sm2-sign-and-verify.sh 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368
  1. #!/bin/bash
  2. ##############################################################################
  3. # Copyright (c) 2021 by Rambus, Inc. and/or its subsidiaries
  4. # All rights reserved. Unauthorized use (including, without limitation,
  5. # distribution and copying) is strictly prohibited. All use requires,
  6. # and is subject to, explicit written authorization and nondisclosure
  7. # Rambus, Inc. and/or its subsidiaries
  8. #
  9. # For more information or support, please go to our online support system at
  10. # https://sipsupport.rambus.com.
  11. # In case you do not have an account for this system, please send an e-mail
  12. # to sipsupport@rambus.com.
  13. ##############################################################################
  14. #
  15. # This script tests openssl engine e_eip28pka.so with openssl 1.1.1k
  16. # running on an x86 host and a PCIe virtex HW with the PKA module.
  17. #
  18. # Tests:
  19. # 1. SM2 sign (openssl) and verify (openssl) / matching private and public key
  20. # 2. SM2 sign (engine) and verify (engine) / matching private and public key
  21. # 3. SM2 sign (engine) and verify (openssl) / matching private and public key
  22. # 4. SM2 sign (openssl) and verify (engine) / matching private and public key
  23. # 5. SM2 sign (openssl) and verify (openssl) / unmatching private and public key
  24. # 6. SM2 sign (engine) and verify (engine) / unmatching private and public key
  25. #
  26. # Setup:
  27. # 1. Configure the openssl: export OPENSSL_DIR="/path/to/openssl-1.1.1k"
  28. # 2. Set engine path: export OPENSSL_ENGINES=/path/to/engines
  29. # 3. Configure the SM2 tool: export SM2TOOL_DIR="/path/to/sm2"
  30. #
  31. # Usage:
  32. # run all tests: bash sm2-sign-and-verify.sh
  33. # run a test: bash sm2-sign-and-verify.sh <test number>
  34. #
  35. # Date: 23/7/2021
  36. ##############################################################################
  37. ############################ constants ############################
  38. PASS=0
  39. FAIL=1
  40. DEBUG=false
  41. VALIDATE_SETUP=true
  42. ENGINE_ID_28=eip28pka
  43. KERNEL_MODULE=umpci_k
  44. OPENSSL=$OPENSSL_DIR/apps/openssl
  45. SM2SIGN=$SM2TOOL_DIR/sm2sign
  46. SM2VERIFY=$SM2TOOL_DIR/sm2verify
  47. DATESTAMP=$(date +%y%m%d_%H%M)
  48. TEMPFILE=tempfile.txt
  49. VALGRIND_CMD='valgrind --leak-check=full --show-leak-kinds=all --log-file='$TEMPFILE
  50. ############################ functions ############################
  51. print_function() {
  52. echo "${FUNCNAME[1]}"
  53. }
  54. print_openssl_details() {
  55. [ $DEBUG = true ] && print_function
  56. ${OPENSSL} version
  57. }
  58. validate_environment() {
  59. [ $DEBUG = true ] && print_function
  60. if [ -z $OPENSSL_DIR ]; then
  61. echo "Error: Environment variable OPENSSL_DIR is undefined"
  62. return $FAIL
  63. fi
  64. if [ ! -f $OPENSSL_DIR/apps/openssl ]; then
  65. echo "Error: openssl client not found"
  66. return $FAIL
  67. fi
  68. if [ -z $OPENSSL_ENGINES ]; then
  69. echo "Error: Environment variable OPENSSL_ENGINES is undefined"
  70. return $FAIL
  71. fi
  72. if [ -z $SM2TOOL_DIR ]; then
  73. echo "Error: Environment variable SM2TOOL_DIR is undefined"
  74. return $FAIL
  75. fi
  76. if [ ! -f $SM2SIGN ]; then
  77. echo "Error: sm2sign not found"
  78. return $FAIL
  79. fi
  80. if [ ! -f $SM2VERIFY ]; then
  81. echo "Error: sm2verify not found"
  82. return $FAIL
  83. fi
  84. if [ $(lsmod | grep "$KERNEL_MODULE" -c) -ne 1 ]; then
  85. echo "Error: kernel module $KERNEL_MODULE not found"
  86. return $FAIL
  87. fi
  88. return $PASS
  89. }
  90. print_engine_capabilities() {
  91. [ $DEBUG = true ] && print_function
  92. ${OPENSSL} engine -c $ENGINE_ID_28
  93. }
  94. print_configuration() {
  95. echo "DEBUG $DEBUG "
  96. echo "VALIDATE_SETUP $VALIDATE_SETUP"
  97. echo "ENGINE_ID_28 $ENGINE_ID_28 "
  98. echo "KERNEL_MODULE $KERNEL_MODULE "
  99. echo "OPENSSL $OPENSSL "
  100. echo "SM2SIGN $SM2SIGN "
  101. echo "SM2VERIFY $SM2VERIFY "
  102. }
  103. create_test_file() {
  104. local filename=$1
  105. local length=$2
  106. [ $DEBUG = true ] && print_function
  107. echo $(${OPENSSL} rand -base64 $length) > $filename
  108. [ $DEBUG = true ] && cat $filename
  109. }
  110. create_SM2_private_key() {
  111. [ $DEBUG = true ] && print_function
  112. local engine=$1
  113. local private_key_file=$2
  114. local parameter_engine
  115. [ $engine == true ] && parameter_engine=-engine=$ENGINE_ID_28
  116. local ret
  117. local print
  118. # generate private SM2 key:
  119. # apps/openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:sm2 -out private.pem
  120. # examine private SM2 key:
  121. # openssl ec -in private.pem -noout -text
  122. print=`$valgrind ${OPENSSL} genpkey \
  123. $parameter_engine \
  124. -algorithm EC \
  125. -pkeyopt ec_paramgen_curve:sm2 \
  126. -out $private_key_file 2>&1`
  127. ret=$?
  128. [ $DEBUG = true ] && echo "$print"
  129. [ $DEBUG = true ] && echo "return: $ret"
  130. [ $DEBUG = true ] && cat $private_key_file
  131. return $ret
  132. }
  133. derive_public_key() {
  134. [ $DEBUG = true ] && print_function
  135. local engine=$1
  136. local private_key_file=$2
  137. local public_key_file=$3
  138. local parameter_engine
  139. [ $engine == true ] && parameter_engine=-engine=$ENGINE_ID_28
  140. local ret
  141. local print
  142. # generate public SM2 key:
  143. # openssl ec -pubout -in private.pem -out public.pem
  144. # examine public SM2 key:
  145. # openssl ec -noout -text -inform PEM -in public.pem -pubin
  146. print=`${OPENSSL} ec \
  147. $parameter_engine \
  148. -pubout \
  149. -in $private_key_file \
  150. -out $public_key_file 2>&1`
  151. ret=$?
  152. [ $DEBUG = true ] && echo "return: $ret"
  153. [ $DEBUG = true ] && cat $public_key_file
  154. return $ret
  155. }
  156. hash_the_file_and_sign_the_hash() {
  157. [ $DEBUG = true ] && print_function
  158. local engine=$1
  159. local message_file=$2
  160. local private_key_file=$3
  161. local sm2id=$4
  162. local signature_file=$5
  163. local ret
  164. local print
  165. local parameter_engine
  166. if [ $engine == true ]; then
  167. local valgrind=$VALGRIND
  168. local dovalgrind=$DO_VALGRIND
  169. fi
  170. if [ $dovalgrind ]; then
  171. echo "// hash_the_file_and_sign_the_hash $2 $3 $4 $5" >> sm2-sign-and-verify_$DATESTAMP.log
  172. fi
  173. [ $engine == true ] && parameter_engine=--engine=$ENGINE_ID_28
  174. print=`$valgrind $SM2SIGN \
  175. $parameter_engine \
  176. --message $message_file \
  177. --key $private_key_file \
  178. --id $sm2id \
  179. --signature $signature_file 2>&1`
  180. ret=$?
  181. [ $DEBUG = true ] && echo "*********************** START *******************************"
  182. [ $DEBUG = true ] && echo "$print"
  183. [ $DEBUG = true ] && echo "*********************** END *******************************"
  184. [ $DEBUG = true ] && echo "return: $ret"
  185. if [ $dovalgrind ]; then
  186. cat $TEMPFILE >> sm2-sign-and-verify_$DATESTAMP.log
  187. fi
  188. return $ret
  189. }
  190. hash_the_file_and_validate_the_signature() {
  191. [ $DEBUG = true ] && print_function
  192. local engine=$1
  193. local message_file=$2
  194. local public_key_file=$3
  195. local sm2id=$4
  196. local signature_file=$5
  197. local ret
  198. local print
  199. local parameter_engine
  200. if [ $engine == true ]; then
  201. local valgrind=$VALGRIND
  202. local dovalgrind=$DO_VALGRIND
  203. fi
  204. if [ $dovalgrind ]; then
  205. echo "// hash_the_file_and_validate_the_signature $2 $3 $4 $5" >> sm2-sign-and-verify_$DATESTAMP.log
  206. fi
  207. [ $engine == true ] && parameter_engine=--engine=$ENGINE_ID_28
  208. print=`$valgrind $SM2VERIFY \
  209. $parameter_engine \
  210. --message $message_file \
  211. --key $public_key_file \
  212. --id $sm2id \
  213. --signature $signature_file 2>&1`
  214. ret=$?
  215. [ $DEBUG = true ] && echo "*********************** START *******************************"
  216. [ $DEBUG = true ] && echo "$print"
  217. [ $DEBUG = true ] && echo "*********************** END *******************************"
  218. [ $DEBUG = true ] && echo "return: $ret"
  219. if [ $dovalgrind ]; then
  220. cat $TEMPFILE >> sm2-sign-and-verify_$DATESTAMP.log
  221. fi
  222. return $ret
  223. }
  224. cleanup() {
  225. [ $DEBUG = true ] && print_function
  226. for f in "$@"; do
  227. [ -f "$f" ] && rm $f
  228. done
  229. }
  230. test_sm2_sign_and_verify_positive() {
  231. local use_engine_sign=$1
  232. local use_engine_verify=$2
  233. cleanup test.file private.pem public.pem signature.bin test.file.hash
  234. create_test_file test.file 50
  235. create_SM2_private_key false private.pem
  236. [ $? -ne 0 ] && return 1
  237. hash_the_file_and_sign_the_hash $use_engine_sign test.file private.pem 1234letter signature.bin
  238. [ $? -ne 0 ] && return 2
  239. derive_public_key false private.pem public.pem
  240. [ $? -ne 0 ] && return 3
  241. hash_the_file_and_validate_the_signature $use_engine_verify test.file public.pem 1234letter signature.bin
  242. [ $? -ne 0 ] && return 4
  243. return $PASS
  244. }
  245. test_sm2_sign_and_verify_negative() {
  246. local use_engine_sign=$1
  247. local use_engine_verify=$2
  248. cleanup test.file private.pem private_2.pem public_2.pem signature.bin test.file.hash
  249. create_test_file test.file 50
  250. create_SM2_private_key false private.pem
  251. [ $? -ne 0 ] && return 1
  252. hash_the_file_and_sign_the_hash $use_engine_sign test.file private.pem 1234letter signature.bin
  253. [ $? -ne 0 ] && return 2
  254. create_SM2_private_key false private_2.pem
  255. [ $? -ne 0 ] && return 3
  256. derive_public_key false private_2.pem public_2.pem
  257. [ $? -ne 0 ] && return 4
  258. hash_the_file_and_validate_the_signature $use_engine_verify test.file public_2.pem 1234letter signature.bin
  259. [ $? -eq 0 ] && return 5 # THIS IS A NEGATIVE TEST
  260. return $PASS
  261. }
  262. ############################ main ############################
  263. main () {
  264. echo "Test: SM2 sign and verify"
  265. # arguments
  266. run_all=false
  267. run_test_number=0
  268. if [ "$1" -eq "$1" ] 2>/dev/null; then
  269. run_test_number=$1
  270. echo "Run test number $test_number"
  271. else
  272. run_all=true
  273. echo "Run all tests"
  274. fi
  275. # validation
  276. if [ $VALIDATE_SETUP == true ]; then
  277. echo "validate setup"
  278. validate_environment
  279. [ $? -eq $FAIL ] && exit 1
  280. print_configuration
  281. print_openssl_details
  282. print_engine_capabilities
  283. fi
  284. if [ "$1" = "-v" ] || [ "$2" = "-v" ]; then
  285. DO_VALGRIND=1
  286. VALGRIND=$VALGRIND_CMD
  287. echo "// OS_IK sm2-sign-and-verify valgrind results - $DATESTAMP" > sm2-sign-and-verify_$DATESTAMP.log
  288. fi
  289. # tests:
  290. if [ $run_all == true ] || [ $run_test_number -eq 1 ]; then
  291. test_name="SM2 sign and verify using a matching pub key (openssl, openssl)"
  292. printf "Test %s: " "$test_name"
  293. test_sm2_sign_and_verify_positive false false
  294. result=$?
  295. [ $result -eq $PASS ] && echo "PASSED" || echo "FAILED ($result)"
  296. fi
  297. if [ $run_all == true ] || [ $run_test_number -eq 2 ]; then
  298. test_name="SM2 sign and verify using a matching pub key (engine, engine)"
  299. printf "Test %s: " "$test_name"
  300. test_sm2_sign_and_verify_positive true true
  301. result=$?
  302. [ $result -eq $PASS ] && echo "PASSED" || echo "FAILED ($result)"
  303. fi
  304. if [ $run_all == true ] || [ $run_test_number -eq 3 ]; then
  305. test_name="SM2 sign and verify using a matching pub key (engine, openssl)"
  306. printf "Test %s: " "$test_name"
  307. test_sm2_sign_and_verify_positive true false
  308. result=$?
  309. [ $result -eq $PASS ] && echo "PASSED" || echo "FAILED ($result)"
  310. fi
  311. if [ $run_all == true ] || [ $run_test_number -eq 4 ]; then
  312. test_name="SM2 sign and verify using a matching pub key (openssl, engine)"
  313. printf "Test %s: " "$test_name"
  314. test_sm2_sign_and_verify_positive false true
  315. result=$?
  316. [ $result -eq $PASS ] && echo "PASSED" || echo "FAILED ($result)"
  317. fi
  318. if [ $run_all == true ] || [ $run_test_number -eq 5 ]; then
  319. test_name="SM2 sign and verify using an unmatching pub key (openssl, openssl)"
  320. printf "Test %s: " "$test_name"
  321. test_sm2_sign_and_verify_negative false false
  322. result=$?
  323. [ $result -eq $PASS ] && echo "PASSED" || echo "FAILED ($result)"
  324. fi
  325. if [ $run_all == true ] || [ $run_test_number -eq 6 ]; then
  326. test_name="SM2 sign and verify using an unmatching pub key (engine, engine)"
  327. printf "Test %s: " "$test_name"
  328. test_sm2_sign_and_verify_negative true true
  329. result=$?
  330. [ $result -eq $PASS ] && echo "PASSED" || echo "FAILED ($result)"
  331. fi
  332. if [ $DO_VALGRIND ]; then
  333. rm $TEMPFILE
  334. fi
  335. exit 0
  336. }
  337. main "$@"