From: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date: Tue, 30 Jun 2026 17:14:23 +0000 (+0200)
Subject: apps: test ec app -param_enc option
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=804fc3ecd8dbced41171c7e7eb249ce54dff50a3;p=thirdparty%2Fopenssl.git

apps: test ec app -param_enc option

Exercise the previously untested -param_enc option of the ec app,
covering named_curve and explicit parameter encodings (compared
against checked-in reference encodings) as well as rejection of an
invalid value.

Assisted-by: Claude:claude-opus-4-8

Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 15:00:25 2026
(Merged from https://github.com/openssl/openssl/pull/31799)
---

diff --git a/test/recipes/15-test_ec.t b/test/recipes/15-test_ec.t
index 5ae3943cb64..5b0a69f0cab 100644
--- a/test/recipes/15-test_ec.t
+++ b/test/recipes/15-test_ec.t
@@ -19,7 +19,7 @@ setup("test_ec");
 
 plan skip_all => 'EC is not supported in this build' if disabled('ec');
 
-plan tests => 17;
+plan tests => 18;
 
 my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
 
@@ -128,6 +128,30 @@ subtest 'EC point conversion form (-conv_form)' => sub {
        "an invalid conversion form is rejected");
 };
 
+subtest 'EC parameter encoding (-param_enc)' => sub {
+    plan tests => 6;
+
+    my $key = srctop_file("test", "testec-p256.pem");
+
+    ok(run(app(['openssl', 'ec', '-in', $key, '-pubout', '-param_enc',
+                'named_curve', '-outform', 'DER', '-out', 'ec-param-named.der'])),
+       "writing public key with named_curve parameter encoding");
+    ok(run(app(['openssl', 'ec', '-in', $key, '-pubout', '-param_enc',
+                'explicit', '-outform', 'DER', '-out', 'ec-param-explicit.der'])),
+       "writing public key with explicit parameter encoding");
+    ok((-s 'ec-param-named.der') < (-s 'ec-param-explicit.der'),
+       "named_curve encoding is smaller than explicit");
+    # The encodings are deterministic for a fixed key, so compare them
+    # against the checked-in reference files.
+    is(compare('ec-param-named.der', data_file('ec-param-named.der')), 0,
+       "named_curve encoding matches the reference file");
+    is(compare('ec-param-explicit.der', data_file('ec-param-explicit.der')), 0,
+       "explicit encoding matches the reference file");
+    ok(!run(app(['openssl', 'ec', '-in', $key, '-noout',
+                 '-param_enc', 'bogus'])),
+       "an invalid parameter encoding is rejected");
+};
+
 subtest 'Check loading of fips and non-fips keys' => sub {
     plan skip_all => "FIPS is disabled"
         if $no_fips;
diff --git a/test/recipes/15-test_ec_data/ec-param-explicit.der b/test/recipes/15-test_ec_data/ec-param-explicit.der
new file mode 100644
index 00000000000..e29a3a72088
Binary files /dev/null and b/test/recipes/15-test_ec_data/ec-param-explicit.der differ
diff --git a/test/recipes/15-test_ec_data/ec-param-named.der b/test/recipes/15-test_ec_data/ec-param-named.der
new file mode 100644
index 00000000000..7a75bb5cf8d
Binary files /dev/null and b/test/recipes/15-test_ec_data/ec-param-named.der differ