2 # Copyright 2017-2023 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
14 use OpenSSL::Test qw/:DEFAULT srctop_file srctop_dir bldtop_dir bldtop_file/;
15 use OpenSSL::Test::Utils;
21 use lib srctop_dir('Configurations');
22 use lib bldtop_dir('.');
24 plan skip_all => "This test is unsupported in a no-dsa build"
27 my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
30 ($no_fips ? 0 : 2) # FIPS related tests
33 ok(run(app([ 'openssl', 'genpkey', '-genparam',
35 '-pkeyopt', 'gindex:1',
36 '-pkeyopt', 'type:fips186_4',
38 "genpkey DSA params fips186_4 with verifiable g");
40 ok(run(app([ 'openssl', 'genpkey', '-genparam',
42 '-pkeyopt', 'type:fips186_4',
44 "genpkey DSA params fips186_4 with unverifiable g");
46 ok(run(app([ 'openssl', 'genpkey', '-genparam',
48 '-pkeyopt', 'pbits:2048',
49 '-pkeyopt', 'qbits:224',
50 '-pkeyopt', 'digest:SHA512-256',
51 '-pkeyopt', 'type:fips186_4'])),
52 "genpkey DSA params fips186_4 with truncated SHA");
54 ok(run(app([ 'openssl', 'genpkey', '-genparam',
56 '-pkeyopt', 'type:fips186_2',
58 "genpkey DSA params fips186_2");
60 ok(run(app([ 'openssl', 'genpkey', '-genparam',
62 '-pkeyopt', 'type:fips186_2',
63 '-pkeyopt', 'dsa_paramgen_bits:1024',
64 '-out', 'dsagen.legacy.pem'])),
65 "genpkey DSA params fips186_2 PEM");
67 ok(!run(app([ 'openssl', 'genpkey', '-algorithm', 'DSA',
68 '-pkeyopt', 'type:group',
70 "genpkey DSA does not support groups");
72 ok(run(app([ 'openssl', 'genpkey', '-genparam',
74 '-pkeyopt', 'gindex:1',
75 '-pkeyopt', 'type:fips186_4',
76 '-out', 'dsagen.pem'])),
77 "genpkey DSA params fips186_4 PEM");
79 ok(run(app([ 'openssl', 'genpkey', '-genparam',
81 '-pkeyopt', 'gindex:1',
82 '-pkeyopt', 'pbits:2048',
83 '-pkeyopt', 'qbits:256',
84 '-pkeyopt', 'type:fips186_4',
86 '-out', 'dsagen.der'])),
87 "genpkey DSA params fips186_4 DER");
89 ok(run(app([ 'openssl', 'genpkey',
90 '-paramfile', 'dsagen.legacy.pem',
91 '-pkeyopt', 'type:fips186_2',
93 "genpkey DSA fips186_2 with PEM params");
95 # The seed and counter should be the ones generated from the param generation
96 # Just put some dummy ones in to show it works.
97 ok(run(app([ 'openssl', 'genpkey',
98 '-paramfile', 'dsagen.der',
99 '-pkeyopt', 'type:fips186_4',
100 '-pkeyopt', 'gindex:1',
101 '-pkeyopt', 'hexseed:0102030405060708090A0B0C0D0E0F1011121314',
102 '-pkeyopt', 'pcounter:25',
104 "genpkey DSA fips186_4 with DER params");
106 ok(!run(app([ 'openssl', 'genpkey',
107 '-algorithm', 'DSA'])),
108 "genpkey DSA with no params should fail");
110 ok(run(app(["openssl", "gendsa", "-verbose",
112 "gendsa with -verbose option and dsagen parameter");
114 ok(!run(app(["openssl", "gendsa",
115 'dsagen.pem', "-verbose"])),
116 "gendsa with extra parameter (at end) should fail");
118 # test key generation with dsaparam tool
119 ok(run(app([ 'openssl', 'dsaparam',
124 "dsaparam -genkey DSA 1024 with default qbits");
126 ok(run(app([ 'openssl', 'dsaparam',
131 "dsaparam -genkey DSA 2048 with default qbits");
133 ok(run(app([ 'openssl', 'dsaparam',
138 "dsaparam -genkey DSA 1024 with 160 qbits");
140 ok(run(app([ 'openssl', 'dsaparam',
145 "dsaparam -genkey DSA 2048 with 224 qbits");
147 ok(run(app([ 'openssl', 'dsaparam',
152 "dsaparam -genkey DSA 2048 with 256 qbits");
153 # genkey test for 3072 bits keys were removed to speed up the tests
156 my $provconf = srctop_file("test", "fips-and-base.cnf");
157 my $provpath = bldtop_dir("providers");
158 my @prov = ( "-provider-path", $provpath,
159 "-config", $provconf);
161 $ENV{OPENSSL_TEST_LIBCTX} = "1";
164 ok(run(app(['openssl', 'genpkey',
168 '-pkeyopt', 'pbits:3072',
169 '-pkeyopt', 'qbits:256',
170 '-out', 'gendsatest3072params.pem'])),
171 "Generating 3072-bit DSA params");
174 ok(run(app(['openssl', 'genpkey',
176 '-paramfile', 'gendsatest3072params.pem',
178 '-out', 'gendsatest3072.pem'])),
179 "Generating 3072-bit DSA keypair");