[Cryptech-Commits] [sw/pkcs11] branch ecdsa updated: More key unit tests.
git at cryptech.is
git at cryptech.is
Tue Sep 22 03:24:42 UTC 2015
This is an automated email from the git hooks/post-receive script.
sra at hactrn.net pushed a commit to branch ecdsa
in repository sw/pkcs11.
The following commit(s) were added to refs/heads/ecdsa by this push:
new 95474a8 More key unit tests.
95474a8 is described below
commit 95474a873859bb8a0991ef3973f0340f30025ce2
Author: Rob Austein <sra at hactrn.net>
Date: Mon Sep 21 23:22:33 2015 -0400
More key unit tests.
---
py11/__init__.py | 45 ++++++++++++++++------
unit_tests.py | 111 ++++++++++++++++++++++++++++++++++++++++++++++++++-----
2 files changed, 135 insertions(+), 21 deletions(-)
diff --git a/py11/__init__.py b/py11/__init__.py
index 9d3837e..80495d9 100644
--- a/py11/__init__.py
+++ b/py11/__init__.py
@@ -119,14 +119,19 @@ class PKCS11 (object):
def C_Login(self, session, user, pin):
self.so.C_Login(session, user, pin, len(pin))
- def C_GetAttributeValue(self, session_handle, object_handle, attributes):
+ def C_GetAttributeValue(self, session_handle, object_handle, *attributes):
+ if len(attributes) == 1 and isinstance(attributes[0], (list, tuple)):
+ attributes = attributes[0]
template = self.adb.getvalue_create_template(attributes)
self.so.C_GetAttributeValue(session_handle, object_handle, template, len(template))
self.adb.getvalue_allocate_template(template)
self.so.C_GetAttributeValue(session_handle, object_handle, template, len(template))
return self.adb.from_ctypes(template)
- def C_FindObjectsInit(self, session, template):
+ def C_FindObjectsInit(self, session, template = None, **kwargs):
+ if kwargs:
+ assert not template
+ template = kwargs
if template:
self.so.C_FindObjectsInit(session, self.adb.to_ctypes(template), len(template))
else:
@@ -140,6 +145,12 @@ class PKCS11 (object):
for i in xrange(count.value):
yield objects[i]
+ def Find(self, session, template = None, **kwargs):
+ self.C_FindObjectsInit(session, template, **kwargs)
+ for obj in self.C_FindObjects(session):
+ yield obj
+ self.C_FindObjectsFinal(session)
+
def _parse_GenerateKeyPair_template(self,
# Attributes common to public and private templates
CKA_ID,
@@ -159,19 +170,26 @@ class PKCS11 (object):
**kwargs):
if CKA_LABEL is None:
CKA_LABEL = CKA_ID
- public = dict(kwargs, CKA_LABEL = CKA_LABEL, CKA_ID = CKA_ID, CKA_TOKEN = public_CKA_TOKEN or CKA_TOKEN)
- private = dict(CKA_LABEL = CKA_LABEL, CKA_ID = CKA_ID, CKA_TOKEN = private_CKA_TOKEN or CKA_TOKEN,
- CKA_SIGN = CKA_SIGN, CKA_DECRYPT = CKA_DECRYPT, CKA_UNWRAP = CKA_UNWRAP,
- CKA_SENSITIVE = CKA_SENSITIVE, CKA_PRIVATE = CKA_PRIVATE, CKA_EXTRACTABLE = CKA_EXTRACTABLE)
- return self.adb.to_ctypes(public), self.adb.to_ctypes(private)
+ return (dict(kwargs,
+ CKA_LABEL = CKA_LABEL,
+ CKA_ID = CKA_ID,
+ CKA_TOKEN = public_CKA_TOKEN or CKA_TOKEN),
+ dict(CKA_LABEL = CKA_LABEL,
+ CKA_ID = CKA_ID,
+ CKA_TOKEN = private_CKA_TOKEN or CKA_TOKEN,
+ CKA_SIGN = CKA_SIGN,
+ CKA_DECRYPT = CKA_DECRYPT,
+ CKA_UNWRAP = CKA_UNWRAP,
+ CKA_SENSITIVE = CKA_SENSITIVE,
+ CKA_PRIVATE = CKA_PRIVATE,
+ CKA_EXTRACTABLE = CKA_EXTRACTABLE))
def C_GenerateKeyPair(self, session, mechanism_type, public_template = None, private_template = None, **kwargs):
- assert kwargs or (public_template and private_template)
if kwargs:
+ assert not public_template and not private_template
public_template, private_template = self._parse_GenerateKeyPair_template(**kwargs)
- else:
- public_template = self.adb.to_ctypes(public_template)
- private_template = self.adb.to_ctypes(private_template)
+ public_template = self.adb.to_ctypes(public_template)
+ private_template = self.adb.to_ctypes(private_template)
mechanism = CK_MECHANISM(mechanism_type, None, 0)
public_handle = CK_OBJECT_HANDLE()
private_handle = CK_OBJECT_HANDLE()
@@ -215,7 +233,10 @@ class PKCS11 (object):
def C_VerifyFinal(self, session, signature):
self.so.C_VerifyFinal(session, signature, len(signature))
- def C_CreateObject(self, session, template):
+ def C_CreateObject(self, session, template = None, **kwargs):
+ if kwargs:
+ assert not template
+ template = kwargs
template = self.adb.to_ctypes(template)
handle = CK_OBJECT_HANDLE()
self.so.C_CreateObject(session, template, len(template), byref(handle))
diff --git a/unit_tests.py b/unit_tests.py
index b38e4ac..b82a479 100644
--- a/unit_tests.py
+++ b/unit_tests.py
@@ -118,18 +118,18 @@ class TestKeys(unittest.TestCase):
p11.C_Login(self.session, CKU_USER, user_pin)
def tearDown(self):
+ for handle in p11.Find(self.session):
+ p11.C_DestroyObject(self.session, handle)
p11.C_CloseAllSessions(only_slot)
del self.session
- def assertIsKeypair(self, public_key, private_key = None):
- if isinstance(public_key, tuple) and private_key is None:
- public_key, private_key = public_key
- self.assertIsInstance(public_key, (int, long))
- self.assertIsInstance(private_key, (int, long))
- # Could do something clever here like use C_GetAttributeValue() to
- # examine the objects. Maybe later.
+ def assertIsKeypair(self, public_handle, private_handle = None):
+ if isinstance(public_handle, tuple) and private_handle is None:
+ public_handle, private_handle = public_handle
+ self.assertEqual(p11.C_GetAttributeValue(self.session, public_handle, CKA_CLASS)[CKA_CLASS], CKO_PUBLIC_KEY)
+ self.assertEqual(p11.C_GetAttributeValue(self.session, private_handle, CKA_CLASS)[CKA_CLASS], CKO_PRIVATE_KEY)
- def test_keygen_ec_p256(self):
+ def test_keygen_token_vs_session(self):
self.assertIsKeypair(
p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, CKA_TOKEN = False,
CKA_ID = "EC-P256", CKA_EC_PARAMS = self.oid_p256,
@@ -150,7 +150,7 @@ class TestKeys(unittest.TestCase):
CKA_SIGN = True, CKA_VERIFY = True))
def test_gen_sign_verify_ecdsa_p256_sha256(self):
- public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, CKA_TOKEN = False,
+ public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN,
CKA_ID = "EC-P256", CKA_EC_PARAMS = self.oid_p256,
CKA_SIGN = True, CKA_VERIFY = True)
self.assertIsKeypair(public_key, private_key)
@@ -161,6 +161,99 @@ class TestKeys(unittest.TestCase):
p11.C_VerifyInit(self.session, CKM_ECDSA_SHA256, public_key)
p11.C_Verify(self.session, hamster, sig)
+ @unittest.skip("SHA-384 not available in current build")
+ def test_gen_sign_verify_ecdsa_p384_sha384(self):
+ public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN,
+ CKA_ID = "EC-P384", CKA_EC_PARAMS = self.oid_p384,
+ CKA_SIGN = True, CKA_VERIFY = True)
+ self.assertIsKeypair(public_key, private_key)
+ hamster = "Your mother was a hamster"
+ p11.C_SignInit(self.session, CKM_ECDSA_SHA384, private_key)
+ sig = p11.C_Sign(self.session, hamster)
+ self.assertIsInstance(sig, str)
+ p11.C_VerifyInit(self.session, CKM_ECDSA_SHA384, public_key)
+ p11.C_Verify(self.session, hamster, sig)
+
+ @unittest.skip("SHA-512 not available in current build")
+ def test_gen_sign_verify_ecdsa_p521_sha512(self):
+ public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN,
+ CKA_ID = "EC-P521", CKA_EC_PARAMS = self.oid_p521,
+ CKA_SIGN = True, CKA_VERIFY = True)
+ self.assertIsKeypair(public_key, private_key)
+ hamster = "Your mother was a hamster"
+ p11.C_SignInit(self.session, CKM_ECDSA_SHA512, private_key)
+ sig = p11.C_Sign(self.session, hamster)
+ self.assertIsInstance(sig, str)
+ p11.C_VerifyInit(self.session, CKM_ECDSA_SHA512, public_key)
+ p11.C_Verify(self.session, hamster, sig)
+
+ def test_gen_rsa_1024(self):
+ self.assertIsKeypair(
+ p11.C_GenerateKeyPair(self.session, CKM_RSA_PKCS_KEY_PAIR_GEN, CKA_MODULUS_BITS = 1024,
+ CKA_ID = "RSA-1024", CKA_SIGN = True, CKA_VERIFY = True))
+
+ @unittest.skip("RSA key generation is still painfully slow")
+ def test_gen_rsa_2048(self):
+ self.assertIsKeypair(
+ p11.C_GenerateKeyPair(self.session, CKM_RSA_PKCS_KEY_PAIR_GEN, CKA_MODULUS_BITS = 2048,
+ CKA_ID = "RSA-1024", CKA_SIGN = True, CKA_VERIFY = True))
+
+ @staticmethod
+ def _build_ecpoint(x, y):
+ bytes_per_coordinate = (max(x.bit_length(), y.bit_length()) + 15) / 16
+ value = chr(0x04) + ("%0*x%0*x" % (bytes_per_coordinate, x, bytes_per_coordinate, y)).decode("hex")
+ if len(value) < 128:
+ length = chr(len(value))
+ else:
+ n = len(value).bit_length()
+ length = chr((n + 7) / 8) + ("%0*x" % ((n + 15) / 16, len(value))).decode("hex")
+ tag = chr(0x04)
+ return tag + length + value
+
+ def test_canned_ecdsa_p256_verify(self):
+ Q = self._build_ecpoint(0x8101ece47464a6ead70cf69a6e2bd3d88691a3262d22cba4f7635eaff26680a8,
+ 0xd8a12ba61d599235f67d9cb4d58f1783d3ca43e78f0a5abaa624079936c0c3a9)
+ H = "7c3e883ddc8bd688f96eac5e9324222c8f30f9d6bb59e9c5f020bd39ba2b8377".decode("hex")
+ r = "7214bc9647160bbd39ff2f80533f5dc6ddd70ddf86bb815661e805d5d4e6f27c".decode("hex")
+ s = "7d1ff961980f961bdaa3233b6209f4013317d3e3f9e1493592dbeaa1af2bc367".decode("hex")
+ handle = p11.C_CreateObject(
+ session = self.session,
+ CKA_CLASS = CKO_PUBLIC_KEY,
+ CKA_KEY_TYPE = CKK_EC,
+ CKA_LABEL = "EC-P-256 test case from \"Suite B Implementer's Guide to FIPS 186-3\"",
+ CKA_ID = "EC-P-256",
+ CKA_VERIFY = True,
+ CKA_ENCRYPT = False,
+ CKA_WRAP = False,
+ CKA_TOKEN = False,
+ CKA_EC_POINT = Q,
+ CKA_EC_PARAMS = self.oid_p256)
+ p11.C_VerifyInit(self.session, CKM_ECDSA, handle)
+ p11.C_Verify(self.session, H, r + s)
+
+ def test_canned_ecdsa_p384_verify(self):
+ Q = self._build_ecpoint(0x1fbac8eebd0cbf35640b39efe0808dd774debff20a2a329e91713baf7d7f3c3e81546d883730bee7e48678f857b02ca0,
+ 0xeb213103bd68ce343365a8a4c3d4555fa385f5330203bdd76ffad1f3affb95751c132007e1b240353cb0a4cf1693bdf9)
+ H = "b9210c9d7e20897ab86597266a9d5077e8db1b06f7220ed6ee75bd8b45db37891f8ba5550304004159f4453dc5b3f5a1".decode("hex")
+ r = "a0c27ec893092dea1e1bd2ccfed3cf945c8134ed0c9f81311a0f4a05942db8dbed8dd59f267471d5462aa14fe72de856".decode("hex")
+ s = "20ab3f45b74f10b6e11f96a2c8eb694d206b9dda86d3c7e331c26b22c987b7537726577667adadf168ebbe803794a402".decode("hex")
+ handle = p11.C_CreateObject(
+ session = self.session,
+ CKA_CLASS = CKO_PUBLIC_KEY,
+ CKA_KEY_TYPE = CKK_EC,
+ CKA_LABEL = "EC-P-384 test case from \"Suite B Implementer's Guide to FIPS 186-3\"",
+ CKA_ID = "EC-P-384",
+ CKA_VERIFY = True,
+ CKA_ENCRYPT = False,
+ CKA_WRAP = False,
+ CKA_TOKEN = False,
+ CKA_EC_POINT = Q,
+ CKA_EC_PARAMS = self.oid_p384)
+ p11.C_VerifyInit(self.session, CKM_ECDSA, handle)
+ p11.C_Verify(self.session, H, r + s)
+
+
+
def setUpModule():
global p11
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the Commits
mailing list