Skip to content

Crypto access control additional tests #10160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Mar 27, 2019
Merged

Crypto access control additional tests #10160

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c8eb51d
Add crypto acl test - key derivation
Mar 18, 2019
f1722cb
Add crypto acl test - key agreement
Mar 19, 2019
2dfafe6
Crypto acl tests destroy keys
Mar 19, 2019
75e4210
Fix typos
Mar 26, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
142 changes: 119 additions & 23 deletions TESTS/psa/crypto_access_control/COMPONENT_NSPE/main.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,14 @@ void test_open_other_partition_key(void)

/* try to open the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_ERROR_DOES_NOT_EXIST, psa_open_key(PSA_KEY_LIFETIME_PERSISTENT, key_id, &key_handle));

/* via test partition - reopen the key created by the test partition and keep it open */
key_handle = 0;
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_open_persistent_key(key_id, &key_handle));
TEST_ASSERT_NOT_EQUAL(0, key_handle);

/* via test partition - destroy the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_destroy_key(key_handle));
}

void test_create_key_same_id_different_partitions(void)
Expand Down Expand Up @@ -158,11 +166,11 @@ void test_create_key_same_id_different_partitions(void)
TEST_ASSERT_EQUAL(key_usage_local, policy.usage);
TEST_ASSERT_EQUAL(key_alg, policy.alg);

/* via test partition - close the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_close_key(key_handle_remote));
/* via test partition - destroy the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_destroy_key(key_handle_remote));

/* close the key created by the current partition (NSPE) */
TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_close_key(key_handle_local));
/* destroy the key created by the current partition (NSPE) */
TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_destroy_key(key_handle_local));
}

void test_use_other_partition_key_manage_key(void)
Expand Down Expand Up @@ -235,8 +243,8 @@ void test_use_other_partition_key_manage_key(void)
/* via test partition - import key data for the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_import_key(key_handle, key_type, key_data, sizeof(key_data)));

/* via test partition - close the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_close_key(key_handle));
/* via test partition - destroy the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_destroy_key(key_handle));
}

void test_use_other_partition_key_mac(void)
Expand Down Expand Up @@ -266,8 +274,8 @@ void test_use_other_partition_key_mac(void)
operation = psa_mac_operation_init();
TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_HANDLE, psa_mac_verify_setup(&operation, key_handle, key_alg));

/* via test partition - close the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_close_key(key_handle));
/* via test partition - destroy the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_destroy_key(key_handle));
}

void test_use_other_partition_key_cipher(void)
Expand Down Expand Up @@ -297,8 +305,8 @@ void test_use_other_partition_key_cipher(void)
operation = psa_cipher_operation_init();
TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_HANDLE, psa_cipher_decrypt_setup(&operation, key_handle, key_alg));

/* via test partition - close the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_close_key(key_handle));
/* via test partition - destroy the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_destroy_key(key_handle));
}

void test_use_other_partition_key_aead(void)
Expand Down Expand Up @@ -333,8 +341,8 @@ void test_use_other_partition_key_aead(void)
cipher_text, sizeof(cipher_text),
plain_text, sizeof(plain_text), &len));

/* via test partition - close the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_close_key(key_handle));
/* via test partition - destroy the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_destroy_key(key_handle));
}

void test_use_other_partition_key_asymmetric_sign_verify(void)
Expand Down Expand Up @@ -366,8 +374,8 @@ void test_use_other_partition_key_asymmetric_sign_verify(void)
TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_HANDLE, psa_asymmetric_verify(key_handle, key_alg, input, sizeof(input),
signature, sizeof(signature)));

/* via test partition - close the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_close_key(key_handle));
/* via test partition - destroy the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_destroy_key(key_handle));
}

void test_use_other_partition_key_asymmetric_encrypt_decrypt(void)
Expand Down Expand Up @@ -438,8 +446,92 @@ void test_use_other_partition_key_asymmetric_encrypt_decrypt(void)
encrypted, sizeof(encrypted), NULL, 0,
decrypted, sizeof(decrypted), &len));

/* via test partition - close the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_close_key(key_handle));
/* via test partition - destroy the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_destroy_key(key_handle));
}

void test_use_other_partition_key_derivation_setup(void)
{
static const psa_key_id_t key_id = 999;
static const psa_algorithm_t key_alg = PSA_ALG_HKDF(PSA_ALG_SHA_256);
static const psa_key_usage_t key_usage = PSA_KEY_USAGE_DERIVE;
static const psa_key_type_t key_type = PSA_KEY_TYPE_DERIVE;
static const unsigned char key_data[] = {
0x30, 0x82, 0x01, 0x3b, 0x02, 0x01, 0x00, 0x02, 0x41, 0x00, 0xee, 0x2b,
0x13, 0x1d, 0x6b, 0x18, 0x18, 0xa9, 0x4c, 0xa8, 0xe9, 0x1c, 0x42, 0x38
};
static const unsigned char salt[] = {
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
0x0c
};
static const unsigned char label[] = {
0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9
};

psa_key_handle_t key_handle = 0;
psa_crypto_generator_t generator = psa_crypto_generator_init();
size_t bits = 128;

/* via test partition - create a key without generating any key material */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_create_persistent_key(key_id, &key_handle));
TEST_ASSERT_NOT_EQUAL(0, key_handle);

/* via test partition - set key policy */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_set_key_policy(key_handle, key_usage, key_alg));

/* via test partition - import key data for the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_import_key(key_handle, key_type, key_data, sizeof(key_data)));

/* try to setup key derivation using the key that was created by the test partition */
TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_HANDLE, psa_key_derivation(&generator, key_handle, key_alg,
(unsigned char *)salt, sizeof(salt),
(unsigned char *)label, sizeof(label),
PSA_BITS_TO_BYTES(bits)));

/* via test partition - destroy the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_destroy_key(key_handle));
}

void test_use_other_partition_key_agreement_setup(void)
{
static const psa_key_id_t key_id = 999;
static const psa_algorithm_t key_alg = PSA_ALG_ECDH(PSA_ALG_SELECT_RAW);
static const psa_key_usage_t key_usage = PSA_KEY_USAGE_DERIVE;
static const psa_key_type_t key_type = PSA_KEY_TYPE_ECC_KEYPAIR(PSA_ECC_CURVE_SECP256R1);
static const unsigned char key_data[] = {
0xc8, 0x8f, 0x01, 0xf5, 0x10, 0xd9, 0xac, 0x3f, 0x70, 0xa2, 0x92, 0xda,
0xa2, 0x31, 0x6d, 0xe5, 0x44, 0xe9, 0xaa, 0xb8, 0xaf, 0xe8, 0x40, 0x49,
0xc6, 0x2a, 0x9c, 0x57, 0x86, 0x2d, 0x14, 0x33
};
static const unsigned char peer_key_data[] = {
0x04, 0xd1, 0x2d, 0xfb, 0x52, 0x89, 0xc8, 0xd4, 0xf8, 0x12, 0x08, 0xb7,
0x02, 0x70, 0x39, 0x8c, 0x34, 0x22, 0x96, 0x97, 0x0a, 0x0b, 0xcc, 0xb7,
0x4c, 0x73, 0x6f, 0xc7, 0x55, 0x44, 0x94, 0xbf, 0x63, 0x56, 0xfb, 0xf3,
0xca, 0x36, 0x6c, 0xc2, 0x3e, 0x81, 0x57, 0x85, 0x4c, 0x13, 0xc5, 0x8d,
0x6a, 0xac, 0x23, 0xf0, 0x46, 0xad, 0xa3, 0x0f, 0x83, 0x53, 0xe7, 0x4f,
0x33, 0x03, 0x98, 0x72, 0xab
};

psa_key_handle_t key_handle = 0;
psa_crypto_generator_t generator = psa_crypto_generator_init();

/* via test partition - create a key without generating any key material */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_create_persistent_key(key_id, &key_handle));
TEST_ASSERT_NOT_EQUAL(0, key_handle);

/* via test partition - set key policy */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_set_key_policy(key_handle, key_usage, key_alg));

/* via test partition - import key data for the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_import_key(key_handle, key_type, key_data, sizeof(key_data)));

/* try to setup key agreement using the key that was created by the test partition */
TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_HANDLE, psa_key_agreement(&generator, key_handle,
(unsigned char *)peer_key_data, sizeof(peer_key_data),
key_alg));

/* via test partition - destroy the key created by the test partition */
TEST_ASSERT_EQUAL(PSA_SUCCESS, test_partition_crypto_destroy_key(key_handle));
}

utest::v1::status_t case_setup_handler(const Case *const source, const size_t index_of_case)
Expand Down Expand Up @@ -473,22 +565,26 @@ utest::v1::status_t test_setup(const size_t number_of_cases)
}

Case cases[] = {
Case("open other partitions' key",
Case("open other partition's key",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😀

case_setup_handler, test_open_other_partition_key, case_teardown_handler),
Case("create key with same id different partitions",
case_setup_handler, test_create_key_same_id_different_partitions, case_teardown_handler),
Case("use other partitions' key - key manage",
Case("use other partition's key - key manage",
case_setup_handler, test_use_other_partition_key_manage_key, case_teardown_handler),
Case("use other partitions' key - mac",
Case("use other partition's key - mac",
case_setup_handler, test_use_other_partition_key_mac, case_teardown_handler),
Case("use other partitions' key - cipher",
Case("use other partition's key - cipher",
case_setup_handler, test_use_other_partition_key_cipher, case_teardown_handler),
Case("use other partitions' key - aead",
Case("use other partition's key - aead",
case_setup_handler, test_use_other_partition_key_aead, case_teardown_handler),
Case("use other partitions' key - asymmetric sign verify",
Case("use other partition's key - asymmetric sign verify",
case_setup_handler, test_use_other_partition_key_asymmetric_sign_verify, case_teardown_handler),
Case("use other partitions' key - asymmetric encrypt decrypt",
Case("use other partition's key - asymmetric encrypt decrypt",
case_setup_handler, test_use_other_partition_key_asymmetric_encrypt_decrypt, case_teardown_handler),
Case("use other partition's key - key derivation setup",
case_setup_handler, test_use_other_partition_key_derivation_setup, case_teardown_handler),
Case("use other partition's key - key agreement setup",
case_setup_handler, test_use_other_partition_key_agreement_setup, case_teardown_handler),
};

Specification specification(test_setup, cases);
Expand Down