gnutls_pubkey_t load_public_key_or_import(int mand,
gnutls_privkey_t privkey,
common_info_st * info)
{
gnutls_pubkey_t pubkey;
int ret;
ret = gnutls_pubkey_init(&pubkey);
if (ret < 0) {
fprintf(stderr, "gnutls_pubkey_init: %s\n",
gnutls_strerror(ret));
exit(1);
}
if (!privkey || (ret = gnutls_pubkey_import_privkey(pubkey, privkey, 0, 0)) < 0) { /* could not get (e.g. on PKCS #11 */
gnutls_pubkey_deinit(pubkey);
pubkey = load_pubkey(0, info);
if (pubkey == NULL && mand) {
fprintf(stderr, "You must specify --load-privkey\n");
exit(1);
}
}
return pubkey;
}
PublicKey
PrivateKey::getPublicKey() const
{
gnutls_pubkey_t pk;
gnutls_pubkey_init(&pk);
PublicKey pk_ret {pk};
if (gnutls_pubkey_import_privkey(pk, key, GNUTLS_KEY_KEY_CERT_SIGN | GNUTLS_KEY_CRL_SIGN, 0) != GNUTLS_E_SUCCESS)
return {};
return pk_ret;
}
gnutls_pubkey_t load_public_key_or_import(int mand, gnutls_privkey_t privkey, common_info_st * info)
{
gnutls_pubkey_t pubkey;
int ret;
ret = gnutls_pubkey_init(&pubkey);
if (ret < 0)
error (EXIT_FAILURE, 0, "gnutls_pubkey_init: %s",
gnutls_strerror (ret));
if (!privkey || (ret = gnutls_pubkey_import_privkey(pubkey, privkey, 0, 0)) < 0)
{ /* could not get (e.g. on PKCS #11 */
gnutls_pubkey_deinit(pubkey);
return load_pubkey(mand, info);
}
return pubkey;
}
void doit(void)
{
int ret;
const char *lib;
gnutls_privkey_t key;
gnutls_pubkey_t pub;
gnutls_datum_t m1, e1;
gnutls_datum_t m2, e2;
ret = global_init();
if (ret != 0) {
fail("%d: %s\n", ret, gnutls_strerror(ret));
exit(1);
}
gnutls_global_set_log_function(tls_log_func);
if (debug)
gnutls_global_set_log_level(4711);
lib = getenv("P11MOCKLIB1");
if (lib == NULL)
lib = P11LIB;
ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
if (ret != 0) {
fail("%d: %s\n", ret, gnutls_strerror(ret));
exit(1);
}
ret = gnutls_pkcs11_add_provider(lib, NULL);
if (ret != 0) {
fail("%d: %s\n", ret, gnutls_strerror(ret));
exit(1);
}
ret = gnutls_privkey_init(&key);
assert(ret>=0);
ret = gnutls_pubkey_init(&pub);
assert(ret>=0);
gnutls_privkey_set_pin_function(key, pin_func, NULL);
ret = gnutls_privkey_import_url(key, "pkcs11:object=test", GNUTLS_PKCS11_OBJ_FLAG_LOGIN);
if (ret < 0) {
fail("%d: %s\n", ret, gnutls_strerror(ret));
exit(1);
}
ret = gnutls_pubkey_import_privkey(pub, key, 0, 0);
if (ret < 0) {
fail("%d: %s\n", ret, gnutls_strerror(ret));
exit(1);
}
ret = gnutls_pubkey_export_rsa_raw(pub, &m1, &e1);
if (ret < 0) {
fail("%d: %s\n", ret, gnutls_strerror(ret));
exit(1);
}
gnutls_pubkey_deinit(pub);
gnutls_privkey_deinit(key);
/* try again using gnutls_pubkey_import_url */
ret = gnutls_pubkey_init(&pub);
assert(ret>=0);
ret = gnutls_pubkey_import_url(pub, "pkcs11:object=test;type=public", 0);
if (ret < 0) {
fail("%d: %s\n", ret, gnutls_strerror(ret));
exit(1);
}
ret = gnutls_pubkey_export_rsa_raw(pub, &m2, &e2);
if (ret < 0) {
fail("%d: %s\n", ret, gnutls_strerror(ret));
exit(1);
}
assert(m1.size == m2.size);
assert(e1.size == e2.size);
assert(memcmp(e1.data, e2.data, e2.size)==0);
assert(memcmp(m1.data, m2.data, m2.size)==0);
gnutls_pubkey_deinit(pub);
gnutls_free(m1.data);
gnutls_free(e1.data);
gnutls_free(m2.data);
gnutls_free(e2.data);
gnutls_pkcs11_deinit();
gnutls_global_deinit();
}
void doit(void)
{
char buf[128];
int ret;
const char *lib, *bin;
gnutls_x509_crt_t crt;
gnutls_x509_privkey_t key;
gnutls_datum_t tmp, sig;
gnutls_privkey_t pkey;
gnutls_pubkey_t pubkey;
gnutls_pubkey_t pubkey2;
unsigned i, sigalgo;
bin = softhsm_bin();
lib = softhsm_lib();
ret = global_init();
if (ret != 0) {
fail("%d: %s\n", ret, gnutls_strerror(ret));
}
gnutls_pkcs11_set_pin_function(pin_func, NULL);
gnutls_global_set_log_function(tls_log_func);
if (debug)
gnutls_global_set_log_level(4711);
set_softhsm_conf(CONFIG);
snprintf(buf, sizeof(buf),
"%s --init-token --slot 0 --label test --so-pin " PIN " --pin "
PIN, bin);
system(buf);
ret = gnutls_pkcs11_add_provider(lib, NULL);
if (ret < 0) {
fail("gnutls_x509_crt_init: %s\n", gnutls_strerror(ret));
}
if (verify_eddsa_presence() == 0) {
fprintf(stderr, "Skipping test as no EDDSA mech is supported\n");
exit(77);
}
ret = gnutls_x509_crt_init(&crt);
if (ret < 0)
fail("gnutls_x509_crt_init: %s\n", gnutls_strerror(ret));
ret =
gnutls_x509_crt_import(crt, &server_ca3_eddsa_cert,
GNUTLS_X509_FMT_PEM);
if (ret < 0)
fail("gnutls_x509_crt_import: %s\n", gnutls_strerror(ret));
if (debug) {
gnutls_x509_crt_print(crt, GNUTLS_CRT_PRINT_ONELINE, &tmp);
printf("\tCertificate: %.*s\n", tmp.size, tmp.data);
gnutls_free(tmp.data);
}
ret = gnutls_x509_privkey_init(&key);
if (ret < 0) {
fail("gnutls_x509_privkey_init: %s\n", gnutls_strerror(ret));
}
ret =
gnutls_x509_privkey_import(key, &server_ca3_eddsa_key,
GNUTLS_X509_FMT_PEM);
if (ret < 0) {
fail("gnutls_x509_privkey_import: %s\n", gnutls_strerror(ret));
}
/* initialize softhsm token */
ret = gnutls_pkcs11_token_init(SOFTHSM_URL, PIN, "test");
if (ret < 0) {
fail("gnutls_pkcs11_token_init: %s\n", gnutls_strerror(ret));
}
ret =
gnutls_pkcs11_token_set_pin(SOFTHSM_URL, NULL, PIN,
GNUTLS_PIN_USER);
if (ret < 0) {
fail("gnutls_pkcs11_token_set_pin: %s\n", gnutls_strerror(ret));
}
ret = gnutls_pkcs11_copy_x509_crt(SOFTHSM_URL, crt, "cert",
GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE |
GNUTLS_PKCS11_OBJ_FLAG_LOGIN);
if (ret < 0) {
fail("gnutls_pkcs11_copy_x509_crt: %s\n", gnutls_strerror(ret));
}
ret =
gnutls_pkcs11_copy_x509_privkey(SOFTHSM_URL, key, "cert",
GNUTLS_KEY_DIGITAL_SIGNATURE |
GNUTLS_KEY_KEY_ENCIPHERMENT,
GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE
|
GNUTLS_PKCS11_OBJ_FLAG_MARK_SENSITIVE
| GNUTLS_PKCS11_OBJ_FLAG_LOGIN);
if (ret < 0) {
fail("gnutls_pkcs11_copy_x509_privkey: %s\n",
gnutls_strerror(ret));
}
gnutls_x509_crt_deinit(crt);
gnutls_x509_privkey_deinit(key);
gnutls_pkcs11_set_pin_function(NULL, NULL);
assert(gnutls_privkey_init(&pkey) == 0);
ret =
gnutls_privkey_import_pkcs11_url(pkey,
SOFTHSM_URL
";object=cert;object-type=private;pin-value="
PIN);
if (ret < 0) {
fail("error in gnutls_privkey_import_pkcs11_url: %s\n", gnutls_strerror(ret));
}
assert(gnutls_pubkey_init(&pubkey) == 0);
assert(gnutls_pubkey_import_privkey(pubkey, pkey, 0, 0) == 0);
assert(gnutls_pubkey_init(&pubkey2) == 0);
assert(gnutls_pubkey_import_x509_raw
(pubkey2, &server_ca3_eddsa_cert, GNUTLS_X509_FMT_PEM, 0) == 0);
/* this is the algorithm supported by the certificate */
sigalgo = GNUTLS_SIGN_EDDSA_ED25519;
for (i = 0; i < 20; i++) {
/* check whether privkey and pubkey are operational
* by signing and verifying */
ret =
gnutls_privkey_sign_data2(pkey, sigalgo, 0,
&testdata, &sig);
if (ret < 0)
myfail("Error signing data %s\n", gnutls_strerror(ret));
/* verify against the pubkey in PKCS #11 */
ret =
gnutls_pubkey_verify_data2(pubkey, sigalgo, 0,
&testdata, &sig);
if (ret < 0)
myfail("Error verifying data1: %s\n",
gnutls_strerror(ret));
/* verify against the raw pubkey */
ret =
gnutls_pubkey_verify_data2(pubkey2, sigalgo, 0,
&testdata, &sig);
if (ret < 0)
myfail("Error verifying data2: %s\n",
gnutls_strerror(ret));
gnutls_free(sig.data);
}
gnutls_pubkey_deinit(pubkey2);
gnutls_pubkey_deinit(pubkey);
gnutls_privkey_deinit(pkey);
gnutls_global_deinit();
remove(CONFIG);
}
void Plugin::_loadCertificate()
{
QFile file(this->crtFile);
gnutls_datum_t datum;
size_t size = 2048;
QByteArray data;
gnutls_privkey_t privkey;
gnutls_pubkey_t pubkey;
gnutls_pubkey_t pubkeyCrt;
int error;
QMap<char *, QByteArray> oid;
gnutls_digest_algorithm_t digest;
if (!file.open(QIODevice::ReadWrite))
throw Properties("error", "Unable to open the certificate file").add("file", this->crtFile);
ASSERT_INIT(gnutls_x509_crt_init(&this->crt), "crt");
ASSERT(gnutls_privkey_init(&privkey));
ASSERT(gnutls_privkey_import_x509(privkey, this->key, 0));
ASSERT(gnutls_pubkey_init(&pubkey));
ASSERT(gnutls_pubkey_import_privkey(pubkey, privkey, 0, 0));
// Verifies that the certificate is valid
if (file.size() > 0)
{
ASSERT(gnutls_pubkey_init(&pubkeyCrt));
data = file.readAll();
datum.size = data.size();
datum.data = (unsigned char *)data.data();
if (gnutls_x509_crt_import(this->crt, &datum, GNUTLS_X509_FMT_PEM) != GNUTLS_E_SUCCESS)
file.resize(0);
else if (gnutls_x509_crt_get_expiration_time(this->crt) < ::time(NULL) + CRT_EXPIRATION_REGEN)
file.resize(0);
else if (gnutls_pubkey_import_x509(pubkeyCrt, this->crt, 0) != GNUTLS_E_SUCCESS)
file.resize(0);
// Ensures that the public keys of the certificate and the private key match
size_t size1 = size, size2 = size;
QByteArray pub1((int)size1, 0), pub2((int)size2, 0);
if (gnutls_pubkey_export(pubkey, GNUTLS_X509_FMT_PEM, pub1.data(), &size1) != GNUTLS_E_SUCCESS
|| gnutls_pubkey_export(pubkeyCrt, GNUTLS_X509_FMT_PEM, pub2.data(), &size2) != GNUTLS_E_SUCCESS
|| size1 != size2 || pub1 != pub2)
file.resize(0);
gnutls_pubkey_deinit(pubkeyCrt);
}
// Generates a new certificate
if (file.size() == 0)
{
gnutls_x509_crt_deinit(this->crt);
this->init.removeAll("crt");
ASSERT_INIT(gnutls_x509_crt_init(&this->crt), "crt");
LOG_INFO("Generating a new certificate", "Plugin", "_generateCertificate");
oid.insert((char *)GNUTLS_OID_X520_COMMON_NAME, "LightBird");
oid.insert((char *)GNUTLS_OID_X520_ORGANIZATION_NAME, "LightBird");
QMapIterator<char *, QByteArray> it(oid);
while (it.hasNext())
ASSERT(gnutls_x509_crt_set_dn_by_oid(this->crt, it.key(), 0, it.value().data(), it.next().value().size()));
ASSERT(gnutls_x509_crt_set_pubkey(this->crt, pubkey));
data = this->_generateSerial();
ASSERT(gnutls_x509_crt_set_serial(this->crt, data.data(), data.size()));
ASSERT(gnutls_x509_crt_set_activation_time(this->crt, ::time(NULL)));
ASSERT(gnutls_x509_crt_set_expiration_time(this->crt, ::time(NULL) + CRT_EXPIRATION));
ASSERT(gnutls_x509_crt_set_basic_constraints(this->crt, 0, -1));
ASSERT(gnutls_x509_crt_set_key_purpose_oid(this->crt, GNUTLS_KP_TLS_WWW_SERVER, 0));
ASSERT(gnutls_x509_crt_set_key_usage(this->crt, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT));
data.resize((int)size);
ASSERT(gnutls_x509_crt_get_key_id(this->crt, 0, (unsigned char *)data.data(), &size));
ASSERT(gnutls_x509_crt_set_subject_key_id(this->crt, (unsigned char *)data.data(), size));
ASSERT(gnutls_x509_crt_set_version(this->crt, 3));
ASSERT(gnutls_pubkey_get_preferred_hash_algorithm(pubkey, &digest, NULL));
ASSERT(gnutls_x509_crt_privkey_sign(this->crt, this->crt, privkey, digest, 0));
size = data.size();
ASSERT(gnutls_x509_crt_export(this->crt, GNUTLS_X509_FMT_PEM, data.data(), &size));
data.resize((int)size);
file.write(data);
}
gnutls_pubkey_deinit(pubkey);
gnutls_privkey_deinit(privkey);
}
void
pkcs11_test_sign(FILE * outfile, const char *url, unsigned int flags,
common_info_st * info)
{
gnutls_privkey_t privkey;
gnutls_pubkey_t pubkey;
int ret;
gnutls_datum_t data, sig = {NULL, 0};
int pk;
pkcs11_common(info);
FIX(url, outfile, 0, info);
data.data = (void*)TEST_DATA;
data.size = sizeof(TEST_DATA)-1;
ret = gnutls_privkey_init(&privkey);
if (ret < 0) {
fprintf(stderr, "Error in %s:%d: %s\n", __func__,
__LINE__, gnutls_strerror(ret));
exit(1);
}
ret = gnutls_pubkey_init(&pubkey);
if (ret < 0) {
fprintf(stderr, "Error in %s:%d: %s\n", __func__,
__LINE__, gnutls_strerror(ret));
exit(1);
}
ret = gnutls_privkey_import_url(privkey, url, flags);
if (ret < 0) {
fprintf(stderr, "Cannot import private key: %s\n",
gnutls_strerror(ret));
exit(1);
}
ret = gnutls_pubkey_import_privkey(pubkey, privkey, GNUTLS_KEY_DIGITAL_SIGNATURE, flags);
if (ret < 0) {
fprintf(stderr, "Cannot import public key: %s\n",
gnutls_strerror(ret));
exit(1);
}
ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA1, 0, &data, &sig);
if (ret < 0) {
fprintf(stderr, "Cannot sign data: %s\n",
gnutls_strerror(ret));
exit(1);
}
pk = gnutls_pubkey_get_pk_algorithm(pubkey, NULL);
fprintf(stderr, "Verifying against private key parameters... ");
ret = gnutls_pubkey_verify_data2(pubkey, gnutls_pk_to_sign(pk, GNUTLS_DIG_SHA1),
0, &data, &sig);
if (ret < 0) {
fprintf(stderr, "Cannot verify signed data: %s\n",
gnutls_strerror(ret));
exit(1);
}
fprintf(stderr, "ok\n");
/* now try to verify against a public key within the token */
gnutls_pubkey_deinit(pubkey);
ret = gnutls_pubkey_init(&pubkey);
if (ret < 0) {
fprintf(stderr, "Error in %s:%d: %s\n", __func__,
__LINE__, gnutls_strerror(ret));
exit(1);
}
ret = gnutls_pubkey_import_url(pubkey, url, flags);
if (ret < 0) {
fprintf(stderr, "Cannot find a corresponding public key object in token: %s\n",
gnutls_strerror(ret));
if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
exit(0);
exit(1);
}
fprintf(stderr, "Verifying against public key in the token... ");
ret = gnutls_pubkey_verify_data2(pubkey, gnutls_pk_to_sign(pk, GNUTLS_DIG_SHA1),
0, &data, &sig);
if (ret < 0) {
fprintf(stderr, "Cannot verify signed data: %s\n",
gnutls_strerror(ret));
exit(1);
}
fprintf(stderr, "ok\n");
gnutls_free(sig.data);
gnutls_pubkey_deinit(pubkey);
gnutls_privkey_deinit(privkey);
UNFIX;
}
static
int check_gost(void)
{
gnutls_privkey_t key;
gnutls_pubkey_t pub;
gnutls_datum_t y, x, k;
gnutls_ecc_curve_t curve;
gnutls_digest_algorithm_t digest;
gnutls_gost_paramset_t paramset;
int ret;
success("Checking GOST key operations\n");
/* ECC */
ret = gnutls_privkey_init(&key);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_init(&pub);
if (ret < 0)
fail("error\n");
ret = gnutls_privkey_import_x509_raw(key, &server_ca3_gost01_key, GNUTLS_X509_FMT_PEM, 0, 0);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_import_privkey(pub, key, 0, 0);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_export_gost_raw2(pub, &curve, &digest, ¶mset, &x, &y, 0);
if (ret < 0)
fail("error\n");
if (curve != GNUTLS_ECC_CURVE_GOST256CPXA) {
fprintf(stderr, "unexpected curve value: %d\n", (int)curve);
exit(1);
}
if (digest != GNUTLS_DIG_GOSTR_94) {
fprintf(stderr, "unexpected digest value: %d\n", (int)digest);
exit(1);
}
if (paramset != GNUTLS_GOST_PARAMSET_CP_A) {
fprintf(stderr, "unexpected paramset value: %d\n", (int)paramset);
exit(1);
}
CMP("x", &x, gost_x);
CMP("y", &y, gost_y);
gnutls_free(x.data);
gnutls_free(y.data);
ret = gnutls_pubkey_export_gost_raw2(pub, &curve, &digest, ¶mset, &x, &y, GNUTLS_EXPORT_FLAG_NO_LZ);
if (ret < 0)
fail("error\n");
if (curve != GNUTLS_ECC_CURVE_GOST256CPXA) {
fprintf(stderr, "unexpected curve value: %d\n", (int)curve);
exit(1);
}
if (digest != GNUTLS_DIG_GOSTR_94) {
fprintf(stderr, "unexpected digest value: %d\n", (int)digest);
exit(1);
}
if (paramset != GNUTLS_GOST_PARAMSET_CP_A) {
fprintf(stderr, "unexpected paramset value: %d\n", (int)paramset);
exit(1);
}
CMP_NO_LZ("x", &x, gost_x);
CMP_NO_LZ("y", &y, gost_y);
gnutls_free(x.data);
gnutls_free(y.data);
/* check the private key export */
ret = gnutls_privkey_export_gost_raw2(key, &curve, &digest, ¶mset, &x, &y, &k, 0);
if (ret < 0)
fail("error\n");
if (curve != GNUTLS_ECC_CURVE_GOST256CPXA) {
fprintf(stderr, "unexpected curve value: %d\n", (int)curve);
exit(1);
}
if (digest != GNUTLS_DIG_GOSTR_94) {
fprintf(stderr, "unexpected digest value: %d\n", (int)digest);
exit(1);
}
if (paramset != GNUTLS_GOST_PARAMSET_CP_A) {
fprintf(stderr, "unexpected paramset value: %d\n", (int)paramset);
exit(1);
}
CMP("x", &x, gost_x);
CMP("y", &y, gost_y);
CMP("k", &k, gost_k);
gnutls_free(x.data);
gnutls_free(y.data);
gnutls_free(k.data);
ret = _gnutls_privkey_export2_pkcs8(key, GNUTLS_X509_FMT_DER, NULL, 0, &x);
if (ret < 0 || x.size == 0)
fail("error in pkcs8 export\n");
gnutls_free(x.data);
gnutls_privkey_deinit(key);
gnutls_pubkey_deinit(pub);
return 0;
}
static
int check_ed25519(void)
{
gnutls_privkey_t key;
gnutls_pubkey_t pub;
gnutls_datum_t y, x, k;
gnutls_ecc_curve_t curve;
int ret;
success("Checking ed25519 key operations\n");
/* ECC */
ret = gnutls_privkey_init(&key);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_init(&pub);
if (ret < 0)
fail("error\n");
ret = gnutls_privkey_import_x509_raw(key, &server_ca3_eddsa_key, GNUTLS_X509_FMT_PEM, 0, 0);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_import_privkey(pub, key, 0, 0);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_export_ecc_raw(pub, &curve, &x, NULL);
if (ret < 0)
fail("error\n");
gnutls_free(x.data);
ret = gnutls_pubkey_export_ecc_raw(pub, &curve, &x, &y);
if (ret < 0)
fail("error\n");
if (curve != GNUTLS_ECC_CURVE_ED25519) {
fail("unexpected curve value: %d\n", (int)curve);
}
CMP("x", &x, ed25519_x);
if (y.data != NULL) {
fail("expected NULL value in Y\n");
}
gnutls_free(x.data);
/* check the private key export */
ret = gnutls_privkey_export_ecc_raw(key, &curve, &x, NULL, &k);
if (ret < 0)
fail("error\n");
gnutls_free(x.data);
gnutls_free(k.data);
ret = gnutls_privkey_export_ecc_raw(key, &curve, &x, &y, &k);
if (ret < 0)
fail("error\n");
if (curve != GNUTLS_ECC_CURVE_ED25519) {
fail("unexpected curve value: %d\n", (int)curve);
}
CMP("x", &x, ed25519_x);
CMP("k", &k, ed25519_k);
gnutls_free(x.data);
gnutls_free(k.data);
if (y.data != NULL) {
fail("expected NULL value in Y\n");
}
ret = _gnutls_privkey_export2_pkcs8(key, GNUTLS_X509_FMT_DER, NULL, 0, &x);
if (ret < 0 || x.size == 0)
fail("error in pkcs8 export\n");
gnutls_free(x.data);
gnutls_privkey_deinit(key);
/* More public key ops */
ret = gnutls_pubkey_export_ecc_x962(pub, &x, &y);
if (ret != GNUTLS_E_INVALID_REQUEST)
fail("error\n");
gnutls_pubkey_deinit(pub);
return 0;
}
static
int check_ecc(void)
{
gnutls_privkey_t key;
gnutls_pubkey_t pub;
gnutls_datum_t y, x, k;
gnutls_ecc_curve_t curve;
int ret;
success("Checking SECP256R1 key operations\n");
/* ECC */
ret = gnutls_privkey_init(&key);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_init(&pub);
if (ret < 0)
fail("error\n");
ret = gnutls_privkey_import_x509_raw(key, &server_ecc_key, GNUTLS_X509_FMT_PEM, 0, 0);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_import_privkey(pub, key, 0, 0);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_export_ecc_raw2(pub, &curve, &x, &y, 0);
if (ret < 0)
fail("error\n");
if (curve != GNUTLS_ECC_CURVE_SECP256R1) {
fprintf(stderr, "unexpected curve value: %d\n", (int)curve);
exit(1);
}
CMP("x", &x, ecc_x);
CMP("y", &y, ecc_y);
gnutls_free(x.data);
gnutls_free(y.data);
ret = gnutls_pubkey_export_ecc_raw2(pub, &curve, &x, &y, GNUTLS_EXPORT_FLAG_NO_LZ);
if (ret < 0)
fail("error\n");
if (curve != GNUTLS_ECC_CURVE_SECP256R1) {
fprintf(stderr, "unexpected curve value: %d\n", (int)curve);
exit(1);
}
CMP_NO_LZ("x", &x, ecc_x);
CMP_NO_LZ("y", &y, ecc_y);
gnutls_free(x.data);
gnutls_free(y.data);
/* check the private key export */
ret = gnutls_privkey_export_ecc_raw(key, &curve, &x, &y, &k);
if (ret < 0)
fail("error\n");
if (curve != GNUTLS_ECC_CURVE_SECP256R1) {
fprintf(stderr, "unexpected curve value: %d\n", (int)curve);
exit(1);
}
CMP("x", &x, ecc_x);
CMP("y", &y, ecc_y);
CMP("k", &k, ecc_k);
gnutls_free(x.data);
gnutls_free(y.data);
gnutls_free(k.data);
ret = _gnutls_privkey_export2_pkcs8(key, GNUTLS_X509_FMT_DER, NULL, 0, &x);
if (ret < 0 || x.size == 0)
fail("error in pkcs8 export\n");
gnutls_free(x.data);
gnutls_privkey_deinit(key);
/* More public key ops */
ret = gnutls_pubkey_export_ecc_x962(pub, &x, &y);
if (ret < 0)
fail("error\n");
CMP("parameters", &x, ecc_params);
CMP("ecpoint", &y, ecc_point);
ret = gnutls_pubkey_import_ecc_x962(pub, &x, &y);
if (ret < 0)
fail("error\n");
gnutls_free(x.data);
gnutls_free(y.data);
/* check again */
ret = gnutls_pubkey_export_ecc_raw(pub, &curve, &x, &y);
if (ret < 0)
fail("error\n");
if (curve != GNUTLS_ECC_CURVE_SECP256R1) {
fprintf(stderr, "unexpected curve value: %d\n", (int)curve);
fail("error\n");
}
CMP("x", &x, ecc_x);
CMP("y", &y, ecc_y);
gnutls_free(x.data);
gnutls_free(y.data);
gnutls_pubkey_deinit(pub);
return 0;
}
static
int check_rsa(void)
{
gnutls_privkey_t key;
gnutls_pubkey_t pub;
gnutls_datum_t m, e, d, p, q, u, e1, e2;
int ret;
success("Checking RSA key operations\n");
/* RSA */
ret = gnutls_privkey_init(&key);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_init(&pub);
if (ret < 0)
fail("error\n");
ret = gnutls_privkey_import_x509_raw(key, &rsa_key, GNUTLS_X509_FMT_PEM, 0, 0);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_import_privkey(pub, key, 0, 0);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_export_rsa_raw2(pub, &m, &e, 0);
if (ret < 0)
fail("error\n");
CMP("m", &m, rsa_m);
CMP("e", &e, rsa_e);
gnutls_free(m.data);
gnutls_free(e.data);
ret = gnutls_pubkey_export_rsa_raw2(pub, &m, &e, GNUTLS_EXPORT_FLAG_NO_LZ);
if (ret < 0)
fail("error\n");
CMP_NO_LZ("m", &m, rsa_m);
CMP_NO_LZ("e", &e, rsa_e);
gnutls_free(m.data);
gnutls_free(e.data);
ret = gnutls_privkey_export_rsa_raw(key, &m, &e, &d, &p, &q, &u, &e1, &e2);
if (ret < 0)
fail("error\n");
CMP("m", &m, rsa_m);
CMP("e", &e, rsa_e);
CMP("d", &d, rsa_d);
CMP("p", &p, rsa_p);
CMP("q", &q, rsa_q);
CMP("u", &u, rsa_u);
CMP("e1", &e1, rsa_e1);
CMP("e2", &e2, rsa_e2);
gnutls_free(m.data);
gnutls_free(e.data);
gnutls_free(d.data);
gnutls_free(p.data);
gnutls_free(q.data);
gnutls_free(u.data);
gnutls_free(e1.data);
gnutls_free(e2.data);
ret = _gnutls_privkey_export2_pkcs8(key, GNUTLS_X509_FMT_DER, NULL, 0, &m);
if (ret < 0 || m.size == 0)
fail("error in pkcs8 export\n");
gnutls_free(m.data);
gnutls_privkey_deinit(key);
gnutls_pubkey_deinit(pub);
return 0;
}
static
int check_dsa(void)
{
gnutls_privkey_t key;
gnutls_pubkey_t pub;
gnutls_datum_t p, q, g, y, x;
int ret;
global_init();
success("Checking DSA key operations\n");
ret = gnutls_privkey_init(&key);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_init(&pub);
if (ret < 0)
fail("error\n");
ret = gnutls_privkey_import_x509_raw(key, &dsa_key, GNUTLS_X509_FMT_PEM, 0, 0);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_import_privkey(pub, key, 0, 0);
if (ret < 0)
fail("error\n");
ret = gnutls_pubkey_export_dsa_raw2(pub, &p, &q, &g, &y, 0);
if (ret < 0)
fail("error\n");
CMP("p", &p, dsa_p);
CMP("q", &q, dsa_q);
CMP("g", &g, dsa_g);
CMP("y", &y, dsa_y);
gnutls_free(p.data);
gnutls_free(q.data);
gnutls_free(g.data);
gnutls_free(y.data);
ret = gnutls_pubkey_export_dsa_raw2(pub, &p, &q, &g, &y, GNUTLS_EXPORT_FLAG_NO_LZ);
if (ret < 0)
fail("error\n");
CMP_NO_LZ("p", &p, dsa_p);
CMP_NO_LZ("q", &q, dsa_q);
CMP_NO_LZ("g", &g, dsa_g);
CMP_NO_LZ("y", &y, dsa_y);
gnutls_free(p.data);
gnutls_free(q.data);
gnutls_free(g.data);
gnutls_free(y.data);
ret = gnutls_privkey_export_dsa_raw(key, &p, &q, &g, &y, &x);
if (ret < 0)
fail("error\n");
CMP("p", &p, dsa_p);
CMP("q", &q, dsa_q);
CMP("g", &g, dsa_g);
CMP("y", &y, dsa_y);
CMP("x", &x, dsa_x);
gnutls_free(p.data);
gnutls_free(q.data);
gnutls_free(g.data);
gnutls_free(y.data);
gnutls_free(x.data);
ret = _gnutls_privkey_export2_pkcs8(key, GNUTLS_X509_FMT_DER, NULL, 0, &x);
if (ret < 0 || x.size == 0)
fail("error in pkcs8 export\n");
gnutls_free(x.data);
gnutls_privkey_deinit(key);
gnutls_pubkey_deinit(pub);
return 0;
}
static
void test_sig(gnutls_pk_algorithm_t pk, unsigned hash, unsigned bits)
{
gnutls_pubkey_t pubkey;
gnutls_privkey_t privkey;
gnutls_sign_algorithm_t sign_algo;
gnutls_datum_t signature;
const gnutls_datum_t *hash_data;
int ret;
unsigned j;
if (hash == GNUTLS_DIG_SHA1)
hash_data = &sha1_data;
else if (hash == GNUTLS_DIG_SHA256)
hash_data = &sha256_data;
else
abort();
sign_algo =
gnutls_pk_to_sign(pk, hash);
for (j = 0; j < 100; j++) {
ret = gnutls_pubkey_init(&pubkey);
if (ret < 0)
ERR(__LINE__);
ret = gnutls_privkey_init(&privkey);
if (ret < 0)
ERR(__LINE__);
ret = gnutls_privkey_generate(privkey, pk, bits, 0);
if (ret < 0)
ERR(__LINE__);
ret =
gnutls_privkey_sign_hash(privkey, hash,
0, hash_data,
&signature);
if (ret < 0)
ERR(__LINE__);
ret = gnutls_pubkey_import_privkey(pubkey, privkey, GNUTLS_KEY_DIGITAL_SIGNATURE, 0);
if (ret < 0)
ERR(__LINE__);
ret =
gnutls_pubkey_verify_hash2(pubkey,
sign_algo, 0,
hash_data, &signature);
if (ret < 0)
ERR(__LINE__);
/* should fail */
ret =
gnutls_pubkey_verify_hash2(pubkey,
sign_algo, 0,
&invalid_hash_data,
&signature);
if (ret != GNUTLS_E_PK_SIG_VERIFY_FAILED)
ERR(__LINE__);
sign_algo =
gnutls_pk_to_sign(gnutls_pubkey_get_pk_algorithm
(pubkey, NULL), hash);
ret =
gnutls_pubkey_verify_hash2(pubkey, sign_algo, 0,
hash_data, &signature);
if (ret < 0)
ERR(__LINE__);
/* should fail */
ret =
gnutls_pubkey_verify_hash2(pubkey, sign_algo, 0,
&invalid_hash_data,
&signature);
if (ret != GNUTLS_E_PK_SIG_VERIFY_FAILED)
ERR(__LINE__);
/* test the raw interface */
gnutls_free(signature.data);
signature.data = NULL;
if (pk == GNUTLS_PK_RSA) {
ret =
gnutls_privkey_sign_hash(privkey,
hash,
GNUTLS_PRIVKEY_SIGN_FLAG_TLS1_RSA,
hash_data,
&signature);
if (ret < 0)
ERR(__LINE__);
sign_algo =
gnutls_pk_to_sign
(gnutls_pubkey_get_pk_algorithm
(pubkey, NULL), hash);
ret =
gnutls_pubkey_verify_hash2(pubkey,
sign_algo,
GNUTLS_PUBKEY_VERIFY_FLAG_TLS1_RSA,
hash_data,
&signature);
if (ret < 0)
ERR(__LINE__);
}
gnutls_free(signature.data);
gnutls_privkey_deinit(privkey);
gnutls_pubkey_deinit(pubkey);
}
}