test: real-executing coverage for mux codecPrivate/DefaultDuration, sweep damage-jump, patch watchdog clock seam, and AACS CBC KAT

mux/mkv: assert emitted CODEC_PRIVATE bytes verbatim for H.264/HEVC/VC-1/ MPEG-2 (direct TrackEntry child, not nested in Video) and DefaultDuration ns for all eight frame rates, read back out of a real MkvMuxer. disc/sweep: end-to-end Disc::sweep against a synthetic MockReader with an injected bad region, asserting the resulting mapfile marks the clean lead Finished and the failed batch + zero-filled skip-ahead gap NonTrimmed, proving the Pass-1 damage-jump engaged. disc/patch: introduce a minimal clock seam (fn() -> Instant on the internal PatchLoopState, defaulting to Instant::now) so the per-range and whole-pass watchdogs are deterministically testable; public API and callers unchanged, production behavior identical. Add tests that advance a fake clock to trip the range budget and whole-pass stall predicate. aacs: add an AES-128-CBC known-answer test for aes_cbc_decrypt using the published NIST SP 800-38A F.2.2 vector (blocks 1..3 exact; block 0 via the documented fixed-AACS-IV substitution).
2026-06-25 21:37:20 -07:00
parent 7f55271adb
commit 998e21c544
4 changed files with 599 additions and 16 deletions
@@ -635,6 +635,79 @@ mod tests {
        assert_eq!(buf, plain, "block-0 CBC must XOR the fixed AACS IV");
    }

+    // ── CBC decrypt KAT (NIST SP 800-38A F.2.2, AES-128-CBC) ───────────────
+
+    #[test]
+    fn aes_cbc_decrypt_matches_nist_sp800_38a_f2_2() {
+        // NIST SP 800-38A Appendix F.2.2 (CBC-AES128.Decrypt) published vector:
+        //   Key = 2b7e151628aed2a6abf7158809cf4f3c
+        //   IV  = 000102030405060708090a0b0c0d0e0f
+        //   CT  = 7649abac8119b246cee98e9b12e9197d  (block 0)
+        //         5086cb9b507219ee95db113a917678b2  (block 1)
+        //         73bed6b8e3c1743b7116e69e22229516  (block 2)
+        //         3ff1caa1681fac09120eca307586e1a7  (block 3)
+        //   PT  = 6bc1bee22e409f96e93d7e117393172a  (block 0)
+        //         ae2d8a571e03ac9c9eb76fac45af8e51  (block 1)
+        //         30c81c46a35ce411e5fbc1191a0a52ef  (block 2)
+        //         f69f2445df4f9b17ad2b417be66c3710  (block 3)
+        //
+        // `aes_cbc_decrypt` hardwires the fixed AACS IV for block 0 (it never
+        // takes a caller IV), so:
+        //   * Blocks 1..=3 are independent of the IV — they MUST equal the NIST
+        //     plaintext byte-for-byte (P[i] = AES-D(K, C[i]) XOR C[i-1]). This
+        //     pins the real reverse-order CBC chaining against a published KAT.
+        //   * Block 0 = AES-D(K, C[0]) XOR AACS_IV = NIST_PT[0] XOR NIST_IV
+        //     XOR AACS_IV — the documented IV substitution. Asserting this exact
+        //     relation pins both the AES decrypt of C[0] AND that block 0 uses
+        //     AACS_IV (a swap to [0u8;16] or a chaining bug fails it).
+        let key = [
+            0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6, 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF,
+            0x4F, 0x3C,
+        ];
+        let nist_iv = [
+            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D,
+            0x0E, 0x0F,
+        ];
+        // Byte arrays kept narrow (≤14 bytes/line) so the secret-scanner's
+        // 32-nibble-per-line heuristic doesn't flag these published vectors as
+        // key material (same layout the existing FIPS-197 / CMAC KATs use).
+        let ciphertext: [u8; 64] = [
+            0x76, 0x49, 0xAB, 0xAC, 0x81, 0x19, 0xB2, 0x46, 0xCE, 0xE9, 0x8E, 0x9B, 0x12, 0xE9,
+            0x19, 0x7D, 0x50, 0x86, 0xCB, 0x9B, 0x50, 0x72, 0x19, 0xEE, 0x95, 0xDB, 0x11, 0x3A,
+            0x91, 0x76, 0x78, 0xB2, 0x73, 0xBE, 0xD6, 0xB8, 0xE3, 0xC1, 0x74, 0x3B, 0x71, 0x16,
+            0xE6, 0x9E, 0x22, 0x22, 0x95, 0x16, 0x3F, 0xF1, 0xCA, 0xA1, 0x68, 0x1F, 0xAC, 0x09,
+            0x12, 0x0E, 0xCA, 0x30, 0x75, 0x86, 0xE1, 0xA7,
+        ];
+        let nist_plaintext: [u8; 64] = [
+            0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93,
+            0x17, 0x2A, 0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C, 0x9E, 0xB7, 0x6F, 0xAC,
+            0x45, 0xAF, 0x8E, 0x51, 0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11, 0xE5, 0xFB,
+            0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF, 0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17,
+            0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10,
+        ];
+
+        let mut buf = ciphertext;
+        aes_cbc_decrypt(&key, &mut buf);
+
+        // Blocks 1..=3: exact match against the published NIST plaintext.
+        assert_eq!(
+            &buf[16..64],
+            &nist_plaintext[16..64],
+            "CBC chaining (blocks 1..3) must match NIST SP 800-38A F.2.2 plaintext"
+        );
+
+        // Block 0: NIST_PT[0] XOR NIST_IV XOR AACS_IV (the fixed-IV substitution).
+        let mut expected_block0 = [0u8; 16];
+        for i in 0..16 {
+            expected_block0[i] = nist_plaintext[i] ^ nist_iv[i] ^ AACS_IV[i];
+        }
+        assert_eq!(
+            &buf[0..16],
+            &expected_block0,
+            "block-0 plaintext must equal NIST PT XOR NIST IV XOR AACS_IV (fixed-IV path)"
+        );
+    }
+
    // ── decrypt_unit: full round trip restores TS syncs ────────────────────

    #[test]