src/test-apps/TestAppKeys.cpp - third_party/openweave-core - Git at Google

 /*
  *
  *    Copyright (c) 2016-2017 Nest Labs, Inc.
  *    All rights reserved.
  *
  *    Licensed under the Apache License, Version 2.0 (the "License");
  *    you may not use this file except in compliance with the License.
  *    You may obtain a copy of the License at
  *
  *        http://www.apache.org/licenses/LICENSE-2.0
  *
  *    Unless required by applicable law or agreed to in writing, software
  *    distributed under the License is distributed on an "AS IS" BASIS,
  *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  *    See the License for the specific language governing permissions and
  *    limitations under the License.
  */

 /**
  *    @file
  *      This file implements unit tests for the Weave application keys library.
  *
  */

 #ifndef __STDC_FORMAT_MACROS
 #define __STDC_FORMAT_MACROS
 #endif

 #ifndef __STDC_LIMIT_MACROS
 #define __STDC_LIMIT_MACROS
 #endif

 #include <stdint.h>
 #include <stdio.h>
 #include <nlunit-test.h>
 #include <string.h>
 #include <new>

 #include "ToolCommon.h"
 #include "TestGroupKeyStore.h"
 #include <Weave/Support/ErrorStr.h>
 #include <Weave/Core/WeaveKeyIds.h>
 #include <Weave/Core/WeaveEncoding.h>
 #include <Weave/Profiles/security/WeaveApplicationKeys.h>
 #include <Weave/Profiles/security/WeavePasscodes.h>
 #include <Weave/Support/crypto/WeaveCrypto.h>

 using namespace nl::Weave::Encoding;
 using namespace nl::Weave::Crypto;
 using namespace nl::Weave::Profiles::Security::AppKeys;
 using namespace nl::Weave::Profiles::Security::Passcodes;

 #define DEBUG_PRINT_ENABLE 0

 static void ClearSecretKeyMaterial(WeaveGroupKey& key)
 {
     key.KeyId = WeaveKeyId::kNone;
     key.KeyLen = 0;
     key.StartTime = UINT32_MAX;
     ClearSecretData(key.Key, key.MaxKeySize);
 }

 void DeriveAppRootKey_Test(nlTestSuite *inSuite, void *inContext)
 {
     WEAVE_ERROR err;
     TestGroupKeyStore keyStore;
     WeaveGroupKey rootKey;
     uint32_t keyId;
     uint8_t rootKeyHKDF[kWeaveAppRootKeySize];

     // Derive fabric root key.
     keyId = WeaveKeyId::kFabricRootKey;
     err = keyStore.GetGroupKey(keyId, rootKey);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, rootKey.KeyLen == kWeaveAppRootKeySize);
     NL_TEST_ASSERT(inSuite, rootKey.KeyId == keyId);

 #if DEBUG_PRINT_ENABLE
     printf("Derived fabric root key:\n");
     DumpMemoryCStyle(rootKey.Key, rootKey.KeyLen, "    ", 16);
 #endif

     // Use HKDF function manually to derive fabric root key and compare against result generated by GetGroupKey().
     err = HKDFSHA1::DeriveKey(NULL, 0,
                               sFabricSecret, sFabricSecretLen,
                               NULL, 0,
                               kWeaveAppFabricRootKeyDiversifier, kWeaveAppFabricRootKeyDiversifierSize,
                               rootKeyHKDF, sizeof(rootKeyHKDF), kWeaveAppRootKeySize);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, memcmp(rootKey.Key, rootKeyHKDF, kWeaveAppRootKeySize) == 0);

     // Compare the result against precalculated value.
     NL_TEST_ASSERT(inSuite, memcmp(rootKey.Key, sFabricRootKey, sFabricRootKeyLen) == 0);

     ClearSecretKeyMaterial(rootKey);

     // Derive client root key.
     keyId = WeaveKeyId::kClientRootKey;
     err = keyStore.GetGroupKey(keyId, rootKey);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, rootKey.KeyLen == kWeaveAppRootKeySize);
     NL_TEST_ASSERT(inSuite, rootKey.KeyId == keyId);

 #if DEBUG_PRINT_ENABLE
     printf("Derived client root key:\n");
     DumpMemoryCStyle(rootKey.Key, rootKey.KeyLen, "    ", 16);
 #endif

     // Use HKDF function manually to derive client root key and compare against result generated by GetGroupKey().
     err = HKDFSHA1::DeriveKey(NULL, 0,
                               sFabricSecret, sFabricSecretLen,
                               NULL, 0,
                               kWeaveAppClientRootKeyDiversifier, kWeaveAppClientRootKeyDiversifierSize,
                               rootKeyHKDF, sizeof(rootKeyHKDF), kWeaveAppRootKeySize);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, memcmp(rootKey.Key, rootKeyHKDF, kWeaveAppRootKeySize) == 0);

     // Compare the result against precalculated value.
     NL_TEST_ASSERT(inSuite, memcmp(rootKey.Key, sClientRootKey, sClientRootKeyLen) == 0);

     ClearSecretKeyMaterial(rootKey);

     // Retrieve service root key.
     keyId = WeaveKeyId::kServiceRootKey;
     err = keyStore.GetGroupKey(keyId, rootKey);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, rootKey.KeyLen == kWeaveAppRootKeySize);
     NL_TEST_ASSERT(inSuite, rootKey.KeyId == keyId);
     NL_TEST_ASSERT(inSuite, memcmp(rootKey.Key, sServiceRootKey, sServiceRootKeyLen) == 0);

     ClearSecretKeyMaterial(rootKey);

     // Try to derive invalid root key.
     keyId = sInvalidRootKeyId;
     err = keyStore.GetGroupKey(keyId, rootKey);
     NL_TEST_ASSERT(inSuite, err == WEAVE_ERROR_KEY_NOT_FOUND);
 }

 void DeriveAppIntermediateKey_Test(nlTestSuite *inSuite, void *inContext)
 {
     WEAVE_ERROR err;
     TestGroupKeyStore keyStore;
     WeaveGroupKey intermediateKey;
     uint32_t keyId;

     // Derive intermediate key from fabric root key and epoch key #2.
     keyId = sIntermediateKeyId_FRK_E2;
     err = keyStore.GetGroupKey(keyId, intermediateKey);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

 #if DEBUG_PRINT_ENABLE
     printf("Derived intermediate key using fabric root key and epoch key #2 (FRK_E2):\n");
     DumpMemoryCStyle(intermediateKey.Key, intermediateKey.KeyLen, "    ", 16);
 #endif

     // Compare the result against precalculated value.
     NL_TEST_ASSERT(inSuite, intermediateKey.KeyLen == kWeaveAppIntermediateKeySize);
     NL_TEST_ASSERT(inSuite, intermediateKey.KeyId == keyId);
     NL_TEST_ASSERT(inSuite, memcmp(intermediateKey.Key, sIntermediateKey_FRK_E2, sIntermediateKeyLen_FRK_E2) == 0);

     ClearSecretKeyMaterial(intermediateKey);

     // Derive intermediate key from fabric root key and current epoch key.
     keyId = sIntermediateKeyId_FRK_EC;
     sCurrentUTCTime = sEpochKey2_StartTime + 1;
     err = keyStore.GetGroupKey(keyId, intermediateKey);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

     NL_TEST_ASSERT(inSuite, intermediateKey.KeyLen == kWeaveAppIntermediateKeySize);
     NL_TEST_ASSERT(inSuite, intermediateKey.KeyId == sIntermediateKeyId_FRK_E2);
     NL_TEST_ASSERT(inSuite, memcmp(intermediateKey.Key, sIntermediateKey_FRK_E2, sIntermediateKeyLen_FRK_E2) == 0);
     NL_TEST_ASSERT(inSuite, sLastUsedEpochKeyId == sEpochKey2_KeyId);
     NL_TEST_ASSERT(inSuite, keyStore.TestValue_LastUsedEpochKeyId() == sEpochKey2_KeyId);
     NL_TEST_ASSERT(inSuite, keyStore.TestValue_NextEpochKeyStartTime() == sEpochKey3_StartTime);

     ClearSecretKeyMaterial(intermediateKey);

     // Derive intermediate key from fabric root key and current epoch key, while the time value is not accurate.
     keyId = sIntermediateKeyId_FRK_EC;
     sCurrentUTCTime = 0x0;
     err = keyStore.GetGroupKey(keyId, intermediateKey);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

     NL_TEST_ASSERT(inSuite, intermediateKey.KeyLen == kWeaveAppIntermediateKeySize);
     NL_TEST_ASSERT(inSuite, intermediateKey.KeyId == sIntermediateKeyId_FRK_E2);
     NL_TEST_ASSERT(inSuite, memcmp(intermediateKey.Key, sIntermediateKey_FRK_E2, sIntermediateKeyLen_FRK_E2) == 0);
     NL_TEST_ASSERT(inSuite, keyStore.TestValue_LastUsedEpochKeyId() == sEpochKey2_KeyId);

     ClearSecretKeyMaterial(intermediateKey);
 }

 void DeriveAppStaticKey_Test(nlTestSuite *inSuite, void *inContext)
 {
     WEAVE_ERROR err;
     TestGroupKeyStore keyStore;
     uint8_t appStaticKey[sAppStaticKeyLen_CRK_G10];
     uint32_t keyId;
     uint8_t appStaticKeyHKDF[sAppStaticKeyLen_CRK_G10];
     uint32_t appGroupGlobalId;

     // Derive application static key from client root key and group master key #10.
     keyId = sAppStaticKeyId_CRK_G10;
     err = keyStore.DeriveApplicationKey(keyId, NULL, 0,
                                         sAppStaticKeyDiversifier_CRK_G10, sAppStaticKeyDiversifierLen_CRK_G10,
                                         appStaticKey, sizeof(appStaticKey), sAppStaticKeyLen_CRK_G10, appGroupGlobalId);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, appGroupGlobalId == sAppGroupMasterKey10_GlobalId);

 #if DEBUG_PRINT_ENABLE
     printf("Derived application static key, using client root key and group master key #10 (CRK_G10):\n");
     DumpMemoryCStyle(appStaticKey, sAppStaticKeyLen_CRK_G10, "    ", 16);
 #endif

     // Use HKDF function manually to derive application static key and compare against result generated by DeriveApplicationKey().
     err = HKDFSHA1::DeriveKey(NULL, 0,
                               sClientRootKey, sClientRootKeyLen,
                               sAppGroupMasterKey10_Key, sAppGroupMasterKey10_KeyLen,
                               sAppStaticKeyDiversifier_CRK_G10, sAppStaticKeyDiversifierLen_CRK_G10,
                               appStaticKeyHKDF, sizeof(appStaticKeyHKDF), sAppStaticKeyLen_CRK_G10);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

     NL_TEST_ASSERT(inSuite, memcmp(appStaticKey, appStaticKeyHKDF, sAppStaticKeyLen_CRK_G10) == 0);

     // Compare the result against precalculated value.
     NL_TEST_ASSERT(inSuite, keyId == sAppStaticKeyId_CRK_G10);
     NL_TEST_ASSERT(inSuite, memcmp(appStaticKey, sAppStaticKey_CRK_G10, sAppStaticKeyLen_CRK_G10) == 0);
 }

 void DeriveAppRotatingKey_Test(nlTestSuite *inSuite, void *inContext)
 {
     WEAVE_ERROR err;
     TestGroupKeyStore keyStore;
     uint8_t appRotatingKey[sAppRotatingKeyLen_SRK_E3_G54];
     uint32_t keyId;
     uint8_t intermediateKeyHKDF[kWeaveAppIntermediateKeySize];
     uint8_t appRotatingKeyHKDF[sAppRotatingKeyLen_SRK_E3_G54];
     uint32_t appGroupGlobalId;

     // Derive application rotating key from service root key and group master key #54.
     keyId = sAppRotatingKeyId_SRK_E3_G54;
     err = keyStore.DeriveApplicationKey(keyId, NULL, 0,
                                         sAppRotatingKeyDiversifier_SRK_E3_G54, sAppRotatingKeyDiversifierLen_SRK_E3_G54,
                                         appRotatingKey, sizeof(appRotatingKey), sAppRotatingKeyLen_SRK_E3_G54, appGroupGlobalId);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, appGroupGlobalId == sAppGroupMasterKey54_GlobalId);

 #if DEBUG_PRINT_ENABLE
     printf("Derived application rotating key, using service root key, epoch key #3 and group master key #54 (SRK_E3_G54):\n");
     DumpMemoryCStyle(appRotatingKey, sAppRotatingKeyLen_SRK_E3_G54, "    ", 16);
 #endif

     // Use HKDF function manually to derive application rotating key and compare against result generated by DeriveApplicationKey().
     err = HKDFSHA1::DeriveKey(NULL, 0,
                               sServiceRootKey, sServiceRootKeyLen,
                               sEpochKey3_Key, sEpochKey3_KeyLen,
                               kWeaveAppIntermediateKeyDiversifier, kWeaveAppIntermediateKeyDiversifierSize,
                               intermediateKeyHKDF, sizeof(intermediateKeyHKDF), kWeaveAppIntermediateKeySize);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

     err = HKDFSHA1::DeriveKey(NULL, 0,
                               intermediateKeyHKDF, kWeaveAppIntermediateKeySize,
                               sAppGroupMasterKey54_Key, sAppGroupMasterKey54_KeyLen,
                               sAppRotatingKeyDiversifier_SRK_E3_G54, sAppRotatingKeyDiversifierLen_SRK_E3_G54,
                               appRotatingKeyHKDF, sizeof(appRotatingKeyHKDF), sAppRotatingKeyLen_SRK_E3_G54);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

     NL_TEST_ASSERT(inSuite, memcmp(appRotatingKey, appRotatingKeyHKDF, sAppRotatingKeyLen_SRK_E3_G54) == 0);

     // Compare the result against precalculated value.
     NL_TEST_ASSERT(inSuite, keyId == sAppRotatingKeyId_SRK_E3_G54);
     NL_TEST_ASSERT(inSuite, memcmp(appRotatingKey, sAppRotatingKey_SRK_E3_G54, sAppRotatingKeyLen_SRK_E3_G54) == 0);
 }

 void DerivePasscodeKeys_Test(nlTestSuite *inSuite, void *inContext)
 {
     WEAVE_ERROR err;
     TestGroupKeyStore keyStore;
     uint8_t appKey[sPasscodeEncRotatingKeyLen_CRK_E0_G4];
     uint32_t keyId;
     uint8_t nonce[sPasscodeEncryptionKeyNonceLen];
     uint8_t intermediateKeyHKDF[kWeaveAppIntermediateKeySize];
     uint8_t appKeyHKDF[sPasscodeEncRotatingKeyLen_CRK_E0_G4];
     uint32_t appGroupGlobalId;

     // 1. Derive passcode encryption (and authentication) ROTATING key using client root key, epoch key #0 and group master key #4.
     keyId = sPasscodeEncRotatingKeyId_CRK_E0_G4;
     LittleEndian::Put32(nonce, sPasscodeEncryptionKeyNonce);
     err = keyStore.DeriveApplicationKey(keyId, nonce, sPasscodeEncryptionKeyNonceLen,
                                         sPasscodeEncryptionKeyDiversifier, sPasscodeEncryptionKeyDiversifierLen,
                                         appKey, sizeof(appKey), sPasscodeEncRotatingKeyLen_CRK_E0_G4, appGroupGlobalId);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, keyId == sPasscodeEncRotatingKeyId_CRK_E0_G4);
     NL_TEST_ASSERT(inSuite, memcmp(appKey, sPasscodeEncRotatingKey_CRK_E0_G4, sPasscodeEncRotatingKeyLen_CRK_E0_G4) == 0);
     NL_TEST_ASSERT(inSuite, appGroupGlobalId == sAppGroupMasterKey4_GlobalId);

 #if DEBUG_PRINT_ENABLE
     printf("Derived passcode encryption (and authentication) rotating key using client root key, epoch key #0 and group master key #4 (CRK_E0_G4):\n");
     DumpMemoryCStyle(appKey, sPasscodeEncRotatingKeyLen_CRK_E0_G4, "    ", 16);
 #endif

     // Use HKDF function manually to derive passcode encryption rotating key and compare against result generated by DeriveApplicationKey().
     err = HKDFSHA1::DeriveKey(NULL, 0,
                               sClientRootKey, sClientRootKeyLen,
                               sEpochKey0_Key, sEpochKey0_KeyLen,
                               kWeaveAppIntermediateKeyDiversifier, kWeaveAppIntermediateKeyDiversifierSize,
                               intermediateKeyHKDF, sizeof(intermediateKeyHKDF), kWeaveAppIntermediateKeySize);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

     err = HKDFSHA1::DeriveKey(nonce, sPasscodeEncryptionKeyNonceLen,
                               intermediateKeyHKDF, kWeaveAppIntermediateKeySize,
                               sAppGroupMasterKey4_Key, sAppGroupMasterKey4_KeyLen,
                               sPasscodeEncryptionKeyDiversifier, sPasscodeEncryptionKeyDiversifierLen,
                               appKeyHKDF, sizeof(appKeyHKDF), sPasscodeEncRotatingKeyLen_CRK_E0_G4);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, memcmp(appKey, appKeyHKDF, sPasscodeEncRotatingKeyLen_CRK_E0_G4) == 0);


     // 2. Derive passcode encryption (and authentication) STATIC key using client root key and group master key #4.
     keyId = sPasscodeEncStaticKeyId_CRK_G4;
     LittleEndian::Put32(nonce, sPasscodeEncryptionKeyNonce);
     err = keyStore.DeriveApplicationKey(keyId, nonce, sPasscodeEncryptionKeyNonceLen,
                                         sPasscodeEncryptionKeyDiversifier, sPasscodeEncryptionKeyDiversifierLen,
                                         appKey, sizeof(appKey), sPasscodeEncStaticKeyLen_CRK_G4, appGroupGlobalId);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, keyId == sPasscodeEncStaticKeyId_CRK_G4);
     NL_TEST_ASSERT(inSuite, memcmp(appKey, sPasscodeEncStaticKey_CRK_G4, sPasscodeEncStaticKeyLen_CRK_G4) == 0);
     NL_TEST_ASSERT(inSuite, appGroupGlobalId == sAppGroupMasterKey4_GlobalId);

 #if DEBUG_PRINT_ENABLE
     printf("Derived passcode encryption (and authentication) static key using client root key and group master key #4 (CRK_G4):\n");
     DumpMemoryCStyle(appKey, sPasscodeEncStaticKeyLen_CRK_G4, "    ", 16);
 #endif

     // Use HKDF function manually to derive passcode encryption static key and compare against result generated by DeriveApplicationKey().
     err = HKDFSHA1::DeriveKey(nonce, sPasscodeEncryptionKeyNonceLen,
                               sClientRootKey, sClientRootKeyLen,
                               sAppGroupMasterKey4_Key, sAppGroupMasterKey4_KeyLen,
                               sPasscodeEncryptionKeyDiversifier, sPasscodeEncryptionKeyDiversifierLen,
                               appKeyHKDF, sizeof(appKeyHKDF), sPasscodeEncRotatingKeyLen_CRK_E0_G4);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, memcmp(appKey, appKeyHKDF, sPasscodeEncStaticKeyLen_CRK_G4) == 0);


     // 3. Derive passcode fingerprint (always static) key using client root key and group master key #4.
     keyId = sPasscodeFingerprintKeyId_CRK_G4;
     err = keyStore.DeriveApplicationKey(keyId, NULL, 0,
                                         kPasscodeFingerprintKeyDiversifier, kPasscodeFingerprintKeyDiversifierSize,
                                         appKey, sizeof(appKey), sPasscodeFingerprintKeyLen_CRK_G4, appGroupGlobalId);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, keyId == sPasscodeFingerprintKeyId_CRK_G4);
     NL_TEST_ASSERT(inSuite, memcmp(appKey, sPasscodeFingerprintKey_CRK_G4, sPasscodeFingerprintKeyLen_CRK_G4) == 0);
     NL_TEST_ASSERT(inSuite, appGroupGlobalId == sAppGroupMasterKey4_GlobalId);

 #if DEBUG_PRINT_ENABLE
     printf("Derived passcode fingerprint key using client root key and group master key #4 (CRK_G4):\n");
     DumpMemoryCStyle(appKey, sPasscodeFingerprintKeyLen_CRK_G4, "    ", 16);
 #endif

     // Use HKDF function manually to derive passcode encryption static key and compare against result generated by DeriveApplicationKey().
     err = HKDFSHA1::DeriveKey(NULL, 0,
                               sClientRootKey, sClientRootKeyLen,
                               sAppGroupMasterKey4_Key, sAppGroupMasterKey4_KeyLen,
                               kPasscodeFingerprintKeyDiversifier, kPasscodeFingerprintKeyDiversifierSize,
                               appKeyHKDF, sizeof(appKeyHKDF), sPasscodeFingerprintKeyLen_CRK_G4);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, memcmp(appKey, appKeyHKDF, sPasscodeFingerprintKeyLen_CRK_G4) == 0);
 }

 void GetAppGroupMasterKeyId_Test(nlTestSuite *inSuite, void *inContext)
 {
     WEAVE_ERROR err;
     TestGroupKeyStore keyStore;
     uint32_t groupGlobalId;
     uint32_t groupMasterKeyId;

     // Get application group key Id given group global Id - for the app group #0.
     groupGlobalId = sAppGroupMasterKey0_GlobalId;
     err = GetAppGroupMasterKeyId(groupGlobalId, &keyStore, groupMasterKeyId);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, groupMasterKeyId == sAppGroupMasterKey0_KeyId);

     groupMasterKeyId = WeaveKeyId::kNone;
     groupGlobalId = 0;

     // Get application group key Id given group global Id - for the app group #4.
     groupGlobalId = sAppGroupMasterKey4_GlobalId;
     err = GetAppGroupMasterKeyId(groupGlobalId, &keyStore, groupMasterKeyId);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, groupMasterKeyId == sAppGroupMasterKey4_KeyId);

     groupMasterKeyId = WeaveKeyId::kNone;
     groupGlobalId = 0;

     // Get application group key Id given group global Id - for the app group #10.
     groupGlobalId = sAppGroupMasterKey10_GlobalId;
     err = GetAppGroupMasterKeyId(groupGlobalId, &keyStore, groupMasterKeyId);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, groupMasterKeyId == sAppGroupMasterKey10_KeyId);

     groupMasterKeyId = WeaveKeyId::kNone;
     groupGlobalId = 0;

     // Get application group key Id given group global Id - for the app group #54.
     groupGlobalId = sAppGroupMasterKey54_GlobalId;
     err = GetAppGroupMasterKeyId(groupGlobalId, &keyStore, groupMasterKeyId);
     NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
     NL_TEST_ASSERT(inSuite, groupMasterKeyId == sAppGroupMasterKey54_KeyId);
 }


 int main(int argc, char *argv[])
 {
     static const nlTest tests[] = {
         NL_TEST_DEF("DeriveAppRootKey",                 DeriveAppRootKey_Test),
         NL_TEST_DEF("DeriveAppIntermediateKey",         DeriveAppIntermediateKey_Test),
         NL_TEST_DEF("DeriveAppStaticKey",               DeriveAppStaticKey_Test),
         NL_TEST_DEF("DeriveAppRotatingKey",             DeriveAppRotatingKey_Test),
         NL_TEST_DEF("DerivePasscodeKeys",               DerivePasscodeKeys_Test),
         NL_TEST_DEF("GetAppGroupMasterKeyId",           GetAppGroupMasterKeyId_Test),
         NL_TEST_SENTINEL()
     };

     static nlTestSuite testSuite = {
         "application-keys",
         &tests[0]
     };

     nl_test_set_output_style(OUTPUT_CSV);

     nlTestRunner(&testSuite, NULL);

     return nlTestRunnerStats(&testSuite);
 }
	/*
	*
	* Copyright (c) 2016-2017 Nest Labs, Inc.
	* All rights reserved.
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	/**
	* @file
	* This file implements unit tests for the Weave application keys library.
	*
	*/

	#ifndef __STDC_FORMAT_MACROS
	#define __STDC_FORMAT_MACROS
	#endif

	#ifndef __STDC_LIMIT_MACROS
	#define __STDC_LIMIT_MACROS
	#endif

	#include <stdint.h>
	#include <stdio.h>
	#include <nlunit-test.h>
	#include <string.h>
	#include <new>

	#include "ToolCommon.h"
	#include "TestGroupKeyStore.h"
	#include <Weave/Support/ErrorStr.h>
	#include <Weave/Core/WeaveKeyIds.h>
	#include <Weave/Core/WeaveEncoding.h>
	#include <Weave/Profiles/security/WeaveApplicationKeys.h>
	#include <Weave/Profiles/security/WeavePasscodes.h>
	#include <Weave/Support/crypto/WeaveCrypto.h>

	using namespace nl::Weave::Encoding;
	using namespace nl::Weave::Crypto;
	using namespace nl::Weave::Profiles::Security::AppKeys;
	using namespace nl::Weave::Profiles::Security::Passcodes;

	#define DEBUG_PRINT_ENABLE 0

	static void ClearSecretKeyMaterial(WeaveGroupKey& key)
	{
	key.KeyId = WeaveKeyId::kNone;
	key.KeyLen = 0;
	key.StartTime = UINT32_MAX;
	ClearSecretData(key.Key, key.MaxKeySize);
	}

	void DeriveAppRootKey_Test(nlTestSuite inSuite, void inContext)
	{
	WEAVE_ERROR err;
	TestGroupKeyStore keyStore;
	WeaveGroupKey rootKey;
	uint32_t keyId;
	uint8_t rootKeyHKDF[kWeaveAppRootKeySize];

	// Derive fabric root key.
	keyId = WeaveKeyId::kFabricRootKey;
	err = keyStore.GetGroupKey(keyId, rootKey);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, rootKey.KeyLen == kWeaveAppRootKeySize);
	NL_TEST_ASSERT(inSuite, rootKey.KeyId == keyId);

	#if DEBUG_PRINT_ENABLE
	printf("Derived fabric root key:\n");
	DumpMemoryCStyle(rootKey.Key, rootKey.KeyLen, " ", 16);
	#endif

	// Use HKDF function manually to derive fabric root key and compare against result generated by GetGroupKey().
	err = HKDFSHA1::DeriveKey(NULL, 0,
	sFabricSecret, sFabricSecretLen,
	NULL, 0,
	kWeaveAppFabricRootKeyDiversifier, kWeaveAppFabricRootKeyDiversifierSize,
	rootKeyHKDF, sizeof(rootKeyHKDF), kWeaveAppRootKeySize);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, memcmp(rootKey.Key, rootKeyHKDF, kWeaveAppRootKeySize) == 0);

	// Compare the result against precalculated value.
	NL_TEST_ASSERT(inSuite, memcmp(rootKey.Key, sFabricRootKey, sFabricRootKeyLen) == 0);

	ClearSecretKeyMaterial(rootKey);

	// Derive client root key.
	keyId = WeaveKeyId::kClientRootKey;
	err = keyStore.GetGroupKey(keyId, rootKey);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, rootKey.KeyLen == kWeaveAppRootKeySize);
	NL_TEST_ASSERT(inSuite, rootKey.KeyId == keyId);

	#if DEBUG_PRINT_ENABLE
	printf("Derived client root key:\n");
	DumpMemoryCStyle(rootKey.Key, rootKey.KeyLen, " ", 16);
	#endif

	// Use HKDF function manually to derive client root key and compare against result generated by GetGroupKey().
	err = HKDFSHA1::DeriveKey(NULL, 0,
	sFabricSecret, sFabricSecretLen,
	NULL, 0,
	kWeaveAppClientRootKeyDiversifier, kWeaveAppClientRootKeyDiversifierSize,
	rootKeyHKDF, sizeof(rootKeyHKDF), kWeaveAppRootKeySize);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, memcmp(rootKey.Key, rootKeyHKDF, kWeaveAppRootKeySize) == 0);

	// Compare the result against precalculated value.
	NL_TEST_ASSERT(inSuite, memcmp(rootKey.Key, sClientRootKey, sClientRootKeyLen) == 0);

	ClearSecretKeyMaterial(rootKey);

	// Retrieve service root key.
	keyId = WeaveKeyId::kServiceRootKey;
	err = keyStore.GetGroupKey(keyId, rootKey);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, rootKey.KeyLen == kWeaveAppRootKeySize);
	NL_TEST_ASSERT(inSuite, rootKey.KeyId == keyId);
	NL_TEST_ASSERT(inSuite, memcmp(rootKey.Key, sServiceRootKey, sServiceRootKeyLen) == 0);

	ClearSecretKeyMaterial(rootKey);

	// Try to derive invalid root key.
	keyId = sInvalidRootKeyId;
	err = keyStore.GetGroupKey(keyId, rootKey);
	NL_TEST_ASSERT(inSuite, err == WEAVE_ERROR_KEY_NOT_FOUND);
	}

	void DeriveAppIntermediateKey_Test(nlTestSuite inSuite, void inContext)
	{
	WEAVE_ERROR err;
	TestGroupKeyStore keyStore;
	WeaveGroupKey intermediateKey;
	uint32_t keyId;

	// Derive intermediate key from fabric root key and epoch key #2.
	keyId = sIntermediateKeyId_FRK_E2;
	err = keyStore.GetGroupKey(keyId, intermediateKey);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

	#if DEBUG_PRINT_ENABLE
	printf("Derived intermediate key using fabric root key and epoch key #2 (FRK_E2):\n");
	DumpMemoryCStyle(intermediateKey.Key, intermediateKey.KeyLen, " ", 16);
	#endif

	// Compare the result against precalculated value.
	NL_TEST_ASSERT(inSuite, intermediateKey.KeyLen == kWeaveAppIntermediateKeySize);
	NL_TEST_ASSERT(inSuite, intermediateKey.KeyId == keyId);
	NL_TEST_ASSERT(inSuite, memcmp(intermediateKey.Key, sIntermediateKey_FRK_E2, sIntermediateKeyLen_FRK_E2) == 0);

	ClearSecretKeyMaterial(intermediateKey);

	// Derive intermediate key from fabric root key and current epoch key.
	keyId = sIntermediateKeyId_FRK_EC;
	sCurrentUTCTime = sEpochKey2_StartTime + 1;
	err = keyStore.GetGroupKey(keyId, intermediateKey);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

	NL_TEST_ASSERT(inSuite, intermediateKey.KeyLen == kWeaveAppIntermediateKeySize);
	NL_TEST_ASSERT(inSuite, intermediateKey.KeyId == sIntermediateKeyId_FRK_E2);
	NL_TEST_ASSERT(inSuite, memcmp(intermediateKey.Key, sIntermediateKey_FRK_E2, sIntermediateKeyLen_FRK_E2) == 0);
	NL_TEST_ASSERT(inSuite, sLastUsedEpochKeyId == sEpochKey2_KeyId);
	NL_TEST_ASSERT(inSuite, keyStore.TestValue_LastUsedEpochKeyId() == sEpochKey2_KeyId);
	NL_TEST_ASSERT(inSuite, keyStore.TestValue_NextEpochKeyStartTime() == sEpochKey3_StartTime);

	ClearSecretKeyMaterial(intermediateKey);

	// Derive intermediate key from fabric root key and current epoch key, while the time value is not accurate.
	keyId = sIntermediateKeyId_FRK_EC;
	sCurrentUTCTime = 0x0;
	err = keyStore.GetGroupKey(keyId, intermediateKey);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

	NL_TEST_ASSERT(inSuite, intermediateKey.KeyLen == kWeaveAppIntermediateKeySize);
	NL_TEST_ASSERT(inSuite, intermediateKey.KeyId == sIntermediateKeyId_FRK_E2);
	NL_TEST_ASSERT(inSuite, memcmp(intermediateKey.Key, sIntermediateKey_FRK_E2, sIntermediateKeyLen_FRK_E2) == 0);
	NL_TEST_ASSERT(inSuite, keyStore.TestValue_LastUsedEpochKeyId() == sEpochKey2_KeyId);

	ClearSecretKeyMaterial(intermediateKey);
	}

	void DeriveAppStaticKey_Test(nlTestSuite inSuite, void inContext)
	{
	WEAVE_ERROR err;
	TestGroupKeyStore keyStore;
	uint8_t appStaticKey[sAppStaticKeyLen_CRK_G10];
	uint32_t keyId;
	uint8_t appStaticKeyHKDF[sAppStaticKeyLen_CRK_G10];
	uint32_t appGroupGlobalId;

	// Derive application static key from client root key and group master key #10.
	keyId = sAppStaticKeyId_CRK_G10;
	err = keyStore.DeriveApplicationKey(keyId, NULL, 0,
	sAppStaticKeyDiversifier_CRK_G10, sAppStaticKeyDiversifierLen_CRK_G10,
	appStaticKey, sizeof(appStaticKey), sAppStaticKeyLen_CRK_G10, appGroupGlobalId);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, appGroupGlobalId == sAppGroupMasterKey10_GlobalId);

	#if DEBUG_PRINT_ENABLE
	printf("Derived application static key, using client root key and group master key #10 (CRK_G10):\n");
	DumpMemoryCStyle(appStaticKey, sAppStaticKeyLen_CRK_G10, " ", 16);
	#endif

	// Use HKDF function manually to derive application static key and compare against result generated by DeriveApplicationKey().
	err = HKDFSHA1::DeriveKey(NULL, 0,
	sClientRootKey, sClientRootKeyLen,
	sAppGroupMasterKey10_Key, sAppGroupMasterKey10_KeyLen,
	sAppStaticKeyDiversifier_CRK_G10, sAppStaticKeyDiversifierLen_CRK_G10,
	appStaticKeyHKDF, sizeof(appStaticKeyHKDF), sAppStaticKeyLen_CRK_G10);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

	NL_TEST_ASSERT(inSuite, memcmp(appStaticKey, appStaticKeyHKDF, sAppStaticKeyLen_CRK_G10) == 0);

	// Compare the result against precalculated value.
	NL_TEST_ASSERT(inSuite, keyId == sAppStaticKeyId_CRK_G10);
	NL_TEST_ASSERT(inSuite, memcmp(appStaticKey, sAppStaticKey_CRK_G10, sAppStaticKeyLen_CRK_G10) == 0);
	}

	void DeriveAppRotatingKey_Test(nlTestSuite inSuite, void inContext)
	{
	WEAVE_ERROR err;
	TestGroupKeyStore keyStore;
	uint8_t appRotatingKey[sAppRotatingKeyLen_SRK_E3_G54];
	uint32_t keyId;
	uint8_t intermediateKeyHKDF[kWeaveAppIntermediateKeySize];
	uint8_t appRotatingKeyHKDF[sAppRotatingKeyLen_SRK_E3_G54];
	uint32_t appGroupGlobalId;

	// Derive application rotating key from service root key and group master key #54.
	keyId = sAppRotatingKeyId_SRK_E3_G54;
	err = keyStore.DeriveApplicationKey(keyId, NULL, 0,
	sAppRotatingKeyDiversifier_SRK_E3_G54, sAppRotatingKeyDiversifierLen_SRK_E3_G54,
	appRotatingKey, sizeof(appRotatingKey), sAppRotatingKeyLen_SRK_E3_G54, appGroupGlobalId);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, appGroupGlobalId == sAppGroupMasterKey54_GlobalId);

	#if DEBUG_PRINT_ENABLE
	printf("Derived application rotating key, using service root key, epoch key #3 and group master key #54 (SRK_E3_G54):\n");
	DumpMemoryCStyle(appRotatingKey, sAppRotatingKeyLen_SRK_E3_G54, " ", 16);
	#endif

	// Use HKDF function manually to derive application rotating key and compare against result generated by DeriveApplicationKey().
	err = HKDFSHA1::DeriveKey(NULL, 0,
	sServiceRootKey, sServiceRootKeyLen,
	sEpochKey3_Key, sEpochKey3_KeyLen,
	kWeaveAppIntermediateKeyDiversifier, kWeaveAppIntermediateKeyDiversifierSize,
	intermediateKeyHKDF, sizeof(intermediateKeyHKDF), kWeaveAppIntermediateKeySize);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

	err = HKDFSHA1::DeriveKey(NULL, 0,
	intermediateKeyHKDF, kWeaveAppIntermediateKeySize,
	sAppGroupMasterKey54_Key, sAppGroupMasterKey54_KeyLen,
	sAppRotatingKeyDiversifier_SRK_E3_G54, sAppRotatingKeyDiversifierLen_SRK_E3_G54,
	appRotatingKeyHKDF, sizeof(appRotatingKeyHKDF), sAppRotatingKeyLen_SRK_E3_G54);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

	NL_TEST_ASSERT(inSuite, memcmp(appRotatingKey, appRotatingKeyHKDF, sAppRotatingKeyLen_SRK_E3_G54) == 0);

	// Compare the result against precalculated value.
	NL_TEST_ASSERT(inSuite, keyId == sAppRotatingKeyId_SRK_E3_G54);
	NL_TEST_ASSERT(inSuite, memcmp(appRotatingKey, sAppRotatingKey_SRK_E3_G54, sAppRotatingKeyLen_SRK_E3_G54) == 0);
	}

	void DerivePasscodeKeys_Test(nlTestSuite inSuite, void inContext)
	{
	WEAVE_ERROR err;
	TestGroupKeyStore keyStore;
	uint8_t appKey[sPasscodeEncRotatingKeyLen_CRK_E0_G4];
	uint32_t keyId;
	uint8_t nonce[sPasscodeEncryptionKeyNonceLen];
	uint8_t intermediateKeyHKDF[kWeaveAppIntermediateKeySize];
	uint8_t appKeyHKDF[sPasscodeEncRotatingKeyLen_CRK_E0_G4];
	uint32_t appGroupGlobalId;

	// 1. Derive passcode encryption (and authentication) ROTATING key using client root key, epoch key #0 and group master key #4.
	keyId = sPasscodeEncRotatingKeyId_CRK_E0_G4;
	LittleEndian::Put32(nonce, sPasscodeEncryptionKeyNonce);
	err = keyStore.DeriveApplicationKey(keyId, nonce, sPasscodeEncryptionKeyNonceLen,
	sPasscodeEncryptionKeyDiversifier, sPasscodeEncryptionKeyDiversifierLen,
	appKey, sizeof(appKey), sPasscodeEncRotatingKeyLen_CRK_E0_G4, appGroupGlobalId);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, keyId == sPasscodeEncRotatingKeyId_CRK_E0_G4);
	NL_TEST_ASSERT(inSuite, memcmp(appKey, sPasscodeEncRotatingKey_CRK_E0_G4, sPasscodeEncRotatingKeyLen_CRK_E0_G4) == 0);
	NL_TEST_ASSERT(inSuite, appGroupGlobalId == sAppGroupMasterKey4_GlobalId);

	#if DEBUG_PRINT_ENABLE
	printf("Derived passcode encryption (and authentication) rotating key using client root key, epoch key #0 and group master key #4 (CRK_E0_G4):\n");
	DumpMemoryCStyle(appKey, sPasscodeEncRotatingKeyLen_CRK_E0_G4, " ", 16);
	#endif

	// Use HKDF function manually to derive passcode encryption rotating key and compare against result generated by DeriveApplicationKey().
	err = HKDFSHA1::DeriveKey(NULL, 0,
	sClientRootKey, sClientRootKeyLen,
	sEpochKey0_Key, sEpochKey0_KeyLen,
	kWeaveAppIntermediateKeyDiversifier, kWeaveAppIntermediateKeyDiversifierSize,
	intermediateKeyHKDF, sizeof(intermediateKeyHKDF), kWeaveAppIntermediateKeySize);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);

	err = HKDFSHA1::DeriveKey(nonce, sPasscodeEncryptionKeyNonceLen,
	intermediateKeyHKDF, kWeaveAppIntermediateKeySize,
	sAppGroupMasterKey4_Key, sAppGroupMasterKey4_KeyLen,
	sPasscodeEncryptionKeyDiversifier, sPasscodeEncryptionKeyDiversifierLen,
	appKeyHKDF, sizeof(appKeyHKDF), sPasscodeEncRotatingKeyLen_CRK_E0_G4);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, memcmp(appKey, appKeyHKDF, sPasscodeEncRotatingKeyLen_CRK_E0_G4) == 0);


	// 2. Derive passcode encryption (and authentication) STATIC key using client root key and group master key #4.
	keyId = sPasscodeEncStaticKeyId_CRK_G4;
	LittleEndian::Put32(nonce, sPasscodeEncryptionKeyNonce);
	err = keyStore.DeriveApplicationKey(keyId, nonce, sPasscodeEncryptionKeyNonceLen,
	sPasscodeEncryptionKeyDiversifier, sPasscodeEncryptionKeyDiversifierLen,
	appKey, sizeof(appKey), sPasscodeEncStaticKeyLen_CRK_G4, appGroupGlobalId);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, keyId == sPasscodeEncStaticKeyId_CRK_G4);
	NL_TEST_ASSERT(inSuite, memcmp(appKey, sPasscodeEncStaticKey_CRK_G4, sPasscodeEncStaticKeyLen_CRK_G4) == 0);
	NL_TEST_ASSERT(inSuite, appGroupGlobalId == sAppGroupMasterKey4_GlobalId);

	#if DEBUG_PRINT_ENABLE
	printf("Derived passcode encryption (and authentication) static key using client root key and group master key #4 (CRK_G4):\n");
	DumpMemoryCStyle(appKey, sPasscodeEncStaticKeyLen_CRK_G4, " ", 16);
	#endif

	// Use HKDF function manually to derive passcode encryption static key and compare against result generated by DeriveApplicationKey().
	err = HKDFSHA1::DeriveKey(nonce, sPasscodeEncryptionKeyNonceLen,
	sClientRootKey, sClientRootKeyLen,
	sAppGroupMasterKey4_Key, sAppGroupMasterKey4_KeyLen,
	sPasscodeEncryptionKeyDiversifier, sPasscodeEncryptionKeyDiversifierLen,
	appKeyHKDF, sizeof(appKeyHKDF), sPasscodeEncRotatingKeyLen_CRK_E0_G4);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, memcmp(appKey, appKeyHKDF, sPasscodeEncStaticKeyLen_CRK_G4) == 0);


	// 3. Derive passcode fingerprint (always static) key using client root key and group master key #4.
	keyId = sPasscodeFingerprintKeyId_CRK_G4;
	err = keyStore.DeriveApplicationKey(keyId, NULL, 0,
	kPasscodeFingerprintKeyDiversifier, kPasscodeFingerprintKeyDiversifierSize,
	appKey, sizeof(appKey), sPasscodeFingerprintKeyLen_CRK_G4, appGroupGlobalId);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, keyId == sPasscodeFingerprintKeyId_CRK_G4);
	NL_TEST_ASSERT(inSuite, memcmp(appKey, sPasscodeFingerprintKey_CRK_G4, sPasscodeFingerprintKeyLen_CRK_G4) == 0);
	NL_TEST_ASSERT(inSuite, appGroupGlobalId == sAppGroupMasterKey4_GlobalId);

	#if DEBUG_PRINT_ENABLE
	printf("Derived passcode fingerprint key using client root key and group master key #4 (CRK_G4):\n");
	DumpMemoryCStyle(appKey, sPasscodeFingerprintKeyLen_CRK_G4, " ", 16);
	#endif

	// Use HKDF function manually to derive passcode encryption static key and compare against result generated by DeriveApplicationKey().
	err = HKDFSHA1::DeriveKey(NULL, 0,
	sClientRootKey, sClientRootKeyLen,
	sAppGroupMasterKey4_Key, sAppGroupMasterKey4_KeyLen,
	kPasscodeFingerprintKeyDiversifier, kPasscodeFingerprintKeyDiversifierSize,
	appKeyHKDF, sizeof(appKeyHKDF), sPasscodeFingerprintKeyLen_CRK_G4);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, memcmp(appKey, appKeyHKDF, sPasscodeFingerprintKeyLen_CRK_G4) == 0);
	}

	void GetAppGroupMasterKeyId_Test(nlTestSuite inSuite, void inContext)
	{
	WEAVE_ERROR err;
	TestGroupKeyStore keyStore;
	uint32_t groupGlobalId;
	uint32_t groupMasterKeyId;

	// Get application group key Id given group global Id - for the app group #0.
	groupGlobalId = sAppGroupMasterKey0_GlobalId;
	err = GetAppGroupMasterKeyId(groupGlobalId, &keyStore, groupMasterKeyId);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, groupMasterKeyId == sAppGroupMasterKey0_KeyId);

	groupMasterKeyId = WeaveKeyId::kNone;
	groupGlobalId = 0;

	// Get application group key Id given group global Id - for the app group #4.
	groupGlobalId = sAppGroupMasterKey4_GlobalId;
	err = GetAppGroupMasterKeyId(groupGlobalId, &keyStore, groupMasterKeyId);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, groupMasterKeyId == sAppGroupMasterKey4_KeyId);

	groupMasterKeyId = WeaveKeyId::kNone;
	groupGlobalId = 0;

	// Get application group key Id given group global Id - for the app group #10.
	groupGlobalId = sAppGroupMasterKey10_GlobalId;
	err = GetAppGroupMasterKeyId(groupGlobalId, &keyStore, groupMasterKeyId);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, groupMasterKeyId == sAppGroupMasterKey10_KeyId);

	groupMasterKeyId = WeaveKeyId::kNone;
	groupGlobalId = 0;

	// Get application group key Id given group global Id - for the app group #54.
	groupGlobalId = sAppGroupMasterKey54_GlobalId;
	err = GetAppGroupMasterKeyId(groupGlobalId, &keyStore, groupMasterKeyId);
	NL_TEST_ASSERT(inSuite, err == WEAVE_NO_ERROR);
	NL_TEST_ASSERT(inSuite, groupMasterKeyId == sAppGroupMasterKey54_KeyId);
	}


	int main(int argc, char *argv[])
	{
	static const nlTest tests[] = {
	NL_TEST_DEF("DeriveAppRootKey", DeriveAppRootKey_Test),
	NL_TEST_DEF("DeriveAppIntermediateKey", DeriveAppIntermediateKey_Test),
	NL_TEST_DEF("DeriveAppStaticKey", DeriveAppStaticKey_Test),
	NL_TEST_DEF("DeriveAppRotatingKey", DeriveAppRotatingKey_Test),
	NL_TEST_DEF("DerivePasscodeKeys", DerivePasscodeKeys_Test),
	NL_TEST_DEF("GetAppGroupMasterKeyId", GetAppGroupMasterKeyId_Test),
	NL_TEST_SENTINEL()
	};

	static nlTestSuite testSuite = {
	"application-keys",
	&tests[0]
	};

	nl_test_set_output_style(OUTPUT_CSV);

	nlTestRunner(&testSuite, NULL);

	return nlTestRunnerStats(&testSuite);
	}