Exclude RFC7539 tests from chacha20_poly1305_fuzz builds
What the developer wrote
Authored by Abeeujah
Exclude RFC7539 tests from chacha20_poly1305_fuzz builds
The rfc7539 and related tests `new_from_block` require the
implementation to be spec-compliant. However under the
`chacha20_poly1305_fuzz` cfg flag, the `apply_keystream` is a no-op
that leaves ciphertext unmodified.
This intentional deviation from the RFC causes these specific tests
to fail. Gating them prevents false positives in
`--cfg=chacha20_poly1305_fuzz` builds.
What changed, and why it matters
This commit only changes test code. It adds a configuration gate so that certain cryptography specification tests are skipped when the code is built with a special fuzzing flag. The fuzzing flag intentionally disables encryption to make fuzz testing easier, which naturally causes those spec-compliance tests to fail. There is no change to production code and no security vulnerability is being fixed.
No security action required. This is a test-maintenance change. Reviewers may optionally verify that the fuzz cfg remains documented and that production builds still run these tests.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit gates three RFC7539-related unit tests (rfc_standard, new_from_block, rfc7539) with #[cfg(not(chacha20_poly1305_fuzz))]. Under the chacha20_poly1305_fuzz configuration, apply_keystream is a no-op, so ciphertext is not modified and the spec-compliant test vectors do not match. This is a test-only change to prevent false-positive test failures during fuzz builds; it does not alter runtime behavior, cryptographic logic, or the fuzz cfg implementation itself.
Changed components
chacha20_poly1305/src/chacha20.rschacha20_poly1305/src/lib.rschacha20_poly1305/src/poly1305.rsInspect captured patch +4 / −0
diff --git a/chacha20_poly1305/src/chacha20.rs b/chacha20_poly1305/src/chacha20.rs
index 1a87ec3b..afe733c4 100644
--- a/chacha20_poly1305/src/chacha20.rs
+++ b/chacha20_poly1305/src/chacha20.rs
@@ -442,6 +442,7 @@ mod tests {
assert_eq!([8; 64], binding);
}
+ #[cfg(not(chacha20_poly1305_fuzz))]
#[test]
fn rfc_standard() {
let key =
@@ -462,6 +463,7 @@ mod tests {
assert_eq!(binding, to);
}
+ #[cfg(not(chacha20_poly1305_fuzz))]
#[test]
fn new_from_block() {
let key =
diff --git a/chacha20_poly1305/src/lib.rs b/chacha20_poly1305/src/lib.rs
index 8d181029..ce20f458 100644
--- a/chacha20_poly1305/src/lib.rs
+++ b/chacha20_poly1305/src/lib.rs
@@ -185,6 +185,7 @@ mod tests {
use super::*;
+ #[cfg(not(chacha20_poly1305_fuzz))]
#[test]
fn rfc7539() {
let mut message = *b"Ladies and Gentlemen of the class of '99: If I could offer you only one tip for the future, sunscreen would be it.";
diff --git a/chacha20_poly1305/src/poly1305.rs b/chacha20_poly1305/src/poly1305.rs
index 4e67e95e..3143d848 100644
--- a/chacha20_poly1305/src/poly1305.rs
+++ b/chacha20_poly1305/src/poly1305.rs
@@ -253,6 +253,7 @@ mod tests {
use super::*;
+ #[cfg(not(chacha20_poly1305_fuzz))]
#[test]
fn rfc7539() {
let key = Vec::from_hex("85d6be7857556d337f4452fe42d506a80103808afb0db2fd4abff6af4149f51b")
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.