OSX/libsecurity_transform/regressions/transform-01-sigverify.m

   1 /*
   2  * Copyright (c) 2007-2009,2013-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 #include <TargetConditionals.h>
  26 #include <CoreFoundation/CoreFoundation.h>
  27 #include <Foundation/Foundation.h>
  28 #include <Security/Security.h>
  29 #include <Security/SecRandom.h>
  30 #include <Security/SecKeyPriv.h>
  31 #include <Security/SecItem.h>
  32 #include <Security/SecItemPriv.h>
  33 #include <Security/SecIdentityPriv.h>
  34 #include <Security/SecKeychainItem.h>
  35
  36 #include "utilities/SecCFRelease.h"
  37 #include "utilities/array_size.h"
  38
  39 #include "transform_regressions.h"
  40
  41 static const char *keyDataBase64 = "\
  42 MIIEogIBAAKCAQEAubvYJ2BA80CFbu8guNFXF02dNQ/QiaA/5h+trXmxBxHX1Ty1inqvrgB5yen0yCUL\
  43 5LGiEjscIjqLBY7SN9Jm3ui2f6CttsGF/jlMCoQGI2UD8kWH7miXv+dhdM5n1Eifik21Ga121VRZmuMT\
  44 36YOG6bb7RpBSVp7n7xBB4pjhpjuTuvZVwNB4rdci1NPwDEKyDJmU/IG/CzGRj2Xmq0/dCoQm0xwMY3A\
  45 X7MGWHi/Kt8bhFR1wuxDLOpqvCIGS+5s0gZqwn5gQCDtFY1tpL5stDRcZIyHh1EobWG9daGGMnx7s/tb\
  46 69cuhSKC5g3oylZ8H3LjW+eOZtuqPs/5vS7/WwIDAQABAoIBAGcwmQAPdyZus3OVwa1NCUD2KyB+39KG\
  47 yNmWwgx+br9Jx4s+RnJghVh8BS4MIKZOBtSRaEUOuCvAMNrupZbD+8leq34vDDRcQpCizr+M6Egj6FRj\
  48 Ewl+7Mh+yeN2hbMoghL552MTv9D4Iyxteu4nuPDd/JQ3oQwbDFIL6mlBFtiBDUr9ndemmcJ0WKuzor6a\
  49 3rgsygLs8SPyMefwIKjh5rJZls+iv3AyVEoBdCbHBz0HKgLVE9ZNmY/gWqda2dzAcJxxMdafeNVwHovv\
  50 BtyyRGnA7Yikx2XT4WLgKfuUsYLnDWs4GdAa738uxPBfiddQNeRjN7jRT1GZIWCk0P29rMECgYEA8jWi\
  51 g1Dph+4VlESPOffTEt1aCYQQWtHs13Qex95HrXX/L49fs6cOE7pvBh7nVzaKwBnPRh5+3bCPsPmRVb7h\
  52 k/GreOriCjTZtyt2XGp8eIfstfirofB7c1lNBjT61BhgjJ8Moii5c2ksNIOOZnKtD53n47mf7hiarYkw\
  53 xFEgU6ECgYEAxE8Js3gIPOBjsSw47XHuvsjP880nZZx/oiQ4IeJb/0rkoDMVJjU69WQu1HTNNAnMg4/u\
  54 RXo31h+gDZOlE9t9vSXHdrn3at67KAVmoTbRknGxZ+8tYpRJpPj1hyufynBGcKwevv3eHJHnE5eDqbHx\
  55 ynZFkXemzT9aMy3R4CCFMXsCgYAYyZpnG/m6WohE0zthMFaeoJ6dSLGvyboWVqDrzXjCbMf/4wllRlxv\
  56 cm34T2NXjpJmlH2c7HQJVg9uiivwfYdyb5If3tHhP4VkdIM5dABnCWoVOWy/NvA7XtE+KF/fItuGqKRP\
  57 WCGaiRHoEeqZ23SQm5VmvdF7OXNi/R5LiQ3o4QKBgAGX8qg2TTrRR33ksgGbbyi1UJrWC3/TqWWTjbEY\
  58 uU51OS3jvEQ3ImdjjM3EtPW7LqHSxUhjGZjvYMk7bZefrIGgkOHx2IRRkotcn9ynKURbD+mcE249beuc\
  59 6cFTJVTrXGcFvqomPWtV895A2JzECQZvt1ja88uuu/i2YoHDQdGJAoGAL2TEgiMXiunb6PzYMMKKa+mx\
  60 mFnagF0Ek3UJ9ByXKoLz3HFEl7cADIkqyenXFsAER/ifMyCoZp/PDBd6ZkpqLTdH0jQ2Yo4SllLykoiZ\
  61 fBWMfjRu4iw9E0MbPB3blmtzfv53BtWKy0LUOlN4juvpqryA7TgaUlZkfMT+T1TC7xU=\
  62 ";
  63
  64 static const int kTestTransformSignVerify = 85;
  65
  66 static void sign_verify_transform_from_key(SecKeyRef privateKey, SecKeyRef publicKey, bool expect_success) {
  67     // Create signature transform with private key
  68     CFErrorRef error=NULL;
  69     NSData *testData = [NSData dataWithBytes:"test" length:4];
  70     SecTransformRef signer = SecSignTransformCreate(privateKey, &error);
  71
  72     ok(signer != nil, "transform execution succeeded");
  73     ok(expect_success==(error==NULL), "no error %@",error);
  74     CFReleaseNull(error);
  75
  76     ok(expect_success==SecTransformSetAttribute(signer, kSecTransformInputAttributeName, (CFDataRef)testData, &error),
  77        "set input data to verify transform");
  78     ok(expect_success==(error==NULL), "error reported %@",error);
  79     CFReleaseNull(error);
  80
  81     NSData *signature = (__bridge_transfer NSData *)SecTransformExecute(signer, &error);
  82     ok(expect_success==(signature!=nil), "create signature with transform");
  83     ok(expect_success==(error==NULL), "error reported %@",error);
  84     CFReleaseNull(error);
  85
  86     // Create verify transform with public key.
  87     ok(publicKey != NULL, "get public key from private key");
  88     SecTransformRef verifier = SecVerifyTransformCreate(publicKey, (CFDataRef)signature, &error);
  89     ok(verifier, "create verification transform");
  90     ok(expect_success==(error==NULL), "no error %@",error);
  91     CFReleaseNull(error);
  92
  93     ok(expect_success==SecTransformSetAttribute(verifier, kSecTransformInputAttributeName, (CFDataRef)testData, &error),
  94        "set input data to verify transform");
  95     ok(expect_success==(error==NULL), "no error %@",error);
  96     CFReleaseNull(error);
  97
  98     NSNumber *result = (__bridge_transfer NSNumber *)SecTransformExecute(verifier, &error);
  99     ok(expect_success==(result!=nil), "transform execution succeeded");
 100     ok(expect_success==(error==NULL), "no error %@",error);
 101     ok(expect_success==result.boolValue, "transform verified signature");
 102
 103     CFReleaseNull(signer);
 104     CFReleaseNull(verifier);
 105     CFReleaseNull(error);
 106 }
 107
 108 static void createKeysWithUsage(SecKeyRef *privateKey, SecKeyRef *publicKey, CFTypeRef privKeyUsage, CFTypeRef pubKeyUsage, CFDataRef keyData) {
 109
 110
 111     CFArrayRef keyUsagesArray = NULL;
 112     // First the private key
 113     {
 114         CFArrayRef itemsRef = 0;
 115         CFTypeRef  keyAtt[1] = { kSecAttrIsExtractable };
 116         CFArrayRef keyAttArray = CFArrayCreate(NULL, keyAtt, 1, &kCFTypeArrayCallBacks);
 117         CFTypeRef  keyUsagesPriv[1] = { privKeyUsage };
 118         keyUsagesArray = CFArrayCreate(NULL, keyUsagesPriv, 1, &kCFTypeArrayCallBacks);
 119         SecItemImportExportKeyParameters priv_params={.keyUsage=keyUsagesArray,.keyAttributes=keyAttArray};
 120
 121         ok_status(SecItemImport(keyData, 0, 0, 0, 0, &priv_params, 0, &itemsRef));
 122         NSArray *items_priv = CFBridgingRelease(itemsRef);
 123         is(items_priv.count,1);
 124         *privateKey = (SecKeyRef)CFBridgingRetain([items_priv objectAtIndex:0]);
 125         CFReleaseNull(keyUsagesArray);
 126         CFReleaseNull(keyAttArray);
 127     }
 128
 129     // Public key
 130     {
 131         CFErrorRef error=NULL;
 132         CFArrayRef itemsRef = 0;
 133         CFTypeRef  keyUsagesPub[1] = { pubKeyUsage };
 134         SecKeyRef  publicKey_tmp = SecKeyCopyPublicKey(*privateKey); // It does not have the attribute we want
 135         CFDataRef  publicKeyData = SecKeyCopyExternalRepresentation(publicKey_tmp,&error); // Extract the external representation and import with attributes
 136         keyUsagesArray = CFArrayCreate(NULL, keyUsagesPub, 1, &kCFTypeArrayCallBacks);
 137         SecItemImportExportKeyParameters pub_params={.keyUsage=keyUsagesArray};
 138
 139         ok_status(SecItemImport(publicKeyData, 0, 0, 0, 0, &pub_params, 0, &itemsRef));
 140         NSArray *items_pub = CFBridgingRelease(itemsRef);
 141         is(items_pub.count,1);
 142         *publicKey = (SecKeyRef)CFBridgingRetain([items_pub objectAtIndex:0]);
 143         CFReleaseNull(keyUsagesArray);
 144         CFReleaseNull(publicKeyData);
 145         CFReleaseNull(publicKey_tmp);
 146     }
 147 }
 148
 149
 150
 151 static void test_transform_sign_verify() {
 152     SecKeyRef privateKey = NULL;
 153     SecKeyRef publicKey = NULL;
 154     // Create private key instance.
 155     NSData *keyData = [[NSData alloc] initWithBase64EncodedString:[NSString stringWithUTF8String:keyDataBase64]
 156                                                           options:NSDataBase64DecodingIgnoreUnknownCharacters];
 157
 158     // Import key with SecKeyCreateWithData
 159     {
 160         NSDictionary *keyAttrs = @{ (id)kSecAttrKeyType: (id)kSecAttrKeyTypeRSA, (id)kSecAttrKeySizeInBits: @2048,
 161                                     (id)kSecAttrKeyClass: (id)kSecAttrKeyClassPrivate };
 162         privateKey = SecKeyCreateWithData((CFDataRef)keyData, (CFDictionaryRef)keyAttrs, NULL);
 163         ok(privateKey != NULL, "create private key from data");
 164         publicKey = SecKeyCopyPublicKey(privateKey);
 165         sign_verify_transform_from_key(privateKey,publicKey,true);
 166         CFReleaseNull(privateKey);
 167         CFReleaseNull(publicKey);
 168     }
 169
 170     // Import the key with default attribute (no key Usage specified)
 171     {
 172         CFArrayRef itemsRef = 0;
 173         CFTypeRef  keyAtt[1] = { kSecAttrIsExtractable };
 174         CFArrayRef keyAttArray = CFArrayCreate(NULL, keyAtt, 1, &kCFTypeArrayCallBacks);
 175         SecItemImportExportKeyParameters params={.keyAttributes=keyAttArray};
 176         ok_status(SecItemImport((__bridge CFDataRef)keyData, 0, 0, 0, 0, &params, 0, &itemsRef));
 177         NSArray *items = CFBridgingRelease(itemsRef);
 178         is(items.count,1);
 179         privateKey = ((SecKeyRef)CFBridgingRetain([items objectAtIndex:0]));
 180         SecKeyRef  publicKey = SecKeyCopyPublicKey(privateKey);
 181         sign_verify_transform_from_key(privateKey,publicKey,true);
 182         CFReleaseNull(privateKey);
 183         CFReleaseNull(publicKey);
 184     }
 185
 186     // Import the key with sign attribute
 187     {
 188         createKeysWithUsage(&privateKey,&publicKey,kSecAttrCanSign,kSecAttrCanVerify,(__bridge CFDataRef)keyData);
 189         sign_verify_transform_from_key(privateKey,publicKey,true);
 190         CFReleaseNull(privateKey);
 191         CFReleaseNull(publicKey);
 192     }
 193
 194     // Import the key with sign attribute
 195     {
 196         createKeysWithUsage(&privateKey,&publicKey,kSecAttrCanSign,kSecAttrCanVerify,(__bridge CFDataRef)keyData);
 197         sign_verify_transform_from_key(privateKey,publicKey,true);
 198         CFReleaseNull(privateKey);
 199         CFReleaseNull(publicKey);
 200     }
 201
 202     // Import the key with enc attribute
 203     {
 204         createKeysWithUsage(&privateKey,&publicKey,kSecAttrCanDecrypt,kSecAttrCanEncrypt,(__bridge CFDataRef)keyData);
 205         sign_verify_transform_from_key(privateKey,publicKey,false);
 206         CFReleaseNull(privateKey);
 207         CFReleaseNull(publicKey);
 208     }
 209 }
 210
 211 static const int kTestCount = kTestTransformSignVerify;
 212
 213 int transform_01_sigverify(int argc, char *const *argv) {
 214     plan_tests(kTestCount);
 215
 216     test_transform_sign_verify();
 217
 218     return 0;
 219 }