Add `FuzzXxx` tests to cipher algorithms
raklaptudirm opened this issue · 3 comments
Description
Use the new go1.18
FuzzXxx
tests to test cipher algorithm encryption and decryption.
The tests should accept fuzzed strings, encrypt then decrypt them, and check for equality with the original. This can help catch more elusive bugs in the code.
I looked at this for a bit, but have a few questions for the fuzzing. As I'm writing the tests, I'm finding some edge cases and wanted to ask first if/how you want algorithms to change
-
For rot13/caesar encryption: the current algorithms only expect a-zA-Z as input, but don't validate this. This can be either be solved on the fuzzer (only allowing valid inputs), or on the algorithm (providing a helpful error is an input is outside of the expected range. Any preference or other ideas?
-
Similarly, RSA encrypt/decrypt as currently tested fails on certain inputs. Specifically, in the test
p
andq
are set to 61 and 53, leading to a modulus of 3233. e.g. try encrypting and then decryptingstring("\x82")
with these exponents. This fails because the expected output isint64(65533)
but the actual output isint64(873)
, which is equal to65533%3233
. Notably, every input aboverune(3232)
will fail because the modulus is not large enough.- Option 1: Encrypt byte by byte (the current string-rune conversion can sometimes return a different output than expected)
- Option 2: invalidate modulus smaller than MaxInt64
- Option 3: invalidate inputs with runes larger than the provided modulus
- Option 4: leave as is, update test to larger modulus (I'll share a PR that does this a bit later)
Any preference / ideas on the above?
- Validate input in the algorithm
- Option 1 or 2 whichever is simpler
Hi everyone, I have been adding some fuzz tests lately to contribute to this issue. I think now once these PRs are good on your side and merged there should be no more work to do on this issue. Let me know if you have any feedbacks about this. Thanks again!