Skip to content

Commit 31ba4d5

Browse files
aveenismailaveenismail
committed
Increase coverage of testing with pkcs11-tool
1 parent 2992bbf commit 31ba4d5

File tree

1 file changed

+187
-19
lines changed

1 file changed

+187
-19
lines changed

Diff for: ‎resources/tests/bash/opensc_test.sh

+187-19
Original file line numberDiff line numberDiff line change
@@ -10,27 +10,195 @@ fi
1010
MODULE=$1
1111
#$env:YUBIHSM_PKCS11_CONF=$YHPKCS11CFG
1212

13-
set -e
13+
test () {
14+
set +e
15+
$1 > output.txt 2>&1
16+
ret=$?
17+
if [ $ret -ne 0 ]; then
18+
echo $1
19+
cat output.txt
20+
rm output.txt
21+
exit 1
22+
else
23+
echo "$2 ... OK!"
24+
rm output.txt
25+
fi
26+
set -e
27+
}
1428

15-
echo "******************* Generation Tests ********************* "
16-
pkcs11-tool --module $MODULE --login --pin 0001password --keypairgen --id 1 --key-type EC:secp384r1
17-
pkcs11-tool --module $MODULE --login --pin 0001password --keypairgen --id 2 --key-type EC:prime256v1
18-
pkcs11-tool --module $MODULE --login --pin 0001password --keypairgen --id 4 --key-type rsa:2048 --usage-sign
19-
pkcs11-tool --module $MODULE --login --pin 0001password --keypairgen --id 5 --key-type rsa:3072 --usage-sign
29+
set -e
2030

21-
echo "******************* Signing Tests ********************* "
2231
echo "this is test data" > data.txt
23-
pkcs11-tool --module $MODULE --sign --pin 0001password --id 1 -m ECDSA-SHA1 --signature-format openssl -i data.txt -o data.sig
24-
pkcs11-tool --module $MODULE --sign --pin 0001password --id 2 -m ECDSA-SHA1 --signature-format openssl -i data.txt -o data.sig
25-
pkcs11-tool --module $MODULE --sign --pin 0001password --id 4 -m SHA512-RSA-PKCS -i data.txt -o data.sig
26-
pkcs11-tool --module $MODULE --sign --pin 0001password --id 5 -m SHA512-RSA-PKCS -i data.txt -o data.sig
27-
rm data.txt
28-
rm data.sig
29-
30-
echo "******************* Testing RSA Tests ********************* "
31-
pkcs11-tool --module $MODULE --login --pin 0001password --test
32-
33-
#echo "******************* Testing EC Tests ********************* "
34-
#pkcs11-tool --module $MODULE --login --login-type so --so-pin 0001password --test-ec --id 200 --key-type EC:secp256r1
32+
33+
### Note about pkcs11-tool and object id:
34+
### When generating/importing private keys, and ID has to be specified otherwise, practically a random key will be used
35+
### when, for example, signing. This is because pkcs11-tool, unless a specific ID is set in the command line, it will use
36+
### the first private key it finds to perform the operation. Setting/using a key's label/alias will not have an effect
37+
### because it will not look for a key by label/alias. However, specifying an object to delete by its label/alias seems
38+
### to work just fine.
39+
40+
EC_CURVES=("secp224r1" "secp256r1" "secp384r1" "secp256k1" "brainpoolP256r1" "brainpoolP384r1" "brainpoolP512r1")
41+
#EC_CURVES=("secp224r1" "secp256r1" "secp384r1" "secp521r1" "secp256k1" "brainpoolP256r1" "brainpoolP384r1" "brainpoolP512r1")
42+
43+
for curve in "${EC_CURVES[@]}"; do
44+
# # Generate key
45+
test "pkcs11-tool --module $MODULE --login --pin 0001password --keypairgen --id 1 --key-type EC:$curve" " Generate EC key with curve $curve"
46+
test "pkcs11-tool --module $MODULE --login --pin 0001password --read-object --id 1 --type pubkey --output-file pubkey.der" " Get public key of generated key"
47+
48+
# Sign with generated key
49+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 1 -m ECDSA-SHA1 --signature-format openssl -i data.txt -o data.sig" " Sign with generated key and ECDSA-SHA1"
50+
test "openssl dgst -sha1 -verify pubkey.der -signature data.sig data.txt" " Verify signature with OpenSSL"
51+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 1 -m ECDSA-SHA256 --signature-format openssl -i data.txt -o data.sig" " Sign with generated key and ECDSA-SHA256"
52+
test "openssl dgst -sha256 -verify pubkey.der -signature data.sig data.txt" " Verify signature with OpenSSL"
53+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 1 -m ECDSA-SHA384 --signature-format openssl -i data.txt -o data.sig" " Sign with generated key and ECDSA-SHA384"
54+
test "openssl dgst -sha384 -verify pubkey.der -signature data.sig data.txt" " Verify signature with OpenSSL"
55+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 1 -m ECDSA-SHA512 --signature-format openssl -i data.txt -o data.sig" " Sign with generated key and ECDSA-SHA512"
56+
test "openssl dgst -sha512 -verify pubkey.der -signature data.sig data.txt" " Verify signature with OpenSSL"
57+
58+
# Import key
59+
test "openssl ecparam -genkey -name $curve -noout -out keypair.pem" " Generate keypair with curve $curve using OpenSSL"
60+
test "pkcs11-tool --module $MODULE --login --pin 0001password --write-object keypair.pem --id 2 --type privkey --usage-sign" " Import EC key with curve $curve"
61+
test "pkcs11-tool --module $MODULE --login --pin 0001password --read-object --id 2 --type pubkey --output-file pubkey_imported.der" " Get public key of imported key"
62+
63+
# Sign with imported key
64+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 2 -m ECDSA-SHA1 --signature-format openssl -i data.txt -o data.sig" " Sign with imported key and ECDSA-SHA1"
65+
test "openssl dgst -sha1 -verify pubkey_imported.der -signature data.sig data.txt" " Verify signature with OpenSSL"
66+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 2 -m ECDSA-SHA256 --signature-format openssl -i data.txt -o data.sig" " Sign with imported key and ECDSA-SHA256"
67+
test "openssl dgst -sha256 -verify pubkey_imported.der -signature data.sig data.txt" " Verify signature with OpenSSL"
68+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 2 -m ECDSA-SHA384 --signature-format openssl -i data.txt -o data.sig" " Sign with imported key and ECDSA-SHA384"
69+
test "openssl dgst -sha384 -verify pubkey_imported.der -signature data.sig data.txt" " Verify signature with OpenSSL"
70+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 2 -m ECDSA-SHA512 --signature-format openssl -i data.txt -o data.sig" " Sign with imported key and ECDSA-SHA512"
71+
test "openssl dgst -sha512 -verify pubkey_imported.der -signature data.sig data.txt" " Verify signature with OpenSSL"
72+
73+
# Derive ECDH
74+
test "pkcs11-tool --module $MODULE --login --pin 0001password --derive --id 1 --input-file pubkey_imported.der --output-file ecdh_pkcs11.bin" " Derive ECDH using pkcs11-tool"
75+
test "openssl pkeyutl -derive -inkey keypair.pem -peerkey pubkey.der -out ecdh_openssl.bin" " Derive ECDH using OpenSSL"
76+
test "cmp ecdh_pkcs11.bin ecdh_openssl.bin" " Compare the derived ECDH keys"
77+
test "rm ecdh_pkcs11.bin ecdh_openssl.bin" " Delete ecdh keys"
78+
79+
# Requires writable session? yubihsm-pkcs11 only allowed regular users
80+
#pkcs11-tool --module $MODULE --login --pin 0001password --test-ec --id 200 --key-type EC:secp256r1
81+
82+
# Delete keys
83+
test "pkcs11-tool --module $MODULE --login --pin 0001password --delete-object --id 1 --type privkey" " Delete generated key"
84+
test "pkcs11-tool --module $MODULE --login --pin 0001password --delete-object --id 2 --type privkey" " Delete imported key"
85+
86+
done
87+
88+
RSA_LENGTHS=("2048" "3072" "4096")
89+
90+
test "openssl dgst -sha1 -binary -out data.sha1 data.txt" " Hash data with SHA1 and OpenSSL"
91+
test "openssl dgst -sha256 -binary -out data.sha256 data.txt" " Hash data with SHA256 and OpenSSL"
92+
test "openssl dgst -sha384 -binary -out data.sha384 data.txt" " Hash data with SHA384 and OpenSSL"
93+
test "openssl dgst -sha512 -binary -out data.sha512 data.txt" " Hash data with SHA512 and OpenSSL"
94+
95+
for len in "${RSA_LENGTHS[@]}"; do
96+
# Generate key
97+
test "pkcs11-tool --module $MODULE --login --pin 0001password --keypairgen --id 1 --key-type rsa:$len --usage-sign --usage-decrypt" " Generate RSA$len key"
98+
test "pkcs11-tool --module $MODULE --login --pin 0001password --read-object --id 1 --type pubkey --output-file pubkey.der" " Get public key of generated key"
99+
100+
# Sign with generated key and RSA-PKCS
101+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 1 -m SHA1-RSA-PKCS -i data.txt -o data.sig" " Sign with generated key and SHA1-RSA-PKCS"
102+
test "openssl dgst -sha1 -verify pubkey.der -signature data.sig data.txt" " Verify signature with OpenSSL"
103+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 1 -m SHA256-RSA-PKCS -i data.txt -o data.sig" " Sign with generated key and SHA256-RSA-PKCS"
104+
test "openssl dgst -sha256 -verify pubkey.der -signature data.sig data.txt" " Verify signature with OpenSSL"
105+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 1 -m SHA384-RSA-PKCS -i data.txt -o data.sig" " Sign with generated key and SHA384-RSA-PKCS"
106+
test "openssl dgst -sha384 -verify pubkey.der -signature data.sig data.txt" " Verify signature with OpenSSL"
107+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 1 -m SHA512-RSA-PKCS -i data.txt -o data.sig" " Sign with generated key and SHA512-RSA-PKCS"
108+
test "openssl dgst -sha512 -verify pubkey.der -signature data.sig data.txt" " Verify signature with OpenSSL"
109+
110+
# Sign with generated key and RSA-PSS
111+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 1 -m SHA1-RSA-PKCS-PSS -i data.txt -o data.sig" " Sign with generated key and SHA1-RSA-PKCS-PSS"
112+
test "openssl pkeyutl -verify -in data.sha1 -sigfile data.sig -pkeyopt rsa_padding_mode:pss -pubin -inkey pubkey.der -pkeyopt rsa_pss_saltlen:-1 -pkeyopt digest:sha1" " Verify signature with OpenSSL"
113+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 1 -m SHA256-RSA-PKCS-PSS -i data.txt -o data.sig" " Sign with generated key and SHA256-RSA-PKCS-PSS"
114+
test "openssl pkeyutl -verify -in data.sha256 -sigfile data.sig -pkeyopt rsa_padding_mode:pss -pubin -inkey pubkey.der -pkeyopt rsa_pss_saltlen:-1 -pkeyopt digest:sha256" " Verify signature with OpenSSL"
115+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 1 -m SHA384-RSA-PKCS-PSS -i data.txt -o data.sig" " Sign with generated key and SHA384-RSA-PKCS-PSS"
116+
test "openssl pkeyutl -verify -in data.sha384 -sigfile data.sig -pkeyopt rsa_padding_mode:pss -pubin -inkey pubkey.der -pkeyopt rsa_pss_saltlen:-1 -pkeyopt digest:sha384" " Verify signature with OpenSSL"
117+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 1 -m SHA512-RSA-PKCS-PSS -i data.txt -o data.sig" " Sign with generated key and SHA512-RSA-PKCS-PSS"
118+
test "openssl pkeyutl -verify -in data.sha512 -sigfile data.sig -pkeyopt rsa_padding_mode:pss -pubin -inkey pubkey.der -pkeyopt rsa_pss_saltlen:-1 -pkeyopt digest:sha512" " Verify signature with OpenSSL"
119+
120+
# Decrypt with generated key and PKCS1v15
121+
test "openssl rsautl -encrypt -inkey pubkey.der -pubin -in data.txt -out data.enc" " Encryp with OpenSSL using PKCS1v15"
122+
test "pkcs11-tool --module $MODULE --decrypt --pin 0001password --id 1 -m RSA-PKCS --input-file data.enc --output-file data.dec" " Decrypt using generated key"
123+
test "cmp data.dec data.txt" " Compare decrypted data with plain text data"
124+
test "rm data.enc data.dec" " Delete test data"
125+
126+
# Decrypt with generated key and OAEP
127+
test "openssl pkeyutl -encrypt -pubin -inkey pubkey.der -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha1 -pkeyopt rsa_mgf1_md:sha1 -in data.txt -out data.enc" " Encrypt with OpenSSL using OAEP and SHA1"
128+
test "pkcs11-tool --module $MODULE --decrypt --pin 0001password --id 1 -m RSA-PKCS-OAEP --hash-algorithm=SHA-1 --input-file data.enc --output-file data.dec" " Decrypt using generated key"
129+
test "cmp data.dec data.txt" " Compare decrypted data with plain text data"
130+
test "rm data.enc data.dec" " Delete test data"
131+
test "openssl pkeyutl -encrypt -pubin -inkey pubkey.der -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha256 -in data.txt -out data.enc" " Encrypt with OpenSSL using OAEP and SHA256"
132+
test "pkcs11-tool --module $MODULE --decrypt --pin 0001password --id 1 -m RSA-PKCS-OAEP --hash-algorithm=SHA256 --input-file data.enc --output-file data.dec" " Decrypt using generated key"
133+
test "cmp data.dec data.txt" " Compare decrypted data with plain text data"
134+
test "rm data.enc data.dec" " Delete test data"
135+
test "openssl pkeyutl -encrypt -pubin -inkey pubkey.der -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha384 -pkeyopt rsa_mgf1_md:sha384 -in data.txt -out data.enc" " Encrypt with OpenSSL using OAEP and SHA384"
136+
test "pkcs11-tool --module $MODULE --decrypt --pin 0001password --id 1 -m RSA-PKCS-OAEP --hash-algorithm=SHA384 --input-file data.enc --output-file data.dec" " Decrypt using generated key"
137+
test "cmp data.dec data.txt" " Compare decrypted data with plain text data"
138+
test "rm data.enc data.dec" " Delete test data"
139+
test "openssl pkeyutl -encrypt -pubin -inkey pubkey.der -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha512 -pkeyopt rsa_mgf1_md:sha512 -in data.txt -out data.enc" " Encrypt with OpenSSL using OAEP and SHA512"
140+
test "pkcs11-tool --module $MODULE --decrypt --pin 0001password --id 1 -m RSA-PKCS-OAEP --hash-algorithm=SHA512 --input-file data.enc --output-file data.dec" " Decrypt using generated key"
141+
test "cmp data.dec data.txt" " Compare decrypted data with plain text data"
142+
test "rm data.enc data.dec" " Delete test data"
143+
144+
# Import key
145+
test "openssl genrsa -out keypair.pem $len" " Generate key with OpenSSL"
146+
test "pkcs11-tool --module $MODULE --login --pin 0001password --write-object keypair.pem --id 2 --type privkey --usage-sign --usage-decrypt" " Import RSA$len key"
147+
test "pkcs11-tool --module $MODULE --login --pin 0001password --read-object --id 2 --type pubkey --output-file pubkey_imported.der" " Get public key of imported key"
148+
149+
# Sign with imported key and PKCS
150+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 2 -m SHA1-RSA-PKCS -i data.txt -o data.sig" " Sign with imported key and SHA1-RSA-PKCS"
151+
test "openssl dgst -sha1 -verify pubkey_imported.der -signature data.sig data.txt" " Verify signature with OpenSSL"
152+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 2 -m SHA256-RSA-PKCS -i data.txt -o data.sig" " Sign with imported key and SHA256-RSA-PKCS"
153+
test "openssl dgst -sha256 -verify pubkey_imported.der -signature data.sig data.txt" " Verify signature with OpenSSL"
154+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 2 -m SHA384-RSA-PKCS -i data.txt -o data.sig" " Sign with imported key and SHA384-RSA-PKCS"
155+
test "openssl dgst -sha384 -verify pubkey_imported.der -signature data.sig data.txt" " Verify signature with OpenSSL"
156+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 2 -m SHA512-RSA-PKCS -i data.txt -o data.sig" " Sign with imported key and SHA512-RSA-PKCS"
157+
test "openssl dgst -sha512 -verify pubkey_imported.der -signature data.sig data.txt" " Verify signature with OpenSSL"
158+
159+
# Sign with imported key and RSA-PSS
160+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 2 -m SHA1-RSA-PKCS-PSS -i data.txt -o data.sig" " Sign with imported key and SHA1-RSA-PKCS-PSS"
161+
test "openssl pkeyutl -verify -in data.sha1 -sigfile data.sig -pkeyopt rsa_padding_mode:pss -pubin -inkey pubkey_imported.der -pkeyopt rsa_pss_saltlen:-1 -pkeyopt digest:sha1" " Verify signature with OpenSSL"
162+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 2 -m SHA256-RSA-PKCS-PSS -i data.txt -o data.sig" " Sign with imported key and SHA256-RSA-PKCS-PSS"
163+
test "openssl pkeyutl -verify -in data.sha256 -sigfile data.sig -pkeyopt rsa_padding_mode:pss -pubin -inkey pubkey_imported.der -pkeyopt rsa_pss_saltlen:-1 -pkeyopt digest:sha256" " Verify signature with OpenSSL"
164+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 2 -m SHA384-RSA-PKCS-PSS -i data.txt -o data.sig" " Sign with imported key and SHA384-RSA-PKCS-PSS"
165+
test "openssl pkeyutl -verify -in data.sha384 -sigfile data.sig -pkeyopt rsa_padding_mode:pss -pubin -inkey pubkey_imported.der -pkeyopt rsa_pss_saltlen:-1 -pkeyopt digest:sha384" " Verify signature with OpenSSL"
166+
test "pkcs11-tool --module $MODULE --sign --pin 0001password --id 2 -m SHA512-RSA-PKCS-PSS -i data.txt -o data.sig" " Sign with imported key and SHA512-RSA-PKCS-PSS"
167+
test "openssl pkeyutl -verify -in data.sha512 -sigfile data.sig -pkeyopt rsa_padding_mode:pss -pubin -inkey pubkey_imported.der -pkeyopt rsa_pss_saltlen:-1 -pkeyopt digest:sha512" " Verify signature with OpenSSL"
168+
169+
# Decrypt with imported key and PKCS1v15
170+
test "openssl rsautl -encrypt -inkey pubkey_imported.der -pubin -in data.txt -out data.enc" " Encryp with OpenSSL using PKCS1v15"
171+
test "pkcs11-tool --module $MODULE --decrypt --pin 0001password --id 2 -m RSA-PKCS --input-file data.enc --output-file data.dec" " Decrypt using imported key"
172+
test "cmp data.dec data.txt" " Compare decrypted data with plain text data"
173+
test "rm data.enc data.dec" " Delete test data"
174+
175+
# Decrypt with imported key and OAEP
176+
test "openssl pkeyutl -encrypt -pubin -inkey pubkey_imported.der -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha1 -pkeyopt rsa_mgf1_md:sha1 -in data.txt -out data.enc" " Encrypt with OpenSSL using OAEP and SHA1"
177+
test "pkcs11-tool --module $MODULE --decrypt --pin 0001password --id 2 -m RSA-PKCS-OAEP --hash-algorithm=SHA-1 --input-file data.enc --output-file data.dec" " Decrypt using imported key"
178+
test "cmp data.dec data.txt" " Compare decrypted data with plain text data"
179+
test "rm data.enc data.dec" " Delete test data"
180+
test "openssl pkeyutl -encrypt -pubin -inkey pubkey_imported.der -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha256 -in data.txt -out data.enc" " Encrypt with OpenSSL using OAEP and SHA256"
181+
test "pkcs11-tool --module $MODULE --decrypt --pin 0001password --id 2 -m RSA-PKCS-OAEP --hash-algorithm=SHA256 --input-file data.enc --output-file data.dec" " Decrypt using imported key"
182+
test "cmp data.dec data.txt" " Compare decrypted data with plain text data"
183+
test "rm data.enc data.dec" " Delete test data"
184+
test "openssl pkeyutl -encrypt -pubin -inkey pubkey_imported.der -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha384 -pkeyopt rsa_mgf1_md:sha384 -in data.txt -out data.enc" " Encrypt with OpenSSL using OAEP and SHA384"
185+
test "pkcs11-tool --module $MODULE --decrypt --pin 0001password --id 2 -m RSA-PKCS-OAEP --hash-algorithm=SHA384 --input-file data.enc --output-file data.dec" " Decrypt using imported key"
186+
test "cmp data.dec data.txt" " Compare decrypted data with plain text data"
187+
test "rm data.enc data.dec" " Delete test data"
188+
test "openssl pkeyutl -encrypt -pubin -inkey pubkey_imported.der -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha512 -pkeyopt rsa_mgf1_md:sha512 -in data.txt -out data.enc" " Encrypt with OpenSSL using OAEP and SHA512"
189+
test "pkcs11-tool --module $MODULE --decrypt --pin 0001password --id 2 -m RSA-PKCS-OAEP --hash-algorithm=SHA512 --input-file data.enc --output-file data.dec" " Decrypt using imported key"
190+
test "cmp data.dec data.txt" " Compare decrypted data with plain text data"
191+
test "rm data.enc data.dec" " Delete test data"
192+
193+
# Perform pkcs11-tool RSA tests
194+
pkcs11-tool --module $MODULE --login --pin 0001password --test
195+
196+
# Delete keys
197+
test "pkcs11-tool --module $MODULE --login --pin 0001password --delete-object --id 1 --type privkey" " Delete generated key"
198+
test "pkcs11-tool --module $MODULE --login --pin 0001password --delete-object --id 2 --type privkey" " Delete generated key"
199+
done
200+
201+
rm data.sha1 data.sha256 data.sha384 data.sha512 data.sig data.txt
202+
rm keypair.pem pubkey.der pubkey_imported.der
35203

36204
set +e

0 commit comments

Comments
 (0)