aboutsummaryrefslogtreecommitdiffstats
path: root/roms/skiboot/libstb/tss2/ibmtpm20tss/utils/regtests/testx509.sh
diff options
context:
space:
mode:
Diffstat (limited to 'roms/skiboot/libstb/tss2/ibmtpm20tss/utils/regtests/testx509.sh')
-rwxr-xr-xroms/skiboot/libstb/tss2/ibmtpm20tss/utils/regtests/testx509.sh342
1 files changed, 342 insertions, 0 deletions
diff --git a/roms/skiboot/libstb/tss2/ibmtpm20tss/utils/regtests/testx509.sh b/roms/skiboot/libstb/tss2/ibmtpm20tss/utils/regtests/testx509.sh
new file mode 100755
index 000000000..a41cfcca1
--- /dev/null
+++ b/roms/skiboot/libstb/tss2/ibmtpm20tss/utils/regtests/testx509.sh
@@ -0,0 +1,342 @@
+#!/bin/bash
+#
+
+#################################################################################
+# #
+# TPM2 regression test #
+# Written by Ken Goldman #
+# IBM Thomas J. Watson Research Center #
+# #
+# (c) Copyright IBM Corporation 2019 - 2020 #
+# #
+# All rights reserved. #
+# #
+# Redistribution and use in source and binary forms, with or without #
+# modification, are permitted provided that the following conditions are #
+# met: #
+# #
+# Redistributions of source code must retain the above copyright notice, #
+# this list of conditions and the following disclaimer. #
+# #
+# Redistributions in binary form must reproduce the above copyright #
+# notice, this list of conditions and the following disclaimer in the #
+# documentation and/or other materials provided with the distribution. #
+# #
+# Neither the names of the IBM Corporation nor the names of its #
+# contributors may be used to endorse or promote products derived from #
+# this software without specific prior written permission. #
+# #
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS #
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT #
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR #
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT #
+# HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, #
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT #
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, #
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY #
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT #
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE #
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #
+# #
+#################################################################################
+
+# The mbedtls port does not support TPM2_CertifyX509 yet */
+
+if [ ${CRYPTOLIBRARY} == "openssl" ]; then
+
+echo ""
+echo "TPM2_CertifyX509"
+echo ""
+
+# basic test
+
+# sign${SKEY[i]}rpriv.bin is a restricted signing key
+# sign${SKEY[i]}priv.bin is an unrestricted signing key
+
+SALG=(rsa ecc)
+SKEY=(rsa2048 ecc)
+
+for ((i = 0 ; i < 2 ; i++))
+do
+
+ echo "Load the ${SALG[i]} issuer key 80000001 under the primary key"
+ ${PREFIX}load -hp 80000000 -ipr sign${SKEY[i]}rpriv.bin -ipu sign${SKEY[i]}rpub.bin -pwdp sto > run.out
+ checkSuccess $?
+
+ echo "Load the ${SALG[i]} subject key 80000002 under the primary key"
+ ${PREFIX}load -hp 80000000 -ipr sign${SKEY[i]}priv.bin -ipu sign${SKEY[i]}pub.bin -pwdp sto > run.out
+ checkSuccess $?
+
+ echo "Signing Key Self Certify CA Root ${SALG[i]}"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000001 -halg sha256 -pwdk sig -pwdo sig -opc tmppart1.bin -os tmpsig1.bin -oa tmpadd1.bin -otbs tmptbs1.bin -ocert tmpx5091.bin -salg ${SALG[i]} -sub -v -iob 00050472 > run.out
+ checkSuccess $?
+
+
+ # dumpasn1 -a -l -d tmpx509i.bin > tmpx509i1.dump
+ # dumpasn1 -a -l -d -hh tmpx509i.bin > tmpx509i1.dumphh
+ # dumpasn1 -a -l -d tmppart1.bin > tmppart1.dump
+ # dumpasn1 -a -l -d -hh tmppart1.bin > tmppart1.dumphh
+ # dumpasn1 -a -l -d tmpadd1.bin > tmpadd1.dump
+ # dumpasn1 -a -l -d -hh tmpadd1.bin > tmpadd1.dumphh
+ # dumpasn1 -a -l -d tmpx5091.bin > tmpx5091.dump
+ # dumpasn1 -a -l -d -hh tmpx5091.bin > tmpx5091.dumphh
+ # openssl x509 -text -inform der -in tmpx5091.bin -noout > tmpx5091.txt
+
+ echo "Convert issuer X509 DER to PEM"
+ openssl x509 -inform der -in tmpx5091.bin -out tmpx5091.pem > run.out 2>&1
+ echo " INFO:"
+
+ echo "Verify ${SALG[i]} self signed issuer root"
+ echo -n " INFO: "
+ openssl verify -CAfile tmpx5091.pem tmpx5091.pem > run.out 2>&1
+
+ echo "Signing Key Certify ${SALG[i]}"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -iob 00040472 > run.out
+ checkSuccess $?
+
+ # dumpasn1 -a -l -d tmpx509i.bin > tmpx509i2.dump
+ # dumpasn1 -a -l -d -hh tmpx509i.bin > tmpx509i2.dumphh
+ # dumpasn1 -a -l -d tmppart2.bin > tmppart2.dump
+ # dumpasn1 -a -l -d -hh tmppart2.bin > tmppart2.dumphhe
+ # dumpasn1 -a -l -d tmpadd2.bin > tmpadd2.dump
+ # dumpasn1 -a -l -d -hh tmpadd2.bin > tmpadd2.dumphh
+ # dumpasn1 -a -l -d tmpx5092.bin > tmpx5092.dump
+ # dumpasn1 -a -l -d -hh tmpx5092.bin > tmpx5092.dumphh
+ # openssl x509 -text -inform der -in tmpx5092.bin -noout > tmpx5092.txt
+
+ echo "Convert subject X509 DER to PEM"
+ openssl x509 -inform der -in tmpx5092.bin -out tmpx5092.pem > run.out 2>&1
+ echo " INFO:"
+
+ echo "Verify ${SALG[i]} subject against issuer"
+ echo -n " INFO: "
+ openssl verify -CAfile tmpx5091.pem tmpx5092.pem > run.out 2>&1
+
+
+ echo "Signing Key Certify ${SALG[i]} with bad OID"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -iob ffffffff > run.out
+ checkFailure $?
+
+# bad der, test bits for 250 bytes
+# better to get size from tmppart2.bin
+
+ # for bit in {0..2}
+ # do
+ # echo "Signing Key Certify ${SALG[i]} testing bit $bit"
+ # ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -bit $bit > run.out
+ # checkSuccess0 $?
+ # done
+
+ echo "Flush the root CA issuer signing key"
+ ${PREFIX}flushcontext -ha 80000001 > run.out
+ checkSuccess $?
+
+ echo "Flush the subject signing key"
+ ${PREFIX}flushcontext -ha 80000002 > run.out
+ checkSuccess $?
+
+done
+
+# bad extensions for key type
+
+echo ""
+echo "TPM2_CertifyX509 Key Usage Extension for fixedTPM signing key"
+echo ""
+
+for ((i = 0 ; i < 2 ; i++))
+do
+
+ echo "Load the ${SALG[i]} issuer key 80000001 under the primary key"
+ ${PREFIX}load -hp 80000000 -ipr sign${SKEY[i]}rpriv.bin -ipu sign${SKEY[i]}rpub.bin -pwdp sto > run.out
+ checkSuccess $?
+
+ echo "Load the ${SALG[i]} subject key 80000002 under the primary key"
+ ${PREFIX}load -hp 80000000 -ipr sign${SKEY[i]}priv.bin -ipu sign${SKEY[i]}pub.bin -pwdp sto > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} digitalSignature"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,digitalSignature > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} nonRepudiation"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,nonRepudiation > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} keyEncipherment"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,keyEncipherment > run.out
+ checkFailure $?
+
+ echo "Signing Key Certify ${SALG[i]} dataEncipherment"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,dataEncipherment > run.out
+ checkFailure $?
+
+ echo "Signing Key Certify ${SALG[i]} keyAgreement"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,keyAgreement > run.out
+ checkFailure $?
+
+ echo "Signing Key Certify ${SALG[i]} keyCertSign"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,keyCertSign > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} cRLSign"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,cRLSign > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} encipherOnly"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,encipherOnly > run.out
+ checkFailure $?
+
+ echo "Signing Key Certify ${SALG[i]} decipherOnly"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,decipherOnly > run.out
+ checkFailure $?
+
+ echo "Flush the root CA issuer signing key"
+ ${PREFIX}flushcontext -ha 80000001 > run.out
+ checkSuccess $?
+
+ echo "Flush the subject signing key"
+ ${PREFIX}flushcontext -ha 80000002 > run.out
+ checkSuccess $?
+
+done
+
+echo ""
+echo "TPM2_CertifyX509 Key Usage Extension for not fixedTPM signing key"
+echo ""
+
+for ((i = 0 ; i < 2 ; i++))
+do
+
+ echo "Load the ${SALG[i]} issuer key 80000001 under the primary key"
+ ${PREFIX}load -hp 80000000 -ipr sign${SKEY[i]}nfpriv.bin -ipu sign${SKEY[i]}nfpub.bin -pwdp sto > run.out
+ checkSuccess $?
+
+ echo "Load the ${SALG[i]} subject key 80000002 under the primary key"
+ ${PREFIX}load -hp 80000000 -ipr sign${SKEY[i]}nfpriv.bin -ipu sign${SKEY[i]}nfpub.bin -pwdp sto > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} digitalSignature"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,digitalSignature > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} nonRepudiation"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,nonRepudiation > run.out
+ checkFailure $?
+
+ echo "Signing Key Certify ${SALG[i]} keyEncipherment"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SAL[i]} -ku critical,keyEncipherment > run.out
+ checkFailure $?
+
+ echo "Signing Key Certify ${SALG[i]} dataEncipherment"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,dataEncipherment > run.out
+ checkFailure $?
+
+ echo "Signing Key Certify ${SALG[i]} keyAgreement"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,keyAgreement > run.out
+ checkFailure $?
+
+ echo "Signing Key Certify ${SALG[i]} keyCertSign"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,keyCertSign > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} cRLSign"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,cRLSign > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} encipherOnly"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,encipherOnly > run.out
+ checkFailure $?
+
+ echo "Signing Key Certify ${SALG[i]} decipherOnly"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,decipherOnly > run.out
+ checkFailure $?
+
+ echo "Flush the root CA issuer signing key"
+ ${PREFIX}flushcontext -ha 80000001 > run.out
+ checkSuccess $?
+
+ echo "Flush the subject signing key"
+ ${PREFIX}flushcontext -ha 80000002 > run.out
+ checkSuccess $?
+
+done
+
+echo ""
+echo "TPM2_CertifyX509 Key Usage Extension for fixedTpm restricted encryption key"
+echo ""
+
+for ((i = 0 ; i < 2 ; i++))
+do
+
+ echo "Load the ${SALG[i]} issuer key 80000001 under the primary key"
+ ${PREFIX}load -hp 80000000 -ipr sign${SKEY[i]}rpriv.bin -ipu sign${SKEY[i]}rpub.bin -pwdp sto > run.out
+ checkSuccess $?
+
+ echo "Load the ${SALG[i]} subject key 80000002 under the primary key"
+ ${PREFIX}load -hp 80000000 -ipr store${SKEY[i]}priv.bin -ipu store${SKEY[i]}pub.bin -pwdp sto > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} digitalSignature"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,digitalSignature > run.out
+ checkFailure $?
+
+ echo "Signing Key Certify ${SALG[i]} nonRepudiation"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,nonRepudiation > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} keyEncipherment"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,keyEncipherment > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} dataEncipherment"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,dataEncipherment > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} keyAgreement"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,keyAgreement > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} keyCertSign"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,keyCertSign > run.out
+ checkFailure $?
+
+ echo "Signing Key Certify ${SALG[i]} cRLSign"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,cRLSign > run.out
+ checkFailure $?
+
+ echo "Signing Key Certify ${SALG[i]} encipherOnly"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,encipherOnly > run.out
+ checkSuccess $?
+
+ echo "Signing Key Certify ${SALG[i]} decipherOnly"
+ ${PREFIX}certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg ${SALG[i]} -ku critical,decipherOnly > run.out
+ checkSuccess $?
+
+ echo "Flush the root CA issuer signing key"
+ ${PREFIX}flushcontext -ha 80000001 > run.out
+ checkSuccess $?
+
+ echo "Flush the subject signing key"
+ ${PREFIX}flushcontext -ha 80000002 > run.out
+ checkSuccess $?
+
+done
+
+# cleanup
+
+rm -r tmppart1.bin
+rm -r tmpadd1.bin
+rm -r tmptbs1.bin
+rm -r tmpsig1.bin
+rm -r tmpx5091.bin
+rm -r tmpx5091.pem
+rm -r tmpx5092.pem
+rm -r tmpx509i.bin
+rm -r tmppart2.bin
+rm -r tmpadd2.bin
+rm -r tmptbs2.bin
+rm -r tmpsig2.bin
+rm -r tmpx5092.bin
+
+# openssl only
+fi