2 # Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
14 use OpenSSL::Test qw/:DEFAULT srctop_file ok_nofips/;
15 use OpenSSL::Test::Utils;
17 setup("test_pkeyutl");
21 # For the tests below we use the cert itself as the TBS file
24 skip "Skipping tests that require EC, SM2 or SM3", 2
25 if disabled("ec") || disabled("sm2") || disabled("sm3");
28 ok_nofips(run(app(([ 'openssl', 'pkeyutl', '-sign',
29 '-in', srctop_file('test', 'certs', 'sm2.pem'),
30 '-inkey', srctop_file('test', 'certs', 'sm2.key'),
31 '-out', 'sm2.sig', '-rawin',
32 '-digest', 'sm3', '-pkeyopt', 'distid:someid']))),
33 "Sign a piece of data using SM2");
34 ok_nofips(run(app(([ 'openssl', 'pkeyutl',
36 '-in', srctop_file('test', 'certs', 'sm2.pem'),
37 '-inkey', srctop_file('test', 'certs', 'sm2.pem'),
38 '-sigfile', 'sm2.sig', '-rawin',
39 '-digest', 'sm3', '-pkeyopt', 'distid:someid']))),
40 "Verify an SM2 signature against a piece of data");
44 skip "Skipping tests that require EC", 4
48 ok(run(app(([ 'openssl', 'pkeyutl', '-sign', '-in',
49 srctop_file('test', 'certs', 'server-ed25519-cert.pem'),
50 '-inkey', srctop_file('test', 'certs', 'server-ed25519-key.pem'),
51 '-out', 'Ed25519.sig', '-rawin']))),
52 "Sign a piece of data using Ed25519");
53 ok(run(app(([ 'openssl', 'pkeyutl', '-verify', '-certin', '-in',
54 srctop_file('test', 'certs', 'server-ed25519-cert.pem'),
55 '-inkey', srctop_file('test', 'certs', 'server-ed25519-cert.pem'),
56 '-sigfile', 'Ed25519.sig', '-rawin']))),
57 "Verify an Ed25519 signature against a piece of data");
60 ok(run(app(([ 'openssl', 'pkeyutl', '-sign', '-in',
61 srctop_file('test', 'certs', 'server-ed448-cert.pem'),
62 '-inkey', srctop_file('test', 'certs', 'server-ed448-key.pem'),
63 '-out', 'Ed448.sig', '-rawin']))),
64 "Sign a piece of data using Ed448");
65 ok(run(app(([ 'openssl', 'pkeyutl', '-verify', '-certin', '-in',
66 srctop_file('test', 'certs', 'server-ed448-cert.pem'),
67 '-inkey', srctop_file('test', 'certs', 'server-ed448-cert.pem'),
68 '-sigfile', 'Ed448.sig', '-rawin']))),
69 "Verify an Ed448 signature against a piece of data");
78 my $data_to_sign = srctop_file('test', 'data.bin');
79 my $other_data = srctop_file('test', 'data2.bin');
80 my $sigfile = basename($privkey, '.pem') . '.sig';
85 @args = ('openssl', 'pkeyutl', '-sign',
88 '-in', $data_to_sign);
89 push(@args, @extraopts);
91 $testtext.": Generating signature");
93 @args = ('openssl', 'pkeyutl', '-sign',
97 '-in', $data_to_sign);
98 push(@args, @extraopts);
99 ok(!run(app([@args])),
100 $testtext.": Checking that mismatching keyform fails");
102 @args = ('openssl', 'pkeyutl', '-verify',
104 '-sigfile', $sigfile,
105 '-in', $data_to_sign);
106 push(@args, @extraopts);
107 ok(run(app([@args])),
108 $testtext.": Verify signature with private key");
110 @args = ('openssl', 'pkeyutl', '-verify',
112 '-inkey', $pubkey, '-pubin',
113 '-sigfile', $sigfile,
114 '-in', $data_to_sign);
115 push(@args, @extraopts);
116 ok(run(app([@args])),
117 $testtext.": Verify signature with public key");
119 @args = ('openssl', 'pkeyutl', '-verify',
120 '-inkey', $pubkey, '-pubin',
121 '-sigfile', $sigfile,
123 push(@args, @extraopts);
124 ok(!run(app([@args])),
125 $testtext.": Expect failure verifying mismatching data");
129 skip "RSA is not supported by this OpenSSL build", 1
132 subtest "RSA CLI signature generation and verification" => sub {
134 srctop_file("test","testrsa.pem"),
135 srctop_file("test","testrsapub.pem"),
136 "-rawin", "-digest", "sha256");
139 subtest "RSA CLI signature and verification with pkeyopt" => sub {
141 srctop_file("test","testrsa.pem"),
142 srctop_file("test","testrsapub.pem"),
143 "-rawin", "-digest", "sha256",
144 "-pkeyopt", "rsa_padding_mode:pss");
149 skip "DSA is not supported by this OpenSSL build", 1
152 subtest "DSA CLI signature generation and verification" => sub {
154 srctop_file("test","testdsa.pem"),
155 srctop_file("test","testdsapub.pem"),
156 "-rawin", "-digest", "sha256");
161 skip "ECDSA is not supported by this OpenSSL build", 1
164 subtest "ECDSA CLI signature generation and verification" => sub {
166 srctop_file("test","testec-p256.pem"),
167 srctop_file("test","testecpub-p256.pem"),
168 "-rawin", "-digest", "sha256");
173 skip "EdDSA is not supported by this OpenSSL build", 2
176 subtest "Ed2559 CLI signature generation and verification" => sub {
177 tsignverify("Ed25519",
178 srctop_file("test","tested25519.pem"),
179 srctop_file("test","tested25519pub.pem"),
183 subtest "Ed448 CLI signature generation and verification" => sub {
185 srctop_file("test","tested448.pem"),
186 srctop_file("test","tested448pub.pem"),