1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
|
package cose
import (
"crypto/ed25519"
"crypto/rand"
"reflect"
"testing"
)
func generateTestEd25519Key(t *testing.T) (ed25519.PublicKey, ed25519.PrivateKey) {
vk, sk, err := ed25519.GenerateKey(rand.Reader)
if err != nil {
t.Fatalf("ed25519.GenerateKey() error = %v", err)
}
return vk, sk
}
func Test_ed25519Signer(t *testing.T) {
// generate key
alg := AlgorithmEd25519
_, key := generateTestEd25519Key(t)
// set up signer
signer, err := NewSigner(alg, key)
if err != nil {
t.Fatalf("NewSigner() error = %v", err)
}
if _, ok := signer.(*ed25519Signer); !ok {
t.Fatalf("NewSigner() type = %v, want *ed25519Signer", reflect.TypeOf(signer))
}
if got := signer.Algorithm(); got != alg {
t.Fatalf("Algorithm() = %v, want %v", got, alg)
}
// sign / verify round trip
// see also conformance_test.go for strict tests.
content := []byte("hello world")
sig, err := signer.Sign(rand.Reader, content)
if err != nil {
t.Fatalf("Sign() error = %v", err)
}
verifier, err := NewVerifier(alg, key.Public())
if err != nil {
t.Fatalf("NewVerifier() error = %v", err)
}
if err := verifier.Verify(content, sig); err != nil {
t.Fatalf("Verifier.Verify() error = %v", err)
}
}
func Test_ed25519Verifier_Verify_Success(t *testing.T) {
// generate key
alg := AlgorithmEd25519
_, key := generateTestEd25519Key(t)
// generate a valid signature
content, sig := signTestData(t, alg, key)
// set up verifier
verifier, err := NewVerifier(alg, key.Public())
if err != nil {
t.Fatalf("NewVerifier() error = %v", err)
}
if _, ok := verifier.(*ed25519Verifier); !ok {
t.Fatalf("NewVerifier() type = %v, want *ed25519Verifier", reflect.TypeOf(verifier))
}
if got := verifier.Algorithm(); got != alg {
t.Fatalf("Algorithm() = %v, want %v", got, alg)
}
// verify round trip
if err := verifier.Verify(content, sig); err != nil {
t.Fatalf("ed25519Verifier.Verify() error = %v", err)
}
}
func Test_ed25519Verifier_Verify_KeyMismatch(t *testing.T) {
// generate key
alg := AlgorithmEd25519
_, key := generateTestEd25519Key(t)
// generate a valid signature
content, sig := signTestData(t, alg, key)
// set up verifier with a different key / new key
vk, _ := generateTestEd25519Key(t)
verifier := &ed25519Verifier{
key: vk,
}
// verification should fail on key mismatch
if err := verifier.Verify(content, sig); err != ErrVerification {
t.Fatalf("ed25519Verifier.Verify() error = %v, wantErr %v", err, ErrVerification)
}
}
func Test_ed25519Verifier_Verify_InvalidSignature(t *testing.T) {
// generate key
alg := AlgorithmEd25519
vk, sk := generateTestEd25519Key(t)
// generate a valid signature with a tampered one
content, sig := signTestData(t, alg, sk)
tamperedSig := make([]byte, len(sig))
copy(tamperedSig, sig)
tamperedSig[0]++
// set up verifier with a different algorithm
verifier := &ed25519Verifier{
key: vk,
}
// verification should fail on invalid signature
tests := []struct {
name string
signature []byte
}{
{
name: "nil signature",
signature: nil,
},
{
name: "empty signature",
signature: []byte{},
},
{
name: "incomplete signature",
signature: sig[:len(sig)-2],
},
{
name: "tampered signature",
signature: tamperedSig,
},
{
name: "too many signature bytes",
signature: append(sig, 0),
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if err := verifier.Verify(content, tt.signature); err != ErrVerification {
t.Errorf("ed25519Verifier.Verify() error = %v, wantErr %v", err, ErrVerification)
}
})
}
}
|
