File: rsa_key_test.go

package info (click to toggle)
golang-github-docker-libtrust 0.0~git20150526.0.9cbd2a1-3
  • links: PTS, VCS
  • area: main
  • in suites: bullseye, buster-proposed-updates, sid
  • size: 288 kB
  • ctags: 297
  • sloc: makefile: 3
file content (157 lines) | stat: -rw-r--r-- 3,433 bytes parent folder | download | duplicates (3)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
package libtrust

import (
	"bytes"
	"encoding/json"
	"log"
	"testing"
)

var rsaKeys []PrivateKey

func init() {
	var err error
	rsaKeys, err = generateRSATestKeys()
	if err != nil {
		log.Fatal(err)
	}
}

func generateRSATestKeys() (keys []PrivateKey, err error) {
	log.Println("Generating RSA 2048-bit Test Key")
	rsa2048Key, err := GenerateRSA2048PrivateKey()
	if err != nil {
		return
	}

	log.Println("Generating RSA 3072-bit Test Key")
	rsa3072Key, err := GenerateRSA3072PrivateKey()
	if err != nil {
		return
	}

	log.Println("Generating RSA 4096-bit Test Key")
	rsa4096Key, err := GenerateRSA4096PrivateKey()
	if err != nil {
		return
	}

	log.Println("Done generating RSA Test Keys!")
	keys = []PrivateKey{rsa2048Key, rsa3072Key, rsa4096Key}

	return
}

func TestRSAKeys(t *testing.T) {
	for _, rsaKey := range rsaKeys {
		if rsaKey.KeyType() != "RSA" {
			t.Fatalf("key type must be %q, instead got %q", "RSA", rsaKey.KeyType())
		}
	}
}

func TestRSASignVerify(t *testing.T) {
	message := "Hello, World!"
	data := bytes.NewReader([]byte(message))

	sigAlgs := []*signatureAlgorithm{rs256, rs384, rs512}

	for i, rsaKey := range rsaKeys {
		sigAlg := sigAlgs[i]

		t.Logf("%s signature of %q with kid: %s\n", sigAlg.HeaderParam(), message, rsaKey.KeyID())

		data.Seek(0, 0) // Reset the byte reader

		// Sign
		sig, alg, err := rsaKey.Sign(data, sigAlg.HashID())
		if err != nil {
			t.Fatal(err)
		}

		data.Seek(0, 0) // Reset the byte reader

		// Verify
		err = rsaKey.Verify(data, alg, sig)
		if err != nil {
			t.Fatal(err)
		}
	}
}

func TestMarshalUnmarshalRSAKeys(t *testing.T) {
	data := bytes.NewReader([]byte("This is a test. I repeat: this is only a test."))
	sigAlgs := []*signatureAlgorithm{rs256, rs384, rs512}

	for i, rsaKey := range rsaKeys {
		sigAlg := sigAlgs[i]
		privateJWKJSON, err := json.MarshalIndent(rsaKey, "", "    ")
		if err != nil {
			t.Fatal(err)
		}

		publicJWKJSON, err := json.MarshalIndent(rsaKey.PublicKey(), "", "    ")
		if err != nil {
			t.Fatal(err)
		}

		t.Logf("JWK Private Key: %s", string(privateJWKJSON))
		t.Logf("JWK Public Key: %s", string(publicJWKJSON))

		privKey2, err := UnmarshalPrivateKeyJWK(privateJWKJSON)
		if err != nil {
			t.Fatal(err)
		}

		pubKey2, err := UnmarshalPublicKeyJWK(publicJWKJSON)
		if err != nil {
			t.Fatal(err)
		}

		// Ensure we can sign/verify a message with the unmarshalled keys.
		data.Seek(0, 0) // Reset the byte reader
		signature, alg, err := privKey2.Sign(data, sigAlg.HashID())
		if err != nil {
			t.Fatal(err)
		}

		data.Seek(0, 0) // Reset the byte reader
		err = pubKey2.Verify(data, alg, signature)
		if err != nil {
			t.Fatal(err)
		}

		// It's a good idea to validate the Private Key to make sure our
		// (un)marshal process didn't corrupt the extra parameters.
		k := privKey2.(*rsaPrivateKey)
		err = k.PrivateKey.Validate()
		if err != nil {
			t.Fatal(err)
		}
	}
}

func TestFromCryptoRSAKeys(t *testing.T) {
	for _, rsaKey := range rsaKeys {
		cryptoPrivateKey := rsaKey.CryptoPrivateKey()
		cryptoPublicKey := rsaKey.CryptoPublicKey()

		pubKey, err := FromCryptoPublicKey(cryptoPublicKey)
		if err != nil {
			t.Fatal(err)
		}

		if pubKey.KeyID() != rsaKey.KeyID() {
			t.Fatal("public key key ID mismatch")
		}

		privKey, err := FromCryptoPrivateKey(cryptoPrivateKey)
		if err != nil {
			t.Fatal(err)
		}

		if privKey.KeyID() != rsaKey.KeyID() {
			t.Fatal("public key key ID mismatch")
		}
	}
}