diff options
| -rw-r--r-- | unit_tests.py | 66 |
1 files changed, 29 insertions, 37 deletions
diff --git a/unit_tests.py b/unit_tests.py index 3c359fb..923d108 100644 --- a/unit_tests.py +++ b/unit_tests.py @@ -231,41 +231,44 @@ class TestKeys(unittest.TestCase): self.assertEqual(p11.C_GetAttributeValue(self.session, private_handle, CKA_CLASS), {CKA_CLASS: CKO_PRIVATE_KEY}) def test_keygen_token_vs_session(self): - self.assertIsKeypair( - p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, CKA_TOKEN = False, - CKA_ID = "EC-P256", CKA_EC_PARAMS = self.oid_p256, - CKA_SIGN = True, CKA_VERIFY = True)) + + # XXX pkcs11.c currently generates the wrong error code if the + # user tries to generate a keypair with the private key as + # a session object. Refusing to allow this is deliberate + # (we have no way to protect such private keys), but + # returning CKR_FUNCTION_FAILED is wrong. Fixing this + # will require minor work in pkcs11.c and perhaps in libhal. + # + # For the moment, I'm just testing for the (known) wrong + # exception while I make sure that the library is in fact + # behaving as I expect it to behave. + + with self.assertRaises(CKR_FUNCTION_FAILED): + p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, CKA_TOKEN = False, + CKA_ID = "EC-P256", CKA_EC_PARAMS = self.oid_p256, + CKA_SIGN = True, CKA_VERIFY = True) + self.assertIsKeypair( p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, CKA_TOKEN = True, CKA_ID = "EC-P256", CKA_EC_PARAMS = self.oid_p256, CKA_SIGN = True, CKA_VERIFY = True)) + self.assertIsKeypair( p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, public_CKA_TOKEN = False, private_CKA_TOKEN = True, CKA_ID = "EC-P256", CKA_EC_PARAMS = self.oid_p256, CKA_SIGN = True, CKA_VERIFY = True)) - self.assertIsKeypair( + + with self.assertRaises(CKR_FUNCTION_FAILED): p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, public_CKA_TOKEN = True, private_CKA_TOKEN = False, CKA_ID = "EC-P256", CKA_EC_PARAMS = self.oid_p256, - CKA_SIGN = True, CKA_VERIFY = True)) - - def test_gen_sign_verify_ecdsa_p256_sha256_token(self): - public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, CKA_TOKEN = True, - CKA_ID = "EC-P256", CKA_EC_PARAMS = self.oid_p256, - CKA_SIGN = True, CKA_VERIFY = True) - self.assertIsKeypair(public_key, private_key) - hamster = "Your mother was a hamster" - p11.C_SignInit(self.session, CKM_ECDSA_SHA256, private_key) - sig = p11.C_Sign(self.session, hamster) - self.assertIsInstance(sig, str) - p11.C_VerifyInit(self.session, CKM_ECDSA_SHA256, public_key) - p11.C_Verify(self.session, hamster, sig) + CKA_SIGN = True, CKA_VERIFY = True) - def test_gen_sign_verify_ecdsa_p256_sha256_session(self): - public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, CKA_TOKEN = False, + def test_gen_sign_verify_ecdsa_p256_sha256(self): + public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, CKA_ID = "EC-P256", CKA_EC_PARAMS = self.oid_p256, - CKA_SIGN = True, CKA_VERIFY = True) + CKA_SIGN = True, CKA_VERIFY = True, CKA_TOKEN = True) self.assertIsKeypair(public_key, private_key) hamster = "Your mother was a hamster" p11.C_SignInit(self.session, CKM_ECDSA_SHA256, private_key) @@ -278,7 +281,7 @@ class TestKeys(unittest.TestCase): #if not args.all_tests: self.skipTest("SHA-384 not available in current build") public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, CKA_ID = "EC-P384", CKA_EC_PARAMS = self.oid_p384, - CKA_SIGN = True, CKA_VERIFY = True) + CKA_SIGN = True, CKA_VERIFY = True, CKA_TOKEN = True) self.assertIsKeypair(public_key, private_key) hamster = "Your mother was a hamster" p11.C_SignInit(self.session, CKM_ECDSA_SHA384, private_key) @@ -291,7 +294,7 @@ class TestKeys(unittest.TestCase): #if not args.all_tests: self.skipTest("SHA-512 not available in current build") public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, CKA_ID = "EC-P521", CKA_EC_PARAMS = self.oid_p521, - CKA_SIGN = True, CKA_VERIFY = True) + CKA_SIGN = True, CKA_VERIFY = True, CKA_TOKEN = True) self.assertIsKeypair(public_key, private_key) hamster = "Your mother was a hamster" p11.C_SignInit(self.session, CKM_ECDSA_SHA512, private_key) @@ -300,7 +303,7 @@ class TestKeys(unittest.TestCase): p11.C_VerifyInit(self.session, CKM_ECDSA_SHA512, public_key) p11.C_Verify(self.session, hamster, sig) - def test_gen_sign_verify_rsa_1024_token(self): + def test_gen_sign_verify_rsa_1024(self): public_key, private_key = p11.C_GenerateKeyPair( self.session, CKM_RSA_PKCS_KEY_PAIR_GEN, CKA_MODULUS_BITS = 1024, CKA_ID = "RSA-1024", CKA_SIGN = True, CKA_VERIFY = True, CKA_TOKEN = True) @@ -312,23 +315,11 @@ class TestKeys(unittest.TestCase): p11.C_VerifyInit(self.session, CKM_SHA512_RSA_PKCS, public_key) p11.C_Verify(self.session, hamster, sig) - def test_gen_sign_verify_rsa_1024_session(self): - public_key, private_key = p11.C_GenerateKeyPair( - self.session, CKM_RSA_PKCS_KEY_PAIR_GEN, CKA_MODULUS_BITS = 1024, - CKA_ID = "RSA-1024", CKA_SIGN = True, CKA_VERIFY = True, CKA_TOKEN = False) - self.assertIsKeypair(public_key, private_key) - hamster = "Your mother was a hamster" - p11.C_SignInit(self.session, CKM_SHA512_RSA_PKCS, private_key) - sig = p11.C_Sign(self.session, hamster) - self.assertIsInstance(sig, str) - p11.C_VerifyInit(self.session, CKM_SHA512_RSA_PKCS, public_key) - p11.C_Verify(self.session, hamster, sig) - def test_gen_sign_verify_rsa_2048(self): if not args.all_tests: self.skipTest("RSA key generation is still painfully slow") public_key, private_key = p11.C_GenerateKeyPair( self.session, CKM_RSA_PKCS_KEY_PAIR_GEN, CKA_MODULUS_BITS = 2048, - CKA_ID = "RSA-2048", CKA_SIGN = True, CKA_VERIFY = True) + CKA_ID = "RSA-2048", CKA_SIGN = True, CKA_VERIFY = True, CKA_TOKEN = True) self.assertIsKeypair(public_key, private_key) hamster = "Your mother was a hamster" p11.C_SignInit(self.session, CKM_SHA512_RSA_PKCS, private_key) @@ -387,6 +378,7 @@ class TestKeys(unittest.TestCase): def test_gen_sign_verify_reload_ecdsa_p256_sha256(self): public_key, private_key = p11.C_GenerateKeyPair(self.session, CKM_EC_KEY_PAIR_GEN, + public_CKA_TOKEN = False, private_CKA_TOKEN = True, CKA_ID = "EC-P256", CKA_EC_PARAMS = self.oid_p256, CKA_SIGN = True, CKA_VERIFY = True) self.assertIsKeypair(public_key, private_key) |