diff options
| -rw-r--r-- | py11/__init__.py | 45 | ||||
| -rw-r--r-- | unit_tests.py | 111 |
2 files changed, 135 insertions, 21 deletions
diff --git a/py11/__init__.py b/py11/__init__.py index 9d3837e..80495d9 100644 --- a/py11/__init__.py +++ b/py11/__init__.py @@ -119,14 +119,19 @@ class PKCS11 (object): def C_Login(self, session, user, pin): self.so.C_Login(session, user, pin, len(pin)) - def C_GetAttributeValue(self, session_handle, object_handle, attributes): + def C_GetAttributeValue(self, session_handle, object_handle, *attributes): + if len(attributes) == 1 and isinstance(attributes[0], (list, tuple)): + attributes = attributes[0] template = self.adb.getvalue_create_template(attributes) self.so.C_GetAttributeValue(session_handle, object_handle, template, len(template)) self.adb.getvalue_allocate_template(template) self.so.C_GetAttributeValue(session_handle, object_handle, template, len(template)) return self.adb.from_ctypes(template) - def C_FindObjectsInit(self, session, template): + def C_FindObjectsInit(self, session, template = None, **kwargs): + if kwargs: + assert not template + template = kwargs if template: self.so.C_FindObjectsInit(session, self.adb.to_ctypes(template), len(template)) else: @@ -140,6 +145,12 @@ class PKCS11 (object): for i in xrange(count.value): yield objects[i] + def Find(self, session, template = None, **kwargs): + self.C_FindObjectsInit(session, template, **kwargs) + for obj in self.C_FindObjects(session): + yield obj + self.C_FindObjectsFinal(session) + def _parse_GenerateKeyPair_template(self, # Attributes common to public and private templates CKA_ID, @@ -159,19 +170,26 @@ class PKCS11 (object): **kwargs): if CKA_LABEL is None: CKA_LABEL = CKA_ID - public = dict(kwargs, CKA_LABEL = CKA_LABEL, CKA_ID = CKA_ID, CKA_TOKEN = public_CKA_TOKEN or CKA_TOKEN) - private = dict(CKA_LABEL = CKA_LABEL, CKA_ID = CKA_ID, CKA_TOKEN = private_CKA_TOKEN or CKA_TOKEN, - CKA_SIGN = CKA_SIGN, CKA_DECRYPT = CKA_DECRYPT, CKA_UNWRAP = CKA_UNWRAP, - CKA_SENSITIVE = CKA_SENSITIVE, CKA_PRIVATE = CKA_PRIVATE, CKA_EXTRACTABLE = CKA_EXTRACTABLE) - return self.adb.to_ctypes(public), self.adb.to_ctypes(private) + return (dict(kwargs, + CKA_LABEL = CKA_LABEL, + CKA_ID = CKA_ID, + CKA_TOKEN = public_CKA_TOKEN or CKA_TOKEN), + dict(CKA_LABEL = CKA_LABEL, + CKA_ID = CKA_ID, + CKA_TOKEN = private_CKA_TOKEN or CKA_TOKEN, + CKA_SIGN = CKA_SIGN, + CKA_DECRYPT = CKA_DECRYPT, + CKA_UNWRAP = CKA_UNWRAP, + CKA_SENSITIVE = CKA_SENSITIVE, + CKA_PRIVATE = CKA_PRIVATE, + CKA_EXTRACTABLE = CKA_EXTRACTABLE)) def C_GenerateKeyPair(self, session, mechanism_type, public_template = None, private_template = None, **kwargs): - assert kwargs or (public_template and private_template) if kwargs: + assert not public_template and not private_template public_template, private_template = self._parse_GenerateKeyPair_template(**kwargs) - else: - public_template = self.adb.to_ctypes(public_template) - private_template = self.adb.to_ctypes(private_template) + public_template = self.adb.to_ctypes(public_template) + private_template = self.adb.to_ctypes(private_template) mechanism = CK_MECHANISM(mechanism_type, None, 0) public_handle = CK_OBJECT_HANDLE() private_handle = CK_OBJECT_HANDLE() @@ -215,7 +233,10 @@ class PKCS11 (object): def C_VerifyFinal(self, session, signature): self.so.C_VerifyFinal(session, signature, len(signature)) - def C_CreateObject(self, session, template): + def C_CreateObject(self, session, template = None, **kwargs): + if kwargs: + assert not template + template = kwargs template = self.adb.to_ctypes(template) handle = CK_OBJECT_HANDLE() self.so.C_CreateObject(session, template, len(template), byref(handle)) diff --git a/unit_tests.py b/unit_tests.py index b38e4ac..b82a479 100644 --- a/unit_tests.py +++ b/unit_tests.py @@ -118,18 +118,18 @@ class TestKeys(unittest.TestCase): p11.C_Login(self.session, CKU_USER, user_pin) def tearDown(self): + for handle in p11.Find(self.session): + p11.C_DestroyObject(self.session, handle) p11.C_CloseAllSessions(only_slot) del self.session - def assertIsKeypair(self, public_key, private_key = None): - if isinstance(public_key, tuple) and private_key is None: - public_key, private_key = public_key - self.assertIsInstance(public_key, (int, long)) - self.assertIsInstance(private_key, (int, long)) - # Could do something clever here like use C_GetAttributeValue() to - # examine the objects. Maybe later. + def assertIsKeypair(self, public_handle, private_handle = None): + if isinstance(public_handle, tuple) and private_handle is None: + public_handle, private_handle = public_handle + self.assertEqual(p11.C_GetAttributeValue(self.session, public_handle, CKA_CLASS)[CKA_CLASS], CKO_PUBLIC_KEY) + self.assertEqual(p11.C_GetAttributeValue(self.session, private_handle, CKA_CLASS)[CKA_CLASS], CKO_PRIVATE_KEY) - def test_keygen_ec_p256(self): + def test_keygen_token_vs_session(self): self.assertIsKeypair( p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, CKA_TOKEN = False, CKA_ID = "EC-P256", CKA_EC_PARAMS = self.oid_p256, @@ -150,7 +150,7 @@ class TestKeys(unittest.TestCase): CKA_SIGN = True, CKA_VERIFY = True)) def test_gen_sign_verify_ecdsa_p256_sha256(self): - public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, CKA_TOKEN = False, + public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, CKA_ID = "EC-P256", CKA_EC_PARAMS = self.oid_p256, CKA_SIGN = True, CKA_VERIFY = True) self.assertIsKeypair(public_key, private_key) @@ -161,6 +161,99 @@ class TestKeys(unittest.TestCase): p11.C_VerifyInit(self.session, CKM_ECDSA_SHA256, public_key) p11.C_Verify(self.session, hamster, sig) + @unittest.skip("SHA-384 not available in current build") + def test_gen_sign_verify_ecdsa_p384_sha384(self): + public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, + CKA_ID = "EC-P384", CKA_EC_PARAMS = self.oid_p384, + CKA_SIGN = True, CKA_VERIFY = True) + self.assertIsKeypair(public_key, private_key) + hamster = "Your mother was a hamster" + p11.C_SignInit(self.session, CKM_ECDSA_SHA384, private_key) + sig = p11.C_Sign(self.session, hamster) + self.assertIsInstance(sig, str) + p11.C_VerifyInit(self.session, CKM_ECDSA_SHA384, public_key) + p11.C_Verify(self.session, hamster, sig) + + @unittest.skip("SHA-512 not available in current build") + def test_gen_sign_verify_ecdsa_p521_sha512(self): + public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, + CKA_ID = "EC-P521", CKA_EC_PARAMS = self.oid_p521, + CKA_SIGN = True, CKA_VERIFY = True) + self.assertIsKeypair(public_key, private_key) + hamster = "Your mother was a hamster" + p11.C_SignInit(self.session, CKM_ECDSA_SHA512, private_key) + sig = p11.C_Sign(self.session, hamster) + self.assertIsInstance(sig, str) + p11.C_VerifyInit(self.session, CKM_ECDSA_SHA512, public_key) + p11.C_Verify(self.session, hamster, sig) + + def test_gen_rsa_1024(self): + self.assertIsKeypair( + p11.C_GenerateKeyPair(self.session, CKM_RSA_PKCS_KEY_PAIR_GEN, CKA_MODULUS_BITS = 1024, + CKA_ID = "RSA-1024", CKA_SIGN = True, CKA_VERIFY = True)) + + @unittest.skip("RSA key generation is still painfully slow") + def test_gen_rsa_2048(self): + self.assertIsKeypair( + p11.C_GenerateKeyPair(self.session, CKM_RSA_PKCS_KEY_PAIR_GEN, CKA_MODULUS_BITS = 2048, + CKA_ID = "RSA-1024", CKA_SIGN = True, CKA_VERIFY = True)) + + @staticmethod + def _build_ecpoint(x, y): + bytes_per_coordinate = (max(x.bit_length(), y.bit_length()) + 15) / 16 + value = chr(0x04) + ("%0*x%0*x" % (bytes_per_coordinate, x, bytes_per_coordinate, y)).decode("hex") + if len(value) < 128: + length = chr(len(value)) + else: + n = len(value).bit_length() + length = chr((n + 7) / 8) + ("%0*x" % ((n + 15) / 16, len(value))).decode("hex") + tag = chr(0x04) + return tag + length + value + + def test_canned_ecdsa_p256_verify(self): + Q = self._build_ecpoint(0x8101ece47464a6ead70cf69a6e2bd3d88691a3262d22cba4f7635eaff26680a8, + 0xd8a12ba61d599235f67d9cb4d58f1783d3ca43e78f0a5abaa624079936c0c3a9) + H = "7c3e883ddc8bd688f96eac5e9324222c8f30f9d6bb59e9c5f020bd39ba2b8377".decode("hex") + r = "7214bc9647160bbd39ff2f80533f5dc6ddd70ddf86bb815661e805d5d4e6f27c".decode("hex") + s = "7d1ff961980f961bdaa3233b6209f4013317d3e3f9e1493592dbeaa1af2bc367".decode("hex") + handle = p11.C_CreateObject( + session = self.session, + CKA_CLASS = CKO_PUBLIC_KEY, + CKA_KEY_TYPE = CKK_EC, + CKA_LABEL = "EC-P-256 test case from \"Suite B Implementer's Guide to FIPS 186-3\"", + CKA_ID = "EC-P-256", + CKA_VERIFY = True, + CKA_ENCRYPT = False, + CKA_WRAP = False, + CKA_TOKEN = False, + CKA_EC_POINT = Q, + CKA_EC_PARAMS = self.oid_p256) + p11.C_VerifyInit(self.session, CKM_ECDSA, handle) + p11.C_Verify(self.session, H, r + s) + + def test_canned_ecdsa_p384_verify(self): + Q = self._build_ecpoint(0x1fbac8eebd0cbf35640b39efe0808dd774debff20a2a329e91713baf7d7f3c3e81546d883730bee7e48678f857b02ca0, + 0xeb213103bd68ce343365a8a4c3d4555fa385f5330203bdd76ffad1f3affb95751c132007e1b240353cb0a4cf1693bdf9) + H = "b9210c9d7e20897ab86597266a9d5077e8db1b06f7220ed6ee75bd8b45db37891f8ba5550304004159f4453dc5b3f5a1".decode("hex") + r = "a0c27ec893092dea1e1bd2ccfed3cf945c8134ed0c9f81311a0f4a05942db8dbed8dd59f267471d5462aa14fe72de856".decode("hex") + s = "20ab3f45b74f10b6e11f96a2c8eb694d206b9dda86d3c7e331c26b22c987b7537726577667adadf168ebbe803794a402".decode("hex") + handle = p11.C_CreateObject( + session = self.session, + CKA_CLASS = CKO_PUBLIC_KEY, + CKA_KEY_TYPE = CKK_EC, + CKA_LABEL = "EC-P-384 test case from \"Suite B Implementer's Guide to FIPS 186-3\"", + CKA_ID = "EC-P-384", + CKA_VERIFY = True, + CKA_ENCRYPT = False, + CKA_WRAP = False, + CKA_TOKEN = False, + CKA_EC_POINT = Q, + CKA_EC_PARAMS = self.oid_p384) + p11.C_VerifyInit(self.session, CKM_ECDSA, handle) + p11.C_Verify(self.session, H, r + s) + + + def setUpModule(): global p11 |