]>
git.ipfire.org Git - thirdparty/openssl.git/blob - test/recipes/15-test_genrsa.t
2 # Copyright 2017-2023 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
14 use OpenSSL
::Test qw
/:DEFAULT srctop_file srctop_dir bldtop_dir bldtop_file/;
15 use OpenSSL
::Test
::Utils
;
21 use lib srctop_dir
('Configurations');
22 use lib bldtop_dir
('.');
24 my $no_fips = disabled
('fips') || ($ENV{NO_FIPS
} // 0);
27 ($no_fips ?
0 : 5) # Extra FIPS related tests
30 # We want to know that an absurdly small number of bits isn't support
31 is
(run
(app
([ 'openssl', 'genpkey', '-out', 'genrsatest.pem',
32 '-algorithm', 'RSA', '-pkeyopt', 'rsa_keygen_bits:8',
33 '-pkeyopt', 'rsa_keygen_pubexp:3'])),
35 is
(run
(app
([ 'openssl', 'genrsa', '-3', '-out', 'genrsatest.pem', '8'])),
38 # Depending on the shared library, we might have different lower limits.
39 # Let's find it! This is a simple binary search
40 # ------------------------------------------------------------
41 # NOTE: $good may need an update in the future
42 # ------------------------------------------------------------
43 note
"Looking for lowest amount of bits";
44 my $bad = 3; # Log2 of number of bits (2 << 3 == 8)
45 my $good = 11; # Log2 of number of bits (2 << 11 == 2048)
47 while ($good > $bad + 1) {
48 my $checked = int(($good + $bad + 1) / 2);
49 my $bits = 2 ** $checked;
50 $fin = run
(app
([ 'openssl', 'genpkey', '-out', 'genrsatest.pem',
51 '-algorithm', 'RSA', '-pkeyopt', 'rsa_keygen_pubexp:65537',
52 '-pkeyopt', "rsa_keygen_bits:$bits",
55 note
2 ** $checked, " bits is good";
58 note
2 ** $checked, " bits is bad";
62 $good++ if $good == $bad;
64 note
"Found lowest allowed amount of bits to be $good";
66 ok
(run
(app
([ 'openssl', 'genpkey', '-algorithm', 'RSA',
67 '-pkeyopt', 'rsa_keygen_pubexp:65537',
68 '-pkeyopt', "rsa_keygen_bits:$good",
69 '-out', 'genrsatest.pem' ])),
71 ok
(run
(app
([ 'openssl', 'pkey', '-check', '-in', 'genrsatest.pem', '-noout' ])),
74 ok
(run
(app
([ 'openssl', 'genpkey', '-algorithm', 'RSA',
75 '-pkeyopt', 'rsa_keygen_bits:2048',
76 '-out', 'genrsatest2048.pem' ])),
78 ok
(run
(app
([ 'openssl', 'pkey', '-check', '-in', 'genrsatest2048.pem', '-noout' ])),
81 ok
(!run
(app
([ 'openssl', 'genpkey', '-algorithm', 'RSA',
82 '-pkeyopt', 'hexe:02',
83 '-out', 'genrsatest.pem' ])),
84 "genpkey with a bad public exponent should fail");
85 ok
(!run
(app
([ 'openssl', 'genpkey', '-algorithm', 'RSA',
86 '-pkeyopt', 'e:65538',
87 '-out', 'genrsatest.pem' ])),
88 "genpkey with a even public exponent should fail");
89 ok
(!run
(app
([ 'openssl', 'genpkey', '-propquery', 'unknown',
90 '-algorithm', 'RSA' ])),
91 "genpkey requesting unknown=yes property should fail");
94 skip
"Skipping rsa command line test", 2 if disabled
("deprecated-3.0");
96 ok
(run
(app
([ 'openssl', 'genrsa', '-3', '-out', 'genrsatest.pem', $good ])),
98 ok
(run
(app
([ 'openssl', 'rsa', '-check', '-in', 'genrsatest.pem', '-noout' ])),
102 ok
(run
(app
([ 'openssl', 'genrsa', '-f4', '-out', 'genrsatest.pem', $good ])),
104 ok
(run
(app
([ 'openssl', 'rsa', '-check', '-in', 'genrsatest.pem', '-noout' ])),
106 ok
(run
(app
([ 'openssl', 'rsa', '-in', 'genrsatest.pem', '-out', 'genrsatest-enc.pem',
107 '-aes256', '-passout', 'pass:x' ])),
109 # Check the default salt length for PBKDF2 is 16 bytes
110 # We expect the output to be of the form "0:d=0 hl=2 l= 16 prim: OCTET STRING [HEX DUMP]:FAC7F37508E6B7A805BF4B13861B3687"
111 # i.e. 2 byte header + 16 byte salt.
112 ok
(run
(app
(([ 'openssl', 'asn1parse',
113 '-in', 'genrsatest-enc.pem',
114 '-offset', '34', '-length', '18']))),
115 "Check the default size of the PBKDF2 PARAM 'salt length' is 16");
116 ok
(run
(app
([ 'openssl', 'rsa', '-in', 'genrsatest-enc.pem', '-passin', 'pass:x' ])),
120 my $provconf = srctop_file
("test", "fips-and-base.cnf");
121 my $provpath = bldtop_dir
("providers");
122 my @prov = ( "-provider-path", $provpath,
123 "-config", $provconf);
125 $ENV{OPENSSL_TEST_LIBCTX
} = "1";
126 ok
(run
(app
(['openssl', 'genpkey',
129 '-pkeyopt', 'bits:2080',
130 '-out', 'genrsatest2080.pem'])),
131 "Generating RSA key with > 2048 bits and < 3072 bits");
132 ok
(run
(app
(['openssl', 'genpkey',
135 '-pkeyopt', 'bits:3072',
136 '-out', 'genrsatest3072.pem'])),
137 "Generating RSA key with 3072 bits");
139 ok
(!run
(app
(['openssl', 'genrsa', @prov, '512'])),
140 "Generating RSA key with 512 bits should fail in FIPS provider");
142 ok
(!run
(app
(['openssl', 'genrsa',
144 '-provider', 'default',
145 '-propquery', '?fips!=yes',
147 "Generating RSA key with 512 bits should succeed with FIPS provider as".
148 " default with a non-FIPS property query");
150 # We want to know that an absurdly large number of bits fails the RNG check
151 is
(run
(app
([ 'openssl', 'genpkey',
154 '-pkeyopt', 'bits:1000000000',
155 '-out', 'genrsatest.pem'])),
156 0, "genpkey 1000000000");