From: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date: Thu, 23 Jul 2026 21:44:56 +0000 (+0200)
Subject: apps: test ec -check key consistency reporting
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8068ac6dd6fa438741b5e28c80ead2f6a26ea533;p=thirdparty%2Fopenssl.git

apps: test ec -check key consistency reporting

Add a test recipe subtest checking that 'openssl ec -check' reports a
valid key and an invalid one, using a new data file that combines the
testec-p256.pem private scalar with the group generator as the public
key, so it loads but fails the pairwise consistency check.

Assisted-by: Claude:claude-opus-4-8

Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jul 30 08:53:23 2026
(Merged from https://github.com/openssl/openssl/pull/32059)
---

diff --git a/test/recipes/15-test_ec.t b/test/recipes/15-test_ec.t
index e3d18a88498..d5d7f4902fe 100644
--- a/test/recipes/15-test_ec.t
+++ b/test/recipes/15-test_ec.t
@@ -19,7 +19,7 @@ setup("test_ec");
 
 plan skip_all => 'EC is not supported in this build' if disabled('ec');
 
-plan tests => 19;
+plan tests => 20;
 
 my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
 
@@ -201,6 +201,30 @@ subtest 'ec -text prints the key in text form' => sub {
        "ec -text does not print a private component for a public key");
 };
 
+subtest 'ec -check reports the key consistency' => sub {
+    plan tests => 4;
+
+    # ec -check prints the verdict on stderr and always exits successfully,
+    # so check the printed message instead of the exit status.
+    my $valid_err = 'ec-check-valid.err';
+    ok(run(app(['openssl', 'ec', '-check', '-noout',
+                '-in', srctop_file("test", "testec-p256.pem")],
+               stderr => $valid_err)),
+       "ec -check runs on a valid key");
+    test_file_contains("ec -check of a valid key", $valid_err,
+                       "EC Key valid");
+
+    # The invalid key is testec-p256.pem with the group generator as the
+    # public key, which is on the curve but fails the pairwise check.
+    my $invalid_err = 'ec-check-invalid.err';
+    ok(run(app(['openssl', 'ec', '-check', '-noout',
+                '-in', data_file('ec-check-invalid.pem')],
+               stderr => $invalid_err)),
+       "ec -check runs on an invalid key");
+    test_file_contains("ec -check of an invalid key", $invalid_err,
+                       "EC Key Invalid");
+};
+
 subtest 'Check loading of fips and non-fips keys' => sub {
     plan skip_all => "FIPS is disabled"
         if $no_fips;
diff --git a/test/recipes/15-test_ec_data/ec-check-invalid.pem b/test/recipes/15-test_ec_data/ec-check-invalid.pem
new file mode 100644
index 00000000000..cc592f5a24d
--- /dev/null
+++ b/test/recipes/15-test_ec_data/ec-check-invalid.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIDYEX2yQlhJXDIwBEwcfyAn2eICEKJxqsAPGChey1a2toAoGCCqGSM49
+AwEHoUQDQgAEaxfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpZP40Li/hp/
+m47n60p8D54WK84zV2sxXs7LtkBoN79R9Q==
+-----END EC PRIVATE KEY-----