From 0a932e9a20bcae8629eb3e2085ef40b1cefa2897 Mon Sep 17 00:00:00 2001
From: Christos Longros <98426896+chrislongros@users.noreply.github.com>
Date: Tue, 4 Aug 2026 23:42:59 +0200
Subject: [PATCH] unit/sha2: add Monte Carlo test

SHAVS chain MD[i] = SHA(MD[i-3] || MD[i-2] || MD[i-1]) run for 1000
rounds, for SHA-256, SHA-512 and SHA-512/256.  The seeds and expected
digests are the COUNT = 0 vectors from the NIST CAVP byte-oriented test
vectors (shabytetestvectors).

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Christos Longros <chris.longros@gmail.com>
Closes #18879
---
 tests/unit/test_sha2.c | 90 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 90 insertions(+)

diff --git a/tests/unit/test_sha2.c b/tests/unit/test_sha2.c
index db8898020d6c..d7a6794f62c3 100644
--- a/tests/unit/test_sha2.c
+++ b/tests/unit/test_sha2.c
@@ -146,6 +146,61 @@ static const uint8_t	sha512_million_digest[64] = {
 	0x4E, 0xAD, 0xB2, 0x17, 0xAD, 0x8C, 0xC0, 0x9B
 };
 
+/*
+ * Monte Carlo seeds and COUNT = 0 checkpoints from the NIST CAVP
+ * byte-oriented test vectors (shabytetestvectors).
+ */
+
+static const uint8_t	sha256_monte_carlo_seed[32] = {
+	0x6D, 0x1E, 0x72, 0xAD, 0x03, 0xDD, 0xEB, 0x5D,
+	0xE8, 0x91, 0xE5, 0x72, 0xE2, 0x39, 0x6F, 0x8D,
+	0xA0, 0x15, 0xD8, 0x99, 0xEF, 0x0E, 0x79, 0x50,
+	0x31, 0x52, 0xD6, 0x01, 0x0A, 0x3F, 0xE6, 0x91
+};
+
+static const uint8_t	sha256_monte_carlo_digest[32] = {
+	0xE9, 0x3C, 0x33, 0x0A, 0xE5, 0x44, 0x77, 0x38,
+	0xC8, 0xAA, 0x85, 0xD7, 0x1A, 0x6C, 0x80, 0xF2,
+	0xA5, 0x83, 0x81, 0xD0, 0x58, 0x72, 0xD2, 0x6B,
+	0xDD, 0x39, 0xF1, 0xFC, 0xD4, 0xF2, 0xB7, 0x88
+};
+
+static const uint8_t	sha512_monte_carlo_seed[64] = {
+	0x5C, 0x33, 0x7D, 0xE5, 0xCA, 0xF3, 0x5D, 0x18,
+	0xED, 0x90, 0xB5, 0xCD, 0xDF, 0xCE, 0x00, 0x1C,
+	0xA1, 0xB8, 0xEE, 0x86, 0x02, 0xF3, 0x67, 0xE7,
+	0xC2, 0x4C, 0xCC, 0xA6, 0xF8, 0x93, 0x80, 0x2F,
+	0xB1, 0xAC, 0xA7, 0xA3, 0xDA, 0xE3, 0x2D, 0xCD,
+	0x60, 0x80, 0x0A, 0x59, 0x95, 0x9B, 0xC5, 0x40,
+	0xD6, 0x32, 0x37, 0x87, 0x6B, 0x79, 0x92, 0x29,
+	0xAE, 0x71, 0xA2, 0x52, 0x6F, 0xBC, 0x52, 0xCD
+};
+
+static const uint8_t	sha512_monte_carlo_digest[64] = {
+	0xAD, 0xA6, 0x9A, 0xDD, 0x00, 0x71, 0xB7, 0x94,
+	0x46, 0x3C, 0x88, 0x06, 0xA1, 0x77, 0x32, 0x67,
+	0x35, 0xFA, 0x62, 0x4B, 0x68, 0xAB, 0x7B, 0xCA,
+	0xB2, 0x38, 0x8B, 0x92, 0x76, 0xC0, 0x36, 0xE4,
+	0xEA, 0xAF, 0xF8, 0x73, 0x33, 0xE8, 0x3C, 0x81,
+	0xC0, 0xBC, 0xA0, 0x35, 0x9D, 0x4A, 0xEE, 0xBC,
+	0xBC, 0xFD, 0x31, 0x4C, 0x06, 0x30, 0xE0, 0xC2,
+	0xAF, 0x68, 0xC1, 0xFB, 0x19, 0xCC, 0x47, 0x0E
+};
+
+static const uint8_t	sha512_256_monte_carlo_seed[32] = {
+	0xF4, 0x1E, 0xCE, 0x26, 0x13, 0xE4, 0x57, 0x39,
+	0x15, 0x69, 0x6B, 0x5A, 0xDC, 0xD5, 0x1C, 0xA3,
+	0x28, 0xBE, 0x3B, 0xF5, 0x66, 0xA9, 0xCA, 0x99,
+	0xC9, 0xCE, 0xB0, 0x27, 0x9C, 0x1C, 0xB0, 0xA7
+};
+
+static const uint8_t	sha512_256_monte_carlo_digest[32] = {
+	0xB1, 0xD9, 0x7A, 0x65, 0x36, 0x89, 0x6A, 0xA0,
+	0x10, 0x98, 0xFB, 0x2B, 0x9E, 0x15, 0xD8, 0x69,
+	0x26, 0x21, 0xC8, 0x40, 0x77, 0x05, 0x1F, 0xC1,
+	0xF7, 0x0A, 0x8A, 0x48, 0xBA, 0xA6, 0xDF, 0xAF
+};
+
 static MunitResult
 test_sha256_known(const MunitParameter params[], void *data)
 {
@@ -217,6 +272,40 @@ test_million(const MunitParameter params[], void *data)
 	return (MUNIT_OK);
 }
 
+/* SHAVS chain MD[i] = SHA(MD[i-3] || MD[i-2] || MD[i-1]), 1000 rounds. */
+static MunitResult
+test_monte_carlo(const MunitParameter params[], void *data)
+{
+	(void) params, (void) data;
+
+	static const int algos[] = { SHA256, SHA512, SHA512_256 };
+	static const size_t diglens[] = { SHA256_DIGEST_LENGTH,
+	    SHA512_DIGEST_LENGTH, SHA512_256_DIGEST_LENGTH };
+	static const uint8_t *const seeds[] = { sha256_monte_carlo_seed,
+	    sha512_monte_carlo_seed, sha512_256_monte_carlo_seed };
+	static const uint8_t *const known[] = { sha256_monte_carlo_digest,
+	    sha512_monte_carlo_digest, sha512_256_monte_carlo_digest };
+
+	for (size_t a = 0; a < ARRAY_SIZE(algos); a++) {
+		uint8_t msg[3 * SHA512_DIGEST_LENGTH];
+		uint8_t digest[SHA512_DIGEST_LENGTH];
+		size_t diglen = diglens[a];
+
+		for (int m = 0; m < 3; m++)
+			memcpy(msg + m * diglen, seeds[a], diglen);
+
+		for (int i = 0; i < 1000; i++) {
+			hash_buf(algos[a], msg, 3 * diglen, digest);
+			memmove(msg, msg + diglen, 2 * diglen);
+			memcpy(msg + 2 * diglen, digest, diglen);
+		}
+
+		munit_assert_memory_equal(diglen, digest, known[a]);
+	}
+
+	return (MUNIT_OK);
+}
+
 /*
  * Split updates across the 64- and 128-byte message block boundaries
  * must produce the same digest as a single update.
@@ -309,6 +398,7 @@ static const MunitTest sha2_tests[] = {
 	UNIT_TEST("sha512_known",	test_sha512_known),
 	UNIT_TEST("sha512_256_known",	test_sha512_256_known),
 	UNIT_TEST("million",		test_million),
+	UNIT_TEST("monte_carlo",	test_monte_carlo),
 	UNIT_TEST("incremental",	test_incremental),
 	UNIT_TEST("impls",		test_impls),
 	{ 0 },