sm2-encrypt-and-decrypt.sh 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376
  1. #!/bin/bash
  2. ##############################################################################
  3. # Copyright (c) 2021 by Rambus, Inc. and/or its subsidiaries
  4. # All rights reserved. Unauthorized use (including, without limitation,
  5. # distribution and copying) is strictly prohibited. All use requires,
  6. # and is subject to, explicit written authorization and nondisclosure
  7. # Rambus, Inc. and/or its subsidiaries
  8. #
  9. # For more information or support, please go to our online support system at
  10. # https://sipsupport.rambus.com.
  11. # In case you do not have an account for this system, please send an e-mail
  12. # to sipsupport@rambus.com.
  13. ##############################################################################
  14. #
  15. # This script tests openssl engine e_eip28pka.so with openssl 1.1.1k
  16. # running on an x86 host and a PCIe virtex HW with the PKA module.
  17. #
  18. # Tests:
  19. # 1. SM2 encrypt (openssl) and decrypt (openssl) / matching private and public key
  20. # 2. SM2 sign (engine) and verify (engine) / matching private and public key
  21. # 3. SM2 sign (engine) and verify (openssl) / matching private and public key
  22. # 4. SM2 sign (openssl) and verify (engine) / matching private and public key
  23. # 5. SM2 sign (openssl) and verify (openssl) / unmatching private and public key
  24. # 6. SM2 sign (engine) and verify (engine) / unmatching private and public key
  25. #
  26. # Setup:
  27. # 1. Configure the openssl: export OPENSSL_DIR="/path/to/openssl-1.1.1k"
  28. # 2. Set engine path: export OPENSSL_ENGINES=/path/to/engines
  29. # 3. Configure the SM2 tool: export SM2TOOL_DIR="/path/to/sm2"
  30. #
  31. # Usage:
  32. # run all tests: bash sm2-encrypt-and-decrypt.sh
  33. # run a test: bash sm2-encrypt-and-decrypt.sh <test number>
  34. #
  35. # Date: 12/8/2021
  36. ##############################################################################
  37. ############################ constants ############################
  38. PASS=0
  39. FAIL=1
  40. DEBUG=false
  41. VALIDATE_SETUP=true
  42. ENGINE_ID_28=eip28pka
  43. KERNEL_MODULE=umpci_k
  44. OPENSSL=$OPENSSL_DIR/apps/openssl
  45. SM2ENCRYPT=$SM2TOOL_DIR/sm2encrypt
  46. SM2DECRYPT=$SM2TOOL_DIR/sm2decrypt
  47. DATESTAMP=$(date +%y%m%d_%H%M)
  48. TEMPFILE=tempfile.txt
  49. VALGRIND_CMD='valgrind --leak-check=full --show-leak-kinds=all --log-file='$TEMPFILE
  50. ############################ functions ############################
  51. print_function() {
  52. echo "${FUNCNAME[1]}"
  53. }
  54. print_openssl_details() {
  55. [ $DEBUG = true ] && print_function
  56. ${OPENSSL} version
  57. }
  58. validate_environment() {
  59. [ $DEBUG = true ] && print_function
  60. if [ -z $OPENSSL_DIR ]; then
  61. echo "Error: Environment variable OPENSSL_DIR is undefined"
  62. return $FAIL
  63. fi
  64. if [ ! -f $OPENSSL_DIR/apps/openssl ]; then
  65. echo "Error: openssl client not found"
  66. return $FAIL
  67. fi
  68. if [ -z $OPENSSL_ENGINES ]; then
  69. echo "Error: Environment variable OPENSSL_ENGINES is undefined"
  70. return $FAIL
  71. fi
  72. if [ -z $SM2TOOL_DIR ]; then
  73. echo "Error: Environment variable SM2TOOL_DIR is undefined"
  74. return $FAIL
  75. fi
  76. if [ ! -f $SM2ENCRYPT ]; then
  77. echo "Error: sm2encrypt not found"
  78. return $FAIL
  79. fi
  80. if [ ! -f $SM2DECRYPT ]; then
  81. echo "Error: sm2decrypt not found"
  82. return $FAIL
  83. fi
  84. if [ $(lsmod | grep "$KERNEL_MODULE" -c) -ne 1 ]; then
  85. echo "Error: kernel module $KERNEL_MODULE not found"
  86. return $FAIL
  87. fi
  88. return $PASS
  89. }
  90. print_engine_capabilities() {
  91. [ $DEBUG = true ] && print_function
  92. ${OPENSSL} engine -c $ENGINE_ID_28
  93. }
  94. is_engine_available() {
  95. if [ $(${OPENSSL} engine -t eip28pka | grep -c "\[ available \]") -ne 1 ]; then
  96. echo "Error: engine unavailable"
  97. return $FAIL
  98. fi
  99. return $PASS
  100. }
  101. print_configuration() {
  102. echo "DEBUG $DEBUG "
  103. echo "VALIDATE_SETUP $VALIDATE_SETUP"
  104. echo "ENGINE_ID_28 $ENGINE_ID_28 "
  105. echo "KERNEL_MODULE $KERNEL_MODULE "
  106. echo "OPENSSL $OPENSSL "
  107. echo "SM2ENCRYPT $SM2ENCRYPT "
  108. echo "SM2DECRYPT $SM2DECRYPT "
  109. }
  110. create_test_file() {
  111. local filename=$1
  112. local length=$2
  113. [ $DEBUG = true ] && print_function
  114. echo $(${OPENSSL} rand -base64 $length) > $filename
  115. [ $DEBUG = true ] && cat $filename
  116. }
  117. create_SM2_private_key() {
  118. [ $DEBUG = true ] && print_function
  119. local engine=$1
  120. local private_key_file=$2
  121. local parameter_engine
  122. [ $engine == true ] && parameter_engine=-engine=$ENGINE_ID_28
  123. local ret
  124. local print
  125. # generate private SM2 key:
  126. # apps/openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:sm2 -out private.pem
  127. # examine private SM2 key:
  128. # openssl ec -in private.pem -noout -text
  129. print=`${OPENSSL} genpkey \
  130. $parameter_engine \
  131. -algorithm EC \
  132. -pkeyopt ec_paramgen_curve:sm2 \
  133. -out $private_key_file 2>&1`
  134. ret=$?
  135. [ $DEBUG = true ] && echo "$print"
  136. [ $DEBUG = true ] && echo "return: $ret"
  137. [ $DEBUG = true ] && cat $private_key_file
  138. return $ret
  139. }
  140. derive_public_key() {
  141. [ $DEBUG = true ] && print_function
  142. local engine=$1
  143. local private_key_file=$2
  144. local public_key_file=$3
  145. local parameter_engine
  146. [ $engine == true ] && parameter_engine=-engine=$ENGINE_ID_28
  147. local ret
  148. local print
  149. # generate public SM2 key:
  150. # openssl ec -pubout -in private.pem -out public.pem
  151. # examine public SM2 key:
  152. # openssl ec -noout -text -inform PEM -in public.pem -pubin
  153. print=`${OPENSSL} ec \
  154. $parameter_engine \
  155. -pubout \
  156. -in $private_key_file \
  157. -out $public_key_file 2>&1`
  158. ret=$?
  159. [ $DEBUG = true ] && echo "return: $ret"
  160. [ $DEBUG = true ] && cat $public_key_file
  161. return $ret
  162. }
  163. sm2_encrypt() {
  164. [ $DEBUG = true ] && print_function
  165. local engine=$1
  166. local message_file=$2
  167. local public_key_file=$3
  168. local output_file=$4
  169. local ret
  170. local print
  171. local parameter_engine
  172. if [ $engine == true ]; then
  173. local valgrind=$VALGRIND
  174. local dovalgrind=$DO_VALGRIND
  175. fi
  176. if [ $dovalgrind ]; then
  177. echo "// sm2_encrypt $2 $3 $4" >> sm2-encrypt-and-decrypt_$DATESTAMP.log
  178. fi
  179. [ $engine == true ] && parameter_engine=--engine=$ENGINE_ID_28
  180. print=`$valgrind $SM2ENCRYPT \
  181. $parameter_engine \
  182. --message $message_file \
  183. --key $public_key_file \
  184. --out $output_file 2>&1`
  185. ret=$?
  186. [ $DEBUG = true ] && echo "*********************** START *******************************"
  187. [ $DEBUG = true ] && echo "$print"
  188. [ $DEBUG = true ] && echo "*********************** END *******************************"
  189. [ $DEBUG = true ] && echo "return: $ret"
  190. if [ $dovalgrind ]; then
  191. cat $TEMPFILE >> sm2-encrypt-and-decrypt_$DATESTAMP.log
  192. fi
  193. return $ret
  194. }
  195. sm2_decrypt() {
  196. [ $DEBUG = true ] && print_function
  197. local engine=$1
  198. local encrypted_file=$2
  199. local private_key_file=$3
  200. local output_file=$4
  201. local ret
  202. local print
  203. local parameter_engine
  204. if [ $engine == true ]; then
  205. local valgrind=$VALGRIND
  206. local dovalgrind=$DO_VALGRIND
  207. fi
  208. if [ $dovalgrind ]; then
  209. echo "// sm2_decrypt $2 $3 $4" >> sm2-encrypt-and-decrypt_$DATESTAMP.log
  210. fi
  211. [ $engine == true ] && parameter_engine=--engine=$ENGINE_ID_28
  212. print=`$SM2DECRYPT \
  213. $parameter_engine \
  214. --encrypted $encrypted_file \
  215. --key $private_key_file \
  216. --out $output_file 2>&1`
  217. ret=$?
  218. [ $DEBUG = true ] && echo "*********************** START *******************************"
  219. [ $DEBUG = true ] && echo "$print"
  220. [ $DEBUG = true ] && echo "*********************** END *******************************"
  221. [ $DEBUG = true ] && echo "return: $ret"
  222. if [ $dovalgrind ]; then
  223. cat $TEMPFILE >> sm2-encrypt-and-decrypt_$DATESTAMP.log
  224. fi
  225. return $ret
  226. }
  227. cleanup() {
  228. [ $DEBUG = true ] && print_function
  229. for f in "$@"; do
  230. [ -f "$f" ] && rm $f
  231. done
  232. }
  233. test_sm2_encrypt_and_decrypt_positive() {
  234. local use_engine_encrypt=$1
  235. local use_engine_decrypt=$2
  236. cleanup test.file private.pem public.pem test.file.enc test.file.dec
  237. create_test_file test.file 50
  238. create_SM2_private_key false private.pem
  239. [ $? -ne 0 ] && return 1
  240. derive_public_key false private.pem public.pem
  241. [ $? -ne 0 ] && return 2
  242. sm2_encrypt $use_engine_encrypt test.file public.pem test.file.enc
  243. [ $? -ne 0 ] && return 3
  244. sm2_decrypt $use_engine_decrypt test.file.enc private.pem test.file.dec
  245. [ $? -ne 0 ] && return 4
  246. cmp -s test.file test.file.dec
  247. [ $? -ne 0 ] && return 5
  248. return $PASS
  249. }
  250. test_sm2_encrypt_and_decrypt_negative() {
  251. local use_engine_encrypt=$1
  252. local use_engine_decrypt=$2
  253. cleanup test.file private.pem private_2.pem public_2.pem test.file.enc test.file.dec
  254. create_test_file test.file 50
  255. create_SM2_private_key false private.pem
  256. [ $? -ne 0 ] && return 1
  257. create_SM2_private_key false private_2.pem
  258. [ $? -ne 0 ] && return 2
  259. derive_public_key false private_2.pem public_2.pem
  260. [ $? -ne 0 ] && return 3
  261. sm2_encrypt $use_engine_encrypt test.file public_2.pem test.file.enc
  262. [ $? -ne 0 ] && return 4
  263. sm2_decrypt $use_engine_decrypt test.file.enc private.pem test.file.dec
  264. [ $? -eq 0 ] && return 5 # THIS IS A NEGATIVE TEST
  265. return $PASS
  266. }
  267. ############################ main ############################
  268. main () {
  269. echo "Test: SM2 encrypt and decrypt"
  270. # arguments
  271. run_all=false
  272. run_test_number=0
  273. if [ "$1" -eq "$1" ] 2>/dev/null; then
  274. run_test_number=$1
  275. echo "Run test number $test_number"
  276. else
  277. run_all=true
  278. echo "Run all tests"
  279. fi
  280. # validation
  281. if [ $VALIDATE_SETUP == true ]; then
  282. echo "validate setup"
  283. validate_environment
  284. [ $? -eq $FAIL ] && exit 1
  285. is_engine_available
  286. [ $? -eq $FAIL ] && exit 1
  287. print_configuration
  288. print_openssl_details
  289. print_engine_capabilities
  290. fi
  291. if [ "$1" = "-v" ] || [ "$2" = "-v" ]; then
  292. DO_VALGRIND=1
  293. VALGRIND=$VALGRIND_CMD
  294. echo "// OS_IK sm2-encrypt-and-decrypt valgrind results - $DATESTAMP" > sm2-encrypt-and-decrypt_$DATESTAMP.log
  295. fi
  296. # tests:
  297. if [ $run_all == true ] || [ $run_test_number -eq 1 ]; then
  298. test_name="SM2 encrypt and decrypt using a matching pub key (openssl, openssl)"
  299. printf "Test %s: " "$test_name"
  300. test_sm2_encrypt_and_decrypt_positive false false
  301. result=$?
  302. [ $result -eq $PASS ] && echo "PASSED" || echo "FAILED ($result)"
  303. fi
  304. if [ $run_all == true ] || [ $run_test_number -eq 2 ]; then
  305. test_name="SM2 encrypt and decrypt using a matching pub key (engine, engine)"
  306. printf "Test %s: " "$test_name"
  307. test_sm2_encrypt_and_decrypt_positive true true
  308. result=$?
  309. [ $result -eq $PASS ] && echo "PASSED" || echo "FAILED ($result)"
  310. fi
  311. if [ $run_all == true ] || [ $run_test_number -eq 3 ]; then
  312. test_name="SM2 encrypt and decrypt using a matching pub key (engine, openssl)"
  313. printf "Test %s: " "$test_name"
  314. test_sm2_encrypt_and_decrypt_positive true false
  315. result=$?
  316. [ $result -eq $PASS ] && echo "PASSED" || echo "FAILED ($result)"
  317. fi
  318. if [ $run_all == true ] || [ $run_test_number -eq 4 ]; then
  319. test_name="SM2 encrypt and decrypt using a matching pub key (openssl, engine)"
  320. printf "Test %s: " "$test_name"
  321. test_sm2_encrypt_and_decrypt_positive false true
  322. result=$?
  323. [ $result -eq $PASS ] && echo "PASSED" || echo "FAILED ($result)"
  324. fi
  325. if [ $run_all == true ] || [ $run_test_number -eq 5 ]; then
  326. test_name="SM2 encrypt and decrypt using an unmatching pub key (openssl, openssl)"
  327. printf "Test %s: " "$test_name"
  328. test_sm2_encrypt_and_decrypt_negative false false
  329. result=$?
  330. [ $result -eq $PASS ] && echo "PASSED" || echo "FAILED ($result)"
  331. fi
  332. if [ $run_all == true ] || [ $run_test_number -eq 6 ]; then
  333. test_name="SM2 encrypt and decrypt using an unmatching pub key (engine, engine)"
  334. printf "Test %s: " "$test_name"
  335. test_sm2_encrypt_and_decrypt_negative true true
  336. result=$?
  337. [ $result -eq $PASS ] && echo "PASSED" || echo "FAILED ($result)"
  338. fi
  339. if [ $DO_VALGRIND ]; then
  340. rm $TEMPFILE
  341. fi
  342. exit 0
  343. }
  344. main "$@"