def test_set_attribute_usage_limit_Assym(self): """Test: Verify that user is able to set CKA_USAGE_LIMIT attribute on an assymetric crypto object Procedure: Generate a RSA key pair Use C_SetAttributeValue to set CKA_USAGE_LIMIT to 2 on RSA public key Use C_getAttributeValue to verify """ LOG.info( "Test: Verify that user is able to set CKA_USAGE_LIMIT attribute on \ an assymetric crypto object") usage_lim_template = {CKA_USAGE_LIMIT: 2} h_pbkey, h_prkey = c_generate_key_pair_ex( self.h_session, mechanism=CKM_RSA_PKCS_KEY_PAIR_GEN, pbkey_template=CKM_RSA_PKCS_KEY_PAIR_GEN_PUBTEMP, prkey_template=CKM_RSA_PKCS_KEY_PAIR_GEN_PRIVTEMP) LOG.info( "Called c-generate: Public Key handle: %s Private Key Handle: %s", h_pbkey, h_prkey) usage_limit = 2 c_set_attribute_value_ex(self.h_session, h_pbkey, usage_lim_template) py_template = c_get_attribute_value_ex( self.h_session, h_pbkey, template={CKA_USAGE_LIMIT: None}) usage_val_out = py_template[CKA_USAGE_LIMIT] LOG.info("CKA_USAGE_LIMIT reported by C_GetAttributeValue: %s", usage_val_out) assert usage_limit == usage_val_out, "reported USAGE LIMIT does not match"
def asym_key(auth_session, usage_set): """ Generate a key pair & set the USAGE limit by some method (on creation or c_setattr, or both) :return: private key handle """ usage_type, limit = usage_set pubtemp, privtemp = get_default_key_pair_template( CKM_RSA_PKCS_KEY_PAIR_GEN) usage_template = {CKA_USAGE_LIMIT: limit} if usage_type in ("create", "both", "create_then_use"): privtemp.update(usage_template) pubkey, privkey = c_generate_key_pair_ex(auth_session, CKM_RSA_PKCS_KEY_PAIR_GEN, get_session_template(pubtemp), get_session_template(privtemp)) try: if usage_type == "create_then_use": with open(_get_data_file('sha1pkcs_plain.der'), 'rb') as df: data = df.read() c_sign_ex(auth_session, privkey, data, CKM_RSA_PKCS) if usage_type in ("setattr", "both", "create_then_use"): c_set_attribute_value_ex(auth_session, privkey, usage_template) yield privkey finally: c_destroy_object(auth_session, pubkey) c_destroy_object(auth_session, privkey)
def test_usage_limit_attribute_check_Assym(self): """Test: Verify that CKA_USAGE_COUNT attribute increments as user use the assymetric crypto object Procedure: Generate a RSA Key pair Use C_SetAttributeValue to set CKA_USAGE_LIMIT to 2 Use RSA public key twice for encryption Use C_getAttributeValue to verify that CKA_USAGE_COUNT is 2 """ LOG.info( "Test: Verify that CKA_USAGE_COUNT attribute increments as user \ use the assymetric crypto object") usage_lim_template = {CKA_USAGE_LIMIT: 2} usage_count = 2 h_pbkey, h_prkey = c_generate_key_pair_ex( self.h_session, mechanism=CKM_RSA_PKCS_KEY_PAIR_GEN, pbkey_template=CKM_RSA_PKCS_KEY_PAIR_GEN_PUBTEMP, prkey_template=CKM_RSA_PKCS_KEY_PAIR_GEN_PRIVTEMP) LOG.info( "Called c-generate: Public Key handle -%s Private Key Handle -%s", h_pbkey, h_prkey) c_set_attribute_value_ex(self.h_session, h_pbkey, usage_lim_template) c_encrypt_ex(self.h_session, h_pbkey, b'a' * 20, mechanism={"mech_type": CKM_RSA_PKCS}) c_encrypt_ex(self.h_session, h_pbkey, b'a' * 20, mechanism={"mech_type": CKM_RSA_PKCS}) py_template = c_get_attribute_value_ex( self.h_session, h_pbkey, template={CKA_USAGE_COUNT: None}) usage_val_out = py_template[CKA_USAGE_COUNT] LOG.info("CKA_USAGE_COUNT reported by C_GetAttributeValue: %s", usage_val_out) assert usage_count == usage_val_out, "reported USAGE LIMIT does not match"
def test_set_attribute_usage_count_check_error_CKR_KEY_NOT_ACTIVE_rsa( self): """Test: Verify that crypto operation returns error CKR_KEY_NOT_ACTIVE if user try to use crypto object more than limit set on CKA_USAGE_LIMIT Procedure: Generate a RSA Key pair Use C_SetAttributeValue to set CKA_USAGE_LIMIT to 2 Use RSA public key 3 times for encryption """ usage_lim_template = {CKA_USAGE_LIMIT: 2} h_pbkey, h_prkey = c_generate_key_pair_ex( self.h_session, mechanism=CKM_RSA_PKCS_KEY_PAIR_GEN, pbkey_template=CKM_RSA_PKCS_KEY_PAIR_GEN_PUBTEMP, prkey_template=CKM_RSA_PKCS_KEY_PAIR_GEN_PRIVTEMP) LOG.info( "Called c-generate: Public Key handle -%s Private Key Handle - %s", h_pbkey, h_prkey) c_set_attribute_value_ex(self.h_session, h_pbkey, usage_lim_template) c_encrypt_ex(self.h_session, h_pbkey, b'a' * 20, mechanism={"mech_type": CKM_RSA_PKCS}) c_encrypt_ex(self.h_session, h_pbkey, b'a' * 20, mechanism={"mech_type": CKM_RSA_PKCS}) return_val, data = c_encrypt(self.h_session, h_pbkey, b'a' * 20, mechanism={"mech_type": CKM_RSA_PKCS}) LOG.info("Called C_Encrypt, return code: %s", return_val) py_template = c_get_attribute_value_ex( self.h_session, h_pbkey, template={CKA_USAGE_COUNT: None}) usage_val_out = py_template[CKA_USAGE_COUNT] assert return_val == CKR_KEY_NOT_ACTIVE, "reported error code does not match"
def test_x9_key_derive(self, auth_session, curve_type): """ Test we can do X9 key derivation """ derived_key2 = derived_key1 = pub_key1 = pub_key2 = prv_key2 = prv_key1 = None derived_template = { CKA_CLASS: CKO_SECRET_KEY, CKA_KEY_TYPE: CKK_DES, CKA_ENCRYPT: True, CKA_DECRYPT: True, CKA_PRIVATE: True, CKA_SENSITIVE: True } pub_temp, priv_temp = get_default_key_pair_template( CKM_ECDSA_KEY_PAIR_GEN) priv_temp = get_session_template(priv_temp) pub_temp = get_session_template(pub_temp) pub_temp[CKA_ECDSA_PARAMS] = curve_list[curve_type] pub_key1, prv_key1 = c_generate_key_pair_ex(auth_session, CKM_ECDSA_KEY_PAIR_GEN, pbkey_template=pub_temp, prkey_template=priv_temp) try: pub_key2, prv_key2 = c_generate_key_pair_ex( auth_session, CKM_ECDSA_KEY_PAIR_GEN, pbkey_template=pub_temp, prkey_template=priv_temp) pub_key1_raw = c_get_attribute_value_ex( auth_session, pub_key1, {CKA_EC_POINT: None})[CKA_EC_POINT] pub_key2_raw = c_get_attribute_value_ex( auth_session, pub_key2, {CKA_EC_POINT: None})[CKA_EC_POINT] derived_key1 = c_derive_key_ex(auth_session, h_base_key=prv_key2, template=derived_template, mechanism={ "mech_type": CKM_ECDH1_DERIVE, "params": { "kdf": CKD_NULL, "sharedData": None, "publicData": pub_key1_raw } }) derived_key2 = c_derive_key_ex(auth_session, h_base_key=prv_key1, template=derived_template, mechanism={ "mech_type": CKM_ECDH1_DERIVE, "params": { "kdf": CKD_NULL, "sharedData": None, "publicData": pub_key2_raw } }) cipher_data = c_encrypt_ex(auth_session, derived_key1, data=DATA, mechanism=CKM_DES_ECB) restored_text = c_decrypt_ex(auth_session, derived_key2, cipher_data, mechanism=CKM_DES_ECB) assert DATA == restored_text.rstrip(b'\x00') finally: for key in (pub_key1, prv_key1, pub_key2, prv_key2, derived_key1, derived_key2): if key: c_destroy_object(auth_session, key)
def test_asymmetric_key_expiry_dsa(self): """Test: Verify that user is not able to use the dsa asymmetric object after date specified in CKA_END_DATE attribute Procedure: Generate a DSA Key dsa1 Use dsa11 in encrypt operation. Should work fine Using audit role, change the date of HSM to 12/31/2013 Use dsa1 in encrypt operation """ logger.info( "Test: Verify that user is not able to use the dsa asymmetric object after " "date specified in \ CKA_END_DATE attribute") end_d = {'year': b"2013", 'month': b"12", 'day': b"31"} CKM_DSA_KEY_PAIR_GEN_PUBTEMP_1024_160 = { CKA_TOKEN: True, CKA_PRIVATE: True, CKA_ENCRYPT: True, CKA_VERIFY: True, CKA_WRAP: True, CKA_PRIME: dsa_prime_1024_160, CKA_SUBPRIME: dsa_sub_prime_1024_160, CKA_BASE: dsa_base_1024_160, CKA_END_DATE: end_d, CKA_LABEL: b"DSA 1024_160 Public Key" } CKM_DSA_KEY_PAIR_GEN_PRIVTEMP = { CKA_TOKEN: True, CKA_PRIVATE: True, CKA_SENSITIVE: True, CKA_DECRYPT: True, CKA_SIGN: True, CKA_UNWRAP: True, CKA_EXTRACTABLE: True, CKA_END_DATE: end_d, CKA_LABEL: b"DSA Public Key" } h_pbkey, h_prkey = c_generate_key_pair_ex( self.h_session, flavor=CKM_DSA_KEY_PAIR_GEN, pbkey_template=CKM_DSA_KEY_PAIR_GEN_PUBTEMP_1024_160, prkey_template=CKM_DSA_KEY_PAIR_GEN_PRIVTEMP, mech=None) logger.info("Called c-generate: Public Key handle -" + str(h_pbkey) + "Private Key Handle" + str(h_prkey)) c_sign_ex(self.h_session, CKM_DSA_SHA1, b"Some data to sign", h_prkey) c_logout_ex(self.h_session) c_close_session_ex(self.h_session) ca_init_audit_ex(self.admin_slot, AUDITOR_PASSWORD, AUDITOR_LABEL) h_session2 = c_open_session_ex(slot_num=self.admin_slot, flags=(CKF_SERIAL_SESSION | CKF_AUDIT_SESSION)) login_ex(h_session2, self.admin_slot, AUDITOR_PASSWORD, CKU_AUDIT) dt = datetime(2014, 1, 31) epoch = datetime.utcfromtimestamp(0) delta = dt - epoch hsm_dt = delta.total_seconds() hsm_new_date = int(hsm_dt) ca_time_sync_ex(h_session2, hsm_new_date) hsm_time = ca_get_time_ex(self.h_session) # print datetime.fromtimestamp(float(hsm_time.value)) c_logout_ex(h_session2) c_close_session_ex(h_session2) h_session = c_open_session_ex(slot_num=self.admin_slot) login_ex(h_session, self.admin_slot, CO_PASSWORD, CKU_USER) return_val, sig = c_sign(h_session, CKM_DSA_SHA1, b"Some data to sign", h_prkey) logger.info("Called C_Sign, return code: " + str(return_val)) assert return_val == CKR_KEY_NOT_ACTIVE, "Expected return code is CKR_KEY_NOT_ACTIVE"