From 586ac5a2efea2e3a23d4bc7cafcfd7ea9d1f8d1c Mon Sep 17 00:00:00 2001 From: Major Hayden Date: Tue, 7 Jul 2026 15:03:07 -0500 Subject: [PATCH] test: exercise SPHINCS+ OID round-trip for -simple variants The OID encode/decode round-trip in SphincsPlusTest was skipped for -simple hash-mode variants behind a stale FIXME guard. OID mappings for these variants were already wired correctly in commit 729a3aa83 (interop updates for SPHINCS+, Nov 2023), aligning with FIPS 205 SLH-DSA finalizing on the simple hashing mode, so the guard was never needed after that change. - remove the stale FIXME/guard so the round-trip runs for all variants - add parameter-identity assertions so decode(encode(params)) is verified to return the exact same parameter set, not just matching raw key bytes - apply the same fix to the jdk1.3 mirror of this test Verified locally: all 9 SphincsPlusTest cases pass, including every -simple, -robust, and haraka variant. Investigation and fix drafted with AI assistance (Claude); reviewed and verified by the author before submission. Signed-off-by: Major Hayden --- .../pqc/crypto/test/SphincsPlusTest.java | 17 +++++++++-------- .../pqc/crypto/test/SphincsPlusTest.java | 17 +++++++++-------- 2 files changed, 18 insertions(+), 16 deletions(-) diff --git a/core/src/test/java/org/bouncycastle/pqc/crypto/test/SphincsPlusTest.java b/core/src/test/java/org/bouncycastle/pqc/crypto/test/SphincsPlusTest.java index d5269aabfd..f80d07a7cf 100644 --- a/core/src/test/java/org/bouncycastle/pqc/crypto/test/SphincsPlusTest.java +++ b/core/src/test/java/org/bouncycastle/pqc/crypto/test/SphincsPlusTest.java @@ -160,14 +160,15 @@ else if (simple) SPHINCSPlusPublicKeyParameters pubParams = (SPHINCSPlusPublicKeyParameters)kp.getPublic(); SPHINCSPlusPrivateKeyParameters privParams = (SPHINCSPlusPrivateKeyParameters)kp.getPrivate(); - // FIXME No OIDs for simple variants of SPHINCS+ - if (name.indexOf("-simple") < 0) - { - pubParams = (SPHINCSPlusPublicKeyParameters)PublicKeyFactory.createKey( - SubjectPublicKeyInfoFactory.createSubjectPublicKeyInfo(pubParams)); - privParams = (SPHINCSPlusPrivateKeyParameters)PrivateKeyFactory.createKey( - PrivateKeyInfoFactory.createPrivateKeyInfo(privParams)); - } + // OID encode/decode round-trip runs for all variants including "-simple" + // (OIDs for simple variants were wired correctly; the former FIXME guard was stale). + // The getParameters() assertions below catch any future OID<->parameters mapping regression. + pubParams = (SPHINCSPlusPublicKeyParameters)PublicKeyFactory.createKey( + SubjectPublicKeyInfoFactory.createSubjectPublicKeyInfo(pubParams)); + privParams = (SPHINCSPlusPrivateKeyParameters)PrivateKeyFactory.createKey( + PrivateKeyInfoFactory.createPrivateKeyInfo(privParams)); + assertTrue(name + " " + count + ": public key parameters", parameters == pubParams.getParameters()); + assertTrue(name + " " + count + ": private key parameters", parameters == privParams.getParameters()); // System.err.println(Hex.toHexString(pubParams.getEncoded())); // System.err.println(Hex.toHexString(Arrays.concatenate(pubParams.getParameters().getEncoded(), pk))); diff --git a/core/src/test/jdk1.3/org/bouncycastle/pqc/crypto/test/SphincsPlusTest.java b/core/src/test/jdk1.3/org/bouncycastle/pqc/crypto/test/SphincsPlusTest.java index 1bb5f77b87..2ff7f7b30c 100644 --- a/core/src/test/jdk1.3/org/bouncycastle/pqc/crypto/test/SphincsPlusTest.java +++ b/core/src/test/jdk1.3/org/bouncycastle/pqc/crypto/test/SphincsPlusTest.java @@ -160,14 +160,15 @@ else if (simple) SPHINCSPlusPublicKeyParameters pubParams = (SPHINCSPlusPublicKeyParameters)kp.getPublic(); SPHINCSPlusPrivateKeyParameters privParams = (SPHINCSPlusPrivateKeyParameters)kp.getPrivate(); - // FIXME No OIDs for simple variants of SPHINCS+ - if (name.indexOf("-simple") < 0) - { - pubParams = (SPHINCSPlusPublicKeyParameters)PublicKeyFactory.createKey( - SubjectPublicKeyInfoFactory.createSubjectPublicKeyInfo(pubParams)); - privParams = (SPHINCSPlusPrivateKeyParameters)PrivateKeyFactory.createKey( - PrivateKeyInfoFactory.createPrivateKeyInfo(privParams)); - } + // OID encode/decode round-trip runs for all variants including "-simple" + // (OIDs for simple variants were wired correctly; the former FIXME guard was stale). + // The getParameters() assertions below catch any future OID<->parameters mapping regression. + pubParams = (SPHINCSPlusPublicKeyParameters)PublicKeyFactory.createKey( + SubjectPublicKeyInfoFactory.createSubjectPublicKeyInfo(pubParams)); + privParams = (SPHINCSPlusPrivateKeyParameters)PrivateKeyFactory.createKey( + PrivateKeyInfoFactory.createPrivateKeyInfo(privParams)); + assertTrue(name + " " + count + ": public key parameters", parameters == pubParams.getParameters()); + assertTrue(name + " " + count + ": private key parameters", parameters == privParams.getParameters()); // System.err.println(Hex.toHexString(pubParams.getEncoded())); // System.err.println(Hex.toHexString(Arrays.concatenate(pubParams.getParameters().getEncoded(), pk)));