test: add test case for shamir algorithm

Author: wa5i

src/http/sys.rs

@@ -103,8 +103,10 @@ async fn sys_init_put_request_handler(
 
     let result = core.init(&seal_config)?;
 
-    let resp =
-        InitResponse { keys: result.secret_shares.iter().map(hex::encode).collect(), root_token: result.root_token.clone() };
+    let resp = InitResponse {
+        keys: result.secret_shares.iter().map(hex::encode).collect(),
+        root_token: result.root_token.clone(),
+    };
 
     Ok(response_json_ok(None, resp))
 }

src/shamir.rs

@@ -161,7 +161,7 @@ impl ShamirSecret {
     }
 
     pub fn split(secret: &[u8], part: u8, threshold: u8) -> Result<Zeroizing<Vec<Vec<u8>>>, RvError> {
-        if part < threshold || threshold < 2 {
+        if part < threshold || threshold < 2 || part >=255 {
             return Err(RvError::ErrShamirShareCountInvalid);
         }
 
@@ -390,4 +390,296 @@ mod tests {
         let secret = recovered.unwrap();
         assert_ne!(&secret, "Hello World!".as_bytes());
     }
+
+    #[test]
+    fn test_split_basic_functionality() {
+        let secret = b"test secret data";
+        let threshold = 3;
+        let total_shares = 5;
+
+        let result = ShamirSecret::split(secret, total_shares, threshold);
+        assert!(result.is_ok());
+
+        let shares = result.unwrap();
+        println!("shares: {:?}", shares);
+        assert_eq!(shares.len(), total_shares as usize);
+
+        let expected_length = secret.len() + 1; // secret length + 1 byte for share ID
+        for share in shares.iter() {
+            assert_eq!(share.len(), expected_length);
+        }
+
+        for (i, share) in shares.iter().enumerate() {
+            assert_eq!(share[share.len() - 1], (i + 1) as u8);
+        }
+    }
+
+    #[test]
+    fn test_split_parameter_validation() {
+        let secret = b"test secret";
+
+        // threshold < 2 should fail
+        let result = ShamirSecret::split(secret, 3, 1);
+        assert!(result.is_err());
+
+        // part < threshold should fail
+        let result = ShamirSecret::split(secret, 2, 3);
+        assert!(result.is_err());
+
+        // Valid parameters should succeed
+        let result = ShamirSecret::split(secret, 3, 2);
+        assert!(result.is_ok());
+
+        let result = ShamirSecret::split(secret, 5, 3);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_split_minimum_valid_parameters() {
+        let secret = b"minimum test";
+        let threshold = 2;
+        let total_shares = 2;
+
+        let result = ShamirSecret::split(secret, total_shares, threshold);
+        assert!(result.is_ok());
+
+        let shares = result.unwrap();
+        assert_eq!(shares.len(), 2);
+
+        // Test that we can recover the secret with both shares
+        let recovered = ShamirSecret::combine(shares.to_vec());
+        assert!(recovered.is_some());
+        assert_eq!(recovered.unwrap(), secret);
+    }
+
+    #[test]
+    fn test_split_maximum_shares() {
+        let secret = b"max shares test";
+        let threshold = 2;
+        let total_shares = 255; // Maximum possible share count
+
+        let result = ShamirSecret::split(secret, total_shares, threshold);
+        assert!(result.is_err());
+
+        let result = ShamirSecret::split(secret, total_shares - 1, threshold);
+        assert!(result.is_ok());
+
+        let shares = result.unwrap();
+        assert_eq!(shares.len(), (total_shares - 1) as usize);
+
+        // Test recovery with minimum threshold
+        let minimal_shares = vec![shares[0].clone(), shares[1].clone()];
+        let recovered = ShamirSecret::combine(minimal_shares);
+        assert!(recovered.is_some());
+        assert_eq!(recovered.unwrap(), secret);
+    }
+
+    #[test]
+    fn test_split_empty_secret() {
+        let secret = b"";
+        let threshold = 2;
+        let total_shares = 3;
+
+        let result = ShamirSecret::split(secret, total_shares, threshold);
+        assert!(result.is_ok());
+
+        let shares = result.unwrap();
+        assert_eq!(shares.len(), 3);
+
+        // Each share should only contain the share ID
+        for share in shares.iter() {
+            assert_eq!(share.len(), 1); // Only share ID
+        }
+
+        // Recovery should work
+        let recovered = ShamirSecret::combine(vec![shares[0].clone(), shares[1].clone()]);
+        assert!(recovered.is_some());
+        assert_eq!(recovered.unwrap(), secret);
+    }
+
+    #[test]
+    fn test_split_single_byte_secret() {
+        let secret = b"A";
+        let threshold = 3;
+        let total_shares = 5;
+
+        let result = ShamirSecret::split(secret, total_shares, threshold);
+        assert!(result.is_ok());
+
+        let shares = result.unwrap();
+        assert_eq!(shares.len(), 5);
+
+        for share in shares.iter() {
+            assert_eq!(share.len(), 2); // 1 byte secret + 1 byte share ID
+        }
+
+        // Recovery with exact threshold
+        let recovered = ShamirSecret::combine(vec![shares[0].clone(), shares[1].clone(), shares[2].clone()]);
+        assert!(recovered.is_some());
+        assert_eq!(recovered.unwrap(), secret);
+    }
+
+    #[test]
+    fn test_split_large_secret() {
+        let secret = vec![0xAB; 1000]; // 1KB of data
+        let threshold = 4;
+        let total_shares = 7;
+
+        let result = ShamirSecret::split(&secret, total_shares, threshold);
+        assert!(result.is_ok());
+
+        let shares = result.unwrap();
+        assert_eq!(shares.len(), 7);
+
+        for share in shares.iter() {
+            assert_eq!(share.len(), 1001); // 1000 bytes secret + 1 byte share ID
+        }
+
+        // Recovery with more than threshold
+        let recovered = ShamirSecret::combine(vec![
+            shares[0].clone(),
+            shares[1].clone(),
+            shares[2].clone(),
+            shares[3].clone(),
+            shares[4].clone(),
+        ]);
+        assert!(recovered.is_some());
+        assert_eq!(recovered.unwrap(), secret);
+    }
+
+    #[test]
+    fn test_split_recovery_with_exact_threshold() {
+        let secret = b"exact threshold test";
+        let threshold = 4;
+        let total_shares = 6;
+
+        let shares = ShamirSecret::split(secret, total_shares, threshold).unwrap();
+
+        // Test recovery with exactly threshold shares
+        let recovered =
+            ShamirSecret::combine(vec![shares[0].clone(), shares[1].clone(), shares[2].clone(), shares[3].clone()]);
+        assert!(recovered.is_some());
+        assert_eq!(recovered.unwrap(), secret);
+    }
+
+    #[test]
+    fn test_split_recovery_with_insufficient_shares() {
+        let secret = b"insufficient shares test";
+        let threshold = 4;
+        let total_shares = 6;
+
+        let shares = ShamirSecret::split(secret, total_shares, threshold).unwrap();
+
+        // Test recovery with less than threshold shares (should fail or give wrong result)
+        let recovered = ShamirSecret::combine(vec![shares[0].clone(), shares[1].clone(), shares[2].clone()]);
+
+        // With insufficient shares, either recovery fails or gives wrong result
+        if let Some(recovered_secret) = recovered {
+            assert_ne!(recovered_secret, secret);
+        }
+    }
+
+    #[test]
+    fn test_split_recovery_with_different_share_combinations() {
+        let secret = b"combination test";
+        let threshold = 3;
+        let total_shares = 5;
+
+        let shares = ShamirSecret::split(secret, total_shares, threshold).unwrap();
+
+        // Test different combinations of shares
+        let combinations = vec![
+            vec![0, 1, 2],
+            vec![0, 2, 4],
+            vec![1, 3, 4],
+            vec![2, 3, 4],
+            vec![0, 1, 3, 4], // More than threshold
+        ];
+
+        for combination in combinations {
+            let selected_shares: Vec<_> = combination.iter().map(|&i| shares[i].clone()).collect();
+            let recovered = ShamirSecret::combine(selected_shares);
+            assert!(recovered.is_some());
+            assert_eq!(recovered.unwrap(), secret);
+        }
+    }
+
+    #[test]
+    fn test_split_deterministic_behavior() {
+        // Note: ShamirSecret uses random coefficients, so splits are not deterministic
+        // But we can test that the same secret with same parameters produces valid shares
+        let secret = b"deterministic test";
+        let threshold = 3;
+        let total_shares = 5;
+
+        let shares1 = ShamirSecret::split(secret, total_shares, threshold).unwrap();
+        let shares2 = ShamirSecret::split(secret, total_shares, threshold).unwrap();
+
+        // Shares should be different due to randomness
+        assert_ne!(shares1[0], shares2[0]);
+
+        // But both should recover to the same secret
+        let recovered1 = ShamirSecret::combine(vec![shares1[0].clone(), shares1[1].clone(), shares1[2].clone()]);
+        let recovered2 = ShamirSecret::combine(vec![shares2[0].clone(), shares2[1].clone(), shares2[2].clone()]);
+
+        assert!(recovered1.is_some());
+        assert!(recovered2.is_some());
+        assert_eq!(recovered1.unwrap(), secret);
+        assert_eq!(recovered2.unwrap(), secret);
+    }
+
+    #[test]
+    fn test_split_binary_data() {
+        // Test with binary data including null bytes and high values
+        let secret = vec![0x00, 0xFF, 0x80, 0x7F, 0x01, 0xFE, 0x55, 0xAA];
+        let threshold = 3;
+        let total_shares = 5;
+
+        let shares = ShamirSecret::split(&secret, total_shares, threshold).unwrap();
+
+        let recovered = ShamirSecret::combine(vec![shares[0].clone(), shares[1].clone(), shares[2].clone()]);
+        assert!(recovered.is_some());
+        assert_eq!(recovered.unwrap(), secret);
+    }
+
+    #[test]
+    fn test_split_edge_case_thresholds() {
+        let secret = b"edge case test";
+
+        // Test with threshold = total_shares
+        let shares = ShamirSecret::split(secret, 3, 3).unwrap();
+        assert_eq!(shares.len(), 3);
+
+        // Need all shares to recover
+        let recovered = ShamirSecret::combine(vec![shares[0].clone(), shares[1].clone(), shares[2].clone()]);
+        assert!(recovered.is_some());
+        assert_eq!(recovered.unwrap(), secret);
+
+        // With one less share, recovery should fail or give wrong result
+        let recovered = ShamirSecret::combine(vec![shares[0].clone(), shares[1].clone()]);
+        if let Some(recovered_secret) = recovered {
+            assert_ne!(recovered_secret, secret);
+        }
+    }
+
+    #[test]
+    fn test_split_share_uniqueness() {
+        let secret = b"uniqueness test";
+        let threshold = 3;
+        let total_shares = 5;
+
+        let shares = ShamirSecret::split(secret, total_shares, threshold).unwrap();
+
+        // All shares should be unique
+        for i in 0..shares.len() {
+            for j in (i + 1)..shares.len() {
+                assert_ne!(shares[i], shares[j]);
+            }
+        }
+
+        // Share IDs should be unique and in order
+        for (i, share) in shares.iter().enumerate() {
+            assert_eq!(share[share.len() - 1], (i + 1) as u8);
+        }
+    }
 }