Skip to content

Commit a6df479

Browse files
hug-devhug-dev
authored
Merge pull request #135 from hug-dev/key_attributes_tests
Add tests checking if key attributes are respected
2 parents 64f0499 + ed2978c commit a6df479

File tree

12 files changed

+151
-19
lines changed

12 files changed

+151
-19
lines changed

‎Cargo.lock

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ derivative = "1.0.3"
4040
version = "3.0.0"
4141

4242
[dev-dependencies]
43-
parsec-client-test = { git = "https://github.com/parallaxsecond/parsec-client-test", tag = "0.1.18" }
43+
parsec-client-test = { git = "https://github.com/parallaxsecond/parsec-client-test", tag = "0.2.0" }
4444
num_cpus = "1.10.1"
4545

4646
[build-dependencies]

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ use parsec_client_test::TestClient;
5454

5555
let mut client = TestClient::new();
5656
let key_name = String::from("🔑 What shall I sign? 🔑");
57-
client.create_rsa_sign_key(key_name.clone()).unwrap();
57+
client.generate_rsa_sign_key(key_name.clone()).unwrap();
5858
let signature = client.sign(key_name,
5959
String::from("Platform AbstRaction for SECurity").into_bytes())
6060
.unwrap();

‎tests/all_providers/mod.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,5 +57,5 @@ fn mangled_list_providers() {
5757
fn sign_verify_with_provider_discovery() -> Result<()> {
5858
let mut client = TestClient::new();
5959
let key_name = String::from("sign_verify_with_provider_discovery");
60-
client.create_rsa_sign_key(key_name)
60+
client.generate_rsa_sign_key(key_name)
6161
}

‎tests/per_provider/normal_tests/asym_sign_verify.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ fn asym_sign_and_verify_rsa_pkcs() -> Result<()> {
4848
let key_name = String::from("asym_sign_and_verify_rsa_pkcs");
4949
let mut client = TestClient::new();
5050

51-
client.create_rsa_sign_key(key_name.clone())?;
51+
client.generate_rsa_sign_key(key_name.clone())?;
5252

5353
let signature = client.sign_with_rsa_sha256(key_name.clone(), HASH.to_vec())?;
5454

@@ -61,7 +61,7 @@ fn asym_verify_fail() -> Result<()> {
6161
let signature = vec![0xff; 128];
6262
let mut client = TestClient::new();
6363

64-
client.create_rsa_sign_key(key_name.clone())?;
64+
client.generate_rsa_sign_key(key_name.clone())?;
6565

6666
let status = client
6767
.verify_with_rsa_sha256(key_name, HASH.to_vec(), signature)

‎tests/per_provider/normal_tests/auth.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,10 @@ fn two_auths_same_key_name() -> Result<()> {
2323
let auth2 = String::from("second_client").into_bytes();
2424

2525
client.set_auth(auth1);
26-
client.create_rsa_sign_key(key_name.clone())?;
26+
client.generate_rsa_sign_key(key_name.clone())?;
2727

2828
client.set_auth(auth2);
29-
client.create_rsa_sign_key(key_name)
29+
client.generate_rsa_sign_key(key_name)
3030
}
3131

3232
#[test]
@@ -37,7 +37,7 @@ fn delete_wrong_key() -> Result<()> {
3737
let auth2 = String::from("second_client").into_bytes();
3838

3939
client.set_auth(auth1);
40-
client.create_rsa_sign_key(key_name.clone())?;
40+
client.generate_rsa_sign_key(key_name.clone())?;
4141

4242
client.set_auth(auth2);
4343
let status = client

‎tests/per_provider/normal_tests/create_destroy_key.rs

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ fn create_and_destroy() -> Result<()> {
2121
client.do_not_destroy_keys();
2222
let key_name = String::from("create_and_destroy");
2323

24-
client.create_rsa_sign_key(key_name.clone())?;
24+
client.generate_rsa_sign_key(key_name.clone())?;
2525
client.destroy_key(key_name)
2626
}
2727

@@ -30,9 +30,9 @@ fn create_twice() -> Result<()> {
3030
let mut client = TestClient::new();
3131
let key_name = String::from("create_twice");
3232

33-
client.create_rsa_sign_key(key_name.clone())?;
33+
client.generate_rsa_sign_key(key_name.clone())?;
3434
let status = client
35-
.create_rsa_sign_key(key_name)
35+
.generate_rsa_sign_key(key_name)
3636
.expect_err("A key with the same name can not be created twice.");
3737
assert_eq!(status, ResponseStatus::PsaErrorAlreadyExists);
3838

@@ -56,7 +56,7 @@ fn create_destroy_and_operation() -> Result<()> {
5656
let hash = vec![0xDE, 0xAD, 0xBE, 0xEF];
5757
let key_name = String::from("create_destroy_and_operation");
5858

59-
client.create_rsa_sign_key(key_name.clone())?;
59+
client.generate_rsa_sign_key(key_name.clone())?;
6060

6161
client.destroy_key(key_name.clone())?;
6262

@@ -74,8 +74,8 @@ fn create_destroy_twice() -> Result<()> {
7474
let key_name = String::from("create_destroy_twice_1");
7575
let key_name_2 = String::from("create_destroy_twice_2");
7676

77-
client.create_rsa_sign_key(key_name.clone())?;
78-
client.create_rsa_sign_key(key_name_2.clone())?;
77+
client.generate_rsa_sign_key(key_name.clone())?;
78+
client.generate_rsa_sign_key(key_name_2.clone())?;
7979

8080
client.destroy_key(key_name)?;
8181
client.destroy_key(key_name_2)

‎tests/per_provider/normal_tests/export_public_key.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ fn export_public_key() -> Result<()> {
2222
let mut client = TestClient::new();
2323
let key_name = String::from("export_public_key");
2424

25-
client.create_rsa_sign_key(key_name.clone())?;
25+
client.generate_rsa_sign_key(key_name.clone())?;
2626

2727
let _ = client.export_public_key(key_name)?;
2828

‎tests/per_provider/normal_tests/import_key.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ fn create_and_import_key() -> Result<()> {
4747
let mut client = TestClient::new();
4848
let key_name = String::from("create_and_import_key");
4949

50-
client.create_rsa_sign_key(key_name.clone())?;
50+
client.generate_rsa_sign_key(key_name.clone())?;
5151

5252
let status = client
5353
.import_key(

‎tests/per_provider/normal_tests/key_attributes.rs

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
// Copyright (c) 2020, Arm Limited, All Rights Reserved
2+
// SPDX-License-Identifier: Apache-2.0
3+
use parsec_client_test::TestClient;
4+
use parsec_interface::operations::psa_algorithm::{Algorithm, AsymmetricSignature, Cipher, Hash};
5+
use parsec_interface::operations::psa_key_attributes::{
6+
KeyAttributes, KeyPolicy, KeyType, UsageFlags,
7+
};
8+
use parsec_interface::requests::ResponseStatus;
9+
10+
#[ignore]
11+
#[test]
12+
fn wrong_type() {
13+
let mut client = TestClient::new();
14+
let key_name = String::from("wrong_type");
15+
16+
// Wrong key type
17+
let key_type = KeyType::Derive;
18+
let permitted_algorithm =
19+
Algorithm::AsymmetricSignature(AsymmetricSignature::RsaPkcs1v15Sign {
20+
hash_alg: Hash::Sha256,
21+
});
22+
let key_attributes = KeyAttributes {
23+
key_type,
24+
key_bits: 1024,
25+
key_policy: KeyPolicy {
26+
key_usage_flags: UsageFlags {
27+
sign_hash: true,
28+
verify_hash: false,
29+
sign_message: false,
30+
verify_message: false,
31+
export: false,
32+
encrypt: false,
33+
decrypt: false,
34+
cache: false,
35+
copy: false,
36+
derive: false,
37+
},
38+
key_algorithm: permitted_algorithm,
39+
},
40+
};
41+
42+
client
43+
.generate_key(key_name.clone(), key_attributes)
44+
.unwrap();
45+
let status = client
46+
.sign_with_rsa_sha256(key_name, vec![0xDE, 0xAD, 0xBE, 0xEF])
47+
.unwrap_err();
48+
49+
assert_eq!(status, ResponseStatus::PsaErrorNotPermitted);
50+
}
51+
52+
#[ignore]
53+
#[test]
54+
fn wrong_usage_flags() {
55+
let mut client = TestClient::new();
56+
let key_name = String::from("wrong_usage_flags");
57+
58+
let key_type = KeyType::RsaKeyPair;
59+
let permitted_algorithm =
60+
Algorithm::AsymmetricSignature(AsymmetricSignature::RsaPkcs1v15Sign {
61+
hash_alg: Hash::Sha256,
62+
});
63+
let key_attributes = KeyAttributes {
64+
key_type,
65+
key_bits: 1024,
66+
key_policy: KeyPolicy {
67+
key_usage_flags: UsageFlags {
68+
// Forbid signing
69+
sign_hash: false,
70+
verify_hash: false,
71+
sign_message: false,
72+
verify_message: false,
73+
export: false,
74+
encrypt: false,
75+
decrypt: false,
76+
cache: false,
77+
copy: false,
78+
derive: false,
79+
},
80+
key_algorithm: permitted_algorithm,
81+
},
82+
};
83+
84+
client
85+
.generate_key(key_name.clone(), key_attributes)
86+
.unwrap();
87+
let status = client
88+
.sign_with_rsa_sha256(key_name, vec![0xDE, 0xAD, 0xBE, 0xEF])
89+
.unwrap_err();
90+
91+
assert_eq!(status, ResponseStatus::PsaErrorNotPermitted);
92+
}
93+
94+
#[ignore]
95+
#[test]
96+
fn wrong_permitted_algorithm() {
97+
let mut client = TestClient::new();
98+
let key_name = String::from("wrong_permitted_algorithm");
99+
100+
let key_type = KeyType::RsaKeyPair;
101+
// Do not permit RSA PKCS 1v15 signing algorithm with SHA-256.
102+
let permitted_algorithm = Algorithm::Cipher(Cipher::Ctr);
103+
let key_attributes = KeyAttributes {
104+
key_type,
105+
key_bits: 1024,
106+
key_policy: KeyPolicy {
107+
key_usage_flags: UsageFlags {
108+
sign_hash: true,
109+
verify_hash: false,
110+
sign_message: false,
111+
verify_message: false,
112+
export: false,
113+
encrypt: false,
114+
decrypt: false,
115+
cache: false,
116+
copy: false,
117+
derive: false,
118+
},
119+
key_algorithm: permitted_algorithm,
120+
},
121+
};
122+
123+
client
124+
.generate_key(key_name.clone(), key_attributes)
125+
.unwrap();
126+
let status = client
127+
.sign_with_rsa_sha256(key_name, vec![0xDE, 0xAD, 0xBE, 0xEF])
128+
.unwrap_err();
129+
130+
assert_eq!(status, ResponseStatus::PsaErrorNotPermitted);
131+
}

0 commit comments

Comments
 (0)