins/cryptofuzz/generate_corpus.cpp:193:5
#3 0x4d1d84 in generate_Digest_inner(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, unsigned long, unsigned long, unsigned long, unsigned long) /home/jenkins/cryptofuzz/generate_corpus.cpp:242:5
#4 0x4ce961 in generate_Digest(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, unsigned long) /home/jenkins/cryptofuzz/generate_corpus.cpp:249:17
#5 0x4cd4be in main /home/jenkins/cryptofuzz/generate_corpus.cpp:447:9
#6 0x7f3f32f4dd09 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x23d09)
#7 0x420799 in _start (/home/jenkins/cryptofuzz/generate_corpus+0x420799)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x72521) in fwrite
==139==ABORTING
script returned exit code 1`

Should we have to modify the code of Cryptofuzz that is doing the generate_corpus to adapt it to our module (tii_aes for example).
Some clarification will be very welcome because we are a bit lost.
Thanks in advance.

this is throw error~

Thanks for a great project! Really interesting to follow.

It would be awesome to have libsecp256k1 tested as part of the cryptofuzz effort.

Hi, we are stumbling on the following issue.

We followed the steps to build cryptofuzz

• https://github.com/guidovranken/cryptofuzz/blob/master/docs/building.md
• We had to add coreutils and boost lib to make that work
• The python script gen_repository creates 2 files: repository_map.h and repository_tbl.h
• Ran the 3 export command: export CFLAGS="-fsanitize=address,undefined,fuzzer-no-link -O2 -g"
  export CXXFLAGS="-fsanitize=address,undefined,fuzzer-no-link -D_GLIBCXX_DEBUG -O2 -g"
  export LIBFUZZER_LINK="-fsanitize=fuzzer"

On the first attempt of running make, the project builds but with the error:
ld: file not found: /Library/Developer/CommandLineTools/usr/lib/clang/13.1.6/lib/darwin/libclang_rt.fuzzer_osx.a
clang: error: linker command failed with exit code 1 (use -v to see invocation)

After manually updating the llvm and clang version to include the libclang_rt.fuzzer.osx.a and running the steps again, the following error is thrown: ld: symbol(s) not found for architecture x86_64
clang: error: linker command failed with exit code 1 (use -v to see invocation)

Are there certain dependencies that we are overlooking?

Kind regards,
Ronald

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35315

Step #4: clang++ -O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link -stdlib=libc++ -DCRYPTOFUZZ_NO_OPENSSL -I /src/boost_1_74_0/ -DCRYPTOFUZZ_SECP256K1 -DCRYPTOFUZZ_TREZOR_FIRMWARE -DCRYPTOFUZZ_BOTAN -DCRYPTOFUZZ_BOTAN_IS_ORACLE -Wall -Wextra -std=c++17 -I include/ -I . -I fuzzing-headers/include -DFUZZING_HEADERS_NO_IMPL driver.o executor.o util.o entry.o tests.o operation.o datasource.o repository.o options.o components.o wycheproof.o crypto.o mutator.o numbers.o mutatorpool.o modules/trezor/module.a modules/bitcoin/module.a modules/secp256k1/module.a modules/botan/module.a -fsanitize=fuzzer third_party/cpu_features/build/libcpu_features.a  -o cryptofuzz
Step #4: modules/secp256k1/module.a(module.o): In function `cryptofuzz::module::secp256k1::OpSchnorr_Sign(cryptofuzz::operation::Schnorr_Sign&)':
Step #4: /src/cryptofuzz/modules/secp256k1/module.cpp:338: undefined reference to `secp256k1_keypair_create'
Step #4: /src/cryptofuzz/modules/secp256k1/module.cpp:352: undefined reference to `secp256k1_nonce_function_bip340'
Step #4: /src/cryptofuzz/modules/secp256k1/module.cpp:352: undefined reference to `secp256k1_schnorrsig_sign'
Step #4: /src/cryptofuzz/modules/secp256k1/module.cpp:357: undefined reference to `secp256k1_schnorrsig_sign'
Step #4: /src/cryptofuzz/modules/secp256k1/module.cpp:362: undefined reference to `secp256k1_keypair_xonly_pub'
Step #4: /src/cryptofuzz/modules/secp256k1/module.cpp:363: undefined reference to `secp256k1_xonly_pubkey_serialize'
Step #4: /src/cryptofuzz/modules/secp256k1/module.cpp:367: undefined reference to `secp256k1_schnorrsig_verify'
Step #4: /src/cryptofuzz/modules/secp256k1/module.cpp:352: undefined reference to `secp256k1_nonce_function_bip340'
Step #4: modules/secp256k1/module.a(module.o): In function `cryptofuzz::module::secp256k1::OpSchnorr_Verify(cryptofuzz::operation::Schnorr_Verify&)':
Step #4: /src/cryptofuzz/modules/secp256k1/module.cpp:426: undefined reference to `secp256k1_xonly_pubkey_parse'
Step #4: /src/cryptofuzz/modules/secp256k1/module.cpp:428: undefined reference to `secp256k1_schnorrsig_verify'
Step #4: clang-12: error: linker command failed with exit code 1 (use -v to see invocation)
Step #4: make: *** [cryptofuzz] Error 1
Step #4: Makefile:42: recipe for target 'cryptofuzz' failed

Noticed in LibreSSL Fuzzing tests that the build broke recently:

https://github.com/libressl-portable/portable/actions/runs/3728363628/jobs/6328445872#step:4:24696

OpKDF targets use malloc to allocate arbitrarily large chunks of memory upfront to store the output of EVP_PKEY_derive, but EVP_PKEY_derive may fail without every using that memory because the requested output length exceeds the maximum allowable length.

See for instance https://github.com/guidovranken/cryptofuzz/blob/master/modules/openssl/module.cpp#L1871

These large allocations could be avoided by first calling EVP_PKEY_derive to determine the maximum output length and checking that the length requested is within bounds (https://www.openssl.org/docs/man1.1.0/man3/EVP_PKEY_derive.html). See s-zanella@7699bb6 for a way of doing this.

I'm not sure this is an issue in practice because the memory requested to malloc may never materialize. Doing these checks before calling EVP_PKEY_derive means that the logic to check bounds would not be exercised in tests (however, the logic to get the maximum output length will be).

oss-fuzz has tripped on the recently added assertion that after mbedtls_cipher_auth_encrypt_ext, output length = plaintext length + tag length. This is only true for “normal” AEAD modes, not for NIST_KW.

I haven't looked for any similar problems.

I notice that the TODO.md haven't been updated since 1 Sep 2019.

Many of modules mentions in todo.md has been implemented already.
So we might need to update it, delete the finish module, and add some new modules perhaps.

Mbed TLS is going through some API transitions. We would welcome your wisdom on when and how to transition fuzzing to the new interfaces.

The transitions:

• Bignum: we're rewriting the bignum stack into 4 layers. The highest layer is the current one, and does its own memory management. The new layers are implemented without malloc(). There's a core layer for operations in [0,2^n] and two layers for operations modulo P, one with sanity checks and one without (intended to allow ECC code to be better optimized).
• Crypto: we've had a new API for crypto (psa_xxx()) for a while, and it's currently not getting fuzzed. The new interfaces are mostly functionally equivalent, although there are a few features of the legacy API that aren't present in the PSA API. One difference that matters to fuzzing is that the PSA API handles random generation entirely internally, so making the RNG deterministic works completely differently.

In both cases, the mathematical calculations are done by the same code. But input validation is partially the responsibility of the changing layers (because the functions have different precondition) and the memory management is different. So there is value in fuzzing all the interfaces.

Do you have any advice as to when we should start fuzzing the new interfaces, in terms of maturity? Should we have a transition period where both the old and the new interfaces are tested?

If we have a transition period, how should we declare the different APIs to cryptofuzz and bignum-fuzzer? I guess they'd be different modules (since e.g. differential fuzzing of an ECDSA signature should be done via both psa_sign_hash and mbedtls_ecdsa_sign)? How would we arrange the build system to indicate that both modules are using the same library?

For bignum, there's differential fuzzing in both bignum-fuzzer and cryptofuzz. What does bignum-fuzzer do that cryptofuzz doesn't?

I need help with the building of Cryptofuzz -- I kept getting fatal error of not having the boost/algorithm/hex.hpp. Does anyone have a more detailed guide on building the fuzzer, newbie here

The link reported an error while building：

/usr/bin/ld: entry.o: in function void __gnu_cxx::new_allocator<cryptofuzz::module::OpenSSL>::construct<cryptofuzz::module::OpenSSL>(cryptofuzz::module::OpenSSL*)': /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/ext/new_allocator.h:146: undefined reference to cryptofuzz::module::OpenSSL::OpenSSL()'
/usr/bin/ld: entry.o:(.data+0x10f48): undefined reference to `typeinfo for cryptofuzz::module::OpenSSL'
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make: *** [Makefile:34: cryptofuzz] Error 1

Does anyone know why this error occurred🥲🥲🥲

Hi.
I'm using cryptofuzz to test cryptographic libraries.

I recognized that when testing KDF_PBKDF2, it produces incorrect difference.
For example, KDF_PBKDF2 in libgmp, linux, mpdecimal, blst, libsodim, bearssl, trezor-firmware, openssl libraries don't support SHAKE digest.
However, cryptofuzz test KDF_PBKDF2 with SHAKE digest, so that it catches as result is not correct.

It would be better to filter out libraries with unsupported algorithms before testing algorithms.

Thank you for your works for Cryptofuzz.

Hi,
My system is ubuntu 20.04 , installed openssl and libssl-dev with apt-get, compiler and linker are clang-11 and lld-11.
I want to fuzz wolfCrypt , and I compiled wolfCrypt's module.
But when I tried to complie Cryptofuzz, it shows log below:

clang++-11 -fsanitize=address,undefined,fuzzer-no-link -D_GLIBCXX_DEBUG -O2 -g -DCRYPTOFUZZ_WOLFCRYPT -DCRYPTOFUZZ_OPENSSL_110 -Wall -Wextra -std=c++17 -I include/ -I . -I fuzzing-headers/include -DFUZZING_HEADERS_NO_IMPL driver.o executor.o util.o entry.o tests.o operation.o datasource.o repository.o options.o components.o wycheproof.o crypto.o mutator.o numbers.o mutatorpool.o modules/wolfcrypt/module.a -fsanitize=fuzzer third_party/cpu_features/build/libcpu_features.a  -o cryptofuzz
ld: error: undefined symbol: cryptofuzz::module::OpenSSL::OpenSSL()
>>> referenced by new_allocator.h:147 (/usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/ext/new_allocator.h:147)
>>>               entry.o:(std::_Sp_counted_ptr_inplace<cryptofuzz::module::OpenSSL, std::allocator<cryptofuzz::module::OpenSSL>, (__gnu_cxx::_Lock_policy)2>::_Sp_counted_ptr_inplace<>(std::allocator<cryptofuzz::module::OpenSSL>))

ld: error: undefined symbol: typeinfo for cryptofuzz::module::OpenSSL
>>> referenced by entry.cpp
>>>               entry.o:(.data+0xBBC8)
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make: *** [Makefile:43: cryptofuzz] Error 1

why's that? thank you.

When using ubsan: -fsanitize=undefined, the final build of cryptofuzz fails due to a linker failure. The workaround that has solved this for me is to manually link with -lubsan. However, this is not the recommended action

When taking the recommended approach (linking with Wl,-fsanitize=undefined) I see runtime errors, so I just wanted to share what's worked for me in case others also encounter it.

I've installed mbedTLS modules and OpenSSL successfully, but when trying to compile, clang doesn't recognize the std C++17. I don't know why. I've tested in Ubuntu and Arch Linux without success. Can someone help me? Even vscode recognizes it but clang doesn't.

errors.txt

My clang version:

clang version 15.0.7
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/sbin
Found candidate GCC installation: /usr/sbin/../lib/gcc/x86_64-pc-linux-gnu/13.1.1
Found candidate GCC installation: /usr/sbin/../lib64/gcc/x86_64-pc-linux-gnu/13.1.1
Selected GCC installation: /usr/sbin/../lib64/gcc/x86_64-pc-linux-gnu/13.1.1
Candidate multilib: .;@m64
Candidate multilib: 32;@m32
Selected multilib: .;@m64

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54004

As an implementer of a Cryptofuzz module, I want Cryptofuzz to have tests so that I can validate my module quickly. The idea is that ./cryptofuzz --unit-tests [--force-module=mymodule] would just run a small predefined set of test data, at least one per algorithm.

As a maintainer of a project fuzzed by Cryptofuz, I want Cryptofuzz to have tests that run regularly so that I can have confidence that Cryptofuzz is really fuzzing my module and not, for example, deciding that every algorithm is unsupported. (Example: unauthenticated ciphers silently skipped in Mbed TLS for over a year.)

I guess the tests in tests.c are a start. From that point:

1. I don't know how to run them (or if they are running when I run ./cryptofuzz without --disable-tests, how I can get information from them).
2. There needs to be a way to declare which mechanisms each module supports, and to report a failure if a mechanism should be supported but the module says nullopt.
3. There needs to be regular job that runs the tests.

I looked at the running cryptofuzz doc writeup but it's unclear how to actually use the tool, for example doing differential fuzzing of one of the OpenSSL crypto APIs and another library. The program help also seems to describe various program options but I'm not finding a general write-up of how to fuzz two APIs. Can someone send a pointer to how to use this tool to fuzz two libraries? I'm familiar with libfuzzer in general but not quite clear on how to use cryptofuzz.