[test] add tbor crypto command fuzz targets

fuzz/Cargo.toml

@@ -119,3 +119,94 @@ doc = false
 name = "fuzz_tbor_part_info"
 path = "fuzz_targets/ddi/tbor/fuzz_tbor_part_info.rs"
 test = false
+
+[[bin]]
+bench = false
+doc = false
+name = "fuzz_tbor_aes_encrypt_decrypt"
+path = "fuzz_targets/ddi/tbor/fuzz_tbor_aes_encrypt_decrypt.rs"
+test = false
+
+[[bin]]
+bench = false
+doc = false
+name = "fuzz_tbor_aes_generate_key"
+path = "fuzz_targets/ddi/tbor/fuzz_tbor_aes_generate_key.rs"
+test = false
+
+[[bin]]
+bench = false
+doc = false
+name = "fuzz_tbor_concat_kdf_derive"
+path = "fuzz_targets/ddi/tbor/fuzz_tbor_concat_kdf_derive.rs"
+test = false
+
+[[bin]]
+bench = false
+doc = false
+name = "fuzz_tbor_ecc_generate_key"
+path = "fuzz_targets/ddi/tbor/fuzz_tbor_ecc_generate_key.rs"
+test = false
+
+[[bin]]
+bench = false
+doc = false
+name = "fuzz_tbor_ecc_sign"
+path = "fuzz_targets/ddi/tbor/fuzz_tbor_ecc_sign.rs"
+test = false
+
+[[bin]]
+bench = false
+doc = false
+name = "fuzz_tbor_ecdh_derive"
+path = "fuzz_targets/ddi/tbor/fuzz_tbor_ecdh_derive.rs"
+test = false
+
+[[bin]]
+bench = false
+doc = false
+name = "fuzz_tbor_get_unwrapping_key"
+path = "fuzz_targets/ddi/tbor/fuzz_tbor_get_unwrapping_key.rs"
+test = false
+
+[[bin]]
+bench = false
+doc = false
+name = "fuzz_tbor_hash"
+path = "fuzz_targets/ddi/tbor/fuzz_tbor_hash.rs"
+test = false
+
+[[bin]]
+bench = false
+doc = false
+name = "fuzz_tbor_hkdf_derive"
+path = "fuzz_targets/ddi/tbor/fuzz_tbor_hkdf_derive.rs"
+test = false
+
+[[bin]]
+bench = false
+doc = false
+name = "fuzz_tbor_hmac_generate_key"
+path = "fuzz_targets/ddi/tbor/fuzz_tbor_hmac_generate_key.rs"
+test = false
+
+[[bin]]
+bench = false
+doc = false
+name = "fuzz_tbor_hmac"
+path = "fuzz_targets/ddi/tbor/fuzz_tbor_hmac.rs"
+test = false
+
+[[bin]]
+bench = false
+doc = false
+name = "fuzz_tbor_rsa_mod_exp"
+path = "fuzz_targets/ddi/tbor/fuzz_tbor_rsa_mod_exp.rs"
+test = false
+
+[[bin]]
+bench = false
+doc = false
+name = "fuzz_tbor_unwrap_key"
+path = "fuzz_targets/ddi/tbor/fuzz_tbor_unwrap_key.rs"
+test = false

fuzz/fuzz_targets/ddi/tbor/fuzz_tbor_aes_encrypt_decrypt.rs

@@ -0,0 +1,66 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+#![no_main]
+
+use azihsm_ddi_tbor_test_harness::TestCtx;
+use azihsm_ddi_tbor_types::AES_IV_LEN;
+use azihsm_ddi_tbor_types::AES_KEY_SIZE_256;
+use azihsm_ddi_tbor_types::AES_MSG_MAX_LEN;
+use azihsm_ddi_tbor_types::SessionType;
+use azihsm_ddi_tbor_types::TborAesEncryptDecryptReq;
+use azihsm_ddi_tbor_types::TborAesGenerateKeyReq;
+use libfuzzer_sys::arbitrary;
+use libfuzzer_sys::arbitrary::Arbitrary;
+use libfuzzer_sys::fuzz_target;
+
+const CU: u8 = 1;
+static CTX: std::sync::OnceLock<TestCtx> = std::sync::OnceLock::new();
+
+fn bounded_msg(u: &mut arbitrary::Unstructured<'_>) -> arbitrary::Result<Vec<u8>> {
+    let max = AES_MSG_MAX_LEN;
+    let len = usize::arbitrary(u)? % (max + 1);
+    Ok(u.bytes(len)?.to_vec())
+}
+
+#[derive(Arbitrary, Debug)]
+struct FuzzInput {
+    op: u8,
+    #[arbitrary(with = bounded_msg)]
+    msg: Vec<u8>,
+    iv: [u8; AES_IV_LEN],
+}
+
+fuzz_target!(|input: FuzzInput| {
+    let ctx = CTX.get_or_init(TestCtx::new);
+    ctx.erase().expect("erase should succeed");
+
+    let session = ctx
+        .open_session(CU, SessionType::PlainText)
+        .expect("session open should succeed");
+
+    // Generate an AES key to obtain a valid masked_key.
+    let keygen_req = TborAesGenerateKeyReq {
+        session_id: session.session_id(),
+        scope: 0b001, // KeyScope::Session
+        key_size: AES_KEY_SIZE_256,
+    };
+    let masked_key = match ctx.tbor(&keygen_req) {
+        Ok(resp) => resp.masked_key,
+        Err(_) => {
+            session.close().expect("session close should succeed");
+            return;
+        }
+    };
+
+    let req = TborAesEncryptDecryptReq {
+        session_id: session.session_id(),
+        masked_key,
+        op: input.op,
+        msg: input.msg,
+        iv: input.iv,
+    };
+    let _ = ctx.tbor(&req);
+
+    session.close().expect("session close should succeed");
+});

fuzz/fuzz_targets/ddi/tbor/fuzz_tbor_aes_generate_key.rs

@@ -0,0 +1,38 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+#![no_main]
+
+use azihsm_ddi_tbor_test_harness::TestCtx;
+use azihsm_ddi_tbor_types::SessionType;
+use azihsm_ddi_tbor_types::TborAesGenerateKeyReq;
+use libfuzzer_sys::arbitrary;
+use libfuzzer_sys::arbitrary::Arbitrary;
+use libfuzzer_sys::fuzz_target;
+
+const CU: u8 = 1;
+static CTX: std::sync::OnceLock<TestCtx> = std::sync::OnceLock::new();
+
+#[derive(Arbitrary, Debug)]
+struct FuzzInput {
+    scope: u8,
+    key_size: u8,
+}
+
+fuzz_target!(|input: FuzzInput| {
+    let ctx = CTX.get_or_init(TestCtx::new);
+    ctx.erase().expect("erase should succeed");
+
+    let session = ctx
+        .open_session(CU, SessionType::PlainText)
+        .expect("session open should succeed");
+
+    let req = TborAesGenerateKeyReq {
+        session_id: session.session_id(),
+        scope: input.scope,
+        key_size: input.key_size,
+    };
+    let _ = ctx.tbor(&req);
+
+    session.close().expect("session close should succeed");
+});

fuzz/fuzz_targets/ddi/tbor/fuzz_tbor_concat_kdf_derive.rs

@@ -0,0 +1,86 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+#![no_main]
+
+use azihsm_ddi_tbor_test_harness::TestCtx;
+use azihsm_ddi_tbor_types::CONCAT_INFO_MAX_LEN;
+use azihsm_ddi_tbor_types::ECC_CURVE_P256;
+use azihsm_ddi_tbor_types::SessionType;
+use azihsm_ddi_tbor_types::TborConcatKdfDeriveReq;
+use azihsm_ddi_tbor_types::TborEccGenerateKeyReq;
+use azihsm_ddi_tbor_types::TborEcdhDeriveReq;
+use libfuzzer_sys::arbitrary;
+use libfuzzer_sys::arbitrary::Arbitrary;
+use libfuzzer_sys::fuzz_target;
+
+const CU: u8 = 1;
+static CTX: std::sync::OnceLock<TestCtx> = std::sync::OnceLock::new();
+
+fn bounded_info(u: &mut arbitrary::Unstructured<'_>) -> arbitrary::Result<Vec<u8>> {
+    let len = usize::arbitrary(u)? % (CONCAT_INFO_MAX_LEN + 1);
+    Ok(u.bytes(len)?.to_vec())
+}
+
+#[derive(Arbitrary, Debug)]
+struct FuzzInput {
+    scope: u8,
+    hash_algo: u8,
+    kdf_alg: u8,
+    key_type: u8,
+    key_length: u8,
+    #[arbitrary(with = bounded_info)]
+    info: Vec<u8>,
+}
+
+fuzz_target!(|input: FuzzInput| {
+    let ctx = CTX.get_or_init(TestCtx::new);
+    ctx.erase().expect("erase should succeed");
+
+    let session = ctx
+        .open_session(CU, SessionType::PlainText)
+        .expect("session open should succeed");
+
+    // Generate an ECC key pair for the ECDH derive.
+    let keygen_req = TborEccGenerateKeyReq {
+        session_id: session.session_id(),
+        scope: 0b001, // KeyScope::Session
+        curve: ECC_CURVE_P256,
+    };
+    let keygen_resp = match ctx.tbor(&keygen_req) {
+        Ok(resp) => resp,
+        Err(_) => {
+            session.close().expect("session close should succeed");
+            return;
+        }
+    };
+
+    // Derive an ECDH shared secret using the key's own pub key as peer.
+    let ecdh_req = TborEcdhDeriveReq {
+        session_id: session.session_id(),
+        scope: 0b001,
+        masked_key: keygen_resp.masked_key,
+        peer_pub_key: keygen_resp.pub_key,
+    };
+    let masked_secret = match ctx.tbor(&ecdh_req) {
+        Ok(resp) => resp.masked_secret,
+        Err(_) => {
+            session.close().expect("session close should succeed");
+            return;
+        }
+    };
+
+    let req = TborConcatKdfDeriveReq {
+        session_id: session.session_id(),
+        scope: input.scope,
+        hash_algo: input.hash_algo,
+        kdf_alg: input.kdf_alg,
+        key_type: input.key_type,
+        key_length: input.key_length,
+        masked_secret,
+        info: input.info,
+    };
+    let _ = ctx.tbor(&req);
+
+    session.close().expect("session close should succeed");
+});

fuzz/fuzz_targets/ddi/tbor/fuzz_tbor_ecc_generate_key.rs

@@ -0,0 +1,38 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+#![no_main]
+
+use azihsm_ddi_tbor_test_harness::TestCtx;
+use azihsm_ddi_tbor_types::SessionType;
+use azihsm_ddi_tbor_types::TborEccGenerateKeyReq;
+use libfuzzer_sys::arbitrary;
+use libfuzzer_sys::arbitrary::Arbitrary;
+use libfuzzer_sys::fuzz_target;
+
+const CU: u8 = 1;
+static CTX: std::sync::OnceLock<TestCtx> = std::sync::OnceLock::new();
+
+#[derive(Arbitrary, Debug)]
+struct FuzzInput {
+    scope: u8,
+    curve: u8,
+}
+
+fuzz_target!(|input: FuzzInput| {
+    let ctx = CTX.get_or_init(TestCtx::new);
+    ctx.erase().expect("erase should succeed");
+
+    let session = ctx
+        .open_session(CU, SessionType::PlainText)
+        .expect("session open should succeed");
+
+    let req = TborEccGenerateKeyReq {
+        session_id: session.session_id(),
+        scope: input.scope,
+        curve: input.curve,
+    };
+    let _ = ctx.tbor(&req);
+
+    session.close().expect("session close should succeed");
+});

fuzz/fuzz_targets/ddi/tbor/fuzz_tbor_ecc_sign.rs

@@ -0,0 +1,61 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+#![no_main]
+
+use azihsm_ddi_tbor_test_harness::TestCtx;
+use azihsm_ddi_tbor_types::ECC_CURVE_P256;
+use azihsm_ddi_tbor_types::ECC_DIGEST_MAX_LEN;
+use azihsm_ddi_tbor_types::SessionType;
+use azihsm_ddi_tbor_types::TborEccGenerateKeyReq;
+use azihsm_ddi_tbor_types::TborEccSignReq;
+use libfuzzer_sys::arbitrary;
+use libfuzzer_sys::arbitrary::Arbitrary;
+use libfuzzer_sys::fuzz_target;
+
+const CU: u8 = 1;
+static CTX: std::sync::OnceLock<TestCtx> = std::sync::OnceLock::new();
+
+fn bounded_digest(u: &mut arbitrary::Unstructured<'_>) -> arbitrary::Result<Vec<u8>> {
+    let max = ECC_DIGEST_MAX_LEN;
+    let len = usize::arbitrary(u)? % (max + 1);
+    Ok(u.bytes(len)?.to_vec())
+}
+
+#[derive(Arbitrary, Debug)]
+struct FuzzInput {
+    #[arbitrary(with = bounded_digest)]
+    digest: Vec<u8>,
+}
+
+fuzz_target!(|input: FuzzInput| {
+    let ctx = CTX.get_or_init(TestCtx::new);
+    ctx.erase().expect("erase should succeed");
+
+    let session = ctx
+        .open_session(CU, SessionType::PlainText)
+        .expect("session open should succeed");
+
+    // Generate an ECC key to obtain a valid masked_key.
+    let keygen_req = TborEccGenerateKeyReq {
+        session_id: session.session_id(),
+        scope: 0b001, // KeyScope::Session
+        curve: ECC_CURVE_P256,
+    };
+    let masked_key = match ctx.tbor(&keygen_req) {
+        Ok(resp) => resp.masked_key,
+        Err(_) => {
+            session.close().expect("session close should succeed");
+            return;
+        }
+    };
+
+    let req = TborEccSignReq {
+        session_id: session.session_id(),
+        masked_key,
+        digest: input.digest,
+    };
+    let _ = ctx.tbor(&req);
+
+    session.close().expect("session close should succeed");
+});