upstream: regression tests for Ed25519 keys in PKCS#11 tokens

OpenBSD-Regress-ID: 50067c0716abfea3a526b4a0c8f1fe15e7665c0f

diff --git a/regress/agent-pkcs11-cert.sh b/regress/agent-pkcs11-cert.sh
index 39e839f9c26a2a9aca32a39984208098abd92f62..551067d23f5f78c86007ac7605d6df0f58e84f40 100644 (file)
--- a/regress/agent-pkcs11-cert.sh
+++ b/regress/agent-pkcs11-cert.sh
@@ -1,4 +1,4 @@
-#      $OpenBSD: agent-pkcs11-cert.sh,v 1.2 2025/05/24 04:41:12 djm Exp $
+#      $OpenBSD: agent-pkcs11-cert.sh,v 1.3 2025/07/26 01:53:31 djm Exp $
 #      Placed in the Public Domain.
 
 tid="pkcs11 agent certificate test"
@@ -16,7 +16,10 @@ $SSHKEYGEN -qs $OBJ/ca -I "ecdsa_key" -n $USER -z 1 ${SSH_SOFTHSM_DIR}/EC.pub ||
        fatal "certify ECDSA key failed"
 $SSHKEYGEN -qs $OBJ/ca -I "rsa_key" -n $USER -z 2 ${SSH_SOFTHSM_DIR}/RSA.pub ||
        fatal "certify RSA key failed"
-$SSHKEYGEN -qs $OBJ/ca -I "ca_ca" -n $USER -z 3 $OBJ/ca.pub ||
+$SSHKEYGEN -qs $OBJ/ca -I "ed25519_key" -n $USER -z 3 \
+    ${SSH_SOFTHSM_DIR}/ED25519.pub ||
+       fatal "certify ed25519 key failed"
+$SSHKEYGEN -qs $OBJ/ca -I "ca_ca" -n $USER -z 4 $OBJ/ca.pub ||
        fatal "certify CA key failed"
 
 start_ssh_agent
@@ -25,6 +28,8 @@ verbose "load pkcs11 keys and certs"
 # Note: deliberately contains non-cert keys and non-matching cert on commandline
 p11_ssh_add -qs ${TEST_SSH_PKCS11} \
     $OBJ/ca.pub \
+    ${SSH_SOFTHSM_DIR}/ED25519.pub \
+    ${SSH_SOFTHSM_DIR}/ED25519-cert.pub \
     ${SSH_SOFTHSM_DIR}/EC.pub \
     ${SSH_SOFTHSM_DIR}/EC-cert.pub \
     ${SSH_SOFTHSM_DIR}/RSA.pub \
@@ -33,8 +38,10 @@ p11_ssh_add -qs ${TEST_SSH_PKCS11} \
 # Verify their presence
 verbose "verify presence"
 cut -d' ' -f1-2 \
+    ${SSH_SOFTHSM_DIR}/ED25519.pub \
     ${SSH_SOFTHSM_DIR}/EC.pub \
     ${SSH_SOFTHSM_DIR}/RSA.pub \
+    ${SSH_SOFTHSM_DIR}/ED25519-cert.pub \
     ${SSH_SOFTHSM_DIR}/EC-cert.pub \
     ${SSH_SOFTHSM_DIR}/RSA-cert.pub | sort > $OBJ/expect_list
 $SSHADD -L | cut -d' ' -f1-2 | sort > $OBJ/output_list
@@ -43,16 +50,19 @@ diff $OBJ/expect_list $OBJ/output_list
 # Verify that all can perform signatures.
 verbose "check signatures"
 for x in ${SSH_SOFTHSM_DIR}/EC.pub ${SSH_SOFTHSM_DIR}/RSA.pub \
-    ${SSH_SOFTHSM_DIR}/EC-cert.pub ${SSH_SOFTHSM_DIR}/RSA-cert.pub ; do
+    ${SSH_SOFTHSM_DIR}/EC-cert.pub ${SSH_SOFTHSM_DIR}/RSA-cert.pub \
+    ${SSH_SOFTHSM_DIR}/ED25519.pub ${SSH_SOFTHSM_DIR}/ED25519-cert.pub ; do
        $SSHADD -T $x || fail "Signing failed for $x"
 done
 
 # Delete plain keys.
 verbose "delete plain keys"
 $SSHADD -qd ${SSH_SOFTHSM_DIR}/EC.pub ${SSH_SOFTHSM_DIR}/RSA.pub
+$SSHADD -qd ${SSH_SOFTHSM_DIR}/ED25519.pub 
 # Verify that certs can still perform signatures.
 verbose "reverify certificate signatures"
-for x in ${SSH_SOFTHSM_DIR}/EC-cert.pub ${SSH_SOFTHSM_DIR}/RSA-cert.pub ; do
+for x in ${SSH_SOFTHSM_DIR}/EC-cert.pub ${SSH_SOFTHSM_DIR}/RSA-cert.pub \
+    ${SSH_SOFTHSM_DIR}/ED25519-cert.pub ; do
        $SSHADD -T $x || fail "Signing failed for $x"
 done
 
@@ -64,18 +74,22 @@ p11_ssh_add -qCs ${TEST_SSH_PKCS11} \
     ${SSH_SOFTHSM_DIR}/EC.pub \
     ${SSH_SOFTHSM_DIR}/EC-cert.pub \
     ${SSH_SOFTHSM_DIR}/RSA.pub \
-    ${SSH_SOFTHSM_DIR}/RSA-cert.pub ||
+    ${SSH_SOFTHSM_DIR}/RSA-cert.pub \
+    ${SSH_SOFTHSM_DIR}/ED25519.pub \
+    ${SSH_SOFTHSM_DIR}/ED25519-cert.pub ||
        fatal "failed to add keys"
 # Verify their presence
 verbose "verify presence"
 cut -d' ' -f1-2 \
     ${SSH_SOFTHSM_DIR}/EC-cert.pub \
-    ${SSH_SOFTHSM_DIR}/RSA-cert.pub | sort > $OBJ/expect_list
+    ${SSH_SOFTHSM_DIR}/RSA-cert.pub \
+    ${SSH_SOFTHSM_DIR}/ED25519-cert.pub | sort > $OBJ/expect_list
 $SSHADD -L | cut -d' ' -f1-2 | sort > $OBJ/output_list
 diff $OBJ/expect_list $OBJ/output_list
 
 # Verify that certs can perform signatures.
 verbose "check signatures"
-for x in ${SSH_SOFTHSM_DIR}/EC-cert.pub ${SSH_SOFTHSM_DIR}/RSA-cert.pub ; do
+for x in ${SSH_SOFTHSM_DIR}/EC-cert.pub ${SSH_SOFTHSM_DIR}/RSA-cert.pub \
+    ${SSH_SOFTHSM_DIR}/ED25519-cert.pub ; do
        $SSHADD -T $x || fail "Signing failed for $x"
 done

diff --git a/regress/agent-pkcs11-restrict.sh b/regress/agent-pkcs11-restrict.sh
index e5763ea8f6d00c6fe15eb81b5caeaa69683438b4..9fc5e1c69f502c6cca464a66496088e609bd11c1 100644 (file)
--- a/regress/agent-pkcs11-restrict.sh
+++ b/regress/agent-pkcs11-restrict.sh
@@ -1,4 +1,4 @@
-#      $OpenBSD: agent-pkcs11-restrict.sh,v 1.2 2025/05/24 04:41:12 djm Exp $
+#      $OpenBSD: agent-pkcs11-restrict.sh,v 1.3 2025/07/26 01:53:31 djm Exp $
 #      Placed in the Public Domain.
 
 tid="pkcs11 agent constraint test"
@@ -16,6 +16,7 @@ for h in a b x ca ; do
 done
 
 # XXX test CA hostcerts too.
+# XXX test ed25519 keys
 
 key_for() {
        case $h in

diff --git a/regress/agent-pkcs11.sh b/regress/agent-pkcs11.sh
index 731c1f9ddc9683e05034339e8b1ea33f6944b5da..4914666592116a95263c6570086959836bbed415 100644 (file)
--- a/regress/agent-pkcs11.sh
+++ b/regress/agent-pkcs11.sh
@@ -1,4 +1,4 @@
-#      $OpenBSD: agent-pkcs11.sh,v 1.14 2025/05/24 04:41:03 djm Exp $
+#      $OpenBSD: agent-pkcs11.sh,v 1.15 2025/07/26 01:53:31 djm Exp $
 #      Placed in the Public Domain.
 
 tid="pkcs11 agent test"
@@ -21,7 +21,7 @@ if [ $r -ne 0 ]; then
        fail "ssh-add -l failed: exit code $r"
 fi
 
-for k in $RSA $EC; do
+for k in $ED25519 $RSA $EC; do
        trace "testing $k"
        pub=$(cat $k.pub)
        ${SSHADD} -L | grep -q "$pub" || \

diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 0ecf6c5a83c06341127aadf9ff2d61cd04fccd80..c5270042e6a9a977bef1471967c8406178f21609 100644 (file)
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -1,4 +1,4 @@
-#      $OpenBSD: test-exec.sh,v 1.130 2025/06/28 13:34:08 dtucker Exp $
+#      $OpenBSD: test-exec.sh,v 1.131 2025/07/26 01:53:31 djm Exp $
 #      Placed in the Public Domain.
 
 #SUDO=sudo
@@ -979,6 +979,18 @@ EOF
            --import $ECP8 >/dev/null || fatal "softhsm import EC fail"
        chmod 600 $EC
        ssh-keygen -y -f $EC > ${EC}.pub
+       # Ed25519 key
+       ED25519=${SSH_SOFTHSM_DIR}/ED25519
+       ED25519P8=${SSH_SOFTHSM_DIR}/ED25519P8
+       $OPENSSL_BIN genpkey -algorithm ed25519 > $ED25519 || \
+           fatal "genpkey Ed25519 fail"
+       $OPENSSL_BIN pkcs8 -nocrypt -in $ED25519 > $ED25519P8 || \
+               fatal "pkcs8 Ed25519 fail"
+       softhsm2-util --slot "$slot" --label 03 --id 03 --pin "$TEST_SSH_PIN" \
+           --import $ED25519P8 >/dev/null || \
+               fatal "softhsm import ed25519 fail"
+       chmod 600 $ED25519
+       ssh-keygen -y -f $ED25519 > ${ED25519}.pub
        # Prepare askpass script to load PIN.
        PIN_SH=$SSH_SOFTHSM_DIR/pin.sh
        cat > $PIN_SH << EOF