// Copyright 2010-2021, Google Inc.
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
//     * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
//     * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following disclaimer
// in the documentation and/or other materials provided with the
// distribution.
//     * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived from
// this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

#include "base/unverified_aes256.h"

#include <cstddef>
#include <cstdint>

#include "testing/gunit.h"

namespace mozc {
namespace internal {
namespace {

using ::testing::AssertionFailure;
using ::testing::AssertionResult;
using ::testing::AssertionSuccess;

class TestableUnverifiedAES256 : public UnverifiedAES256 {
 public:
  TestableUnverifiedAES256() = delete;
  TestableUnverifiedAES256(const TestableUnverifiedAES256&) = delete;
  TestableUnverifiedAES256& operator=(const TestableUnverifiedAES256&) = delete;

  // Change access rights:
  using UnverifiedAES256::InverseTransformECB;
  using UnverifiedAES256::InvMixColumns;
  using UnverifiedAES256::InvShiftRows;
  using UnverifiedAES256::InvSubBytes;
  using UnverifiedAES256::MakeKeySchedule;
  using UnverifiedAES256::MixColumns;
  using UnverifiedAES256::ShiftRows;
  using UnverifiedAES256::SubBytes;
  using UnverifiedAES256::TransformECB;
};

template <size_t kArraySize>
AssertionResult AssertEqualDataWithFormat(const char* expected_expression,
                                          const char* actual_expression,
                                          const uint8_t (&expected)[kArraySize],
                                          const uint8_t (&actual)[kArraySize]) {
  for (size_t i = 0; i < kArraySize; ++i) {
    if (expected[i] != actual[i]) {
      return AssertionFailure()
             << "Data mismatsh at " << i << " byte."
             << " expected: " << static_cast<uint32_t>(expected[i])
             << ", actual: " << static_cast<uint32_t>(actual[i]);
    }
  }
  return AssertionSuccess();
}

#define EXPECT_EQ_ARRAY(expected, actual) \
  EXPECT_PRED_FORMAT2(AssertEqualDataWithFormat, expected, actual)

TEST(UnverifiedAES256Test, MakeKeySchedule) {
  // A.3 Expansion of a 256-bit Cipher Key
  // http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
  constexpr uint8_t kKey[UnverifiedAES256::kKeyBytes] = {
      0x60, 0x3d, 0xeb, 0x10, 0x15, 0xca, 0x71, 0xbe, 0x2b, 0x73, 0xae,
      0xf0, 0x85, 0x7d, 0x77, 0x81, 0x1f, 0x35, 0x2c, 0x07, 0x3b, 0x61,
      0x08, 0xd7, 0x2d, 0x98, 0x10, 0xa3, 0x09, 0x14, 0xdf, 0xf4,
  };
  constexpr uint8_t kExpected[UnverifiedAES256::kKeyScheduleBytes] = {
      0x60, 0x3d, 0xeb, 0x10, 0x15, 0xca, 0x71, 0xbe, 0x2b, 0x73, 0xae, 0xf0,
      0x85, 0x7d, 0x77, 0x81, 0x1f, 0x35, 0x2c, 0x07, 0x3b, 0x61, 0x08, 0xd7,
      0x2d, 0x98, 0x10, 0xa3, 0x09, 0x14, 0xdf, 0xf4, 0x9b, 0xa3, 0x54, 0x11,
      0x8e, 0x69, 0x25, 0xaf, 0xa5, 0x1a, 0x8b, 0x5f, 0x20, 0x67, 0xfc, 0xde,
      0xa8, 0xb0, 0x9c, 0x1a, 0x93, 0xd1, 0x94, 0xcd, 0xbe, 0x49, 0x84, 0x6e,
      0xb7, 0x5d, 0x5b, 0x9a, 0xd5, 0x9a, 0xec, 0xb8, 0x5b, 0xf3, 0xc9, 0x17,
      0xfe, 0xe9, 0x42, 0x48, 0xde, 0x8e, 0xbe, 0x96, 0xb5, 0xa9, 0x32, 0x8a,
      0x26, 0x78, 0xa6, 0x47, 0x98, 0x31, 0x22, 0x29, 0x2f, 0x6c, 0x79, 0xb3,
      0x81, 0x2c, 0x81, 0xad, 0xda, 0xdf, 0x48, 0xba, 0x24, 0x36, 0x0a, 0xf2,
      0xfa, 0xb8, 0xb4, 0x64, 0x98, 0xc5, 0xbf, 0xc9, 0xbe, 0xbd, 0x19, 0x8e,
      0x26, 0x8c, 0x3b, 0xa7, 0x09, 0xe0, 0x42, 0x14, 0x68, 0x00, 0x7b, 0xac,
      0xb2, 0xdf, 0x33, 0x16, 0x96, 0xe9, 0x39, 0xe4, 0x6c, 0x51, 0x8d, 0x80,
      0xc8, 0x14, 0xe2, 0x04, 0x76, 0xa9, 0xfb, 0x8a, 0x50, 0x25, 0xc0, 0x2d,
      0x59, 0xc5, 0x82, 0x39, 0xde, 0x13, 0x69, 0x67, 0x6c, 0xcc, 0x5a, 0x71,
      0xfa, 0x25, 0x63, 0x95, 0x96, 0x74, 0xee, 0x15, 0x58, 0x86, 0xca, 0x5d,
      0x2e, 0x2f, 0x31, 0xd7, 0x7e, 0x0a, 0xf1, 0xfa, 0x27, 0xcf, 0x73, 0xc3,
      0x74, 0x9c, 0x47, 0xab, 0x18, 0x50, 0x1d, 0xda, 0xe2, 0x75, 0x7e, 0x4f,
      0x74, 0x01, 0x90, 0x5a, 0xca, 0xfa, 0xaa, 0xe3, 0xe4, 0xd5, 0x9b, 0x34,
      0x9a, 0xdf, 0x6a, 0xce, 0xbd, 0x10, 0x19, 0x0d, 0xfe, 0x48, 0x90, 0xd1,
      0xe6, 0x18, 0x8d, 0x0b, 0x04, 0x6d, 0xf3, 0x44, 0x70, 0x6c, 0x63, 0x1e,
  };
  uint8_t key_schedule[UnverifiedAES256::kKeyScheduleBytes] = {};

  TestableUnverifiedAES256::MakeKeySchedule(kKey, key_schedule);
  EXPECT_EQ_ARRAY(kExpected, key_schedule);
}

TEST(UnverifiedAES256Test, SubBytes) {
  uint8_t block[UnverifiedAES256::kBlockBytes] = {
      0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
      0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  };
  constexpr uint8_t kExpected[UnverifiedAES256::kBlockBytes] = {
      0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,
      0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
  };
  TestableUnverifiedAES256::SubBytes(block);
  EXPECT_EQ_ARRAY(kExpected, block);
}

TEST(UnverifiedAES256Test, InvSubBytes) {
  uint8_t block[UnverifiedAES256::kBlockBytes] = {
      0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
      0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  };
  constexpr uint8_t kExpected[UnverifiedAES256::kBlockBytes] = {
      0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38,
      0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,
  };
  TestableUnverifiedAES256::InvSubBytes(block);
  EXPECT_EQ_ARRAY(kExpected, block);
}

TEST(UnverifiedAES256Test, MixColumns) {
  uint8_t block[UnverifiedAES256::kBlockBytes] = {
      0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
      0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  };
  constexpr uint8_t kExpected[UnverifiedAES256::kBlockBytes] = {
      0x02, 0x07, 0x00, 0x05, 0x06, 0x03, 0x04, 0x01,
      0x0a, 0x0f, 0x08, 0x0d, 0x0e, 0x0b, 0x0c, 0x09,
  };
  TestableUnverifiedAES256::MixColumns(block);
  EXPECT_EQ_ARRAY(kExpected, block);
}

TEST(UnverifiedAES256Test, InvMixColumns) {
  uint8_t block[UnverifiedAES256::kBlockBytes] = {
      0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
      0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  };
  constexpr uint8_t kExpected[UnverifiedAES256::kBlockBytes] = {
      0x0a, 0x0f, 0x08, 0x0d, 0x0e, 0x0b, 0x0c, 0x09,
      0x02, 0x07, 0x00, 0x05, 0x06, 0x03, 0x04, 0x01,
  };
  TestableUnverifiedAES256::InvMixColumns(block);
  EXPECT_EQ_ARRAY(kExpected, block);
}

TEST(UnverifiedAES256Test, ShiftRows) {
  uint8_t block[UnverifiedAES256::kBlockBytes] = {
      0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
      0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  };
  constexpr uint8_t kExpected[UnverifiedAES256::kBlockBytes] = {
      0x00, 0x05, 0x0a, 0x0f, 0x04, 0x09, 0x0e, 0x03,
      0x08, 0x0d, 0x02, 0x07, 0x0c, 0x01, 0x06, 0x0b,
  };
  TestableUnverifiedAES256::ShiftRows(block);
  EXPECT_EQ_ARRAY(kExpected, block);
}

TEST(UnverifiedAES256Test, TransformECB_Zero) {
  constexpr uint8_t kKey[UnverifiedAES256::kKeyBytes] = {
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  };
  uint8_t key_schedule[UnverifiedAES256::kKeyScheduleBytes] = {};
  TestableUnverifiedAES256::MakeKeySchedule(kKey, key_schedule);

  uint8_t block[UnverifiedAES256::kBlockBytes] = {
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  };

  // To reproduce this with OpenSSL:
  // $ openssl enc -e -nopad -aes-256-ecb -K
  // 0000000000000000000000000000000000000000000000000000000000000000 -in <(echo
  // "0000: 00000000000000000000000000000000" | xxd -r) -out >(xxd -g 1 -i -c 8)
  constexpr uint8_t kExpected[UnverifiedAES256::kBlockBytes] = {
      0xdc, 0x95, 0xc0, 0x78, 0xa2, 0x40, 0x89, 0x89,
      0xad, 0x48, 0xa2, 0x14, 0x92, 0x84, 0x20, 0x87,
  };

  TestableUnverifiedAES256::TransformECB(key_schedule, block);
  EXPECT_EQ_ARRAY(kExpected, block);
}

TEST(UnverifiedAES256Test, InverseTransformECB_Zero) {
  constexpr uint8_t kKey[UnverifiedAES256::kKeyBytes] = {
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  };
  uint8_t key_schedule[UnverifiedAES256::kKeyScheduleBytes] = {};
  TestableUnverifiedAES256::MakeKeySchedule(kKey, key_schedule);

  uint8_t block[UnverifiedAES256::kBlockBytes] = {
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  };

  // To reproduce this with OpenSSL:
  // $ openssl enc -d -nopad -aes-256-ecb -K
  // 0000000000000000000000000000000000000000000000000000000000000000 -in <(echo
  // "0000: 00000000000000000000000000000000" | xxd -r) -out >(xxd -g 1 -i -c 8)
  constexpr uint8_t kExpected[UnverifiedAES256::kBlockBytes] = {
      0x67, 0x67, 0x1c, 0xe1, 0xfa, 0x91, 0xdd, 0xeb,
      0x0f, 0x8f, 0xbb, 0xb3, 0x66, 0xb5, 0x31, 0xb4,
  };
  TestableUnverifiedAES256::InverseTransformECB(key_schedule, block);
  EXPECT_EQ_ARRAY(kExpected, block);
}

TEST(UnverifiedAES256Test, TransformECB) {
  // http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
  // C.3 AES-256 (Nk=8, Nr=14)
  constexpr uint8_t kKey[UnverifiedAES256::kKeyBytes] = {
      0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a,
      0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15,
      0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
  };
  uint8_t key_schedule[UnverifiedAES256::kKeyScheduleBytes] = {};
  TestableUnverifiedAES256::MakeKeySchedule(kKey, key_schedule);
  uint8_t block[UnverifiedAES256::kBlockBytes] = {
      0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
      0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
  };
  constexpr uint8_t kExpected[UnverifiedAES256::kBlockBytes] = {
      0x8e, 0xa2, 0xb7, 0xca, 0x51, 0x67, 0x45, 0xbf,
      0xea, 0xfc, 0x49, 0x90, 0x4b, 0x49, 0x60, 0x89,
  };
  TestableUnverifiedAES256::TransformECB(key_schedule, block);
  EXPECT_EQ_ARRAY(kExpected, block);
}

TEST(UnverifiedAES256Test, InverseTransformECB) {
  // http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
  // C.3 AES-256 (Nk=8, Nr=14)
  constexpr uint8_t kKey[UnverifiedAES256::kKeyBytes] = {
      0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a,
      0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15,
      0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
  };
  uint8_t key_schedule[UnverifiedAES256::kKeyScheduleBytes] = {};
  TestableUnverifiedAES256::MakeKeySchedule(kKey, key_schedule);
  uint8_t block[UnverifiedAES256::kBlockBytes] = {
      0x8e, 0xa2, 0xb7, 0xca, 0x51, 0x67, 0x45, 0xbf,
      0xea, 0xfc, 0x49, 0x90, 0x4b, 0x49, 0x60, 0x89,
  };
  constexpr uint8_t kExpected[UnverifiedAES256::kBlockBytes] = {
      0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
      0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
  };
  TestableUnverifiedAES256::InverseTransformECB(key_schedule, block);
  EXPECT_EQ_ARRAY(kExpected, block);
}

TEST(UnverifiedAES256Test, TransformCBC_Zero) {
  constexpr uint8_t kKey[UnverifiedAES256::kKeyBytes] = {
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  };
  constexpr uint8_t kIV[UnverifiedAES256::kBlockBytes] = {
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  };
  constexpr size_t kNumBlocks = 4;

  uint8_t block[UnverifiedAES256::kBlockBytes * kNumBlocks] = {
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  };

  // To reproduce this with OpenSSL:
  // $ openssl enc -e -nopad -aes-256-cbc -K
  // 0000000000000000000000000000000000000000000000000000000000000000 -iv
  // 00000000000000000000000000000000 -in <(echo -e "0000:
  // 00000000000000000000000000000000 \n0010: 00000000000000000000000000000000
  // \n0020: 00000000000000000000000000000000 \n0030:
  // 00000000000000000000000000000000" | xxd -r) -out >(xxd -g 1 -i -c 8)
  constexpr uint8_t kExpected[UnverifiedAES256::kBlockBytes * kNumBlocks] = {
      0xdc, 0x95, 0xc0, 0x78, 0xa2, 0x40, 0x89, 0x89, 0xad, 0x48, 0xa2,
      0x14, 0x92, 0x84, 0x20, 0x87, 0x08, 0xc3, 0x74, 0x84, 0x8c, 0x22,
      0x82, 0x33, 0xc2, 0xb3, 0x4f, 0x33, 0x2b, 0xd2, 0xe9, 0xd3, 0x8b,
      0x70, 0xc5, 0x15, 0xa6, 0x66, 0x3d, 0x38, 0xcd, 0xb8, 0xe6, 0x53,
      0x2b, 0x26, 0x64, 0x91, 0x5d, 0x0d, 0xcc, 0x19, 0x25, 0x80, 0xae,
      0xe9, 0xef, 0x8a, 0x85, 0x68, 0x19, 0x3f, 0x1b, 0x44,
  };

  TestableUnverifiedAES256::TransformCBC(kKey, kIV, block, kNumBlocks);
  EXPECT_EQ_ARRAY(kExpected, block);
}

TEST(UnverifiedAES256Test, InverseTransformCBC_Zero) {
  constexpr uint8_t kKey[UnverifiedAES256::kKeyBytes] = {
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  };
  constexpr uint8_t kIV[UnverifiedAES256::kBlockBytes] = {
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  };
  constexpr size_t kNumBlocks = 4;
  uint8_t block[UnverifiedAES256::kBlockBytes * kNumBlocks] = {
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  };

  // To reproduce this with OpenSSL:
  // $ openssl enc -d -nopad -aes-256-cbc -K
  // 0000000000000000000000000000000000000000000000000000000000000000 -iv
  // 00000000000000000000000000000000 -in <(echo -e "0000:
  // 00000000000000000000000000000000 \n0010: 00000000000000000000000000000000
  // \n0020: 00000000000000000000000000000000 \n0030:
  // 00000000000000000000000000000000" | xxd -r) -out >(xxd -g 1 -i -c 8)
  constexpr uint8_t kExpected[UnverifiedAES256::kBlockBytes * kNumBlocks] = {
      0x67, 0x67, 0x1c, 0xe1, 0xfa, 0x91, 0xdd, 0xeb, 0x0f, 0x8f, 0xbb,
      0xb3, 0x66, 0xb5, 0x31, 0xb4, 0x67, 0x67, 0x1c, 0xe1, 0xfa, 0x91,
      0xdd, 0xeb, 0x0f, 0x8f, 0xbb, 0xb3, 0x66, 0xb5, 0x31, 0xb4, 0x67,
      0x67, 0x1c, 0xe1, 0xfa, 0x91, 0xdd, 0xeb, 0x0f, 0x8f, 0xbb, 0xb3,
      0x66, 0xb5, 0x31, 0xb4, 0x67, 0x67, 0x1c, 0xe1, 0xfa, 0x91, 0xdd,
      0xeb, 0x0f, 0x8f, 0xbb, 0xb3, 0x66, 0xb5, 0x31, 0xb4,
  };
  TestableUnverifiedAES256::InverseTransformCBC(kKey, kIV, block, kNumBlocks);
  EXPECT_EQ_ARRAY(kExpected, block);
}

TEST(UnverifiedAES256Test, TransformCBC_NonZero) {
  constexpr uint8_t kKey[UnverifiedAES256::kKeyBytes] = {
      0x00, 0xfe, 0x02, 0xfc, 0x04, 0xfa, 0x06, 0xf8, 0xf7, 0x09, 0xf5,
      0x0b, 0xf3, 0x0d, 0xf1, 0x0f, 0xff, 0x01, 0xfd, 0x03, 0xfb, 0x05,
      0xf9, 0x07, 0x08, 0xf6, 0x0a, 0xf4, 0x0c, 0xf2, 0x0e, 0xf0,
  };
  constexpr uint8_t kIV[UnverifiedAES256::kBlockBytes] = {
      0xf0, 0xe1, 0xd2, 0xc3, 0xb4, 0xa5, 0x96, 0x87,
      0x78, 0x69, 0x5a, 0x4b, 0x3c, 0x2d, 0x1e, 0x0f,
  };
  constexpr size_t kNumBlocks = 5;
  uint8_t block[UnverifiedAES256::kBlockBytes * kNumBlocks] = {
      0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x65, 0x20, 0x74, 0x68, 0x65,
      0x20, 0x77, 0x6f, 0x72, 0x6c, 0x64, 0x27, 0x73, 0x20, 0x69, 0x6e, 0x66,
      0x6f, 0x72, 0x6d, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x61, 0x6e, 0x64,
      0x20, 0x6d, 0x61, 0x6b, 0x65, 0x20, 0x69, 0x74, 0x20, 0x75, 0x6e, 0x69,
      0x76, 0x65, 0x72, 0x73, 0x61, 0x6c, 0x6c, 0x79, 0x20, 0x61, 0x63, 0x63,
      0x65, 0x73, 0x73, 0x69, 0x62, 0x6c, 0x65, 0x20, 0x61, 0x6e, 0x64, 0x20,
      0x75, 0x73, 0x65, 0x66, 0x75, 0x6c, 0x00, 0x00,
  };

  // To reproduce this with OpenSSL:
  // $ openssl enc -e -nopad -aes-256-cbc -K
  // 00fe02fc04fa06f8f709f50bf30df10fff01fd03fb05f90708f60af40cf20ef0 -iv
  // f0e1d2c3b4a5968778695a4b3c2d1e0f -in <(echo -e "0000:
  // 6f7267616e697a652074686520776f72 \n0010: 6c64277320696e666f726d6174696f6e
  // \n0020: 20616e64206d616b6520697420756e69 \n0030:
  // 76657273616c6c792061636365737369 \n0040: 626c6520616e642075736566756c0000"
  // | xxd -r) -out >(xxd -g 1 -i -c 8)
  constexpr uint8_t kExpected[UnverifiedAES256::kBlockBytes * kNumBlocks] = {
      0xcd, 0xba, 0x6b, 0xc8, 0xec, 0x35, 0x36, 0x8c, 0x2f, 0x1a, 0x99, 0x57,
      0x44, 0xdd, 0x3a, 0x51, 0x63, 0xd0, 0x02, 0xd8, 0xab, 0x72, 0x5f, 0xb7,
      0x5a, 0x83, 0x0c, 0xf9, 0x37, 0x9d, 0x80, 0xeb, 0x6d, 0x1a, 0xb2, 0xdd,
      0xca, 0x9a, 0xee, 0x32, 0xea, 0x91, 0xc5, 0xab, 0xc2, 0x85, 0xb2, 0xa5,
      0x30, 0x4e, 0xe5, 0x1a, 0xc9, 0xa2, 0x36, 0xa0, 0x64, 0x42, 0x21, 0x7e,
      0xf6, 0xae, 0x5c, 0x7e, 0x84, 0xff, 0x63, 0x7f, 0x78, 0x3a, 0x4e, 0xab,
      0x0a, 0x5e, 0xb2, 0x49, 0x74, 0xcd, 0x0f, 0x85,
  };
  TestableUnverifiedAES256::TransformCBC(kKey, kIV, block, kNumBlocks);
  EXPECT_EQ_ARRAY(kExpected, block);
}

TEST(UnverifiedAES256Test, InverseTransformCBC_NonZero) {
  constexpr uint8_t kKey[UnverifiedAES256::kKeyBytes] = {
      0x00, 0xfe, 0x02, 0xfc, 0x04, 0xfa, 0x06, 0xf8, 0xf7, 0x09, 0xf5,
      0x0b, 0xf3, 0x0d, 0xf1, 0x0f, 0xff, 0x01, 0xfd, 0x03, 0xfb, 0x05,
      0xf9, 0x07, 0x08, 0xf6, 0x0a, 0xf4, 0x0c, 0xf2, 0x0e, 0xf0,
  };
  constexpr uint8_t kIV[UnverifiedAES256::kBlockBytes] = {
      0xf0, 0xe1, 0xd2, 0xc3, 0xb4, 0xa5, 0x96, 0x87,
      0x78, 0x69, 0x5a, 0x4b, 0x3c, 0x2d, 0x1e, 0x0f,
  };
  constexpr size_t kNumBlocks = 5;

  uint8_t block[UnverifiedAES256::kBlockBytes * kNumBlocks] = {
      0xcd, 0xba, 0x6b, 0xc8, 0xec, 0x35, 0x36, 0x8c, 0x2f, 0x1a, 0x99, 0x57,
      0x44, 0xdd, 0x3a, 0x51, 0x63, 0xd0, 0x02, 0xd8, 0xab, 0x72, 0x5f, 0xb7,
      0x5a, 0x83, 0x0c, 0xf9, 0x37, 0x9d, 0x80, 0xeb, 0x6d, 0x1a, 0xb2, 0xdd,
      0xca, 0x9a, 0xee, 0x32, 0xea, 0x91, 0xc5, 0xab, 0xc2, 0x85, 0xb2, 0xa5,
      0x30, 0x4e, 0xe5, 0x1a, 0xc9, 0xa2, 0x36, 0xa0, 0x64, 0x42, 0x21, 0x7e,
      0xf6, 0xae, 0x5c, 0x7e, 0x84, 0xff, 0x63, 0x7f, 0x78, 0x3a, 0x4e, 0xab,
      0x0a, 0x5e, 0xb2, 0x49, 0x74, 0xcd, 0x0f, 0x85,
  };

  // To reproduce this with OpenSSL:
  // $ openssl enc -d -nopad -aes-256-cbc -K
  // 00fe02fc04fa06f8f709f50bf30df10fff01fd03fb05f90708f60af40cf20ef0 -iv
  // f0e1d2c3b4a5968778695a4b3c2d1e0f -in <(echo -e "0000:
  // cdba6bc8ec35368c2f1a995744dd3a51 \n0010: 63d002d8ab725fb75a830cf9379d80eb
  // \n0020: 6d1ab2ddca9aee32ea91c5abc285b2a5 \n0030:
  // 304ee51ac9a236a06442217ef6ae5c7e \n0040: 84ff637f783a4eab0a5eb24974cd0f85"
  // | xxd -r) -out >(xxd -g 1 -i -c 8)
  constexpr uint8_t kExpected[UnverifiedAES256::kBlockBytes * kNumBlocks] = {
      0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x65, 0x20, 0x74, 0x68, 0x65,
      0x20, 0x77, 0x6f, 0x72, 0x6c, 0x64, 0x27, 0x73, 0x20, 0x69, 0x6e, 0x66,
      0x6f, 0x72, 0x6d, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x61, 0x6e, 0x64,
      0x20, 0x6d, 0x61, 0x6b, 0x65, 0x20, 0x69, 0x74, 0x20, 0x75, 0x6e, 0x69,
      0x76, 0x65, 0x72, 0x73, 0x61, 0x6c, 0x6c, 0x79, 0x20, 0x61, 0x63, 0x63,
      0x65, 0x73, 0x73, 0x69, 0x62, 0x6c, 0x65, 0x20, 0x61, 0x6e, 0x64, 0x20,
      0x75, 0x73, 0x65, 0x66, 0x75, 0x6c, 0x00, 0x00,
  };
  TestableUnverifiedAES256::InverseTransformCBC(kKey, kIV, block, kNumBlocks);
  EXPECT_EQ_ARRAY(kExpected, block);
}

// TODO(yukawa): Add more tests based on well-known test vectors.

}  // namespace
}  // namespace internal
}  // namespace mozc
