tests/test_tpm2_swtpm_cert - master - githubmirror/swtpm

tests/test_tpm2_swtpm_cert
162 строки5 KB
Stefan Berger
tests: Sign different TPM 2 certificate types with an Ed448 key
03 июн 2026, 23:30
03 июн 2026, 23:308356e28
#!/usr/bin/env bash

cd "$(dirname "$0")" || exit 1

TMPDIR=$(mktemp -d) || exit 1
function cleanup()
{
	rm -rf "${TMPDIR}"
}
trap "cleanup" SIGTERM EXIT

# CA:
CACERT=${TMPDIR}/swtpm-localca-rootca-cert.pem
CAKEY=${TMPDIR}/swtpm-localca-rootca-privkey.pem

# EK keys:
RSAPRIVKEY=${TMPDIR}/rsaprivkey.pem
RSAPUBKEY=${TMPDIR}/rsapubkey.pem
EC256PRIVKEY=${TMPDIR}/ec256privkey.pem
EC256PUBKEY=${TMPDIR}/ec256pubkey.pem
MLKEM1024PRIVKEY=${TMPDIR}/mlkem1024privkey.pem
MLKEM1024PUBKEY=${TMPDIR}/mlkem1024pubkey.pem
MLDSA87PRIVKEY=${TMPDIR}/mldsa87privkey.pem
MLDSA87PUBKEY=${TMPDIR}/mldsa87pubkey.pem
ED448PRIVKEY=${TMPDIR}/ed448privkey.pem
ED448PUBKEY=${TMPDIR}/ed448pubkey.pem

# secp521r1 key used for signing
EC521PRIVKEY=${TMPDIR}/ec521privkey.pem
EC521PUBKEY=${TMPDIR}/ec521pubkey.pem
ISSUERCERT_EC521=${TMPDIR}/ec521-issuercert.pem

# RSA 3072 key used for signing
RSA3072PRIVKEY=${TMPDIR}/rsa3072privkey.pem
RSA3072PUBKEY=${TMPDIR}/rsa3072pubkey.pem
ISSUERCERT_RSA3072=${TMPDIR}/rsa3072-issuercert.pem

# ML-DSA-87 key used for signing
ISSUERCERT_MLDSA87=${TMPDIR}/mldsa87-issuercert.pem

# ED448 key used for signing
ISSUERCERT_ED448=${TMPDIR}/ed448-issuercert.pem

if ! msg=$(openssl genrsa -out "${RSAPRIVKEY}" 2432 2>&1) ||
   ! msg=$(openssl rsa -in "${RSAPRIVKEY}" -pubout -out "${RSAPUBKEY}" 2>&1) ||
   ! msg=$(openssl ecparam -name prime256v1 -genkey -noout -out "${EC256PRIVKEY}" 2>&1) || \
   ! msg=$(openssl ec -in "${EC256PRIVKEY}" -pubout -out "${EC256PUBKEY}" 2>&1) || \
   ! msg=$(openssl genpkey -algorithm ml-kem-1024 -out "${MLKEM1024PRIVKEY}" 2>&1) || \
   ! msg=$(openssl pkey -in "${MLKEM1024PRIVKEY}" -pubout -out "${MLKEM1024PUBKEY}" 2>&1) || \
   ! msg=$(openssl genpkey -algorithm ml-dsa-87 -out "${MLDSA87PRIVKEY}" 2>&1) || \
   ! msg=$(openssl pkey -in "${MLDSA87PRIVKEY}" -pubout -out "${MLDSA87PUBKEY}" 2>&1) || \
   ! msg=$(openssl genpkey -algorithm ed448 -out "${ED448PRIVKEY}" 2>&1) || \
   ! msg=$(openssl pkey -in "${ED448PRIVKEY}" -pubout -out "${ED448PUBKEY}" 2>&1) || \
   ! msg=$(openssl req \
	-x509 \
	-new \
	-noenc \
	-keyout "${CAKEY}" \
	-newkey rsa:3072 \
	-sha256 \
	-days 365 \
	-out "${CACERT}" \
	-subj "/CN=swtpm-localca-rootca" 2>&1) || \
   ! msg=$(openssl ecparam -name secp521r1 -genkey -noout -out "${EC521PRIVKEY}" 2>&1) || \
   ! msg=$(openssl ec -in "${EC521PRIVKEY}" -pubout -out "${EC521PUBKEY}" 2>&1) || \
   ! msg=$(openssl req \
	-x509 \
	-key "${EC521PRIVKEY}" \
	-out "${ISSUERCERT_EC521}" \
	-days 1000 \
	-subj "/CN=swtpm-localca" \
	-CA "${CACERT}" \
	-CAkey "${CAKEY}" 2>&1) || \
   ! msg=$(openssl genrsa -out "${RSA3072PRIVKEY}" 3072 2>&1) || \
   ! msg=$(openssl rsa     -in "${RSA3072PRIVKEY}" -pubout -out "${RSA3072PUBKEY}" 2>&1) || \
   ! msg=$(openssl req \
	-x509 \
	-key "${RSA3072PRIVKEY}" \
	-out "${ISSUERCERT_RSA3072}" \
	-days 1000 \
	-subj "/CN=swtpm-localca" \
	-CA "${CACERT}" \
	-CAkey "${CAKEY}" 2>&1) || \
   ! msg=$(openssl req \
	-x509 \
	-key "${MLDSA87PRIVKEY}" \
	-out "${ISSUERCERT_MLDSA87}" \
	-days 1000 \
	-subj "/CN=swtpm-localca" \
	-CA "${CACERT}" \
	-CAkey "${CAKEY}" 2>&1) || \
   ! msg=$(openssl req \
	-x509 \
	-key "${ED448PRIVKEY}" \
	-out "${ISSUERCERT_ED448}" \
	-days 1000 \
	-subj "/CN=swtpm-localca" \
	-CA "${CACERT}" \
	-CAkey "${CAKEY}" 2>&1) \
; then
	echo "Could not create the required keys"
	echo "${msg}"
	exit 1
fi

echo "Testing with RSA certificate signing key"

PARAM_RSAPUBKEY="${RSAPUBKEY}" \
PARAM_ECPUBKEY="${EC256PUBKEY}" \
PARAM_MLKEM1024PUBKEY="${MLKEM1024PUBKEY}" \
PARAM_MLDSA87PUBKEY="${MLDSA87PUBKEY}" \
PARAM_SIGNKEY="${RSA3072PRIVKEY}" \
PARAM_ISSUERCERT="${ISSUERCERT_RSA3072}" \
PARAM_CERT_SIZES="1046 841 1092 841 2340 1572 3364 1057 806 973 3245 973 1112" \
	./_test_tpm2_swtpm_cert
ret=$?
[ $ret -ne 0 ] && exit $ret


printf "\nTesting with secp521r1 certificate signing key\n"

PARAM_RSAPUBKEY="${RSAPUBKEY}" \
PARAM_ECPUBKEY="${EC256PUBKEY}" \
PARAM_MLKEM1024PUBKEY="${MLKEM1024PUBKEY}" \
PARAM_MLDSA87PUBKEY="${MLDSA87PUBKEY}" \
PARAM_SIGNKEY="${EC521PRIVKEY}" \
PARAM_ISSUERCERT="${ISSUERCERT_EC521}" \
PARAM_CERT_SIZES="792-794 587-589 838-840 587-589 2086-2088 1318-1320 3110-3112 804-805 552-554 719-721 2991-2993 720-721 858-860" \
	./_test_tpm2_swtpm_cert
ret=$?
[ $ret -ne 0 ] && exit $ret


printf "\nTesting with ml-dsa-87 certificate signing key\n"

PARAM_RSAPUBKEY="${RSAPUBKEY}" \
PARAM_ECPUBKEY="${EC256PUBKEY}" \
PARAM_MLKEM1024PUBKEY="${MLKEM1024PUBKEY}" \
PARAM_MLDSA87PUBKEY="${MLDSA87PUBKEY}" \
PARAM_SIGNKEY="${MLDSA87PRIVKEY}" \
PARAM_ISSUERCERT="${ISSUERCERT_MLDSA87}" \
PARAM_CERT_SIZES="5285 5080 5331 5080 6579 5811 7603 5296 5045 5212 7484 5212 5351" \
	./_test_tpm2_swtpm_cert
ret=$?
[ $ret -ne 0 ] && exit $ret


printf "\nTesting with Ed448 certificate signing key\n"

PARAM_RSAPUBKEY="${RSAPUBKEY}" \
PARAM_ECPUBKEY="${EC256PUBKEY}" \
PARAM_MLKEM1024PUBKEY="${MLKEM1024PUBKEY}" \
PARAM_MLDSA87PUBKEY="${MLDSA87PUBKEY}" \
PARAM_SIGNKEY="${ED448PRIVKEY}" \
PARAM_ISSUERCERT="${ISSUERCERT_ED448}" \
PARAM_CERT_SIZES="758 553 804 553 2052 1284 3076 769 518 685 2957 685 824" \
	./_test_tpm2_swtpm_cert
ret=$?
[ $ret -ne 0 ] && exit $ret


exit 0