Add an Elliptic Curve Key Exchange Algorithm(ECDH)

The ECDH Key Exchange algorithm as standardized in NIST publication
800-56A Revision 2

Includes tests with vectors from NIST.

Signed-off-by: Simo Sorce <simo@redhat.com>

2 files changed, 24 insertions, 2 deletions

diff --git a/tests/hazmat/backends/test_multibackend.py b/tests/hazmat/backends/test_multibackend.py
index 4d17cdb0..57aa7f44 100644
--- a/tests/hazmat/backends/test_multibackend.py
+++ b/tests/hazmat/backends/test_multibackend.py
@@ -138,8 +138,9 @@ class DummyCMACBackend(object):
 
 @utils.register_interface(EllipticCurveBackend)
 class DummyEllipticCurveBackend(object):
-    def __init__(self, supported_curves):
+    def __init__(self, supported_curves, exchange_supported):
         self._curves = supported_curves
+        self.exchange_supported = exchange_supported
 
     def elliptic_curve_supported(self, curve):
         return any(
@@ -170,6 +171,9 @@ class DummyEllipticCurveBackend(object):
         if not self.elliptic_curve_supported(numbers.curve):
             raise UnsupportedAlgorithm(_Reasons.UNSUPPORTED_ELLIPTIC_CURVE)
 
+    def elliptic_curve_exchange_algorithm_supported(self):
+        return self.exchange_supported
+
 
 @utils.register_interface(PEMSerializationBackend)
 class DummyPEMSerializationBackend(object):
@@ -400,7 +404,7 @@ class TestMultiBackend(object):
         backend = MultiBackend([
             DummyEllipticCurveBackend([
                 ec.SECT283K1
-            ])
+            ], True)
         ])
 
         assert backend.elliptic_curve_supported(ec.SECT283K1()) is True
@@ -462,6 +466,10 @@ class TestMultiBackend(object):
                 )
             )
 
+        assert backend.elliptic_curve_exchange_algorithm_supported() is True
+        backend2 = MultiBackend([DummyEllipticCurveBackend([], False)])
+        assert backend2.elliptic_curve_exchange_algorithm_supported() is False
+
     def test_pem_serialization_backend(self):
         backend = MultiBackend([DummyPEMSerializationBackend()])
 
diff --git a/tests/hazmat/backends/test_openssl.py b/tests/hazmat/backends/test_openssl.py
index 8fd0d711..13162046 100644
--- a/tests/hazmat/backends/test_openssl.py
+++ b/tests/hazmat/backends/test_openssl.py
@@ -534,6 +534,11 @@ class DummyLibrary(object):
     Cryptography_HAS_EC = 0
 
 
+class DummyLibraryECDH(object):
+    Cryptography_HAS_EC = 1
+    Cryptography_HAS_ECDH = 0
+
+
 class TestOpenSSLEllipticCurve(object):
     def test_elliptic_curve_supported(self, monkeypatch):
         monkeypatch.setattr(backend, "_lib", DummyLibrary())
@@ -551,6 +556,15 @@ class TestOpenSSLEllipticCurve(object):
         with raises_unsupported_algorithm(_Reasons.UNSUPPORTED_ELLIPTIC_CURVE):
             _sn_to_elliptic_curve(backend, b"fake")
 
+    def test_elliptic_curve_exchange_algorithm_supported(self, monkeypatch):
+        monkeypatch.setattr(backend, "_lib", DummyLibrary())
+
+        assert backend.elliptic_curve_exchange_algorithm_supported() is False
+
+        monkeypatch.setattr(backend, "_lib", DummyLibraryECDH())
+
+        assert backend.elliptic_curve_exchange_algorithm_supported() is False
+
 
 @pytest.mark.requires_backend_interface(interface=RSABackend)
 class TestRSAPEMSerialization(object):