edcsa-sign-and-verify.sh 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380
  1. #!/bin/bash
  2. ##############################################################################
  3. # Copyright (c) 2021 by Rambus, Inc. and/or its subsidiaries
  4. # All rights reserved. Unauthorized use (including, without limitation,
  5. # distribution and copying) is strictly prohibited. All use requires,
  6. # and is subject to, explicit written authorization and nondisclosure
  7. # Rambus, Inc. and/or its subsidiaries
  8. #
  9. # For more information or support, please go to our online support system at
  10. # https://sipsupport.rambus.com.
  11. # In case you do not have an account for this system, please send an e-mail
  12. # to sipsupport@rambus.com.
  13. ##############################################################################
  14. #
  15. # This script tests openssl engine e_eip28pka.so with openssl 1.1.1k
  16. # running on an x86 host and a PCIe virtex HW with the PKA module.
  17. # Tests:
  18. # 1. ECDSA sign and verify openssl positive flow
  19. # 2. ECDSA sign and verify engine eip28 positive flow
  20. # 3. ECDSA sign and verify openssl negative flow
  21. # 4. ECDSA sign and verify engine eip28 negative flow
  22. # Setup:
  23. # Setup:
  24. # 1. Configure the openssl: export OPENSSL_DIR="/path/to/openssl-1.1.1k"
  25. # 2. Set engine path: export OPENSSL_ENGINES=/path/to/engines
  26. # Usage:
  27. # run all tests: bash sign-and-verify.sh
  28. # run specific test: bash sign-and-verify.sh <test number>
  29. #
  30. # Date: 12/8/2021
  31. ##############################################################################
  32. ############################ constants ############################
  33. DEBUG=false
  34. OPENSSL=$OPENSSL_DIR/apps/openssl
  35. VALIDATE_SETUP=true
  36. ENGINE_ID_28=eip28pka
  37. KERNEL_MODULE=umpci_k
  38. PASS=0
  39. FAIL=1
  40. DATESTAMP=$(date +%y%m%d_%H%M)
  41. TEMPFILE=tempfile.txt
  42. VALGRIND_CMD='valgrind --leak-check=full --show-leak-kinds=all --log-file='$TEMPFILE
  43. ############################ functions ############################
  44. print_function() {
  45. echo "${FUNCNAME[1]}"
  46. }
  47. print_openssl_details() {
  48. [ $DEBUG = true ] && print_function
  49. which openssl
  50. ${OPENSSL} version
  51. }
  52. validate_environment() {
  53. [ $DEBUG = true ] && print_function
  54. if [ -z $OPENSSL_DIR ]; then
  55. echo "Error: Environment variable OPENSSL_DIR is undefined"
  56. return $FAIL
  57. fi
  58. if [ ! -f $OPENSSL_DIR/apps/openssl ]; then
  59. echo "Error: openssl client not found"
  60. return $FAIL
  61. fi
  62. if [ -z $OPENSSL_ENGINES ]; then
  63. echo "Error: Environment variable OPENSSL_ENGINES is undefined"
  64. return $FAIL
  65. fi
  66. if [ $(lsmod | grep "$KERNEL_MODULE" -c) -ne 1 ]; then
  67. echo "Error: kernel module $KERNEL_MODULE not found"
  68. return $FAIL
  69. fi
  70. return $PASS
  71. }
  72. print_engine_capabilities() {
  73. [ $DEBUG = true ] && print_function
  74. ${OPENSSL} engine -c $ENGINE_ID_28
  75. }
  76. create_test_file() {
  77. local filename=$1
  78. local length=$2
  79. [ $DEBUG = true ] && print_function
  80. echo $(${OPENSSL} rand -base64 $length) > $filename
  81. [ $DEBUG = true ] && cat $filename
  82. }
  83. create_ECDSA_private_key() {
  84. [ $DEBUG = true ] && print_function
  85. local engine=$1
  86. local private_key_file=$2
  87. local parameter_engine
  88. if [ $engine == true ]; then
  89. local valgrind=$VALGRIND
  90. local dovalgrind=$DO_VALGRIND
  91. fi
  92. if [ $dovalgrind ]; then
  93. echo "// create_ECDSA_private_key $2" >> edcsa-sign-and-verify_$DATESTAMP.log
  94. fi
  95. [ $engine == true ] && parameter_engine=-engine=$ENGINE_ID_28
  96. # possible curves: ${OPENSSL} ecparam -list_curves
  97. # prev. curve tested: secp384r1
  98. local ret
  99. local print
  100. print=`$valgrind ${OPENSSL} ecparam \
  101. $parameter_engine \
  102. -genkey \
  103. -name secp224r1 \
  104. -noout \
  105. -out $private_key_file 2>&1`
  106. ret=$?
  107. [ $DEBUG = true ] && echo "return: $ret"
  108. [ $DEBUG = true ] && cat $private_key_file
  109. if [ $dovalgrind ]; then
  110. cat $TEMPFILE >> edcsa-sign-and-verify_$DATESTAMP.log
  111. fi
  112. return $ret
  113. }
  114. create_ECDSA_public_key() {
  115. [ $DEBUG = true ] && print_function
  116. local engine=$1
  117. local private_key_file=$2
  118. local public_key_file=$3
  119. local parameter_engine
  120. if [ $engine == true ]; then
  121. local valgrind=$VALGRIND
  122. local dovalgrind=$DO_VALGRIND
  123. fi
  124. if [ $dovalgrind ]; then
  125. echo "// create_ECDSA_public_key $2 $3" >> edcsa-sign-and-verify_$DATESTAMP.log
  126. fi
  127. [ $engine == true ] && parameter_engine=-engine=$ENGINE_ID_28
  128. local ret
  129. local print
  130. print=`$valgrind ${OPENSSL} ec \
  131. $parameter_engine \
  132. -pubout \
  133. -in $private_key_file \
  134. -out $public_key_file 2>&1`
  135. ret=$?
  136. [ $DEBUG = true ] && echo "return: $ret"
  137. [ $DEBUG = true ] && cat $public_key_file
  138. if [ $dovalgrind ]; then
  139. cat $TEMPFILE >> edcsa-sign-and-verify_$DATESTAMP.log
  140. fi
  141. return $ret
  142. }
  143. hash_the_file() {
  144. [ $DEBUG = true ] && print_function
  145. local engine=$1
  146. local hash=$2
  147. local message_file=$3
  148. local hash_file=$4
  149. local parameter_engine
  150. if [ $engine == true ]; then
  151. local valgrind=$VALGRIND
  152. local dovalgrind=$DO_VALGRIND
  153. fi
  154. if [ $dovalgrind ]; then
  155. echo "// hash_the_file $2 $3 $4" >> edcsa-sign-and-verify_$DATESTAMP.log
  156. fi
  157. [ $engine == true ] && parameter_engine=-engine=$ENGINE_ID_28
  158. local ret
  159. local print
  160. print=`$valgrind ${OPENSSL} dgst \
  161. $parameter_engine \
  162. -sha256 \
  163. -out $hash_file \
  164. -binary \
  165. ${message_file} 2>&1`
  166. ret=$?
  167. [ $DEBUG = true ] && hexdump -x $hash_file
  168. if [ $dovalgrind ]; then
  169. cat $TEMPFILE >> edcsa-sign-and-verify_$DATESTAMP.log
  170. fi
  171. return $ret
  172. }
  173. sign_the_hash() {
  174. [ $DEBUG = true ] && print_function
  175. local engine=$1
  176. local hash=$2
  177. local private_key_file=$3
  178. local hash_file=$4
  179. local signature_file=$5
  180. local parameter_engine
  181. [ $engine == true ] && parameter_engine=-engine=$ENGINE_ID_28
  182. local ret
  183. local print
  184. if [ $engine == true ]; then
  185. local valgrind=$VALGRIND
  186. local dovalgrind=$DO_VALGRIND
  187. fi
  188. if [ $dovalgrind ]; then
  189. echo "// sign_the_hash $2 $3 $4 $5" >> edcsa-sign-and-verify_$DATESTAMP.log
  190. fi
  191. print=`$valgrind ${OPENSSL} pkeyutl \
  192. $parameter_engine \
  193. -sign \
  194. -out ${signature_file} \
  195. -in ${hash_file} \
  196. -inkey ${private_key_file} \
  197. -keyform pem \
  198. -pkeyopt digest:sha256 2>&1`
  199. ret=$?
  200. [ $DEBUG = true ] && echo "$print"
  201. [ $DEBUG = true ] && echo "return: $ret"
  202. [ $DEBUG = true ] && hexdump -x $signature_file
  203. if [ $dovalgrind ]; then
  204. cat $TEMPFILE >> edcsa-sign-and-verify_$DATESTAMP.log
  205. fi
  206. return $ret
  207. }
  208. validate_the_hash_with_the_signature() {
  209. [ $DEBUG = true ] && print_function
  210. local engine=$1
  211. local parameter_engine
  212. [ $engine == true ] && parameter_engine=-engine=$ENGINE_ID_28
  213. local public_key_file=$2
  214. local signature_file=$3
  215. local hash_file=$4
  216. local ret
  217. local print
  218. if [ $engine == true ]; then
  219. local valgrind=$VALGRIND
  220. local dovalgrind=$DO_VALGRIND
  221. fi
  222. if [ $dovalgrind ]; then
  223. echo "// validate_the_hash_with_the_signature $2 $3 $4 $5" >> edcsa-sign-and-verify_$DATESTAMP.log
  224. fi
  225. print=`$valgrind ${OPENSSL} pkeyutl \
  226. -verify \
  227. $parameter_engine \
  228. -pubin \
  229. -inkey ${public_key_file} \
  230. -in ${hash_file} \
  231. -sigfile ${signature_file} \
  232. -keyform pem \
  233. -pkeyopt digest:sha256 2>&1`
  234. ret=$?
  235. [ $DEBUG = true ] && echo "return: $ret"
  236. if [ $dovalgrind ]; then
  237. cat $TEMPFILE >> edcsa-sign-and-verify_$DATESTAMP.log
  238. fi
  239. return $ret
  240. }
  241. cleanup() {
  242. [ $DEBUG = true ] && print_function
  243. for f in "$@"; do
  244. [ -f "$f" ] && rm $f
  245. done
  246. }
  247. test_ecdsa_sign_and_verify_positive() {
  248. local use_engine=$1
  249. cleanup test.file ec_private.pem ec_public.pem ec_signature.bin test.file.hash
  250. create_test_file test.file 50
  251. create_ECDSA_private_key $use_engine ec_private.pem
  252. [ $? -ne 0 ] && return $FAIL
  253. hash_the_file $use_engine sha256 test.file test.file.hash
  254. [ $? -ne 0 ] && return $FAIL
  255. sign_the_hash $use_engine sha256 ec_private.pem test.file.hash ec_signature.bin
  256. [ $? -ne 0 ] && return $FAIL
  257. create_ECDSA_public_key $use_engine ec_private.pem ec_public.pem
  258. [ $? -ne 0 ] && return $FAIL
  259. validate_the_hash_with_the_signature $use_engine ec_public.pem ec_signature.bin test.file.hash
  260. [ $? -ne 0 ] && return $FAIL
  261. return $PASS
  262. }
  263. test_ecdsa_sign_and_verify_negative() {
  264. local use_engine=$1
  265. cleanup test.file ec_private.pem ec_private_2.pem ec_public_2.pem ec_signature.bin test.file.hash
  266. create_test_file test.file 50
  267. create_ECDSA_private_key $use_engine ec_private.pem
  268. [ $? -ne 0 ] && return $FAIL
  269. hash_the_file $use_engine sha256 test.file test.file.hash
  270. [ $? -ne 0 ] && return $FAIL
  271. sign_the_hash $use_engine sha256 ec_private.pem test.file.hash ec_signature.bin
  272. [ $? -ne 0 ] && return $FAIL
  273. create_ECDSA_private_key $use_engine ec_private_2.pem
  274. [ $? -ne 0 ] && return $FAIL
  275. create_ECDSA_public_key $use_engine ec_private_2.pem ec_public_2.pem
  276. [ $? -ne 0 ] && return $FAIL
  277. validate_the_hash_with_the_signature $use_engine ec_public_2.pem ec_signature.bin test.file.hash
  278. [ $? -eq 0 ] && return $FAIL # THIS IS A NEGATIVE TEST
  279. return $PASS
  280. }
  281. ############################ main ############################
  282. main () {
  283. # script arguments
  284. run_all=false
  285. run_test_number=0
  286. if [ "$1" -eq "$1" ] 2>/dev/null; then
  287. run_test_number=$1
  288. echo "Run test number $test_number"
  289. else
  290. run_all=true
  291. echo "Run all tests"
  292. fi
  293. if [ $VALIDATE_SETUP == true ]; then
  294. validate_environment
  295. [ $? -eq 1 ] && exit 1
  296. print_openssl_details
  297. print_engine_capabilities
  298. fi
  299. if [ "$1" = "-v" ] || [ "$2" = "-v" ]; then
  300. DO_VALGRIND=1
  301. VALGRIND=$VALGRIND_CMD
  302. echo "// OS_IK edcsa-sign-and-verify valgrind results - $DATESTAMP" > edcsa-sign-and-verify_$DATESTAMP.log
  303. fi
  304. if [ $run_all == true ] || [ $run_test_number -eq 1 ]; then
  305. test_name="ECDSA sign and verify using a matching pub key (openssl)"
  306. printf "Test %s: " "$test_name"
  307. test_ecdsa_sign_and_verify_positive false
  308. [ $? -eq $PASS ] && echo "PASSED" || echo "FAILED"
  309. fi
  310. if [ $run_all == true ] || [ $run_test_number -eq 2 ]; then
  311. test_name="ECDSA sign and verify using a matching pub key"
  312. printf "Test %s: " "$test_name"
  313. test_ecdsa_sign_and_verify_positive true
  314. [ $? -eq $PASS ] && echo "PASSED" || echo "FAILED"
  315. fi
  316. if [ $run_all == true ] || [ $run_test_number -eq 3 ]; then
  317. test_name="ECDSA sign and verify using an unmatching pub key (openssl)"
  318. printf "Test %s: " "$test_name"
  319. test_ecdsa_sign_and_verify_negative false
  320. [ $? -eq $PASS ] && echo "PASSED" || echo "FAILED"
  321. fi
  322. if [ $run_all == true ] || [ $run_test_number -eq 4 ]; then
  323. test_name="ECDSA sign and verify using an unmatching pub key (eip28)"
  324. printf "Test %s: " "$test_name"
  325. test_ecdsa_sign_and_verify_negative true
  326. [ $? -eq $PASS ] && echo "PASSED" || echo "FAILED"
  327. fi
  328. if [ $DO_VALGRIND ]; then
  329. rm $TEMPFILE
  330. fi
  331. exit 0
  332. }
  333. main "$@"