Download this file
| 1 | package seal |
| 2 | |
| 3 | import ( |
| 4 | "encoding/hex" |
| 5 | "testing" |
| 6 | ) |
| 7 | |
| 8 | // Pins the HKDF derivation. If this changes, every sealed row in every |
| 9 | // deployed instance becomes unreadable — so it changes only with a |
| 10 | // migration, never as a refactor. |
| 11 | func TestPurposeKeyVectors(t *testing.T) { |
| 12 | s, _ := New(testDEK()) |
| 13 | for _, tc := range []struct{ purpose, want string }{ |
| 14 | {"cell.input", "cbc5cfc98184cea8e11127274e61a8973520c1d8cc81014678a7e9160ce68b63"}, |
| 15 | {"cell.cached", "6c94c298a000b2fd440767b542a77b97366e653d7412e4b1fab9b7545cee34b5"}, |
| 16 | } { |
| 17 | key, err := s.purposeKey(tc.purpose) |
| 18 | if err != nil { |
| 19 | t.Fatal(err) |
| 20 | } |
| 21 | got := hex.EncodeToString(key) |
| 22 | if tc.want == "" { |
| 23 | t.Logf("RECORD %s = %s", tc.purpose, got) |
| 24 | continue |
| 25 | } |
| 26 | if got != tc.want { |
| 27 | t.Fatalf("%s key = %s, want %s", tc.purpose, got, tc.want) |
| 28 | } |
| 29 | } |
| 30 | } |
| 31 | |
amadan