squash! Initial pkcs11-tool tests for OP-TEE

* Test RSA 2048 and EC secp256r1 key usage Signed-off-by: Mika Tammi <mika.tammi@unikie.com>
tiiuae · Nov 1, 2023 · 20112f4 · 20112f4
1 parent 8394ae2
commit 20112f4
Showing 1 changed file with 46 additions and 3 deletions.
diff --git a/Robot-Framework/test-suites/optee/pkcs11-tool.robot b/Robot-Framework/test-suites/optee/pkcs11-tool.robot
@@ -18,7 +18,10 @@ Basic pkcs11-tool-optee test
     ${tool}=    Set Variable    "pkcs11-tool-optee"
     List all key slots    ${tool}
     Initialize slot    ${tool}
-    List all key slots    ${tool}
+    Test Public Key usage    ${tool}    keyid=1    keylabel=rsakey0    mechanism=SHA256-RSA-PKCS-PSS
+    Test Public Key usage    ${tool}    keyid=2    keylabel=eckey0    mechanism=ECDSA-SHA256
+    List key slots    ${tool}
+    List objects    ${tool}
 
 Check caml-crush service is running
     [Documentation]  Checks if the systemd service for caml-crush is running
@@ -35,18 +38,29 @@ Basic pkcs11-tool-caml-crush test
     ${tool}=    Set Variable    "pkcs11-tool-caml-crush-optee"
     List all key slots    ${tool}
     Initialize slot    ${tool}
-    List all key slots    ${tool}
+    Test Public Key usage    ${tool}    keyid=1    keylabel=rsakey0    mechanism=SHA256-RSA-PKCS-PSS
+    Test Public Key usage    ${tool}    keyid=2    keylabel=eckey0    mechanism=ECDSA-SHA256
+    List key slots    ${tool}
+    List objects    ${tool}
 
 *** Keywords ***
 
-List all key slots
+List key slots
     [Documentation]    List all key slots
     [Arguments]        ${tool}
 
     ${cmd}=    Set Variable    ${tool} -L
     ${stdout}    ${stderr}    ${rc}=    Execute Command    ${cmd}    sudo=True    sudo_password=${PASSWORD}    return_stdout=True    return_stderr=True    return_rc=True
     Should Be Equal As Integers    ${rc}    0
 
+List objects
+    [Documentation]    List all key slots
+    [Arguments]        ${tool}
+
+    ${cmd}=    Set Variable    ${tool} --list-objects
+    ${stdout}    ${stderr}    ${rc}=    Execute Command    ${cmd}    sudo=True    sudo_password=${PASSWORD}    return_stdout=True    return_stderr=True    return_rc=True
+    Should Be Equal As Integers    ${rc}    0
+
 Initialize slot
     [Documentation]    Initialize Key Slot
     [Arguments]        ${tool}
@@ -62,3 +76,32 @@ Initialize slot
     ${cmd}=    Set Variable    ${tool} --token-label mytoken --pin 0000 --keygen --key-type AES:16 --id 0 --label mykey0
     ${stdout}    ${stderr}    ${rc}=    Execute Command    ${cmd}    sudo=True    sudo_password=${PASSWORD}    return_stdout=True    return_stderr=True    return_rc=True
     Should Be Equal As Integers    ${rc}    0
+
+    ${cmd}=    Set Variable    ${tool} --token-label mytoken --pin 0000 --keypairgen --key-type RSA:2048 --id 1 --label rsakey0
+    ${stdout}    ${stderr}    ${rc}=    Execute Command    ${cmd}    sudo=True    sudo_password=${PASSWORD}    return_stdout=True    return_stderr=True    return_rc=True
+    Should Be Equal As Integers    ${rc}    0
+
+    ${cmd}=    Set Variable    ${tool} --token-label mytoken --pin 0000 --keypairgen --key-type EC:secp256r1 --id 2 --label eckey0
+    ${stdout}    ${stderr}    ${rc}=    Execute Command    ${cmd}    sudo=True    sudo_password=${PASSWORD}    return_stdout=True    return_stderr=True    return_rc=True
+    Should Be Equal As Integers    ${rc}    0
+
+Test Public Key usage
+    [Documentation]    Test Public Key usage
+    [Arguments]        ${tool}    ${keyid}    ${keylabel}    ${mechanism}
+
+    ${content_file}=    Set Variable    /tmp/pkcs11test_content
+    ${signature_file}=    Set Variable    /tmp/pkcs11test_signature
+
+    ${cmd}=    Set Variable    dd if=/dev/random of=${content_file} count=1 bs=32
+    ${stdout}    ${stderr}    ${rc}=    Execute Command    ${cmd}    sudo=True    sudo_password=${PASSWORD}    return_stdout=True    return_stderr=True    return_rc=True
+    Should Be Equal As Integers    ${rc}    0
+
+    ${cmd}=    Set Variable    ${tool} --token-label mytoken --pin 0000 --id ${keyid} --label ${keylabel} --sign -m ${mechanism} --input-file ${content_file} --output-file ${signature_file}
+    ${stdout}    ${stderr}    ${rc}=    Execute Command    ${cmd}    sudo=True    sudo_password=${PASSWORD}    return_stdout=True    return_stderr=True    return_rc=True
+    Should Be Equal As Integers    ${rc}    0
+
+    ${cmd}=    Set Variable    ${tool} --token-label mytoken --pin 0000 --id ${keyid} --label ${keylabel} --verify -m ${mechanism} --signature-file ${signature_file} --input-file ${content_file}
+    ${stdout}    ${stderr}    ${rc}=    Execute Command    ${cmd}    sudo=True    sudo_password=${PASSWORD}    return_stdout=True    return_stderr=True    return_rc=True
+    Should Be Equal As Integers    ${rc}    0
+    Should Contain    ${stdout}    Signature is valid
+    Should Not Contain    ${stdout}    Invalid signature