tests: added Ed25519 key and certificate generation tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

3 files changed, 158 insertions, 2 deletions

diff --git a/tests/cert-tests/Makefile.am b/tests/cert-tests/Makefile.am
index 5487b11045..c5b270f06b 100644
--- a/tests/cert-tests/Makefile.am
+++ b/tests/cert-tests/Makefile.am
@@ -73,7 +73,8 @@ EXTRA_DIST = data/ca-no-pathlen.pem data/no-ca-or-pathlen.pem data/aki-cert.pem
 	data/invalid-date-secs.der data/invalid-date-month.der data/invalid-date-day.der \
 	data/mem-leak.p12 data/alt-chain-new-ca.pem data/alt-chain-old-ca.pem \
 	data/alt-chain.pem data/pkcs7-chain.pem data/pkcs7-chain-root.pem \
-	data/pkcs7-chain-endcert-key.pem data/cert-rsa-pss.pem data/openssl-invalid-time-format.pem
+	data/pkcs7-chain-endcert-key.pem data/cert-rsa-pss.pem data/openssl-invalid-time-format.pem \
+	data/cert-eddsa.pem
 
 dist_check_SCRIPTS = pathlen aki certtool invalid-sig email \
 	pkcs7 pkcs7-broken-sigs privkey-import name-constraints certtool-long-cn crl provable-privkey \
@@ -98,7 +99,7 @@ if ENABLE_DANE
 dist_check_SCRIPTS += dane
 endif
 
-dist_check_SCRIPTS += certtool-rsa-pss
+dist_check_SCRIPTS += certtool-rsa-pss certtool-eddsa
 
 TESTS = $(dist_check_SCRIPTS)
 
diff --git a/tests/cert-tests/certtool-eddsa b/tests/cert-tests/certtool-eddsa
new file mode 100755
index 0000000000..83326427f3
--- /dev/null
+++ b/tests/cert-tests/certtool-eddsa
@@ -0,0 +1,119 @@
+#!/bin/sh
+
+# Copyright (C) 2014 Nikos Mavrogiannopoulos
+#
+# This file is part of GnuTLS.
+#
+# GnuTLS is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GnuTLS is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+#set -e
+
+srcdir="${srcdir:-.}"
+CERTTOOL="${CERTTOOL:-../../src/certtool${EXEEXT}}"
+DIFF="${DIFF:-diff -b -B}"
+KEYFILE=eddsa-privkey.$$.tmp
+TMPFILE=eddsa.$$.tmp
+
+if ! test -x "${CERTTOOL}"; then
+	exit 77
+fi
+
+if ! test -z "${VALGRIND}"; then
+	VALGRIND="${LIBTOOL:-libtool} --mode=execute ${VALGRIND}"
+fi
+
+if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
+	exit 77
+fi
+
+# Test certificate in internet draft
+${VALGRIND} "${CERTTOOL}" -i --infile "${srcdir}/data/cert-eddsa.pem" --outfile "${TMPFILE}"
+rc=$?
+
+if test "${rc}" != "0"; then
+	echo "There was an issue parsing the certificate"
+	exit 1
+fi
+
+$DIFF -I 'Not After:' ${TMPFILE} "${srcdir}/data/cert-eddsa.pem"
+if test $? != 0;then
+	echo "Error in parsing EdDSA cert"
+	exit 1
+fi
+
+
+# Create an RSA-PSS private key, restricted to the use with RSA-PSS
+${VALGRIND} "${CERTTOOL}" --generate-privkey --pkcs8 --password '' \
+        --eddsa --outfile "$KEYFILE"
+rc=$?
+
+if test "${rc}" != "0"; then
+	echo "Could not generate an EdDSA key"
+	exit 1
+fi
+
+${VALGRIND} "${CERTTOOL}" -k --password '' --infile "$KEYFILE"
+rc=$?
+if test "${rc}" != "0"; then
+	echo "Could not read generated an EdDSA key"
+	exit 1
+fi
+
+# Create an EdDSA certificate from an EdDSA private key
+${VALGRIND} "${CERTTOOL}" --generate-self-signed \
+	--pkcs8 --load-privkey "$KEYFILE" --password '' \
+	--template "${srcdir}/templates/template-test.tmpl" \
+	--outfile "${TMPFILE}"
+rc=$?
+
+if test "${rc}" != "0"; then
+	echo "Could not generate an EdDSA certificate from an EdDSA key"
+	exit 1
+fi
+
+${VALGRIND} "${CERTTOOL}" --verify --load-ca-certificate "${TMPFILE}" --infile "${TMPFILE}"
+rc=$?
+if test "${rc}" != "0"; then
+	echo "There was an issue verifying the generated certificate (1)"
+	exit 1
+fi
+
+# Create an EdDSA certificate from an RSA key
+${VALGRIND} "${CERTTOOL}" --generate-certificate --eddsa \
+	    --load-privkey ${KEYFILE} \
+	    --load-ca-privkey "${srcdir}/../../doc/credentials/x509/ca-key.pem" \
+	    --load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" \
+	    --template "${srcdir}/templates/template-test.tmpl" \
+	    --outfile "${TMPFILE}" 2>/dev/null
+rc=$?
+
+if test "${rc}" != "0"; then
+	echo "Could not generate an EdDSA certificate $i"
+	exit 1
+fi
+
+${VALGRIND} "${CERTTOOL}" --verify --load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" --infile "${TMPFILE}"
+rc=$?
+if test "${rc}" != "0"; then
+	echo "There was an issue verifying the generated certificate (2)"
+	exit 1
+fi
+
+
+
+rm -f "${TMPFILE}"
+rm -f "${KEYFILE}"
+
+exit 0
diff --git a/tests/cert-tests/data/cert-eddsa.pem b/tests/cert-tests/data/cert-eddsa.pem
new file mode 100644
index 0000000000..b402a97042
--- /dev/null
+++ b/tests/cert-tests/data/cert-eddsa.pem
@@ -0,0 +1,36 @@
+X.509 Certificate Information:
+	Version: 3
+	Serial Number (hex): 5601474a2a8dc330
+	Issuer: CN=IETF Test Demo
+	Validity:
+		Not Before: Mon Aug 01 12:19:24 UTC 2016
+		Not After: Mon Dec 31 23:59:59 UTC 2040
+	Subject: CN=IETF Test Demo
+	Subject Public Key Algorithm: ECDH (X25519)
+	Extensions:
+		Basic Constraints (critical):
+			Certificate Authority (CA): FALSE
+		Key Usage (not critical):
+			Key agreement.
+		Subject Key Identifier (not critical):
+			9b1f5eeded043385e4f7bc623c5975b90bc8bb3b
+	Signature Algorithm: EdDSA-Ed25519
+	Signature:
+		af:23:01:fe:dd:c9:e6:ff:c1:cc:a7:3d:74:d6:48:a4
+		39:80:82:cd:db:69:b1:4e:4d:06:ec:f8:1a:25:ce:50
+		d4:c2:c3:eb:74:6c:4e:dd:83:46:85:6e:c8:6f:3d:ce
+		1a:18:65:c5:7a:c2:7b:50:a0:c3:50:07:f5:e7:d9:07
+Other Information:
+	Fingerprint:
+		sha1:8b011a41d9b72f9848b1dcbd3a038fa8c9d0a536
+		sha256:180516f0a03e4893d234a28f3ad28921bc35d1b12bd35134847240dafb715a11
+
+-----BEGIN CERTIFICATE-----
+MIIBLDCB36ADAgECAghWAUdKKo3DMDAFBgMrZXAwGTEXMBUGA1UEAwwOSUVURiBU
+ZXN0IERlbW8wHhcNMTYwODAxMTIxOTI0WhcNNDAxMjMxMjM1OTU5WjAZMRcwFQYD
+VQQDDA5JRVRGIFRlc3QgRGVtbzAqMAUGAytlbgMhAIUg8AmJMKdUdIt93LQ+91oN
+vzoNJjga9OukqY6qm05qo0UwQzAPBgNVHRMBAf8EBTADAQEAMA4GA1UdDwEBAAQE
+AwIDCDAgBgNVHQ4BAQAEFgQUmx9e7e0EM4Xk97xiPFl1uQvIuzswBQYDK2VwA0EA
+ryMB/t3J5v/BzKc9dNZIpDmAgs3babFOTQbs+BolzlDUwsPrdGxO3YNGhW7Ibz3O
+GhhlxXrCe1Cgw1AH9efZBw==
+-----END CERTIFICATE-----