desec-stack/api/desecapi/tests/test_crypto.py

from math import log
import time

from django.test import TestCase

from desecapi import crypto


class CryptoTestCase(TestCase):
    context = 'desecapi.tests.test_crypto'

    def test_retrieved_key_is_reproducible(self):
        keys = (crypto.retrieve_key(label='test', context=self.context) for _ in range(2))
        self.assertEqual(*keys)

    def test_retrieved_key_depends_on_secret(self):
        keys = []
        for secret in ['abcdefgh', 'hgfedcba']:
            with self.settings(SECRET_KEY=secret):
                keys.append(crypto.retrieve_key(label='test', context=self.context))
        self.assertNotEqual(*keys)

    def test_retrieved_key_depends_on_label(self):
        keys = (crypto.retrieve_key(label=f'test_{i}', context=self.context) for i in range(2))
        self.assertNotEqual(*keys)

    def test_retrieved_key_depends_on_context(self):
        keys = (crypto.retrieve_key(label='test', context=f'{self.context}_{i}') for i in range(2))
        self.assertNotEqual(*keys)

    def test_encrypt_has_high_entropy(self):
        def entropy(value: str):
            result = 0
            counts = [value.count(char) for char in set(value)]
            for count in counts:
                count /= len(value)
                result -= count * log(count, 2)
            return result * len(value)

        ciphertext = crypto.encrypt(b'test', context=self.context)
        self.assertGreater(entropy(ciphertext), 100)  # arbitrary

    def test_encrypt_decrypt(self):
        plain = b'test'
        ciphertext = crypto.encrypt(plain, context=self.context)
        timestamp, decrypted = crypto.decrypt(ciphertext, context=self.context)
        self.assertEqual(plain, decrypted)
        self.assertTrue(0 <= time.time() - timestamp <= 1)

    def test_encrypt_decrypt_raises_on_tampering(self):
        ciphertext = crypto.encrypt(b'test', context=self.context)

        with self.assertRaises(ValueError):
            ciphertext_decoded = ciphertext.decode()
            ciphertext_tampered = (ciphertext_decoded[:30] + 'TAMPERBEEF' + ciphertext_decoded[40:]).encode()
            crypto.decrypt(ciphertext_tampered, context=self.context)

        with self.assertRaises(ValueError):
            crypto.decrypt(ciphertext, context=f'{self.context}2')