2 # Copyright 2018-2023 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
14 use OpenSSL::Test qw/:DEFAULT srctop_file ok_nofips/;
15 use OpenSSL::Test::Utils;
16 use File::Compare qw/compare_text/;
18 setup("test_pkeyutl");
22 # For the tests below we use the cert itself as the TBS file
25 skip "Skipping tests that require EC, SM2 or SM3", 4
26 if disabled("ec") || disabled("sm2") || disabled("sm3");
29 ok_nofips(run(app(([ 'openssl', 'pkeyutl', '-sign',
30 '-in', srctop_file('test', 'certs', 'sm2.pem'),
31 '-inkey', srctop_file('test', 'certs', 'sm2.key'),
32 '-out', 'sm2.sig', '-rawin',
33 '-digest', 'sm3', '-pkeyopt', 'distid:someid']))),
34 "Sign a piece of data using SM2");
35 ok_nofips(run(app(([ 'openssl', 'pkeyutl',
37 '-in', srctop_file('test', 'certs', 'sm2.pem'),
38 '-inkey', srctop_file('test', 'certs', 'sm2.pem'),
39 '-sigfile', 'sm2.sig', '-rawin',
40 '-digest', 'sm3', '-pkeyopt', 'distid:someid']))),
41 "Verify an SM2 signature against a piece of data");
42 ok_nofips(run(app(([ 'openssl', 'pkeyutl', '-encrypt',
43 '-in', srctop_file('test', 'data2.bin'),
44 '-inkey', srctop_file('test', 'certs', 'sm2-pub.key'),
45 '-pubin', '-out', 'sm2.enc']))),
46 "Encrypt a piece of data using SM2");
47 ok_nofips(run(app(([ 'openssl', 'pkeyutl', '-decrypt',
49 '-inkey', srctop_file('test', 'certs', 'sm2.key'),
51 && compare_text('sm2.dat',
52 srctop_file('test', 'data2.bin')) == 0,
53 "Decrypt a piece of data using SM2");
57 skip "Skipping tests that require ECX", 4
61 ok(run(app(([ 'openssl', 'pkeyutl', '-sign', '-in',
62 srctop_file('test', 'certs', 'server-ed25519-cert.pem'),
63 '-inkey', srctop_file('test', 'certs', 'server-ed25519-key.pem'),
64 '-out', 'Ed25519.sig', '-rawin']))),
65 "Sign a piece of data using Ed25519");
66 ok(run(app(([ 'openssl', 'pkeyutl', '-verify', '-certin', '-in',
67 srctop_file('test', 'certs', 'server-ed25519-cert.pem'),
68 '-inkey', srctop_file('test', 'certs', 'server-ed25519-cert.pem'),
69 '-sigfile', 'Ed25519.sig', '-rawin']))),
70 "Verify an Ed25519 signature against a piece of data");
73 ok(run(app(([ 'openssl', 'pkeyutl', '-sign', '-in',
74 srctop_file('test', 'certs', 'server-ed448-cert.pem'),
75 '-inkey', srctop_file('test', 'certs', 'server-ed448-key.pem'),
76 '-out', 'Ed448.sig', '-rawin']))),
77 "Sign a piece of data using Ed448");
78 ok(run(app(([ 'openssl', 'pkeyutl', '-verify', '-certin', '-in',
79 srctop_file('test', 'certs', 'server-ed448-cert.pem'),
80 '-inkey', srctop_file('test', 'certs', 'server-ed448-cert.pem'),
81 '-sigfile', 'Ed448.sig', '-rawin']))),
82 "Verify an Ed448 signature against a piece of data");
91 my $data_to_sign = srctop_file('test', 'data.bin');
92 my $other_data = srctop_file('test', 'data2.bin');
93 my $sigfile = basename($privkey, '.pem') . '.sig';
98 @args = ('openssl', 'pkeyutl', '-sign',
101 '-in', $data_to_sign);
102 push(@args, @extraopts);
103 ok(run(app([@args])),
104 $testtext.": Generating signature");
106 @args = ('openssl', 'pkeyutl', '-sign',
110 '-in', $data_to_sign);
111 push(@args, @extraopts);
112 ok(!run(app([@args])),
113 $testtext.": Checking that mismatching keyform fails");
115 @args = ('openssl', 'pkeyutl', '-verify',
117 '-sigfile', $sigfile,
118 '-in', $data_to_sign);
119 push(@args, @extraopts);
120 ok(run(app([@args])),
121 $testtext.": Verify signature with private key");
123 @args = ('openssl', 'pkeyutl', '-verify',
125 '-inkey', $pubkey, '-pubin',
126 '-sigfile', $sigfile,
127 '-in', $data_to_sign);
128 push(@args, @extraopts);
129 ok(run(app([@args])),
130 $testtext.": Verify signature with public key");
132 @args = ('openssl', 'pkeyutl', '-verify',
133 '-inkey', $pubkey, '-pubin',
134 '-sigfile', $sigfile,
136 push(@args, @extraopts);
137 ok(!run(app([@args])),
138 $testtext.": Expect failure verifying mismatching data");
142 skip "RSA is not supported by this OpenSSL build", 1
145 subtest "RSA CLI signature generation and verification" => sub {
147 srctop_file("test","testrsa.pem"),
148 srctop_file("test","testrsapub.pem"),
149 "-rawin", "-digest", "sha256");
152 subtest "RSA CLI signature and verification with pkeyopt" => sub {
154 srctop_file("test","testrsa.pem"),
155 srctop_file("test","testrsapub.pem"),
156 "-rawin", "-digest", "sha256",
157 "-pkeyopt", "rsa_padding_mode:pss");
162 skip "DSA is not supported by this OpenSSL build", 1
165 subtest "DSA CLI signature generation and verification" => sub {
167 srctop_file("test","testdsa.pem"),
168 srctop_file("test","testdsapub.pem"),
169 "-rawin", "-digest", "sha256");
174 skip "ECDSA is not supported by this OpenSSL build", 1
177 subtest "ECDSA CLI signature generation and verification" => sub {
179 srctop_file("test","testec-p256.pem"),
180 srctop_file("test","testecpub-p256.pem"),
181 "-rawin", "-digest", "sha256");
186 skip "EdDSA is not supported by this OpenSSL build", 2
189 subtest "Ed2559 CLI signature generation and verification" => sub {
190 tsignverify("Ed25519",
191 srctop_file("test","tested25519.pem"),
192 srctop_file("test","tested25519pub.pem"),
196 subtest "Ed448 CLI signature generation and verification" => sub {
198 srctop_file("test","tested448.pem"),
199 srctop_file("test","tested448pub.pem"),