// Copyright 2014 The BoringSSL Authors // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // https://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "../internal.h" #include "../test/test_util.h" BSSL_NAMESPACE_BEGIN namespace { // kExampleRSAKeyDER is an RSA private key in ASN.1, DER format. Of course, you // should never use this key anywhere but in an example. static const uint8_t kExampleRSAKeyDER[] = { 0x30, 0x82, 0x02, 0x5c, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0xf8, 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5, 0xb4, 0x59, 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e, 0xd3, 0x37, 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34, 0x75, 0x71, 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde, 0x97, 0x8a, 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8, 0x50, 0xe4, 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b, 0xdc, 0xec, 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83, 0x58, 0x76, 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48, 0x1a, 0xd8, 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a, 0x5c, 0xd7, 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2, 0xa7, 0x2c, 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, 0x81, 0x80, 0x74, 0x88, 0x64, 0x3f, 0x69, 0x45, 0x3a, 0x6d, 0xc7, 0x7f, 0xb9, 0xa3, 0xc0, 0x6e, 0xec, 0xdc, 0xd4, 0x5a, 0xb5, 0x32, 0x85, 0x5f, 0x19, 0xd4, 0xf8, 0xd4, 0x3f, 0x3c, 0xfa, 0xc2, 0xf6, 0x5f, 0xee, 0xe6, 0xba, 0x87, 0x74, 0x2e, 0xc7, 0x0c, 0xd4, 0x42, 0xb8, 0x66, 0x85, 0x9c, 0x7b, 0x24, 0x61, 0xaa, 0x16, 0x11, 0xf6, 0xb5, 0xb6, 0xa4, 0x0a, 0xc9, 0x55, 0x2e, 0x81, 0xa5, 0x47, 0x61, 0xcb, 0x25, 0x8f, 0xc2, 0x15, 0x7b, 0x0e, 0x7c, 0x36, 0x9f, 0x3a, 0xda, 0x58, 0x86, 0x1c, 0x5b, 0x83, 0x79, 0xe6, 0x2b, 0xcc, 0xe6, 0xfa, 0x2c, 0x61, 0xf2, 0x78, 0x80, 0x1b, 0xe2, 0xf3, 0x9d, 0x39, 0x2b, 0x65, 0x57, 0x91, 0x3d, 0x71, 0x99, 0x73, 0xa5, 0xc2, 0x79, 0x20, 0x8c, 0x07, 0x4f, 0xe5, 0xb4, 0x60, 0x1f, 0x99, 0xa2, 0xb1, 0x4f, 0x0c, 0xef, 0xbc, 0x59, 0x53, 0x00, 0x7d, 0xb1, 0x02, 0x41, 0x00, 0xfc, 0x7e, 0x23, 0x65, 0x70, 0xf8, 0xce, 0xd3, 0x40, 0x41, 0x80, 0x6a, 0x1d, 0x01, 0xd6, 0x01, 0xff, 0xb6, 0x1b, 0x3d, 0x3d, 0x59, 0x09, 0x33, 0x79, 0xc0, 0x4f, 0xde, 0x96, 0x27, 0x4b, 0x18, 0xc6, 0xd9, 0x78, 0xf1, 0xf4, 0x35, 0x46, 0xe9, 0x7c, 0x42, 0x7a, 0x5d, 0x9f, 0xef, 0x54, 0xb8, 0xf7, 0x9f, 0xc4, 0x33, 0x6c, 0xf3, 0x8c, 0x32, 0x46, 0x87, 0x67, 0x30, 0x7b, 0xa7, 0xac, 0xe3, 0x02, 0x41, 0x00, 0xfc, 0x2c, 0xdf, 0x0c, 0x0d, 0x88, 0xf5, 0xb1, 0x92, 0xa8, 0x93, 0x47, 0x63, 0x55, 0xf5, 0xca, 0x58, 0x43, 0xba, 0x1c, 0xe5, 0x9e, 0xb6, 0x95, 0x05, 0xcd, 0xb5, 0x82, 0xdf, 0xeb, 0x04, 0x53, 0x9d, 0xbd, 0xc2, 0x38, 0x16, 0xb3, 0x62, 0xdd, 0xa1, 0x46, 0xdb, 0x6d, 0x97, 0x93, 0x9f, 0x8a, 0xc3, 0x9b, 0x64, 0x7e, 0x42, 0xe3, 0x32, 0x57, 0x19, 0x1b, 0xd5, 0x6e, 0x85, 0xfa, 0xb8, 0x8d, 0x02, 0x41, 0x00, 0xbc, 0x3d, 0xde, 0x6d, 0xd6, 0x97, 0xe8, 0xba, 0x9e, 0x81, 0x37, 0x17, 0xe5, 0xa0, 0x64, 0xc9, 0x00, 0xb7, 0xe7, 0xfe, 0xf4, 0x29, 0xd9, 0x2e, 0x43, 0x6b, 0x19, 0x20, 0xbd, 0x99, 0x75, 0xe7, 0x76, 0xf8, 0xd3, 0xae, 0xaf, 0x7e, 0xb8, 0xeb, 0x81, 0xf4, 0x9d, 0xfe, 0x07, 0x2b, 0x0b, 0x63, 0x0b, 0x5a, 0x55, 0x90, 0x71, 0x7d, 0xf1, 0xdb, 0xd9, 0xb1, 0x41, 0x41, 0x68, 0x2f, 0x4e, 0x39, 0x02, 0x40, 0x5a, 0x34, 0x66, 0xd8, 0xf5, 0xe2, 0x7f, 0x18, 0xb5, 0x00, 0x6e, 0x26, 0x84, 0x27, 0x14, 0x93, 0xfb, 0xfc, 0xc6, 0x0f, 0x5e, 0x27, 0xe6, 0xe1, 0xe9, 0xc0, 0x8a, 0xe4, 0x34, 0xda, 0xe9, 0xa2, 0x4b, 0x73, 0xbc, 0x8c, 0xb9, 0xba, 0x13, 0x6c, 0x7a, 0x2b, 0x51, 0x84, 0xa3, 0x4a, 0xe0, 0x30, 0x10, 0x06, 0x7e, 0xed, 0x17, 0x5a, 0x14, 0x00, 0xc9, 0xef, 0x85, 0xea, 0x52, 0x2c, 0xbc, 0x65, 0x02, 0x40, 0x51, 0xe3, 0xf2, 0x83, 0x19, 0x9b, 0xc4, 0x1e, 0x2f, 0x50, 0x3d, 0xdf, 0x5a, 0xa2, 0x18, 0xca, 0x5f, 0x2e, 0x49, 0xaf, 0x6f, 0xcc, 0xfa, 0x65, 0x77, 0x94, 0xb5, 0xa1, 0x0a, 0xa9, 0xd1, 0x8a, 0x39, 0x37, 0xf4, 0x0b, 0xa0, 0xd7, 0x82, 0x27, 0x5e, 0xae, 0x17, 0x17, 0xa1, 0x1e, 0x54, 0x34, 0xbf, 0x6e, 0xc4, 0x8e, 0x99, 0x5d, 0x08, 0xf1, 0x2d, 0x86, 0x9d, 0xa5, 0x20, 0x1b, 0xe5, 0xdf, }; static const uint8_t kExampleDSAKeyDER[] = { 0x30, 0x82, 0x03, 0x56, 0x02, 0x01, 0x00, 0x02, 0x82, 0x01, 0x01, 0x00, 0x9e, 0x12, 0xfa, 0xb3, 0xde, 0x12, 0x21, 0x35, 0x01, 0xdd, 0x82, 0xaa, 0x10, 0xca, 0x2d, 0x10, 0x1d, 0x2d, 0x4e, 0xbf, 0xef, 0x4d, 0x2a, 0x3f, 0x8d, 0xaa, 0x0f, 0xe0, 0xce, 0xda, 0xd8, 0xd6, 0xaf, 0x85, 0x61, 0x6a, 0xa2, 0xf3, 0x25, 0x2c, 0x0a, 0x2b, 0x5a, 0x6d, 0xb0, 0x9e, 0x6f, 0x14, 0x90, 0x0e, 0x0d, 0xdb, 0x83, 0x11, 0x87, 0x6d, 0xd8, 0xf9, 0x66, 0x95, 0x25, 0xf9, 0x9e, 0xd6, 0x59, 0x49, 0xe1, 0x84, 0xd5, 0x06, 0x47, 0x93, 0x27, 0x11, 0x69, 0xa2, 0x28, 0x68, 0x0b, 0x95, 0xec, 0x12, 0xf5, 0x9a, 0x8e, 0x20, 0xb2, 0x1f, 0x2b, 0x58, 0xeb, 0x2a, 0x20, 0x12, 0xd3, 0x5b, 0xde, 0x2e, 0xe3, 0x51, 0x82, 0x2f, 0xe8, 0xf3, 0x2d, 0x0a, 0x33, 0x05, 0x65, 0xdc, 0xce, 0x5c, 0x67, 0x2b, 0x72, 0x59, 0xc1, 0x4b, 0x24, 0x33, 0xd0, 0xb5, 0xb2, 0xca, 0x2b, 0x2d, 0xb0, 0xab, 0x62, 0x6e, 0x8f, 0x13, 0xf4, 0x7f, 0xe0, 0x34, 0x5d, 0x90, 0x4e, 0x72, 0x94, 0xbb, 0x03, 0x8e, 0x9c, 0xe2, 0x1a, 0x9e, 0x58, 0x0b, 0x83, 0x35, 0x62, 0x78, 0x70, 0x6c, 0xfe, 0x76, 0x84, 0x36, 0xc6, 0x9d, 0xe1, 0x49, 0xcc, 0xff, 0x98, 0xb4, 0xaa, 0xb8, 0xcb, 0x4f, 0x63, 0x85, 0xc9, 0xf1, 0x02, 0xce, 0x59, 0x34, 0x6e, 0xae, 0xef, 0x27, 0xe0, 0xad, 0x22, 0x2d, 0x53, 0xd6, 0xe8, 0x9c, 0xc8, 0xcd, 0xe5, 0x77, 0x6d, 0xd0, 0x00, 0x57, 0xb0, 0x3f, 0x2d, 0x88, 0xab, 0x3c, 0xed, 0xba, 0xfd, 0x7b, 0x58, 0x5f, 0x0b, 0x7f, 0x78, 0x35, 0xe1, 0x7a, 0x37, 0x28, 0xbb, 0xf2, 0x5e, 0xa6, 0x25, 0x72, 0xf2, 0x45, 0xdc, 0x11, 0x1f, 0x3c, 0xe3, 0x9c, 0xb6, 0xff, 0xac, 0xc3, 0x1b, 0x0a, 0x27, 0x90, 0xe7, 0xbd, 0xe9, 0x02, 0x24, 0xea, 0x9b, 0x09, 0x31, 0x53, 0x62, 0xaf, 0x3d, 0x2b, 0x02, 0x21, 0x00, 0xf3, 0x81, 0xdc, 0xf5, 0x3e, 0xbf, 0x72, 0x4f, 0x8b, 0x2e, 0x5c, 0xa8, 0x2c, 0x01, 0x0f, 0xb4, 0xb5, 0xed, 0xa9, 0x35, 0x8d, 0x0f, 0xd8, 0x8e, 0xd2, 0x78, 0x58, 0x94, 0x88, 0xb5, 0x4f, 0xc3, 0x02, 0x82, 0x01, 0x00, 0x0c, 0x40, 0x2a, 0x72, 0x5d, 0xcc, 0x3a, 0x62, 0xe0, 0x2b, 0xf4, 0xcf, 0x43, 0xcd, 0x17, 0xf4, 0xa4, 0x93, 0x59, 0x12, 0x20, 0x22, 0x36, 0x69, 0xcf, 0x41, 0x93, 0xed, 0xab, 0x42, 0x3a, 0xd0, 0x8d, 0xfb, 0x55, 0x2e, 0x30, 0x8a, 0x6a, 0x57, 0xa5, 0xff, 0xbc, 0x7c, 0xd0, 0xfb, 0x20, 0x87, 0xf8, 0x1f, 0x8d, 0xf0, 0xcb, 0x08, 0xab, 0x21, 0x33, 0x28, 0x7d, 0x2b, 0x69, 0x68, 0x71, 0x4a, 0x94, 0xf6, 0x33, 0xc9, 0x40, 0x84, 0x5a, 0x48, 0xa3, 0xe1, 0x67, 0x08, 0xdd, 0xe7, 0x61, 0xcc, 0x6a, 0x8e, 0xab, 0x2d, 0x84, 0xdb, 0x21, 0xb6, 0xea, 0x5b, 0x07, 0x68, 0x14, 0x93, 0xcc, 0x9c, 0x31, 0xfb, 0xc3, 0x68, 0xb2, 0x43, 0xf6, 0xdd, 0xf8, 0xc9, 0x32, 0xa8, 0xb4, 0x03, 0x8f, 0x44, 0xe7, 0xb1, 0x5c, 0xa8, 0x76, 0x34, 0x4a, 0x14, 0x78, 0x59, 0xf2, 0xb4, 0x3b, 0x39, 0x45, 0x86, 0x68, 0xad, 0x5e, 0x0a, 0x1a, 0x9a, 0x66, 0x95, 0x46, 0xdd, 0x28, 0x12, 0xe3, 0xb3, 0x61, 0x7a, 0x0a, 0xef, 0x99, 0xd5, 0x8e, 0x3b, 0xb4, 0xcc, 0x87, 0xfd, 0x94, 0x22, 0x5e, 0x01, 0xd2, 0xdc, 0xc4, 0x69, 0xa7, 0x72, 0x68, 0x14, 0x6c, 0x51, 0x91, 0x8f, 0x18, 0xe8, 0xb4, 0xd7, 0x0a, 0xa1, 0xf0, 0xc7, 0x62, 0x3b, 0xcc, 0x52, 0xcf, 0x37, 0x31, 0xd3, 0x86, 0x41, 0xb2, 0xd2, 0x83, 0x0b, 0x7e, 0xec, 0xb2, 0xf0, 0x95, 0x52, 0xff, 0x13, 0x7d, 0x04, 0x6e, 0x49, 0x4e, 0x7f, 0x33, 0xc3, 0x59, 0x00, 0x02, 0xb1, 0x6d, 0x1b, 0x97, 0xd9, 0x36, 0xfd, 0xa2, 0x8f, 0x90, 0xc3, 0xed, 0x3c, 0xa3, 0x53, 0x38, 0x16, 0x8a, 0xc1, 0x6f, 0x77, 0xc3, 0xc5, 0x7a, 0xdc, 0x2e, 0x8f, 0x7c, 0x6c, 0x22, 0x56, 0xe4, 0x1a, 0x5f, 0x65, 0x45, 0x05, 0x90, 0xdb, 0xb5, 0xbc, 0xf0, 0x6d, 0x66, 0x61, 0x02, 0x82, 0x01, 0x00, 0x31, 0x97, 0x31, 0xa1, 0x4e, 0x38, 0x56, 0x88, 0xdb, 0x94, 0x1d, 0xbf, 0x65, 0x5c, 0xda, 0x4b, 0xc2, 0x10, 0xde, 0x74, 0x20, 0x03, 0xce, 0x13, 0x60, 0xf2, 0x25, 0x1d, 0x55, 0x7c, 0x5d, 0x94, 0x82, 0x54, 0x08, 0x53, 0xdb, 0x85, 0x95, 0xbf, 0xdd, 0x5e, 0x50, 0xd5, 0x96, 0xe0, 0x79, 0x51, 0x1b, 0xbf, 0x4d, 0x4e, 0xb9, 0x3a, 0xc5, 0xee, 0xc4, 0x5e, 0x98, 0x75, 0x7b, 0xbe, 0xff, 0x30, 0xe6, 0xd0, 0x7b, 0xa6, 0xf1, 0xbc, 0x29, 0xea, 0xdf, 0xec, 0xf3, 0x8b, 0xfa, 0x83, 0x11, 0x9f, 0x3f, 0xf0, 0x5d, 0x06, 0x51, 0x32, 0xaa, 0x21, 0xfc, 0x26, 0x17, 0xe7, 0x50, 0xc2, 0x16, 0xba, 0xfa, 0x54, 0xb7, 0x7e, 0x1d, 0x2c, 0xa6, 0xa3, 0x41, 0x66, 0x33, 0x94, 0x83, 0xb9, 0xbf, 0xa0, 0x4f, 0xbd, 0xa6, 0xfd, 0x2c, 0x81, 0x58, 0x35, 0x33, 0x39, 0xc0, 0x6d, 0x33, 0x40, 0x56, 0x64, 0x12, 0x5a, 0xcd, 0x35, 0x53, 0x21, 0x78, 0x8f, 0x27, 0x24, 0x37, 0x66, 0x8a, 0xdf, 0x5e, 0x5f, 0x63, 0xfc, 0x8b, 0x2d, 0xef, 0x57, 0xdb, 0x40, 0x25, 0xd5, 0x17, 0x53, 0x0b, 0xe4, 0xa5, 0xae, 0x54, 0xbf, 0x46, 0x4f, 0xa6, 0x79, 0xc3, 0x74, 0xfa, 0x1f, 0x85, 0x34, 0x64, 0x6d, 0xc5, 0x03, 0xeb, 0x72, 0x98, 0x80, 0x7b, 0xc0, 0x8f, 0x35, 0x11, 0xa7, 0x09, 0xeb, 0x51, 0xe0, 0xb0, 0xac, 0x92, 0x14, 0xf2, 0xad, 0x37, 0x95, 0x5a, 0xba, 0x8c, 0xc4, 0xdb, 0xed, 0xc4, 0x4e, 0x8b, 0x8f, 0x84, 0x33, 0x64, 0xf8, 0x57, 0x12, 0xd7, 0x08, 0x7e, 0x90, 0x66, 0xdf, 0x91, 0x50, 0x23, 0xf2, 0x73, 0xc0, 0x6b, 0xb1, 0x15, 0xdd, 0x64, 0xd7, 0xc9, 0x75, 0x17, 0x73, 0x72, 0xda, 0x33, 0xc4, 0x6f, 0xa5, 0x47, 0xa1, 0xcc, 0xd1, 0xc6, 0x62, 0xe5, 0xca, 0xab, 0x5f, 0x2a, 0x8f, 0x6b, 0xcc, 0x02, 0x21, 0x00, 0xb0, 0xc7, 0x68, 0x70, 0x27, 0x43, 0xbc, 0x51, 0x24, 0x29, 0x93, 0xa9, 0x71, 0xa5, 0x28, 0x89, 0x79, 0x54, 0x44, 0xf7, 0xc6, 0x45, 0x22, 0x03, 0xd0, 0xce, 0x84, 0xfe, 0x61, 0x17, 0xd4, 0x6e, }; static const uint8_t kMsg[] = {1, 2, 3, 4}; static const uint8_t kSignature[] = { 0xa5, 0xf0, 0x8a, 0x47, 0x5d, 0x3c, 0xb3, 0xcc, 0xa9, 0x79, 0xaf, 0x4d, 0x8c, 0xae, 0x4c, 0x14, 0xef, 0xc2, 0x0b, 0x34, 0x36, 0xde, 0xf4, 0x3e, 0x3d, 0xbb, 0x4a, 0x60, 0x5c, 0xc8, 0x91, 0x28, 0xda, 0xfb, 0x7e, 0x04, 0x96, 0x7e, 0x63, 0x13, 0x90, 0xce, 0xb9, 0xb4, 0x62, 0x7a, 0xfd, 0x09, 0x3d, 0xc7, 0x67, 0x78, 0x54, 0x04, 0xeb, 0x52, 0x62, 0x6e, 0x24, 0x67, 0xb4, 0x40, 0xfc, 0x57, 0x62, 0xc6, 0xf1, 0x67, 0xc1, 0x97, 0x8f, 0x6a, 0xa8, 0xae, 0x44, 0x46, 0x5e, 0xab, 0x67, 0x17, 0x53, 0x19, 0x3a, 0xda, 0x5a, 0xc8, 0x16, 0x3e, 0x86, 0xd5, 0xc5, 0x71, 0x2f, 0xfc, 0x23, 0x48, 0xd9, 0x0b, 0x13, 0xdd, 0x7b, 0x5a, 0x25, 0x79, 0xef, 0xa5, 0x7b, 0x04, 0xed, 0x44, 0xf6, 0x18, 0x55, 0xe4, 0x0a, 0xe9, 0x57, 0x79, 0x5d, 0xd7, 0x55, 0xa7, 0xab, 0x45, 0x02, 0x97, 0x60, 0x42, }; // kExampleRSAKeyPKCS8 is kExampleRSAKeyDER encoded in a PKCS #8 // PrivateKeyInfo. static const uint8_t kExampleRSAKeyPKCS8[] = { 0x30, 0x82, 0x02, 0x76, 0x02, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82, 0x02, 0x60, 0x30, 0x82, 0x02, 0x5c, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0xf8, 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5, 0xb4, 0x59, 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e, 0xd3, 0x37, 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34, 0x75, 0x71, 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde, 0x97, 0x8a, 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8, 0x50, 0xe4, 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b, 0xdc, 0xec, 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83, 0x58, 0x76, 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48, 0x1a, 0xd8, 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a, 0x5c, 0xd7, 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2, 0xa7, 0x2c, 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, 0x81, 0x80, 0x74, 0x88, 0x64, 0x3f, 0x69, 0x45, 0x3a, 0x6d, 0xc7, 0x7f, 0xb9, 0xa3, 0xc0, 0x6e, 0xec, 0xdc, 0xd4, 0x5a, 0xb5, 0x32, 0x85, 0x5f, 0x19, 0xd4, 0xf8, 0xd4, 0x3f, 0x3c, 0xfa, 0xc2, 0xf6, 0x5f, 0xee, 0xe6, 0xba, 0x87, 0x74, 0x2e, 0xc7, 0x0c, 0xd4, 0x42, 0xb8, 0x66, 0x85, 0x9c, 0x7b, 0x24, 0x61, 0xaa, 0x16, 0x11, 0xf6, 0xb5, 0xb6, 0xa4, 0x0a, 0xc9, 0x55, 0x2e, 0x81, 0xa5, 0x47, 0x61, 0xcb, 0x25, 0x8f, 0xc2, 0x15, 0x7b, 0x0e, 0x7c, 0x36, 0x9f, 0x3a, 0xda, 0x58, 0x86, 0x1c, 0x5b, 0x83, 0x79, 0xe6, 0x2b, 0xcc, 0xe6, 0xfa, 0x2c, 0x61, 0xf2, 0x78, 0x80, 0x1b, 0xe2, 0xf3, 0x9d, 0x39, 0x2b, 0x65, 0x57, 0x91, 0x3d, 0x71, 0x99, 0x73, 0xa5, 0xc2, 0x79, 0x20, 0x8c, 0x07, 0x4f, 0xe5, 0xb4, 0x60, 0x1f, 0x99, 0xa2, 0xb1, 0x4f, 0x0c, 0xef, 0xbc, 0x59, 0x53, 0x00, 0x7d, 0xb1, 0x02, 0x41, 0x00, 0xfc, 0x7e, 0x23, 0x65, 0x70, 0xf8, 0xce, 0xd3, 0x40, 0x41, 0x80, 0x6a, 0x1d, 0x01, 0xd6, 0x01, 0xff, 0xb6, 0x1b, 0x3d, 0x3d, 0x59, 0x09, 0x33, 0x79, 0xc0, 0x4f, 0xde, 0x96, 0x27, 0x4b, 0x18, 0xc6, 0xd9, 0x78, 0xf1, 0xf4, 0x35, 0x46, 0xe9, 0x7c, 0x42, 0x7a, 0x5d, 0x9f, 0xef, 0x54, 0xb8, 0xf7, 0x9f, 0xc4, 0x33, 0x6c, 0xf3, 0x8c, 0x32, 0x46, 0x87, 0x67, 0x30, 0x7b, 0xa7, 0xac, 0xe3, 0x02, 0x41, 0x00, 0xfc, 0x2c, 0xdf, 0x0c, 0x0d, 0x88, 0xf5, 0xb1, 0x92, 0xa8, 0x93, 0x47, 0x63, 0x55, 0xf5, 0xca, 0x58, 0x43, 0xba, 0x1c, 0xe5, 0x9e, 0xb6, 0x95, 0x05, 0xcd, 0xb5, 0x82, 0xdf, 0xeb, 0x04, 0x53, 0x9d, 0xbd, 0xc2, 0x38, 0x16, 0xb3, 0x62, 0xdd, 0xa1, 0x46, 0xdb, 0x6d, 0x97, 0x93, 0x9f, 0x8a, 0xc3, 0x9b, 0x64, 0x7e, 0x42, 0xe3, 0x32, 0x57, 0x19, 0x1b, 0xd5, 0x6e, 0x85, 0xfa, 0xb8, 0x8d, 0x02, 0x41, 0x00, 0xbc, 0x3d, 0xde, 0x6d, 0xd6, 0x97, 0xe8, 0xba, 0x9e, 0x81, 0x37, 0x17, 0xe5, 0xa0, 0x64, 0xc9, 0x00, 0xb7, 0xe7, 0xfe, 0xf4, 0x29, 0xd9, 0x2e, 0x43, 0x6b, 0x19, 0x20, 0xbd, 0x99, 0x75, 0xe7, 0x76, 0xf8, 0xd3, 0xae, 0xaf, 0x7e, 0xb8, 0xeb, 0x81, 0xf4, 0x9d, 0xfe, 0x07, 0x2b, 0x0b, 0x63, 0x0b, 0x5a, 0x55, 0x90, 0x71, 0x7d, 0xf1, 0xdb, 0xd9, 0xb1, 0x41, 0x41, 0x68, 0x2f, 0x4e, 0x39, 0x02, 0x40, 0x5a, 0x34, 0x66, 0xd8, 0xf5, 0xe2, 0x7f, 0x18, 0xb5, 0x00, 0x6e, 0x26, 0x84, 0x27, 0x14, 0x93, 0xfb, 0xfc, 0xc6, 0x0f, 0x5e, 0x27, 0xe6, 0xe1, 0xe9, 0xc0, 0x8a, 0xe4, 0x34, 0xda, 0xe9, 0xa2, 0x4b, 0x73, 0xbc, 0x8c, 0xb9, 0xba, 0x13, 0x6c, 0x7a, 0x2b, 0x51, 0x84, 0xa3, 0x4a, 0xe0, 0x30, 0x10, 0x06, 0x7e, 0xed, 0x17, 0x5a, 0x14, 0x00, 0xc9, 0xef, 0x85, 0xea, 0x52, 0x2c, 0xbc, 0x65, 0x02, 0x40, 0x51, 0xe3, 0xf2, 0x83, 0x19, 0x9b, 0xc4, 0x1e, 0x2f, 0x50, 0x3d, 0xdf, 0x5a, 0xa2, 0x18, 0xca, 0x5f, 0x2e, 0x49, 0xaf, 0x6f, 0xcc, 0xfa, 0x65, 0x77, 0x94, 0xb5, 0xa1, 0x0a, 0xa9, 0xd1, 0x8a, 0x39, 0x37, 0xf4, 0x0b, 0xa0, 0xd7, 0x82, 0x27, 0x5e, 0xae, 0x17, 0x17, 0xa1, 0x1e, 0x54, 0x34, 0xbf, 0x6e, 0xc4, 0x8e, 0x99, 0x5d, 0x08, 0xf1, 0x2d, 0x86, 0x9d, 0xa5, 0x20, 0x1b, 0xe5, 0xdf, }; // kExampleRSAPSSKeySHA256 is an RSA private key constrained to PSS with // SHA-256, and salt length >= 32, in PKCS#8 format. Of course, you should never // use this key anywhere but in an example. static const uint8_t kExampleRSAPSSKeySHA256[] = { 0x30, 0x82, 0x04, 0xf0, 0x02, 0x01, 0x00, 0x30, 0x41, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0a, 0x30, 0x34, 0xa0, 0x0f, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0xa1, 0x1c, 0x30, 0x1a, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x08, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0xa2, 0x03, 0x02, 0x01, 0x20, 0x04, 0x82, 0x04, 0xa6, 0x30, 0x82, 0x04, 0xa2, 0x02, 0x01, 0x00, 0x02, 0x82, 0x01, 0x01, 0x00, 0xcd, 0x00, 0x81, 0xea, 0x7b, 0x2a, 0xe1, 0xea, 0x06, 0xd5, 0x9f, 0x7c, 0x73, 0xd9, 0xff, 0xb9, 0x4a, 0x09, 0x61, 0x5c, 0x2e, 0x4b, 0xa7, 0xc6, 0x36, 0xce, 0xf0, 0x8d, 0xd3, 0x53, 0x3e, 0xc3, 0x18, 0x55, 0x25, 0xb0, 0x15, 0xc7, 0x69, 0xb9, 0x9a, 0x77, 0xd6, 0x72, 0x5b, 0xf9, 0xc3, 0x53, 0x2a, 0x9b, 0x6e, 0x5f, 0x66, 0x27, 0xd5, 0xfb, 0x85, 0x16, 0x07, 0x68, 0xd3, 0xdd, 0xa9, 0xcb, 0xd3, 0x59, 0x74, 0x51, 0x17, 0x17, 0xdc, 0x3d, 0x30, 0x9d, 0x2f, 0xc4, 0x7e, 0xe4, 0x1f, 0x97, 0xe3, 0x2a, 0xdb, 0x7f, 0x9d, 0xd8, 0x64, 0xa1, 0xc4, 0x76, 0x7a, 0x66, 0x6e, 0xcd, 0x71, 0xbc, 0x1a, 0xac, 0xf5, 0xe7, 0x51, 0x7f, 0x4b, 0x38, 0x59, 0x4f, 0xea, 0x9b, 0x05, 0xe4, 0x2d, 0x5a, 0xda, 0x99, 0x12, 0x00, 0x80, 0x13, 0xe4, 0x53, 0x16, 0xa4, 0xd9, 0xbb, 0x8e, 0xd0, 0x86, 0xb8, 0x8d, 0x28, 0x75, 0x8b, 0xac, 0xaf, 0x92, 0x2d, 0x46, 0xa8, 0x68, 0xb4, 0x85, 0xd2, 0x39, 0xc9, 0xba, 0xeb, 0x0e, 0x2b, 0x64, 0x59, 0x27, 0x10, 0xf4, 0x2b, 0x2d, 0x1e, 0xa0, 0xa4, 0xb4, 0x80, 0x2c, 0x0b, 0xec, 0xab, 0x32, 0x8f, 0x8a, 0x68, 0xb0, 0x07, 0x3b, 0xdb, 0x54, 0x6f, 0xee, 0xa9, 0x80, 0x9d, 0x28, 0x49, 0x91, 0x2b, 0x39, 0x0c, 0x15, 0x32, 0xbc, 0x7e, 0x29, 0xc7, 0x65, 0x8f, 0x81, 0x75, 0xfa, 0xe4, 0x6f, 0x34, 0x33, 0x2f, 0xf8, 0x7b, 0xca, 0xb3, 0xe4, 0x06, 0x49, 0xb9, 0x85, 0x77, 0x86, 0x9d, 0xa0, 0xea, 0x71, 0x83, 0x53, 0xf0, 0x72, 0x27, 0x54, 0x88, 0x69, 0x13, 0x64, 0x87, 0x60, 0xd1, 0x22, 0xbe, 0x67, 0x6e, 0x0f, 0xc4, 0x83, 0xdd, 0x20, 0xff, 0xc3, 0x1b, 0xda, 0x96, 0xa3, 0x19, 0x66, 0xc9, 0xaa, 0x2e, 0x75, 0xad, 0x03, 0xde, 0x47, 0xe1, 0xc4, 0x4f, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, 0x82, 0x01, 0x00, 0x60, 0x29, 0x7a, 0xc7, 0x99, 0x1b, 0x16, 0x7a, 0x06, 0xd6, 0xb2, 0x47, 0x58, 0xb8, 0xcb, 0xe2, 0x08, 0xbe, 0xb9, 0xb2, 0xd9, 0xec, 0x97, 0x38, 0xbd, 0x80, 0xf9, 0x0a, 0x2e, 0x35, 0x00, 0x5d, 0xd7, 0xce, 0x29, 0x2d, 0x9e, 0x29, 0xba, 0x88, 0x5b, 0xd3, 0x16, 0xfe, 0xf1, 0xf2, 0x09, 0x13, 0xbc, 0x0a, 0xc9, 0x0d, 0x6b, 0x08, 0x08, 0xb2, 0x41, 0x4d, 0x82, 0x10, 0x44, 0x41, 0xd8, 0x62, 0x4a, 0x33, 0xce, 0x02, 0x33, 0xc8, 0xf7, 0x80, 0xa4, 0x8b, 0x37, 0x5a, 0xff, 0x02, 0xd7, 0x67, 0x12, 0x22, 0x8a, 0x70, 0x24, 0x84, 0xdb, 0x3f, 0x9e, 0xbe, 0xcc, 0xcf, 0xbb, 0xee, 0x17, 0x09, 0xdb, 0xa1, 0x82, 0x80, 0x0d, 0x94, 0x9e, 0x9e, 0x42, 0x16, 0xe0, 0xbf, 0xf3, 0x55, 0x83, 0x88, 0xf8, 0xbd, 0x90, 0xda, 0x37, 0x3a, 0x1d, 0x82, 0x74, 0x3e, 0xc3, 0xfb, 0xdd, 0x14, 0x27, 0xfd, 0x16, 0x82, 0x5a, 0x65, 0x7a, 0x31, 0x69, 0x12, 0xe8, 0x69, 0x53, 0x65, 0x11, 0x7c, 0xa2, 0xf8, 0x45, 0xc9, 0x09, 0x40, 0x5f, 0xca, 0xc5, 0x5f, 0x89, 0x5f, 0xc1, 0x5d, 0x20, 0x38, 0x6c, 0x26, 0xee, 0x78, 0xc9, 0xe9, 0x90, 0x75, 0x02, 0x9a, 0x17, 0x8a, 0x6c, 0x1e, 0x4c, 0xf0, 0xc2, 0x00, 0xe8, 0xa9, 0xcf, 0xb2, 0x7e, 0x9d, 0x15, 0x6f, 0x86, 0xe6, 0xc2, 0xad, 0xc2, 0x2b, 0x1a, 0x84, 0xa1, 0xcd, 0x5c, 0xa5, 0xb2, 0x79, 0x08, 0x75, 0xd7, 0x94, 0x07, 0xc8, 0x4b, 0x35, 0x23, 0x95, 0xcb, 0x81, 0xcc, 0x3f, 0xed, 0x5b, 0xb0, 0x43, 0xb6, 0x9e, 0xde, 0x0c, 0x07, 0x20, 0x45, 0x50, 0x02, 0x5c, 0xee, 0x8c, 0x5f, 0x44, 0x01, 0x70, 0xb6, 0x12, 0x0b, 0xb4, 0x8e, 0x0f, 0x74, 0x7b, 0xcd, 0x8f, 0x52, 0x21, 0x10, 0x85, 0x0d, 0xf0, 0x43, 0xc4, 0x28, 0xdf, 0xd1, 0x87, 0x05, 0x31, 0x02, 0x81, 0x81, 0x00, 0xf6, 0xf9, 0x61, 0xb4, 0x7c, 0xbc, 0x03, 0x5d, 0x3a, 0xed, 0xeb, 0xc7, 0xde, 0x85, 0x0a, 0x95, 0x6b, 0x65, 0xec, 0xdb, 0x9c, 0xf6, 0x07, 0x64, 0x06, 0x3f, 0x15, 0xaa, 0x48, 0x55, 0x3c, 0x58, 0xd9, 0x72, 0xfe, 0x66, 0x75, 0x05, 0x6e, 0x35, 0xdd, 0xfd, 0xc3, 0x7b, 0xf3, 0xb9, 0xf2, 0xf6, 0x22, 0xee, 0x27, 0x13, 0x37, 0x25, 0x68, 0x49, 0xc9, 0xbe, 0xf2, 0x17, 0x6f, 0xe8, 0xf7, 0xc3, 0xf8, 0xbb, 0x91, 0xba, 0x37, 0x4d, 0xd5, 0x3b, 0xaf, 0x3d, 0xec, 0x81, 0x4d, 0x2b, 0xde, 0xc1, 0x0c, 0x1f, 0xdc, 0x88, 0xcd, 0xd1, 0x68, 0x76, 0xf2, 0x6b, 0x1e, 0xdf, 0xa3, 0xf0, 0x94, 0x19, 0x7e, 0xdf, 0x4d, 0x42, 0xff, 0x1f, 0xb2, 0x97, 0x11, 0x03, 0xb8, 0x98, 0xca, 0x85, 0x9c, 0x42, 0x72, 0x87, 0x08, 0x6a, 0x84, 0x2a, 0xb4, 0x10, 0xbb, 0x69, 0xcf, 0x2d, 0x35, 0xaf, 0x6b, 0xe3, 0x02, 0x81, 0x81, 0x00, 0xd4, 0x7e, 0x72, 0x4a, 0x7f, 0xf4, 0x10, 0x48, 0xb2, 0x70, 0xc2, 0x52, 0x4a, 0x41, 0x01, 0x87, 0x8b, 0x73, 0x15, 0x9b, 0xb7, 0x3d, 0x3d, 0xbc, 0x18, 0x7b, 0x22, 0x0e, 0x63, 0x5b, 0x35, 0x34, 0xf9, 0x6e, 0x24, 0x3a, 0x18, 0x4d, 0x93, 0xf8, 0x60, 0xb6, 0xbf, 0xbb, 0x6b, 0x71, 0xc1, 0xed, 0x9a, 0x1e, 0x1f, 0x45, 0x85, 0x83, 0x02, 0x3c, 0x30, 0x1e, 0x96, 0xa6, 0x92, 0xc1, 0xa0, 0x8b, 0x53, 0xd0, 0xec, 0x9c, 0xa9, 0x10, 0x10, 0x0d, 0x80, 0x45, 0x1e, 0x3b, 0x7d, 0xc6, 0xa0, 0x1b, 0xac, 0x4a, 0xec, 0xef, 0x8d, 0xf7, 0x98, 0x84, 0x6b, 0xc2, 0x35, 0xa0, 0x8c, 0xbb, 0xa2, 0xcf, 0x4c, 0x06, 0x80, 0x4c, 0xc1, 0x12, 0x19, 0xe9, 0x56, 0x08, 0xc7, 0x14, 0xe3, 0xf1, 0x43, 0x0d, 0x49, 0x1f, 0xad, 0xbb, 0xa3, 0x2a, 0x57, 0x51, 0xa0, 0x4f, 0x97, 0x74, 0x58, 0x34, 0xc9, 0xa5, 0x02, 0x81, 0x80, 0x21, 0xf2, 0x45, 0x2b, 0xb9, 0xb9, 0x5d, 0xfd, 0x02, 0x8c, 0x91, 0x4b, 0xf7, 0x99, 0xf1, 0xca, 0x77, 0xe8, 0x9a, 0x95, 0xd5, 0x0d, 0x3c, 0x16, 0xd3, 0x84, 0xf8, 0x45, 0x5f, 0x8b, 0xd7, 0xaf, 0x9e, 0xb3, 0xdf, 0xa3, 0xd5, 0x91, 0xd9, 0x84, 0x2d, 0xef, 0x23, 0x5f, 0x76, 0x30, 0xa8, 0xe4, 0x8c, 0x08, 0x8f, 0xf6, 0x64, 0x2e, 0x10, 0x17, 0x94, 0x53, 0x5a, 0x93, 0x3e, 0x1e, 0x97, 0x6f, 0xa8, 0x50, 0x9f, 0xc7, 0x28, 0xb2, 0xda, 0x0c, 0x4a, 0x1a, 0x08, 0xd7, 0xfc, 0xf3, 0x7a, 0xba, 0xae, 0x1f, 0xf3, 0x00, 0x1a, 0xca, 0x1d, 0xc1, 0xbb, 0xb0, 0x5d, 0x9d, 0xff, 0xba, 0xa1, 0xa0, 0x9f, 0x7f, 0xb1, 0xee, 0xf3, 0x82, 0x37, 0xd9, 0xeb, 0xcc, 0xc7, 0x22, 0xb9, 0x33, 0x84, 0x36, 0xdd, 0xe7, 0x11, 0x91, 0x12, 0x79, 0x8c, 0x26, 0x80, 0x9c, 0x1a, 0x8d, 0xec, 0x43, 0x20, 0x61, 0x02, 0x81, 0x80, 0x1f, 0x75, 0x10, 0xaa, 0x62, 0xc2, 0xd8, 0xde, 0x4a, 0x3c, 0x53, 0x28, 0x27, 0x81, 0xf4, 0x1e, 0x02, 0xd0, 0xe8, 0xb4, 0x02, 0xae, 0x78, 0x43, 0x2e, 0x44, 0x9c, 0x48, 0x11, 0x01, 0x61, 0xa1, 0x14, 0x03, 0xf0, 0x2d, 0x01, 0x88, 0x0a, 0x8d, 0xcc, 0x93, 0x81, 0x52, 0xd7, 0x97, 0x21, 0xa4, 0x71, 0x1a, 0x60, 0x7a, 0xc4, 0x47, 0x1e, 0xbf, 0x96, 0x48, 0x10, 0xf9, 0x5b, 0xe4, 0x7a, 0x45, 0xe6, 0x04, 0x99, 0xe2, 0x9f, 0x4c, 0x97, 0x73, 0xc8, 0x37, 0x73, 0x40, 0x4f, 0x60, 0x66, 0x37, 0x72, 0x8c, 0x2d, 0x03, 0x51, 0xbb, 0x03, 0xc3, 0x26, 0xc8, 0xbb, 0x73, 0xa7, 0x21, 0xe7, 0xfa, 0x54, 0x40, 0xea, 0x21, 0x72, 0xbb, 0xa1, 0x46, 0x5f, 0xcc, 0x30, 0xdc, 0xb0, 0xd9, 0xf8, 0x99, 0x30, 0xe8, 0x15, 0xaa, 0x1f, 0x7f, 0x97, 0x29, 0xa8, 0x57, 0xe0, 0x0e, 0x03, 0x38, 0xdd, 0x59, 0x02, 0x81, 0x80, 0x4d, 0x1f, 0x0d, 0x75, 0x6f, 0xe7, 0x7e, 0x01, 0x09, 0x9a, 0x65, 0x2f, 0x50, 0xa8, 0x8b, 0x7b, 0x68, 0x5d, 0xc5, 0xbf, 0x00, 0x98, 0x1d, 0x5d, 0x23, 0x76, 0xfd, 0x0c, 0x6f, 0xe2, 0x9c, 0xd5, 0xb6, 0x38, 0x73, 0x44, 0x79, 0x30, 0x5a, 0x73, 0xad, 0x3c, 0x15, 0x99, 0xd3, 0x9e, 0xae, 0x3b, 0xae, 0x03, 0x5f, 0xbd, 0x6f, 0xed, 0x07, 0xc2, 0x8d, 0xe7, 0x05, 0x93, 0x38, 0x79, 0xa0, 0x6e, 0x48, 0xe6, 0xa6, 0x03, 0x68, 0x6e, 0xd8, 0xe2, 0x56, 0x0a, 0x5f, 0x6a, 0xf1, 0xf2, 0xc2, 0x4f, 0xaf, 0x4a, 0xa9, 0x60, 0xe3, 0x82, 0x18, 0x6f, 0x15, 0xee, 0xdc, 0xe9, 0xa2, 0x49, 0x1a, 0xe7, 0x30, 0x68, 0x0d, 0xd4, 0xcf, 0x77, 0x8b, 0x70, 0xfa, 0xa8, 0x68, 0x26, 0xab, 0x32, 0x23, 0x47, 0x7c, 0xc9, 0x13, 0x77, 0xb1, 0x9a, 0x6d, 0x5a, 0x2e, 0xae, 0xa2, 0x19, 0x76, 0x0b, 0xee, 0xd5, }; // kExampleRSAPSSKeySHA384 is an RSA private key constrained to PSS with // SHA-384, and salt length >= 48, in PKCS#8 format. Of course, you should never // use this key anywhere but in an example. static const uint8_t kExampleRSAPSSKeySHA384[] = { 0x30, 0x82, 0x04, 0xf0, 0x02, 0x01, 0x00, 0x30, 0x41, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0a, 0x30, 0x34, 0xa0, 0x0f, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0xa1, 0x1c, 0x30, 0x1a, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x08, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0xa2, 0x03, 0x02, 0x01, 0x30, 0x04, 0x82, 0x04, 0xa6, 0x30, 0x82, 0x04, 0xa2, 0x02, 0x01, 0x00, 0x02, 0x82, 0x01, 0x01, 0x00, 0xcd, 0x00, 0x81, 0xea, 0x7b, 0x2a, 0xe1, 0xea, 0x06, 0xd5, 0x9f, 0x7c, 0x73, 0xd9, 0xff, 0xb9, 0x4a, 0x09, 0x61, 0x5c, 0x2e, 0x4b, 0xa7, 0xc6, 0x36, 0xce, 0xf0, 0x8d, 0xd3, 0x53, 0x3e, 0xc3, 0x18, 0x55, 0x25, 0xb0, 0x15, 0xc7, 0x69, 0xb9, 0x9a, 0x77, 0xd6, 0x72, 0x5b, 0xf9, 0xc3, 0x53, 0x2a, 0x9b, 0x6e, 0x5f, 0x66, 0x27, 0xd5, 0xfb, 0x85, 0x16, 0x07, 0x68, 0xd3, 0xdd, 0xa9, 0xcb, 0xd3, 0x59, 0x74, 0x51, 0x17, 0x17, 0xdc, 0x3d, 0x30, 0x9d, 0x2f, 0xc4, 0x7e, 0xe4, 0x1f, 0x97, 0xe3, 0x2a, 0xdb, 0x7f, 0x9d, 0xd8, 0x64, 0xa1, 0xc4, 0x76, 0x7a, 0x66, 0x6e, 0xcd, 0x71, 0xbc, 0x1a, 0xac, 0xf5, 0xe7, 0x51, 0x7f, 0x4b, 0x38, 0x59, 0x4f, 0xea, 0x9b, 0x05, 0xe4, 0x2d, 0x5a, 0xda, 0x99, 0x12, 0x00, 0x80, 0x13, 0xe4, 0x53, 0x16, 0xa4, 0xd9, 0xbb, 0x8e, 0xd0, 0x86, 0xb8, 0x8d, 0x28, 0x75, 0x8b, 0xac, 0xaf, 0x92, 0x2d, 0x46, 0xa8, 0x68, 0xb4, 0x85, 0xd2, 0x39, 0xc9, 0xba, 0xeb, 0x0e, 0x2b, 0x64, 0x59, 0x27, 0x10, 0xf4, 0x2b, 0x2d, 0x1e, 0xa0, 0xa4, 0xb4, 0x80, 0x2c, 0x0b, 0xec, 0xab, 0x32, 0x8f, 0x8a, 0x68, 0xb0, 0x07, 0x3b, 0xdb, 0x54, 0x6f, 0xee, 0xa9, 0x80, 0x9d, 0x28, 0x49, 0x91, 0x2b, 0x39, 0x0c, 0x15, 0x32, 0xbc, 0x7e, 0x29, 0xc7, 0x65, 0x8f, 0x81, 0x75, 0xfa, 0xe4, 0x6f, 0x34, 0x33, 0x2f, 0xf8, 0x7b, 0xca, 0xb3, 0xe4, 0x06, 0x49, 0xb9, 0x85, 0x77, 0x86, 0x9d, 0xa0, 0xea, 0x71, 0x83, 0x53, 0xf0, 0x72, 0x27, 0x54, 0x88, 0x69, 0x13, 0x64, 0x87, 0x60, 0xd1, 0x22, 0xbe, 0x67, 0x6e, 0x0f, 0xc4, 0x83, 0xdd, 0x20, 0xff, 0xc3, 0x1b, 0xda, 0x96, 0xa3, 0x19, 0x66, 0xc9, 0xaa, 0x2e, 0x75, 0xad, 0x03, 0xde, 0x47, 0xe1, 0xc4, 0x4f, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, 0x82, 0x01, 0x00, 0x60, 0x29, 0x7a, 0xc7, 0x99, 0x1b, 0x16, 0x7a, 0x06, 0xd6, 0xb2, 0x47, 0x58, 0xb8, 0xcb, 0xe2, 0x08, 0xbe, 0xb9, 0xb2, 0xd9, 0xec, 0x97, 0x38, 0xbd, 0x80, 0xf9, 0x0a, 0x2e, 0x35, 0x00, 0x5d, 0xd7, 0xce, 0x29, 0x2d, 0x9e, 0x29, 0xba, 0x88, 0x5b, 0xd3, 0x16, 0xfe, 0xf1, 0xf2, 0x09, 0x13, 0xbc, 0x0a, 0xc9, 0x0d, 0x6b, 0x08, 0x08, 0xb2, 0x41, 0x4d, 0x82, 0x10, 0x44, 0x41, 0xd8, 0x62, 0x4a, 0x33, 0xce, 0x02, 0x33, 0xc8, 0xf7, 0x80, 0xa4, 0x8b, 0x37, 0x5a, 0xff, 0x02, 0xd7, 0x67, 0x12, 0x22, 0x8a, 0x70, 0x24, 0x84, 0xdb, 0x3f, 0x9e, 0xbe, 0xcc, 0xcf, 0xbb, 0xee, 0x17, 0x09, 0xdb, 0xa1, 0x82, 0x80, 0x0d, 0x94, 0x9e, 0x9e, 0x42, 0x16, 0xe0, 0xbf, 0xf3, 0x55, 0x83, 0x88, 0xf8, 0xbd, 0x90, 0xda, 0x37, 0x3a, 0x1d, 0x82, 0x74, 0x3e, 0xc3, 0xfb, 0xdd, 0x14, 0x27, 0xfd, 0x16, 0x82, 0x5a, 0x65, 0x7a, 0x31, 0x69, 0x12, 0xe8, 0x69, 0x53, 0x65, 0x11, 0x7c, 0xa2, 0xf8, 0x45, 0xc9, 0x09, 0x40, 0x5f, 0xca, 0xc5, 0x5f, 0x89, 0x5f, 0xc1, 0x5d, 0x20, 0x38, 0x6c, 0x26, 0xee, 0x78, 0xc9, 0xe9, 0x90, 0x75, 0x02, 0x9a, 0x17, 0x8a, 0x6c, 0x1e, 0x4c, 0xf0, 0xc2, 0x00, 0xe8, 0xa9, 0xcf, 0xb2, 0x7e, 0x9d, 0x15, 0x6f, 0x86, 0xe6, 0xc2, 0xad, 0xc2, 0x2b, 0x1a, 0x84, 0xa1, 0xcd, 0x5c, 0xa5, 0xb2, 0x79, 0x08, 0x75, 0xd7, 0x94, 0x07, 0xc8, 0x4b, 0x35, 0x23, 0x95, 0xcb, 0x81, 0xcc, 0x3f, 0xed, 0x5b, 0xb0, 0x43, 0xb6, 0x9e, 0xde, 0x0c, 0x07, 0x20, 0x45, 0x50, 0x02, 0x5c, 0xee, 0x8c, 0x5f, 0x44, 0x01, 0x70, 0xb6, 0x12, 0x0b, 0xb4, 0x8e, 0x0f, 0x74, 0x7b, 0xcd, 0x8f, 0x52, 0x21, 0x10, 0x85, 0x0d, 0xf0, 0x43, 0xc4, 0x28, 0xdf, 0xd1, 0x87, 0x05, 0x31, 0x02, 0x81, 0x81, 0x00, 0xf6, 0xf9, 0x61, 0xb4, 0x7c, 0xbc, 0x03, 0x5d, 0x3a, 0xed, 0xeb, 0xc7, 0xde, 0x85, 0x0a, 0x95, 0x6b, 0x65, 0xec, 0xdb, 0x9c, 0xf6, 0x07, 0x64, 0x06, 0x3f, 0x15, 0xaa, 0x48, 0x55, 0x3c, 0x58, 0xd9, 0x72, 0xfe, 0x66, 0x75, 0x05, 0x6e, 0x35, 0xdd, 0xfd, 0xc3, 0x7b, 0xf3, 0xb9, 0xf2, 0xf6, 0x22, 0xee, 0x27, 0x13, 0x37, 0x25, 0x68, 0x49, 0xc9, 0xbe, 0xf2, 0x17, 0x6f, 0xe8, 0xf7, 0xc3, 0xf8, 0xbb, 0x91, 0xba, 0x37, 0x4d, 0xd5, 0x3b, 0xaf, 0x3d, 0xec, 0x81, 0x4d, 0x2b, 0xde, 0xc1, 0x0c, 0x1f, 0xdc, 0x88, 0xcd, 0xd1, 0x68, 0x76, 0xf2, 0x6b, 0x1e, 0xdf, 0xa3, 0xf0, 0x94, 0x19, 0x7e, 0xdf, 0x4d, 0x42, 0xff, 0x1f, 0xb2, 0x97, 0x11, 0x03, 0xb8, 0x98, 0xca, 0x85, 0x9c, 0x42, 0x72, 0x87, 0x08, 0x6a, 0x84, 0x2a, 0xb4, 0x10, 0xbb, 0x69, 0xcf, 0x2d, 0x35, 0xaf, 0x6b, 0xe3, 0x02, 0x81, 0x81, 0x00, 0xd4, 0x7e, 0x72, 0x4a, 0x7f, 0xf4, 0x10, 0x48, 0xb2, 0x70, 0xc2, 0x52, 0x4a, 0x41, 0x01, 0x87, 0x8b, 0x73, 0x15, 0x9b, 0xb7, 0x3d, 0x3d, 0xbc, 0x18, 0x7b, 0x22, 0x0e, 0x63, 0x5b, 0x35, 0x34, 0xf9, 0x6e, 0x24, 0x3a, 0x18, 0x4d, 0x93, 0xf8, 0x60, 0xb6, 0xbf, 0xbb, 0x6b, 0x71, 0xc1, 0xed, 0x9a, 0x1e, 0x1f, 0x45, 0x85, 0x83, 0x02, 0x3c, 0x30, 0x1e, 0x96, 0xa6, 0x92, 0xc1, 0xa0, 0x8b, 0x53, 0xd0, 0xec, 0x9c, 0xa9, 0x10, 0x10, 0x0d, 0x80, 0x45, 0x1e, 0x3b, 0x7d, 0xc6, 0xa0, 0x1b, 0xac, 0x4a, 0xec, 0xef, 0x8d, 0xf7, 0x98, 0x84, 0x6b, 0xc2, 0x35, 0xa0, 0x8c, 0xbb, 0xa2, 0xcf, 0x4c, 0x06, 0x80, 0x4c, 0xc1, 0x12, 0x19, 0xe9, 0x56, 0x08, 0xc7, 0x14, 0xe3, 0xf1, 0x43, 0x0d, 0x49, 0x1f, 0xad, 0xbb, 0xa3, 0x2a, 0x57, 0x51, 0xa0, 0x4f, 0x97, 0x74, 0x58, 0x34, 0xc9, 0xa5, 0x02, 0x81, 0x80, 0x21, 0xf2, 0x45, 0x2b, 0xb9, 0xb9, 0x5d, 0xfd, 0x02, 0x8c, 0x91, 0x4b, 0xf7, 0x99, 0xf1, 0xca, 0x77, 0xe8, 0x9a, 0x95, 0xd5, 0x0d, 0x3c, 0x16, 0xd3, 0x84, 0xf8, 0x45, 0x5f, 0x8b, 0xd7, 0xaf, 0x9e, 0xb3, 0xdf, 0xa3, 0xd5, 0x91, 0xd9, 0x84, 0x2d, 0xef, 0x23, 0x5f, 0x76, 0x30, 0xa8, 0xe4, 0x8c, 0x08, 0x8f, 0xf6, 0x64, 0x2e, 0x10, 0x17, 0x94, 0x53, 0x5a, 0x93, 0x3e, 0x1e, 0x97, 0x6f, 0xa8, 0x50, 0x9f, 0xc7, 0x28, 0xb2, 0xda, 0x0c, 0x4a, 0x1a, 0x08, 0xd7, 0xfc, 0xf3, 0x7a, 0xba, 0xae, 0x1f, 0xf3, 0x00, 0x1a, 0xca, 0x1d, 0xc1, 0xbb, 0xb0, 0x5d, 0x9d, 0xff, 0xba, 0xa1, 0xa0, 0x9f, 0x7f, 0xb1, 0xee, 0xf3, 0x82, 0x37, 0xd9, 0xeb, 0xcc, 0xc7, 0x22, 0xb9, 0x33, 0x84, 0x36, 0xdd, 0xe7, 0x11, 0x91, 0x12, 0x79, 0x8c, 0x26, 0x80, 0x9c, 0x1a, 0x8d, 0xec, 0x43, 0x20, 0x61, 0x02, 0x81, 0x80, 0x1f, 0x75, 0x10, 0xaa, 0x62, 0xc2, 0xd8, 0xde, 0x4a, 0x3c, 0x53, 0x28, 0x27, 0x81, 0xf4, 0x1e, 0x02, 0xd0, 0xe8, 0xb4, 0x02, 0xae, 0x78, 0x43, 0x2e, 0x44, 0x9c, 0x48, 0x11, 0x01, 0x61, 0xa1, 0x14, 0x03, 0xf0, 0x2d, 0x01, 0x88, 0x0a, 0x8d, 0xcc, 0x93, 0x81, 0x52, 0xd7, 0x97, 0x21, 0xa4, 0x71, 0x1a, 0x60, 0x7a, 0xc4, 0x47, 0x1e, 0xbf, 0x96, 0x48, 0x10, 0xf9, 0x5b, 0xe4, 0x7a, 0x45, 0xe6, 0x04, 0x99, 0xe2, 0x9f, 0x4c, 0x97, 0x73, 0xc8, 0x37, 0x73, 0x40, 0x4f, 0x60, 0x66, 0x37, 0x72, 0x8c, 0x2d, 0x03, 0x51, 0xbb, 0x03, 0xc3, 0x26, 0xc8, 0xbb, 0x73, 0xa7, 0x21, 0xe7, 0xfa, 0x54, 0x40, 0xea, 0x21, 0x72, 0xbb, 0xa1, 0x46, 0x5f, 0xcc, 0x30, 0xdc, 0xb0, 0xd9, 0xf8, 0x99, 0x30, 0xe8, 0x15, 0xaa, 0x1f, 0x7f, 0x97, 0x29, 0xa8, 0x57, 0xe0, 0x0e, 0x03, 0x38, 0xdd, 0x59, 0x02, 0x81, 0x80, 0x4d, 0x1f, 0x0d, 0x75, 0x6f, 0xe7, 0x7e, 0x01, 0x09, 0x9a, 0x65, 0x2f, 0x50, 0xa8, 0x8b, 0x7b, 0x68, 0x5d, 0xc5, 0xbf, 0x00, 0x98, 0x1d, 0x5d, 0x23, 0x76, 0xfd, 0x0c, 0x6f, 0xe2, 0x9c, 0xd5, 0xb6, 0x38, 0x73, 0x44, 0x79, 0x30, 0x5a, 0x73, 0xad, 0x3c, 0x15, 0x99, 0xd3, 0x9e, 0xae, 0x3b, 0xae, 0x03, 0x5f, 0xbd, 0x6f, 0xed, 0x07, 0xc2, 0x8d, 0xe7, 0x05, 0x93, 0x38, 0x79, 0xa0, 0x6e, 0x48, 0xe6, 0xa6, 0x03, 0x68, 0x6e, 0xd8, 0xe2, 0x56, 0x0a, 0x5f, 0x6a, 0xf1, 0xf2, 0xc2, 0x4f, 0xaf, 0x4a, 0xa9, 0x60, 0xe3, 0x82, 0x18, 0x6f, 0x15, 0xee, 0xdc, 0xe9, 0xa2, 0x49, 0x1a, 0xe7, 0x30, 0x68, 0x0d, 0xd4, 0xcf, 0x77, 0x8b, 0x70, 0xfa, 0xa8, 0x68, 0x26, 0xab, 0x32, 0x23, 0x47, 0x7c, 0xc9, 0x13, 0x77, 0xb1, 0x9a, 0x6d, 0x5a, 0x2e, 0xae, 0xa2, 0x19, 0x76, 0x0b, 0xee, 0xd5, }; // kExampleECKeyDER is a sample EC private key encoded as an ECPrivateKey // structure. static const uint8_t kExampleECKeyDER[] = { 0x30, 0x77, 0x02, 0x01, 0x01, 0x04, 0x20, 0x07, 0x0f, 0x08, 0x72, 0x7a, 0xd4, 0xa0, 0x4a, 0x9c, 0xdd, 0x59, 0xc9, 0x4d, 0x89, 0x68, 0x77, 0x08, 0xb5, 0x6f, 0xc9, 0x5d, 0x30, 0x77, 0x0e, 0xe8, 0xd1, 0xc9, 0xce, 0x0a, 0x8b, 0xb4, 0x6a, 0xa0, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0xa1, 0x44, 0x03, 0x42, 0x00, 0x04, 0xe6, 0x2b, 0x69, 0xe2, 0xbf, 0x65, 0x9f, 0x97, 0xbe, 0x2f, 0x1e, 0x0d, 0x94, 0x8a, 0x4c, 0xd5, 0x97, 0x6b, 0xb7, 0xa9, 0x1e, 0x0d, 0x46, 0xfb, 0xdd, 0xa9, 0xa9, 0x1e, 0x9d, 0xdc, 0xba, 0x5a, 0x01, 0xe7, 0xd6, 0x97, 0xa8, 0x0a, 0x18, 0xf9, 0xc3, 0xc4, 0xa3, 0x1e, 0x56, 0xe2, 0x7c, 0x83, 0x48, 0xdb, 0x16, 0x1a, 0x1c, 0xf5, 0x1d, 0x7e, 0xf1, 0x94, 0x2d, 0x4b, 0xcf, 0x72, 0x22, 0xc1, }; // kExampleECKeyPKCS8 is a sample EC private key encoded as a PKCS#8 // PrivateKeyInfo. static const uint8_t kExampleECKeyPKCS8[] = { 0x30, 0x81, 0x87, 0x02, 0x01, 0x00, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x04, 0x6d, 0x30, 0x6b, 0x02, 0x01, 0x01, 0x04, 0x20, 0x43, 0x09, 0xc0, 0x67, 0x75, 0x21, 0x47, 0x9d, 0xa8, 0xfa, 0x16, 0xdf, 0x15, 0x73, 0x61, 0x34, 0x68, 0x6f, 0xe3, 0x8e, 0x47, 0x91, 0x95, 0xab, 0x79, 0x4a, 0x72, 0x14, 0xcb, 0xe2, 0x49, 0x4f, 0xa1, 0x44, 0x03, 0x42, 0x00, 0x04, 0xde, 0x09, 0x08, 0x07, 0x03, 0x2e, 0x8f, 0x37, 0x9a, 0xd5, 0xad, 0xe5, 0xc6, 0x9d, 0xd4, 0x63, 0xc7, 0x4a, 0xe7, 0x20, 0xcb, 0x90, 0xa0, 0x1f, 0x18, 0x18, 0x72, 0xb5, 0x21, 0x88, 0x38, 0xc0, 0xdb, 0xba, 0xf6, 0x99, 0xd8, 0xa5, 0x3b, 0x83, 0xe9, 0xe3, 0xd5, 0x61, 0x99, 0x73, 0x42, 0xc6, 0x6c, 0xe8, 0x0a, 0x95, 0x40, 0x41, 0x3b, 0x0d, 0x10, 0xa7, 0x4a, 0x93, 0xdb, 0x5a, 0xe7, 0xec, }; // kExampleECKeySpecifiedCurvePKCS8 is a sample EC private key encoded as a // PKCS#8 PrivateKeyInfo with P-256's parameters spelled out rather than using // the curve OID. static const uint8_t kExampleECKeySpecifiedCurvePKCS8[] = { 0x30, 0x82, 0x01, 0x79, 0x02, 0x01, 0x00, 0x30, 0x82, 0x01, 0x03, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x30, 0x81, 0xf7, 0x02, 0x01, 0x01, 0x30, 0x2c, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x01, 0x01, 0x02, 0x21, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x30, 0x5b, 0x04, 0x20, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfc, 0x04, 0x20, 0x5a, 0xc6, 0x35, 0xd8, 0xaa, 0x3a, 0x93, 0xe7, 0xb3, 0xeb, 0xbd, 0x55, 0x76, 0x98, 0x86, 0xbc, 0x65, 0x1d, 0x06, 0xb0, 0xcc, 0x53, 0xb0, 0xf6, 0x3b, 0xce, 0x3c, 0x3e, 0x27, 0xd2, 0x60, 0x4b, 0x03, 0x15, 0x00, 0xc4, 0x9d, 0x36, 0x08, 0x86, 0xe7, 0x04, 0x93, 0x6a, 0x66, 0x78, 0xe1, 0x13, 0x9d, 0x26, 0xb7, 0x81, 0x9f, 0x7e, 0x90, 0x04, 0x41, 0x04, 0x6b, 0x17, 0xd1, 0xf2, 0xe1, 0x2c, 0x42, 0x47, 0xf8, 0xbc, 0xe6, 0xe5, 0x63, 0xa4, 0x40, 0xf2, 0x77, 0x03, 0x7d, 0x81, 0x2d, 0xeb, 0x33, 0xa0, 0xf4, 0xa1, 0x39, 0x45, 0xd8, 0x98, 0xc2, 0x96, 0x4f, 0xe3, 0x42, 0xe2, 0xfe, 0x1a, 0x7f, 0x9b, 0x8e, 0xe7, 0xeb, 0x4a, 0x7c, 0x0f, 0x9e, 0x16, 0x2b, 0xce, 0x33, 0x57, 0x6b, 0x31, 0x5e, 0xce, 0xcb, 0xb6, 0x40, 0x68, 0x37, 0xbf, 0x51, 0xf5, 0x02, 0x21, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xbc, 0xe6, 0xfa, 0xad, 0xa7, 0x17, 0x9e, 0x84, 0xf3, 0xb9, 0xca, 0xc2, 0xfc, 0x63, 0x25, 0x51, 0x02, 0x01, 0x01, 0x04, 0x6d, 0x30, 0x6b, 0x02, 0x01, 0x01, 0x04, 0x20, 0x43, 0x09, 0xc0, 0x67, 0x75, 0x21, 0x47, 0x9d, 0xa8, 0xfa, 0x16, 0xdf, 0x15, 0x73, 0x61, 0x34, 0x68, 0x6f, 0xe3, 0x8e, 0x47, 0x91, 0x95, 0xab, 0x79, 0x4a, 0x72, 0x14, 0xcb, 0xe2, 0x49, 0x4f, 0xa1, 0x44, 0x03, 0x42, 0x00, 0x04, 0xde, 0x09, 0x08, 0x07, 0x03, 0x2e, 0x8f, 0x37, 0x9a, 0xd5, 0xad, 0xe5, 0xc6, 0x9d, 0xd4, 0x63, 0xc7, 0x4a, 0xe7, 0x20, 0xcb, 0x90, 0xa0, 0x1f, 0x18, 0x18, 0x72, 0xb5, 0x21, 0x88, 0x38, 0xc0, 0xdb, 0xba, 0xf6, 0x99, 0xd8, 0xa5, 0x3b, 0x83, 0xe9, 0xe3, 0xd5, 0x61, 0x99, 0x73, 0x42, 0xc6, 0x6c, 0xe8, 0x0a, 0x95, 0x40, 0x41, 0x3b, 0x0d, 0x10, 0xa7, 0x4a, 0x93, 0xdb, 0x5a, 0xe7, 0xec, }; // kExampleBadECKeyDER is a sample EC private key encoded as an ECPrivateKey // structure. The private key is equal to the order and will fail to import. static const uint8_t kExampleBadECKeyDER[] = { 0x30, 0x66, 0x02, 0x01, 0x00, 0x30, 0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x04, 0x4C, 0x30, 0x4A, 0x02, 0x01, 0x01, 0x04, 0x20, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84, 0xF3, 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x51, 0xA1, 0x23, 0x03, 0x21, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84, 0xF3, 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x51 }; // kExampleBadECKeyDER2 is a sample EC private key encoded as an ECPrivateKey // structure, but with the curve OID swapped out for 1.1.1.1.1.1.1.1.1. It is // then concatenated with an ECPrivateKey wrapped in a PrivateKeyInfo, // optional public key omitted, and with the private key chopped off. static const uint8_t kExampleBadECKeyDER2[] = { 0x30, 0x77, 0x02, 0x01, 0x01, 0x04, 0x20, 0x07, 0x0f, 0x08, 0x72, 0x7a, 0xd4, 0xa0, 0x4a, 0x9c, 0xdd, 0x59, 0xc9, 0x4d, 0x89, 0x68, 0x77, 0x08, 0xb5, 0x6f, 0xc9, 0x5d, 0x30, 0x77, 0x0e, 0xe8, 0xd1, 0xc9, 0xce, 0x0a, 0x8b, 0xb4, 0x6a, 0xa0, 0x0a, 0x06, 0x08, 0x29, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0xa1, 0x44, 0x03, 0x42, 0x00, 0x04, 0xe6, 0x2b, 0x69, 0xe2, 0xbf, 0x65, 0x9f, 0x97, 0xbe, 0x2f, 0x1e, 0x0d, 0x94, 0x8a, 0x4c, 0xd5, 0x97, 0x6b, 0xb7, 0xa9, 0x1e, 0x0d, 0x46, 0xfb, 0xdd, 0xa9, 0xa9, 0x1e, 0x9d, 0xdc, 0xba, 0x5a, 0x01, 0xe7, 0xd6, 0x97, 0xa8, 0x0a, 0x18, 0xf9, 0xc3, 0xc4, 0xa3, 0x1e, 0x56, 0xe2, 0x7c, 0x83, 0x48, 0xdb, 0x16, 0x1a, 0x1c, 0xf5, 0x1d, 0x7e, 0xf1, 0x94, 0x2d, 0x4b, 0xcf, 0x72, 0x22, 0xc1, 0x30, 0x41, 0x02, 0x01, 0x00, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x04, 0x27, 0x30, 0x25, 0x02, 0x01, 0x01, 0x04, 0x20, 0x07, }; // kInvalidPrivateKey is an invalid private key. See // https://rt.openssl.org/Ticket/Display.html?id=4131. static const uint8_t kInvalidPrivateKey[] = { 0x30, 0x39, 0x02, 0x01, 0x02, 0x30, 0x09, 0x06, 0x01, 0x38, 0x08, 0x04, 0x69, 0x30, 0x30, 0x80, 0x30, 0x19, 0x01, 0x02, 0x9f, 0xf8, 0x8b, 0x29, 0x80, 0x30, 0xb0, 0x1b, 0x06, 0x09, 0x22, 0xbe, 0x08, 0x04, 0xe9, 0x30, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x3a, 0x01, 0x80, 0x09, 0x30, 0x80, 0x06, 0x01, 0x02, 0x30, 0x80, 0x30, 0x01, 0x3b, 0x02, 0x00, 0x00, 0x04, 0x20, 0x30, 0x82, 0x04, 0xe9, 0x30, 0xc3, 0xe8, 0x30, 0x01, 0x05, 0x30, 0x80, 0x30, 0x01, 0x3b, 0x01, 0x04, 0x02, 0x02, 0xff, 0x00, 0x30, 0x29, 0x02, 0x11, 0x03, 0x29, 0x29, 0x02, 0x00, 0x99, 0x30, 0x80, 0x06, 0x21, 0x02, 0x24, 0x04, 0xe8, 0x30, 0x01, 0x01, 0x04, 0x30, 0x80, 0x1b, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x30, 0x01, 0xaa, 0x02, 0x86, 0xc0, 0x30, 0xdf, 0xe9, 0x80, }; static UniquePtr LoadExampleRSAKey() { UniquePtr rsa( RSA_private_key_from_bytes(kExampleRSAKeyDER, sizeof(kExampleRSAKeyDER))); if (!rsa) { return nullptr; } UniquePtr pkey(EVP_PKEY_new()); if (!pkey || !EVP_PKEY_set1_RSA(pkey.get(), rsa.get())) { return nullptr; } return pkey; } TEST(EVPExtraTest, DigestSignInit) { UniquePtr pkey = LoadExampleRSAKey(); ASSERT_TRUE(pkey); ScopedEVP_MD_CTX md_ctx; ASSERT_TRUE(EVP_DigestSignInit(md_ctx.get(), nullptr, EVP_sha256(), nullptr, pkey.get())); ASSERT_TRUE(EVP_DigestSignUpdate(md_ctx.get(), kMsg, sizeof(kMsg))); // Determine the size of the signature. size_t sig_len = 0; ASSERT_TRUE(EVP_DigestSignFinal(md_ctx.get(), nullptr, &sig_len)); // Sanity check for testing. EXPECT_EQ(static_cast(EVP_PKEY_size(pkey.get())), sig_len); std::vector sig; sig.resize(sig_len); ASSERT_TRUE(EVP_DigestSignFinal(md_ctx.get(), sig.data(), &sig_len)); sig.resize(sig_len); // Ensure that the signature round-trips. md_ctx.Reset(); ASSERT_TRUE(EVP_DigestVerifyInit(md_ctx.get(), nullptr, EVP_sha256(), nullptr, pkey.get())); ASSERT_TRUE(EVP_DigestVerifyUpdate(md_ctx.get(), kMsg, sizeof(kMsg))); ASSERT_TRUE(EVP_DigestVerifyFinal(md_ctx.get(), sig.data(), sig_len)); } TEST(EVPExtraTest, DigestVerifyInit) { UniquePtr pkey = LoadExampleRSAKey(); ScopedEVP_MD_CTX md_ctx; ASSERT_TRUE(pkey); ASSERT_TRUE(EVP_DigestVerifyInit(md_ctx.get(), nullptr, EVP_sha256(), nullptr, pkey.get())); ASSERT_TRUE(EVP_DigestVerifyUpdate(md_ctx.get(), kMsg, sizeof(kMsg))); ASSERT_TRUE( EVP_DigestVerifyFinal(md_ctx.get(), kSignature, sizeof(kSignature))); } TEST(EVPExtraTest, VerifyRecover) { UniquePtr pkey = LoadExampleRSAKey(); ASSERT_TRUE(pkey); UniquePtr rsa(EVP_PKEY_get1_RSA(pkey.get())); ASSERT_TRUE(rsa); const uint8_t kDummyHash[32] = {0}; uint8_t sig[2048/8]; unsigned sig_len = sizeof(sig); ASSERT_TRUE(RSA_sign(NID_sha256, kDummyHash, sizeof(kDummyHash), sig, &sig_len, rsa.get())); size_t out_len; UniquePtr ctx(EVP_PKEY_CTX_new(pkey.get(), nullptr)); ASSERT_TRUE(EVP_PKEY_verify_recover_init(ctx.get())); ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_padding(ctx.get(), RSA_PKCS1_PADDING)); ASSERT_TRUE(EVP_PKEY_CTX_set_signature_md(ctx.get(), EVP_sha256())); ASSERT_TRUE( EVP_PKEY_verify_recover(ctx.get(), nullptr, &out_len, sig, sig_len)); std::vector recovered; recovered.resize(out_len); ASSERT_TRUE(EVP_PKEY_verify_recover(ctx.get(), recovered.data(), &out_len, sig, sig_len)); EXPECT_EQ(Bytes(kDummyHash), Bytes(recovered.data(), out_len)); out_len = recovered.size(); ASSERT_TRUE(EVP_PKEY_CTX_set_signature_md(ctx.get(), nullptr)); ASSERT_TRUE(EVP_PKEY_verify_recover(ctx.get(), recovered.data(), &out_len, sig, sig_len)); // The size of a SHA-256 hash plus PKCS#1 v1.5 ASN.1 stuff happens to be 51 // bytes. EXPECT_EQ(51u, out_len); } static void TestValidPrivateKey(Span input, int expected_id) { const uint8_t *p = input.data(); UniquePtr pkey(d2i_AutoPrivateKey(nullptr, &p, input.size())); ASSERT_TRUE(pkey); EXPECT_EQ(EVP_PKEY_has_private(pkey.get()), 1); EXPECT_EQ(input.data() + input.size(), p); EXPECT_EQ(expected_id, EVP_PKEY_id(pkey.get())); } TEST(EVPExtraTest, d2i_AutoPrivateKey) { TestValidPrivateKey(kExampleRSAKeyDER, EVP_PKEY_RSA); TestValidPrivateKey(kExampleRSAKeyPKCS8, EVP_PKEY_RSA); TestValidPrivateKey(kExampleECKeyDER, EVP_PKEY_EC); TestValidPrivateKey(kExampleECKeyPKCS8, EVP_PKEY_EC); TestValidPrivateKey(kExampleECKeySpecifiedCurvePKCS8, EVP_PKEY_EC); TestValidPrivateKey(kExampleDSAKeyDER, EVP_PKEY_DSA); const uint8_t *p = kInvalidPrivateKey; UniquePtr pkey( d2i_AutoPrivateKey(nullptr, &p, sizeof(kInvalidPrivateKey))); EXPECT_FALSE(pkey) << "Parsed invalid private key"; ERR_clear_error(); } static UniquePtr ParsePrivateKey(int type, Span in) { const uint8_t *ptr = in.data(); UniquePtr pkey(d2i_PrivateKey(type, nullptr, &ptr, in.size())); if (!pkey) { return nullptr; } EXPECT_EQ(in.data() + in.size(), ptr); EXPECT_EQ(EVP_PKEY_has_private(pkey.get()), 1); return pkey; } static std::string PrintToString(const EVP_PKEY *pkey, int indent, int (*print_func)(BIO *out, const EVP_PKEY *pkey, int indent, ASN1_PCTX *pctx)) { UniquePtr bio(BIO_new(BIO_s_mem())); const uint8_t *data; size_t len; if (!bio || !print_func(bio.get(), pkey, indent, nullptr) || !BIO_mem_contents(bio.get(), &data, &len)) { ADD_FAILURE() << "Error printing."; return ""; } return std::string(data, data + len); } TEST(EVPExtraTest, Print) { UniquePtr rsa = ParsePrivateKey(EVP_PKEY_RSA, kExampleRSAKeyDER); ASSERT_TRUE(rsa); EXPECT_EQ(PrintToString(rsa.get(), /*indent=*/2, &EVP_PKEY_print_params), " Parameters algorithm unsupported\n"); EXPECT_EQ(PrintToString(rsa.get(), /*indent=*/2, &EVP_PKEY_print_public), R"( Public-Key: (1024 bit) Modulus: 00:f8:b8:6c:83:b4:bc:d9:a8:57:c0:a5:b4:59:76: 8c:54:1d:79:eb:22:52:04:7e:d3:37:eb:41:fd:83: f9:f0:a6:85:15:34:75:71:5a:84:a8:3c:d2:ef:5a: 4e:d3:de:97:8a:dd:ff:bb:cf:0a:aa:86:92:be:b8: 50:e4:cd:6f:80:33:30:76:13:8f:ca:7b:dc:ec:5a: ca:63:c7:03:25:ef:a8:8a:83:58:76:20:fa:16:77: d7:79:92:63:01:48:1a:d8:7b:67:f1:52:55:49:4e: d6:6e:4a:5c:d7:7a:37:36:0c:de:dd:8f:44:e8:c2: a7:2c:2b:b5:af:64:4b:61:07 Exponent: 65537 (0x10001) )"); EXPECT_EQ(PrintToString(rsa.get(), /*indent=*/2, &EVP_PKEY_print_private), R"( Private-Key: (1024 bit) modulus: 00:f8:b8:6c:83:b4:bc:d9:a8:57:c0:a5:b4:59:76: 8c:54:1d:79:eb:22:52:04:7e:d3:37:eb:41:fd:83: f9:f0:a6:85:15:34:75:71:5a:84:a8:3c:d2:ef:5a: 4e:d3:de:97:8a:dd:ff:bb:cf:0a:aa:86:92:be:b8: 50:e4:cd:6f:80:33:30:76:13:8f:ca:7b:dc:ec:5a: ca:63:c7:03:25:ef:a8:8a:83:58:76:20:fa:16:77: d7:79:92:63:01:48:1a:d8:7b:67:f1:52:55:49:4e: d6:6e:4a:5c:d7:7a:37:36:0c:de:dd:8f:44:e8:c2: a7:2c:2b:b5:af:64:4b:61:07 publicExponent: 65537 (0x10001) privateExponent: 74:88:64:3f:69:45:3a:6d:c7:7f:b9:a3:c0:6e:ec: dc:d4:5a:b5:32:85:5f:19:d4:f8:d4:3f:3c:fa:c2: f6:5f:ee:e6:ba:87:74:2e:c7:0c:d4:42:b8:66:85: 9c:7b:24:61:aa:16:11:f6:b5:b6:a4:0a:c9:55:2e: 81:a5:47:61:cb:25:8f:c2:15:7b:0e:7c:36:9f:3a: da:58:86:1c:5b:83:79:e6:2b:cc:e6:fa:2c:61:f2: 78:80:1b:e2:f3:9d:39:2b:65:57:91:3d:71:99:73: a5:c2:79:20:8c:07:4f:e5:b4:60:1f:99:a2:b1:4f: 0c:ef:bc:59:53:00:7d:b1 prime1: 00:fc:7e:23:65:70:f8:ce:d3:40:41:80:6a:1d:01: d6:01:ff:b6:1b:3d:3d:59:09:33:79:c0:4f:de:96: 27:4b:18:c6:d9:78:f1:f4:35:46:e9:7c:42:7a:5d: 9f:ef:54:b8:f7:9f:c4:33:6c:f3:8c:32:46:87:67: 30:7b:a7:ac:e3 prime2: 00:fc:2c:df:0c:0d:88:f5:b1:92:a8:93:47:63:55: f5:ca:58:43:ba:1c:e5:9e:b6:95:05:cd:b5:82:df: eb:04:53:9d:bd:c2:38:16:b3:62:dd:a1:46:db:6d: 97:93:9f:8a:c3:9b:64:7e:42:e3:32:57:19:1b:d5: 6e:85:fa:b8:8d exponent1: 00:bc:3d:de:6d:d6:97:e8:ba:9e:81:37:17:e5:a0: 64:c9:00:b7:e7:fe:f4:29:d9:2e:43:6b:19:20:bd: 99:75:e7:76:f8:d3:ae:af:7e:b8:eb:81:f4:9d:fe: 07:2b:0b:63:0b:5a:55:90:71:7d:f1:db:d9:b1:41: 41:68:2f:4e:39 exponent2: 5a:34:66:d8:f5:e2:7f:18:b5:00:6e:26:84:27:14: 93:fb:fc:c6:0f:5e:27:e6:e1:e9:c0:8a:e4:34:da: e9:a2:4b:73:bc:8c:b9:ba:13:6c:7a:2b:51:84:a3: 4a:e0:30:10:06:7e:ed:17:5a:14:00:c9:ef:85:ea: 52:2c:bc:65 coefficient: 51:e3:f2:83:19:9b:c4:1e:2f:50:3d:df:5a:a2:18: ca:5f:2e:49:af:6f:cc:fa:65:77:94:b5:a1:0a:a9: d1:8a:39:37:f4:0b:a0:d7:82:27:5e:ae:17:17:a1: 1e:54:34:bf:6e:c4:8e:99:5d:08:f1:2d:86:9d:a5: 20:1b:e5:df )"); // We don't support printing DSA keys. UniquePtr dsa = ParsePrivateKey(EVP_PKEY_DSA, kExampleDSAKeyDER); ASSERT_TRUE(dsa); EXPECT_EQ(PrintToString(dsa.get(), /*indent=*/2, &EVP_PKEY_print_params), " Parameters algorithm unsupported\n"); EXPECT_EQ(PrintToString(dsa.get(), /*indent=*/2, &EVP_PKEY_print_public), " Public Key algorithm unsupported\n"); EXPECT_EQ(PrintToString(dsa.get(), /*indent=*/2, &EVP_PKEY_print_private), " Private Key algorithm unsupported\n"); UniquePtr ec = ParsePrivateKey(EVP_PKEY_EC, kExampleECKeyDER); ASSERT_TRUE(ec); EXPECT_EQ(PrintToString(ec.get(), /*indent=*/2, &EVP_PKEY_print_params), " ECDSA-Parameters: (P-256)\n"); EXPECT_EQ(PrintToString(ec.get(), /*indent=*/2, &EVP_PKEY_print_public), R"( Public-Key: (P-256) pub: 04:e6:2b:69:e2:bf:65:9f:97:be:2f:1e:0d:94:8a: 4c:d5:97:6b:b7:a9:1e:0d:46:fb:dd:a9:a9:1e:9d: dc:ba:5a:01:e7:d6:97:a8:0a:18:f9:c3:c4:a3:1e: 56:e2:7c:83:48:db:16:1a:1c:f5:1d:7e:f1:94:2d: 4b:cf:72:22:c1 )"); EXPECT_EQ(PrintToString(ec.get(), /*indent=*/2, &EVP_PKEY_print_private), R"( Private-Key: (P-256) priv: 07:0f:08:72:7a:d4:a0:4a:9c:dd:59:c9:4d:89:68: 77:08:b5:6f:c9:5d:30:77:0e:e8:d1:c9:ce:0a:8b: b4:6a pub: 04:e6:2b:69:e2:bf:65:9f:97:be:2f:1e:0d:94:8a: 4c:d5:97:6b:b7:a9:1e:0d:46:fb:dd:a9:a9:1e:9d: dc:ba:5a:01:e7:d6:97:a8:0a:18:f9:c3:c4:a3:1e: 56:e2:7c:83:48:db:16:1a:1c:f5:1d:7e:f1:94:2d: 4b:cf:72:22:c1 )"); } // Tests loading a bad key in PKCS8 format. TEST(EVPExtraTest, BadECKey) { const uint8_t *derp = kExampleBadECKeyDER; UniquePtr p8inf( d2i_PKCS8_PRIV_KEY_INFO(nullptr, &derp, sizeof(kExampleBadECKeyDER))); ASSERT_TRUE(p8inf); EXPECT_EQ(kExampleBadECKeyDER + sizeof(kExampleBadECKeyDER), derp); UniquePtr pkey(EVP_PKCS82PKEY(p8inf.get())); ASSERT_FALSE(pkey) << "Imported invalid EC key"; ERR_clear_error(); } // Tests |EVP_marshal_public_key| on an empty key. TEST(EVPExtraTest, MarshalEmptyPublicKey) { UniquePtr empty(EVP_PKEY_new()); ASSERT_TRUE(empty); EXPECT_EQ(EVP_PKEY_has_public(empty.get()), 0); EXPECT_EQ(EVP_PKEY_has_private(empty.get()), 0); ScopedCBB cbb; EXPECT_FALSE(EVP_marshal_public_key(cbb.get(), empty.get())) << "Marshalled empty public key."; EXPECT_TRUE(ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM)); } TEST(EVPExtraTest, d2i_PrivateKey) { EXPECT_TRUE(ParsePrivateKey(EVP_PKEY_RSA, kExampleRSAKeyDER)); EXPECT_TRUE(ParsePrivateKey(EVP_PKEY_DSA, kExampleDSAKeyDER)); EXPECT_TRUE(ParsePrivateKey(EVP_PKEY_RSA, kExampleRSAKeyPKCS8)); EXPECT_TRUE(ParsePrivateKey(EVP_PKEY_EC, kExampleECKeyDER)); EXPECT_FALSE(ParsePrivateKey(EVP_PKEY_EC, kExampleBadECKeyDER)); ERR_clear_error(); // Copy the input into a |malloc|'d vector to flag memory errors. std::vector copy( kExampleBadECKeyDER2, kExampleBadECKeyDER2 + sizeof(kExampleBadECKeyDER2)); EXPECT_FALSE(ParsePrivateKey(EVP_PKEY_EC, copy)); ERR_clear_error(); // Test that an RSA key may not be imported as an EC key. EXPECT_FALSE(ParsePrivateKey(EVP_PKEY_EC, kExampleRSAKeyPKCS8)); ERR_clear_error(); } TEST(EVPExtraTest, Ed25519) { static const uint8_t kPublicKey[32] = { 0xd7, 0x5a, 0x98, 0x01, 0x82, 0xb1, 0x0a, 0xb7, 0xd5, 0x4b, 0xfe, 0xd3, 0xc9, 0x64, 0x07, 0x3a, 0x0e, 0xe1, 0x72, 0xf3, 0xda, 0xa6, 0x23, 0x25, 0xaf, 0x02, 0x1a, 0x68, 0xf7, 0x07, 0x51, 0x1a, }; static const uint8_t kPublicKeySPKI[] = { 0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00, 0xd7, 0x5a, 0x98, 0x01, 0x82, 0xb1, 0x0a, 0xb7, 0xd5, 0x4b, 0xfe, 0xd3, 0xc9, 0x64, 0x07, 0x3a, 0x0e, 0xe1, 0x72, 0xf3, 0xda, 0xa6, 0x23, 0x25, 0xaf, 0x02, 0x1a, 0x68, 0xf7, 0x07, 0x51, 0x1a, }; static const uint8_t kPrivateKeySeed[32] = { 0x9d, 0x61, 0xb1, 0x9d, 0xef, 0xfd, 0x5a, 0x60, 0xba, 0x84, 0x4a, 0xf4, 0x92, 0xec, 0x2c, 0xc4, 0x44, 0x49, 0xc5, 0x69, 0x7b, 0x32, 0x69, 0x19, 0x70, 0x3b, 0xac, 0x03, 0x1c, 0xae, 0x7f, 0x60, }; static const uint8_t kPrivateKeyPKCS8[] = { 0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20, 0x9d, 0x61, 0xb1, 0x9d, 0xef, 0xfd, 0x5a, 0x60, 0xba, 0x84, 0x4a, 0xf4, 0x92, 0xec, 0x2c, 0xc4, 0x44, 0x49, 0xc5, 0x69, 0x7b, 0x32, 0x69, 0x19, 0x70, 0x3b, 0xac, 0x03, 0x1c, 0xae, 0x7f, 0x60, }; // Create a public key. UniquePtr pubkey(EVP_PKEY_from_raw_public_key( EVP_pkey_ed25519(), kPublicKey, sizeof(kPublicKey))); ASSERT_TRUE(pubkey); EXPECT_EQ(EVP_PKEY_has_public(pubkey.get()), 1); EXPECT_EQ(EVP_PKEY_ED25519, EVP_PKEY_id(pubkey.get())); // The public key must be extractable. uint8_t buf[32]; size_t len; ASSERT_TRUE(EVP_PKEY_get_raw_public_key(pubkey.get(), nullptr, &len)); EXPECT_EQ(len, 32u); ASSERT_TRUE(EVP_PKEY_get_raw_public_key(pubkey.get(), buf, &len)); EXPECT_EQ(Bytes(buf, len), Bytes(kPublicKey)); // Passing too large of a buffer is okay. The function will still only read // 32 bytes. len = 64; ASSERT_TRUE(EVP_PKEY_get_raw_public_key(pubkey.get(), buf, &len)); EXPECT_EQ(Bytes(buf, len), Bytes(kPublicKey)); // Passing too small of a buffer is noticed. len = 31; EXPECT_FALSE(EVP_PKEY_get_raw_public_key(pubkey.get(), buf, &len)); EXPECT_TRUE( ErrorEquals(ERR_get_error(), ERR_LIB_EVP, EVP_R_BUFFER_TOO_SMALL)); ERR_clear_error(); // There is no private key. EXPECT_EQ(EVP_PKEY_has_private(pubkey.get()), 0); EXPECT_FALSE(EVP_PKEY_get_raw_private_key(pubkey.get(), nullptr, &len)); EXPECT_TRUE( ErrorEquals(ERR_get_error(), ERR_LIB_EVP, EVP_R_NOT_A_PRIVATE_KEY)); ERR_clear_error(); // The public key must encode properly. ScopedCBB cbb; uint8_t *der; size_t der_len; ASSERT_TRUE(CBB_init(cbb.get(), 0)); ASSERT_TRUE(EVP_marshal_public_key(cbb.get(), pubkey.get())); ASSERT_TRUE(CBB_finish(cbb.get(), &der, &der_len)); UniquePtr free_der(der); EXPECT_EQ(Bytes(kPublicKeySPKI), Bytes(der, der_len)); // The public key must gracefully fail to encode as a private key. ASSERT_TRUE(CBB_init(cbb.get(), 0)); EXPECT_FALSE(EVP_marshal_private_key(cbb.get(), pubkey.get())); EXPECT_TRUE( ErrorEquals(ERR_get_error(), ERR_LIB_EVP, EVP_R_NOT_A_PRIVATE_KEY)); ERR_clear_error(); cbb.Reset(); // Create a private key. UniquePtr privkey(EVP_PKEY_from_raw_private_key( EVP_pkey_ed25519(), kPrivateKeySeed, sizeof(kPrivateKeySeed))); ASSERT_TRUE(privkey); EXPECT_EQ(EVP_PKEY_ED25519, EVP_PKEY_id(privkey.get())); // The private key must be extractable. ASSERT_TRUE(EVP_PKEY_get_raw_private_key(privkey.get(), nullptr, &len)); EXPECT_EQ(len, 32u); ASSERT_TRUE(EVP_PKEY_get_raw_private_key(privkey.get(), buf, &len)); EXPECT_EQ(Bytes(buf, len), Bytes(kPrivateKeySeed)); // Passing too large of a buffer is okay. The function will still only read // 32 bytes. len = 64; ASSERT_TRUE(EVP_PKEY_get_raw_private_key(privkey.get(), buf, &len)); EXPECT_EQ(Bytes(buf, len), Bytes(kPrivateKeySeed)); // Passing too small of a buffer is noticed. len = 31; EXPECT_FALSE(EVP_PKEY_get_raw_private_key(privkey.get(), buf, &len)); EXPECT_TRUE( ErrorEquals(ERR_get_error(), ERR_LIB_EVP, EVP_R_BUFFER_TOO_SMALL)); ERR_clear_error(); // The public key must be extractable. len = 32; ASSERT_TRUE(EVP_PKEY_get_raw_public_key(privkey.get(), buf, &len)); EXPECT_EQ(Bytes(buf, len), Bytes(kPublicKey)); // The public key must encode from the private key. ASSERT_TRUE(CBB_init(cbb.get(), 0)); ASSERT_TRUE(EVP_marshal_public_key(cbb.get(), privkey.get())); ASSERT_TRUE(CBB_finish(cbb.get(), &der, &der_len)); free_der.reset(der); EXPECT_EQ(Bytes(kPublicKeySPKI), Bytes(der, der_len)); // The private key must encode properly. ASSERT_TRUE(CBB_init(cbb.get(), 0)); ASSERT_TRUE(EVP_marshal_private_key(cbb.get(), privkey.get())); ASSERT_TRUE(CBB_finish(cbb.get(), &der, &der_len)); free_der.reset(der); EXPECT_EQ(Bytes(kPrivateKeyPKCS8), Bytes(der, der_len)); // Test EVP_PKEY_eq. EXPECT_EQ(1, EVP_PKEY_eq(pubkey.get(), privkey.get())); static const uint8_t kZeros[32] = {0}; UniquePtr pubkey2( EVP_PKEY_from_raw_public_key(EVP_pkey_ed25519(), kZeros, sizeof(kZeros))); ASSERT_TRUE(pubkey2); EXPECT_EQ(0, EVP_PKEY_eq(pubkey.get(), pubkey2.get())); EXPECT_EQ(0, EVP_PKEY_eq(privkey.get(), pubkey2.get())); // Ed25519 may not be used streaming. ScopedEVP_MD_CTX ctx; ASSERT_TRUE( EVP_DigestSignInit(ctx.get(), nullptr, nullptr, nullptr, privkey.get())); EXPECT_FALSE(EVP_DigestSignUpdate(ctx.get(), nullptr, 0)); EXPECT_FALSE(EVP_DigestSignFinal(ctx.get(), nullptr, &len)); ERR_clear_error(); ctx.Reset(); ASSERT_TRUE(EVP_DigestVerifyInit(ctx.get(), nullptr, nullptr, nullptr, privkey.get())); EXPECT_FALSE(EVP_DigestVerifyUpdate(ctx.get(), nullptr, 0)); EXPECT_FALSE(EVP_DigestVerifyFinal(ctx.get(), nullptr, 0)); ERR_clear_error(); // The buffer length to |EVP_DigestSign| is an input/output parameter and // should be checked before signing. ctx.Reset(); ASSERT_TRUE( EVP_DigestSignInit(ctx.get(), nullptr, nullptr, nullptr, privkey.get())); len = 31; EXPECT_FALSE(EVP_DigestSign(ctx.get(), buf, &len, nullptr /* msg */, 0)); EXPECT_TRUE( ErrorEquals(ERR_get_error(), ERR_LIB_EVP, EVP_R_BUFFER_TOO_SMALL)); ERR_clear_error(); } static void ExpectRSAKey(const EVP_PKEY *pkey, int bits, uint64_t e) { ASSERT_EQ(EVP_PKEY_id(pkey), EVP_PKEY_RSA); EXPECT_EQ(EVP_PKEY_bits(pkey), bits); const BIGNUM *e_bn = RSA_get0_e(EVP_PKEY_get0_RSA(pkey)); uint64_t e_seen; ASSERT_TRUE(BN_get_u64(e_bn, &e_seen)); EXPECT_EQ(e_seen, e); } TEST(EVPExtraTest, RSAKeygen) { // By default, we generate a 2048-bit RSA key. UniquePtr pkey(EVP_PKEY_generate_from_alg(EVP_pkey_rsa())); ASSERT_TRUE(pkey); ExpectRSAKey(pkey.get(), 2048, RSA_F4); UniquePtr ctx(EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, nullptr)); ASSERT_TRUE(ctx); ASSERT_TRUE(EVP_PKEY_keygen_init(ctx.get())); EVP_PKEY *pkey_raw = nullptr; ASSERT_TRUE(EVP_PKEY_keygen(ctx.get(), &pkey_raw)); pkey.reset(pkey_raw); ExpectRSAKey(pkey.get(), 2048, RSA_F4); // Callers can specify a bit count. pkey.reset(EVP_RSA_gen(1024)); ASSERT_TRUE(pkey); ExpectRSAKey(pkey.get(), 1024, RSA_F4); ctx.reset(EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, nullptr)); ASSERT_TRUE(ctx); ASSERT_TRUE(EVP_PKEY_keygen_init(ctx.get())); ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_keygen_bits(ctx.get(), 1024)); pkey_raw = nullptr; ASSERT_TRUE(EVP_PKEY_keygen(ctx.get(), &pkey_raw)); pkey.reset(pkey_raw); ExpectRSAKey(pkey.get(), 1024, RSA_F4); // Callers can specify bit count and e. ctx.reset(EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, nullptr)); ASSERT_TRUE(ctx); ASSERT_TRUE(EVP_PKEY_keygen_init(ctx.get())); ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_keygen_bits(ctx.get(), 1024)); UniquePtr e(BN_new()); ASSERT_TRUE(e); ASSERT_TRUE(BN_set_u64(e.get(), 3)); ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_keygen_pubexp(ctx.get(), e.release())); pkey_raw = nullptr; ASSERT_TRUE(EVP_PKEY_keygen(ctx.get(), &pkey_raw)); pkey.reset(pkey_raw); ExpectRSAKey(pkey.get(), 1024, 3); } static void ExpectECGroupOnly(const EVP_PKEY *pkey, int nid) { EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey); ASSERT_TRUE(ec); const EC_GROUP *group = EC_KEY_get0_group(ec); ASSERT_TRUE(group); EXPECT_EQ(nid, EC_GROUP_get_curve_name(group)); EXPECT_EQ(nid, EVP_PKEY_get_ec_curve_nid(pkey)); EXPECT_EQ(EVP_PKEY_has_public(pkey), 0); EXPECT_EQ(EVP_PKEY_has_private(pkey), 0); EXPECT_FALSE(EC_KEY_get0_public_key(ec)); EXPECT_FALSE(EC_KEY_get0_private_key(ec)); } static void ExpectECGroupAndKey(const EVP_PKEY *pkey, int nid) { EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey); ASSERT_TRUE(ec); const EC_GROUP *group = EC_KEY_get0_group(ec); ASSERT_TRUE(group); EXPECT_EQ(nid, EC_GROUP_get_curve_name(group)); EXPECT_EQ(nid, EVP_PKEY_get_ec_curve_nid(pkey)); EXPECT_EQ(EVP_PKEY_has_public(pkey), 1); EXPECT_EQ(EVP_PKEY_has_private(pkey), 1); EXPECT_TRUE(EC_KEY_get0_public_key(ec)); EXPECT_TRUE(EC_KEY_get0_private_key(ec)); } TEST(EVPExtraTest, ECKeygen) { for (bool copy : {false, true}) { SCOPED_TRACE(copy); auto maybe_copy = [&](UniquePtr *ctx) -> bool { if (copy) { ctx->reset(EVP_PKEY_CTX_dup(ctx->get())); } return *ctx != nullptr; }; // |EVP_PKEY_paramgen| may be used as an extremely roundabout way to get an // |EC_GROUP|. UniquePtr ctx(EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr)); ASSERT_TRUE(ctx); ASSERT_TRUE(maybe_copy(&ctx)); ASSERT_TRUE(EVP_PKEY_paramgen_init(ctx.get())); ASSERT_TRUE(maybe_copy(&ctx)); ASSERT_TRUE(EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx.get(), NID_X9_62_prime256v1)); ASSERT_TRUE(maybe_copy(&ctx)); EVP_PKEY *raw = nullptr; ASSERT_TRUE(EVP_PKEY_paramgen(ctx.get(), &raw)); UniquePtr pkey(raw); ExpectECGroupOnly(pkey.get(), NID_X9_62_prime256v1); // That resulting |EVP_PKEY| may be used as a template for key generation. ctx.reset(EVP_PKEY_CTX_new(pkey.get(), nullptr)); ASSERT_TRUE(ctx); ASSERT_TRUE(maybe_copy(&ctx)); ASSERT_TRUE(EVP_PKEY_keygen_init(ctx.get())); ASSERT_TRUE(maybe_copy(&ctx)); raw = nullptr; ASSERT_TRUE(EVP_PKEY_keygen(ctx.get(), &raw)); pkey.reset(raw); ExpectECGroupAndKey(pkey.get(), NID_X9_62_prime256v1); // |EVP_PKEY_paramgen| may also be skipped. ctx.reset(EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr)); ASSERT_TRUE(ctx); ASSERT_TRUE(maybe_copy(&ctx)); ASSERT_TRUE(EVP_PKEY_keygen_init(ctx.get())); ASSERT_TRUE(maybe_copy(&ctx)); ASSERT_TRUE(EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx.get(), NID_X9_62_prime256v1)); ASSERT_TRUE(maybe_copy(&ctx)); raw = nullptr; ASSERT_TRUE(EVP_PKEY_keygen(ctx.get(), &raw)); UniquePtr pkey2(raw); ExpectECGroupAndKey(pkey2.get(), NID_X9_62_prime256v1); // The two keys should compare as different. EXPECT_EQ(EVP_PKEY_eq(pkey.get(), pkey2.get()), 0); // Keys of different groups should also compare as different. ctx.reset(EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr)); ASSERT_TRUE(ctx); ASSERT_TRUE(maybe_copy(&ctx)); ASSERT_TRUE(EVP_PKEY_keygen_init(ctx.get())); ASSERT_TRUE(maybe_copy(&ctx)); ASSERT_TRUE( EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx.get(), NID_secp384r1)); ASSERT_TRUE(maybe_copy(&ctx)); raw = nullptr; ASSERT_TRUE(EVP_PKEY_keygen(ctx.get(), &raw)); UniquePtr pkey3(raw); ExpectECGroupAndKey(pkey3.get(), NID_secp384r1); EXPECT_EQ(EVP_PKEY_eq(pkey.get(), pkey3.get()), 0); // The algorithm-based API provides a much, much easier keygen API. pkey.reset(EVP_PKEY_generate_from_alg(EVP_pkey_ec_p256())); ASSERT_TRUE(pkey); ExpectECGroupAndKey(pkey.get(), NID_X9_62_prime256v1); pkey.reset(EVP_PKEY_generate_from_alg(EVP_pkey_ec_p384())); ASSERT_TRUE(pkey); ExpectECGroupAndKey(pkey.get(), NID_secp384r1); } } TEST(EVPExtraTest, DHKeygen) { // Set up some DH params in an |EVP_PKEY|. There is currently no API to do // this from EVP directly. UniquePtr p(BN_get_rfc3526_prime_1536(nullptr)); ASSERT_TRUE(p); UniquePtr g(BN_new()); ASSERT_TRUE(g); ASSERT_TRUE(BN_set_u64(g.get(), 2)); UniquePtr params_dh(DH_new()); ASSERT_TRUE(params_dh); ASSERT_TRUE( DH_set0_pqg(params_dh.get(), p.release(), /*q=*/nullptr, g.release())); UniquePtr params(EVP_PKEY_new()); ASSERT_TRUE(params); ASSERT_TRUE(EVP_PKEY_set1_DH(params.get(), params_dh.get())); for (bool copy : {false, true}) { SCOPED_TRACE(copy); auto maybe_copy = [&](UniquePtr *ctx) -> bool { if (copy) { ctx->reset(EVP_PKEY_CTX_dup(ctx->get())); } return *ctx != nullptr; }; // |params| may be used as a template for key generation. UniquePtr ctx(EVP_PKEY_CTX_new(params.get(), nullptr)); ASSERT_TRUE(ctx); ASSERT_TRUE(maybe_copy(&ctx)); ASSERT_TRUE(EVP_PKEY_keygen_init(ctx.get())); ASSERT_TRUE(maybe_copy(&ctx)); EVP_PKEY *raw = nullptr; ASSERT_TRUE(EVP_PKEY_keygen(ctx.get(), &raw)); UniquePtr pkey(raw); EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_DH); const DH *dh = EVP_PKEY_get0_DH(pkey.get()); EXPECT_EQ(0, BN_cmp(DH_get0_p(dh), DH_get0_p(params_dh.get()))); EXPECT_EQ(0, BN_cmp(DH_get0_g(dh), DH_get0_g(params_dh.get()))); EXPECT_FALSE(DH_get0_q(dh)); EXPECT_TRUE(DH_get0_pub_key(dh)); EXPECT_TRUE(DH_get0_priv_key(dh)); EXPECT_EQ(1, EVP_PKEY_parameters_eq(params.get(), pkey.get())); EXPECT_EQ(0, EVP_PKEY_eq(params.get(), pkey.get())); // Generate a second key. ctx.reset(EVP_PKEY_CTX_new(params.get(), nullptr)); ASSERT_TRUE(ctx); ASSERT_TRUE(maybe_copy(&ctx)); ASSERT_TRUE(EVP_PKEY_keygen_init(ctx.get())); ASSERT_TRUE(maybe_copy(&ctx)); raw = nullptr; ASSERT_TRUE(EVP_PKEY_keygen(ctx.get(), &raw)); UniquePtr pkey2(raw); EXPECT_EQ(1, EVP_PKEY_parameters_eq(params.get(), pkey2.get())); EXPECT_EQ(1, EVP_PKEY_parameters_eq(pkey.get(), pkey2.get())); EXPECT_EQ(0, EVP_PKEY_eq(pkey.get(), pkey2.get())); } } static void CheckSignAndVerify(EVP_PKEY *pkey) { auto msg = StringAsBytes("hello"); ScopedEVP_MD_CTX ctx; ASSERT_TRUE(EVP_DigestSignInit(ctx.get(), nullptr, nullptr, nullptr, pkey)); size_t len; ASSERT_TRUE(EVP_DigestSign(ctx.get(), nullptr, &len, msg.data(), msg.size())); std::vector sig(len); ASSERT_TRUE( EVP_DigestSign(ctx.get(), sig.data(), &len, msg.data(), msg.size())); sig.resize(len); ctx.Reset(); ASSERT_TRUE(EVP_DigestVerifyInit(ctx.get(), nullptr, nullptr, nullptr, pkey)); ASSERT_TRUE(EVP_DigestVerify(ctx.get(), sig.data(), sig.size(), msg.data(), msg.size())); } // Test that |EVP_PKEY_keygen| works for Ed25519. TEST(EVPExtraTest, Ed25519Keygen) { UniquePtr pctx(EVP_PKEY_CTX_new_id(EVP_PKEY_ED25519, nullptr)); ASSERT_TRUE(pctx); ASSERT_TRUE(EVP_PKEY_keygen_init(pctx.get())); EVP_PKEY *raw = nullptr; ASSERT_TRUE(EVP_PKEY_keygen(pctx.get(), &raw)); UniquePtr pkey(raw); CheckSignAndVerify(pkey.get()); pkey.reset(EVP_PKEY_generate_from_alg(EVP_pkey_ed25519())); ASSERT_TRUE(pkey); CheckSignAndVerify(pkey.get()); } TEST(EVPExtraTest, MLDSAKeyGen) { const struct { int type; const EVP_PKEY_ALG *alg; } kAlgs[] = { {EVP_PKEY_ML_DSA_44, EVP_pkey_ml_dsa_44()}, {EVP_PKEY_ML_DSA_65, EVP_pkey_ml_dsa_65()}, {EVP_PKEY_ML_DSA_87, EVP_pkey_ml_dsa_87()}, }; for (const auto &alg : kAlgs) { SCOPED_TRACE(alg.type); UniquePtr ctx(EVP_PKEY_CTX_new_id(alg.type, nullptr)); ASSERT_TRUE(ctx); ASSERT_TRUE(EVP_PKEY_keygen_init(ctx.get())); EVP_PKEY *raw = nullptr; ASSERT_TRUE(EVP_PKEY_keygen(ctx.get(), &raw)); UniquePtr pkey(raw); // The key should be functional. Test that we can round-trip a signature. EXPECT_EQ(EVP_PKEY_id(pkey.get()), alg.type); CheckSignAndVerify(pkey.get()); // Generate a second key. They should be different. ctx.reset(EVP_PKEY_CTX_new_id(alg.type, nullptr)); ASSERT_TRUE(ctx); ASSERT_TRUE(EVP_PKEY_keygen_init(ctx.get())); raw = nullptr; ASSERT_TRUE(EVP_PKEY_keygen(ctx.get(), &raw)); UniquePtr pkey2(raw); EXPECT_EQ(EVP_PKEY_id(pkey2.get()), alg.type); CheckSignAndVerify(pkey2.get()); EXPECT_EQ(EVP_PKEY_eq(pkey.get(), pkey2.get()), 0); // The less messy API should also work. UniquePtr pkey3(EVP_PKEY_generate_from_alg(alg.alg)); ASSERT_TRUE(pkey3); EXPECT_EQ(EVP_PKEY_id(pkey3.get()), alg.type); CheckSignAndVerify(pkey3.get()); EXPECT_EQ(EVP_PKEY_eq(pkey.get(), pkey3.get()), 0); } } // Test that OpenSSL's legacy TLS-specific APIs in EVP work correctly. When we // target OpenSSL 3.0, these should be renamed to // |EVP_PKEY_get1_encoded_public_key|. TEST(EVPExtraTest, TLSEncodedPoint) { const struct { int pkey_type; std::vector spki; std::vector encoded_point; } kTests[] = { {EVP_PKEY_EC, {0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0x2c, 0x15, 0x0f, 0x42, 0x9c, 0xe7, 0x0f, 0x21, 0x6c, 0x25, 0x2c, 0xf5, 0xe0, 0x62, 0xce, 0x1f, 0x63, 0x9c, 0xd5, 0xd1, 0x65, 0xc7, 0xf8, 0x94, 0x24, 0x07, 0x2c, 0x27, 0x19, 0x7d, 0x78, 0xb3, 0x3b, 0x92, 0x0e, 0x95, 0xcd, 0xb6, 0x64, 0xe9, 0x90, 0xdc, 0xf0, 0xcf, 0xea, 0x0d, 0x94, 0xe2, 0xa8, 0xe6, 0xaf, 0x9d, 0x0e, 0x58, 0x05, 0x6e, 0x65, 0x31, 0x04, 0x92, 0x5b, 0x9f, 0xe6, 0xc9}, {0x04, 0x2c, 0x15, 0x0f, 0x42, 0x9c, 0xe7, 0x0f, 0x21, 0x6c, 0x25, 0x2c, 0xf5, 0xe0, 0x62, 0xce, 0x1f, 0x63, 0x9c, 0xd5, 0xd1, 0x65, 0xc7, 0xf8, 0x94, 0x24, 0x07, 0x2c, 0x27, 0x19, 0x7d, 0x78, 0xb3, 0x3b, 0x92, 0x0e, 0x95, 0xcd, 0xb6, 0x64, 0xe9, 0x90, 0xdc, 0xf0, 0xcf, 0xea, 0x0d, 0x94, 0xe2, 0xa8, 0xe6, 0xaf, 0x9d, 0x0e, 0x58, 0x05, 0x6e, 0x65, 0x31, 0x04, 0x92, 0x5b, 0x9f, 0xe6, 0xc9}}, {EVP_PKEY_X25519, {0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x6e, 0x03, 0x21, 0x00, 0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb, 0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c, 0x72, 0x66, 0x24, 0xec, 0x26, 0xb3, 0x35, 0x3b, 0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c}, {0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb, 0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c, 0x72, 0x66, 0x24, 0xec, 0x26, 0xb3, 0x35, 0x3b, 0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c}}}; for (const auto& test : kTests) { SCOPED_TRACE(test.pkey_type); SCOPED_TRACE(Bytes(test.spki)); CBS spki; CBS_init(&spki, test.spki.data(), test.spki.size()); UniquePtr from_spki(EVP_parse_public_key(&spki)); ASSERT_TRUE(from_spki); uint8_t *data; size_t len = EVP_PKEY_get1_tls_encodedpoint(from_spki.get(), &data); ASSERT_GT(len, 0u); EXPECT_EQ(Bytes(data, len), Bytes(test.encoded_point)); OPENSSL_free(data); UniquePtr from_encoded_point(EVP_PKEY_new()); ASSERT_TRUE(from_encoded_point); if (test.pkey_type == EVP_PKEY_EC) { // |EVP_PKEY_EC| should have been |EVP_PKEY_EC_P256|, etc., but instead // part of the type is buried inside parameters. ASSERT_TRUE( EVP_PKEY_copy_parameters(from_encoded_point.get(), from_spki.get())); } else { ASSERT_TRUE(EVP_PKEY_set_type(from_encoded_point.get(), test.pkey_type)); } ASSERT_TRUE(EVP_PKEY_set1_tls_encodedpoint(from_encoded_point.get(), test.encoded_point.data(), test.encoded_point.size())); ScopedCBB cbb; ASSERT_TRUE(CBB_init(cbb.get(), test.spki.size())); ASSERT_TRUE(EVP_marshal_public_key(cbb.get(), from_encoded_point.get())); EXPECT_EQ(Bytes(CBB_data(cbb.get()), CBB_len(cbb.get())), Bytes(test.spki)); } } TEST(EVPExtraTest, Parameters) { auto new_pkey_with_curve = [](int curve_nid) -> UniquePtr { UniquePtr ctx(EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr)); EVP_PKEY *pkey = nullptr; if (!ctx || // !EVP_PKEY_paramgen_init(ctx.get()) || !EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx.get(), curve_nid) || !EVP_PKEY_paramgen(ctx.get(), &pkey)) { return nullptr; } return UniquePtr(pkey); }; // RSA keys have no parameters. UniquePtr rsa = LoadExampleRSAKey(); ASSERT_TRUE(rsa); EXPECT_FALSE(EVP_PKEY_missing_parameters(rsa.get())); UniquePtr rsa2 = LoadExampleRSAKey(); ASSERT_TRUE(rsa2); // Two null parameters should compare as equal. EXPECT_EQ(1, EVP_PKEY_parameters_eq(rsa.get(), rsa2.get())); // RSA-PSS keys have parameters. EVP_PKEY_ALG const *alg = EVP_pkey_rsa_pss_sha256(); UniquePtr rsa_pss_sha256(EVP_PKEY_from_private_key_info( kExampleRSAPSSKeySHA256, sizeof(kExampleRSAPSSKeySHA256), &alg, 1u)); ASSERT_TRUE(rsa_pss_sha256); EXPECT_FALSE(EVP_PKEY_missing_parameters(rsa_pss_sha256.get())); UniquePtr rsa_pss_sha256_2(EVP_PKEY_from_private_key_info( kExampleRSAPSSKeySHA256, sizeof(kExampleRSAPSSKeySHA256), &alg, 1u)); ASSERT_TRUE(rsa_pss_sha256_2); EXPECT_TRUE( EVP_PKEY_parameters_eq(rsa_pss_sha256.get(), rsa_pss_sha256_2.get())); EXPECT_TRUE( EVP_PKEY_copy_parameters(rsa_pss_sha256.get(), rsa_pss_sha256_2.get())); // RSA-PSS keys' parameters are not compatible with RSA keys. EXPECT_FALSE(EVP_PKEY_parameters_eq(rsa_pss_sha256.get(), rsa.get())); EXPECT_FALSE(EVP_PKEY_copy_parameters(rsa_pss_sha256.get(), rsa.get())); // Different RSA-PSS key types are not compatible. alg = EVP_pkey_rsa_pss_sha384(); UniquePtr rsa_pss_sha384(EVP_PKEY_from_private_key_info( kExampleRSAPSSKeySHA384, sizeof(kExampleRSAPSSKeySHA384), &alg, 1u)); ASSERT_TRUE(rsa_pss_sha384); EXPECT_FALSE(EVP_PKEY_missing_parameters(rsa_pss_sha384.get())); EXPECT_FALSE( EVP_PKEY_parameters_eq(rsa_pss_sha256.get(), rsa_pss_sha384.get())); EXPECT_FALSE( EVP_PKEY_copy_parameters(rsa_pss_sha256.get(), rsa_pss_sha384.get())); // EC keys have parameters, but it is possible to initialize an |EVP_PKEY| // with a completely empty |EC_KEY|. UniquePtr ec_no_params(EVP_PKEY_new()); ASSERT_TRUE(ec_no_params); ASSERT_TRUE(EVP_PKEY_assign_EC_KEY(ec_no_params.get(), EC_KEY_new())); EXPECT_TRUE(EVP_PKEY_missing_parameters(ec_no_params.get())); UniquePtr p256 = new_pkey_with_curve(NID_X9_62_prime256v1); ASSERT_TRUE(p256); EXPECT_FALSE(EVP_PKEY_missing_parameters(p256.get())); UniquePtr p256_2 = new_pkey_with_curve(NID_X9_62_prime256v1); ASSERT_TRUE(p256_2); EXPECT_FALSE(EVP_PKEY_missing_parameters(p256_2.get())); UniquePtr p384 = new_pkey_with_curve(NID_secp384r1); ASSERT_TRUE(p384); EXPECT_FALSE(EVP_PKEY_missing_parameters(p384.get())); EXPECT_EQ(1, EVP_PKEY_parameters_eq(p256.get(), p256_2.get())); EXPECT_EQ(0, EVP_PKEY_parameters_eq(p256.get(), p384.get())); // Copying parameters onto a curve-less EC key works. ASSERT_TRUE(EVP_PKEY_copy_parameters(ec_no_params.get(), p256.get())); EXPECT_EQ(1, EVP_PKEY_parameters_eq(p256.get(), ec_no_params.get())); // No-op copies silently succeed. ASSERT_TRUE(EVP_PKEY_copy_parameters(ec_no_params.get(), p256.get())); EXPECT_EQ(1, EVP_PKEY_parameters_eq(p256.get(), ec_no_params.get())); // Copying parameters onto a type-less key works. UniquePtr pkey(EVP_PKEY_new()); ASSERT_TRUE(pkey); ASSERT_TRUE(EVP_PKEY_copy_parameters(pkey.get(), p256.get())); EXPECT_EQ(EVP_PKEY_EC, EVP_PKEY_id(pkey.get())); EXPECT_EQ(1, EVP_PKEY_parameters_eq(p256.get(), pkey.get())); // |EVP_PKEY_copy_parameters| cannot change a key's type or curve. EXPECT_FALSE(EVP_PKEY_copy_parameters(rsa.get(), p256.get())); EXPECT_EQ(EVP_PKEY_RSA, EVP_PKEY_id(rsa.get())); EXPECT_FALSE(EVP_PKEY_copy_parameters(rsa.get(), p256.get())); EXPECT_EQ(EVP_PKEY_RSA, EVP_PKEY_id(rsa.get())); } // Test copying parameters into an empty key. This should result in allocating a // key for the receiving key, which did not already have one. TEST(EVPExtraTest, CopyParamsIntoEmptyKey) { UniquePtr dsa = ParsePrivateKey(EVP_PKEY_DSA, kExampleDSAKeyDER); UniquePtr ec = ParsePrivateKey(EVP_PKEY_EC, kExampleECKeyDER); for (const EVP_PKEY* from_pkey : {dsa.get(), ec.get()}) { SCOPED_TRACE(EVP_PKEY_id(from_pkey)); ASSERT_TRUE(from_pkey); ASSERT_FALSE(EVP_PKEY_missing_parameters(from_pkey)); UniquePtr to_pkey(EVP_PKEY_new()); ASSERT_TRUE(to_pkey); ASSERT_EQ(EVP_PKEY_NONE, EVP_PKEY_id(to_pkey.get())); // EVP_PKEY_NONE has no parameters, so the params are not missing. ASSERT_FALSE(EVP_PKEY_missing_parameters(to_pkey.get())); ASSERT_FALSE(EVP_PKEY_has_private(to_pkey.get())); ASSERT_FALSE(EVP_PKEY_has_public(to_pkey.get())); EXPECT_TRUE(EVP_PKEY_copy_parameters(to_pkey.get(), from_pkey)); EXPECT_EQ(EVP_PKEY_id(to_pkey.get()), EVP_PKEY_id(from_pkey)); EXPECT_FALSE(EVP_PKEY_missing_parameters(to_pkey.get())); // Only params are copied, not keys. EXPECT_FALSE(EVP_PKEY_has_private(to_pkey.get())); EXPECT_FALSE(EVP_PKEY_has_public(to_pkey.get())); } } TEST(EVPExtraTest, CompareDifferentTypes) { UniquePtr rsa = ParsePrivateKey(EVP_PKEY_RSA, kExampleRSAKeyDER); UniquePtr dsa = ParsePrivateKey(EVP_PKEY_DSA, kExampleDSAKeyDER); UniquePtr ec = ParsePrivateKey(EVP_PKEY_EC, kExampleECKeyDER); EXPECT_EQ(EVP_PKEY_eq(rsa.get(), dsa.get()), 0); EXPECT_EQ(EVP_PKEY_eq(rsa.get(), ec.get()), 0); EXPECT_EQ(EVP_PKEY_eq(dsa.get(), ec.get()), 0); EXPECT_EQ(EVP_PKEY_parameters_eq(rsa.get(), dsa.get()), 0); EXPECT_EQ(EVP_PKEY_parameters_eq(rsa.get(), ec.get()), 0); EXPECT_EQ(EVP_PKEY_parameters_eq(dsa.get(), ec.get()), 0); } TEST(EVPExtraTest, RawKeyUnsupported) { static const uint8_t kKey[] = {1, 2, 3, 4}; EXPECT_FALSE( EVP_PKEY_new_raw_public_key(EVP_PKEY_RSA, nullptr, kKey, sizeof(kKey))); EXPECT_FALSE( EVP_PKEY_new_raw_private_key(EVP_PKEY_RSA, nullptr, kKey, sizeof(kKey))); EXPECT_FALSE( EVP_PKEY_from_raw_public_key(EVP_pkey_rsa(), kKey, sizeof(kKey))); EXPECT_FALSE( EVP_PKEY_from_raw_private_key(EVP_pkey_rsa(), kKey, sizeof(kKey))); } // The default salt length for PSS should be |RSA_PSS_SALTLEN_DIGEST|. TEST(EVPExtraTest, PSSDefaultSaltLen) { UniquePtr key = LoadExampleRSAKey(); ASSERT_TRUE(key); ScopedEVP_MD_CTX ctx; EVP_PKEY_CTX *pctx; ASSERT_TRUE( EVP_DigestSignInit(ctx.get(), &pctx, EVP_sha256(), nullptr, key.get())); ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING)); int salt_len; ASSERT_TRUE(EVP_PKEY_CTX_get_rsa_pss_saltlen(pctx, &salt_len)); EXPECT_EQ(salt_len, RSA_PSS_SALTLEN_DIGEST); } // Test that setting a key to type none will clear it. Some calling code has // unit tests that rely on this, usually as part of a roundabout way to get a // key of the "wrong" type to test with. (In reality, |EVP_PKEY_new| will // produce the same object.) TEST(EVPExtraTest, SetNoneClearsKey) { UniquePtr pkey = LoadExampleRSAKey(); ASSERT_TRUE(pkey); // EVP_PKEY_NONE is not a known type, so this should fail. EXPECT_FALSE(EVP_PKEY_set_type(pkey.get(), EVP_PKEY_NONE)); // However, it still resets the key to the initial state. EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE); // Calling operations on the |EVP_PKEY| should cleanly fail. EXPECT_EQ(EVP_PKEY_bits(pkey.get()), 0); } // Test that |EC_KEY|s using custom curves can be wrapped in |EVP_PKEY|. Callers // should not follow this code. This is maintained and tested only for // compatibility with one legacy application, and supported in only a limited // form. (E.g. such keys cannot be serialized.) TEST(EVPExtraTest, CustomCurve) { // Coefficients for brainpoolp256r1, not supported by BoringSSL. static const char kP[] = "a9fb57dba1eea9bc3e660a909d838d726e3bf623d52620282013481d1f6e5377"; static const char kA[] = "7d5a0975fc2c3057eef67530417affe7fb8055c126dc5c6ce94a4b44f330b5d9"; static const char kB[] = "26dc5c6ce94a4b44f330b5d9bbd77cbf958416295cf7e1ce6bccdc18ff8c07b6"; static const char kX[] = "8bd2aeb9cb7e57cb2c4b482ffc81b7afb9de27e1e3bd23c23a4453bd9ace3262"; static const char kY[] = "547ef835c3dac4fd97f8461a14611dc9c27745132ded8e545c1d54c72f046997"; static const char kN[] = "a9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a7"; static const char kD[] = "0da21d76fed40dd82ac3314cce91abb585b5c4246e902b238a839609ea1e7ce1"; static const char kQX[] = "3a55e0341cab50452fe27b8a87e4775dec7a9daca94b0d84ad1e9f85b53ea513"; static const char kQY[] = "40088146b33bbbe81b092b41146774b35dd478cf056437cfb35ef0df2d269339"; // Construct a custom group. UniquePtr p = HexToBIGNUM(kP), a = HexToBIGNUM(kA), b = HexToBIGNUM(kB), x = HexToBIGNUM(kX), y = HexToBIGNUM(kY), n = HexToBIGNUM(kN), d = HexToBIGNUM(kD), qx = HexToBIGNUM(kQX), qy = HexToBIGNUM(kQY); ASSERT_TRUE(p && a && b && x && y && n && d && qx && qy); UniquePtr group( EC_GROUP_new_curve_GFp(p.get(), a.get(), b.get(), nullptr)); ASSERT_TRUE(group); UniquePtr g(EC_POINT_new(group.get())); ASSERT_TRUE(g); ASSERT_TRUE(EC_POINT_set_affine_coordinates_GFp(group.get(), g.get(), x.get(), y.get(), nullptr)); ASSERT_TRUE( EC_GROUP_set_generator(group.get(), g.get(), n.get(), BN_value_one())); // Generate a key with it. UniquePtr ec_key(EC_KEY_new()); ASSERT_TRUE(ec_key); ASSERT_TRUE(EC_KEY_set_group(ec_key.get(), group.get())); ASSERT_TRUE(EC_KEY_generate_key(ec_key.get())); // Wrap it in an |EVP_PKEY|. UniquePtr pkey(EVP_PKEY_new()); ASSERT_TRUE(pkey); ASSERT_TRUE(EVP_PKEY_set1_EC_KEY(pkey.get(), ec_key.get())); // Signing should work. Span msg = StringAsBytes("hello"); ScopedEVP_MD_CTX ctx; ASSERT_TRUE(EVP_DigestSignInit(ctx.get(), nullptr, EVP_sha256(), nullptr, pkey.get())); std::vector sig(EVP_PKEY_size(pkey.get())); size_t len = sig.size(); ASSERT_TRUE( EVP_DigestSign(ctx.get(), sig.data(), &len, msg.data(), msg.size())); sig.resize(len); // Verifying should work. ctx.Reset(); ASSERT_TRUE(EVP_DigestVerifyInit(ctx.get(), nullptr, EVP_sha256(), nullptr, pkey.get())); ASSERT_TRUE(EVP_DigestVerify(ctx.get(), sig.data(), sig.size(), msg.data(), msg.size())); // We will not serialize arbitrary groups, so serialization should fail. ScopedCBB cbb; ASSERT_TRUE(CBB_init(cbb.get(), 0)); EXPECT_FALSE(EVP_marshal_public_key(cbb.get(), pkey.get())); cbb.Reset(); ASSERT_TRUE(CBB_init(cbb.get(), 0)); EXPECT_FALSE(EVP_marshal_private_key(cbb.get(), pkey.get())); } // APIs should avoid creating an |EVP_PKEY| that is missing its underlying data. // In some cases, we are stuck with this due to OpenSSL compatibility, but it is // preferable to reduce the number of kinds of half-empty states. TEST(EVPExtraTest, NoHalfEmptyKeys) { UniquePtr pkey(EVP_PKEY_new()); ASSERT_TRUE(pkey); EXPECT_FALSE(EVP_PKEY_set_type(pkey.get(), EVP_PKEY_RSA)); EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE); EXPECT_FALSE(EVP_PKEY_set1_RSA(pkey.get(), nullptr)); EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE); EXPECT_FALSE(EVP_PKEY_set_type(pkey.get(), EVP_PKEY_EC)); EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE); EXPECT_FALSE(EVP_PKEY_set1_EC_KEY(pkey.get(), nullptr)); EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE); EXPECT_FALSE(EVP_PKEY_set_type(pkey.get(), EVP_PKEY_DH)); EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE); EXPECT_FALSE(EVP_PKEY_set1_DH(pkey.get(), nullptr)); EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE); EXPECT_FALSE(EVP_PKEY_set_type(pkey.get(), EVP_PKEY_DSA)); EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE); EXPECT_FALSE(EVP_PKEY_set1_DSA(pkey.get(), nullptr)); EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE); } // An empty key shouldn't crash on operations. TEST(EVPExtraTest, EmptyKey) { UniquePtr empty(EVP_PKEY_new()); ASSERT_TRUE(empty); EXPECT_FALSE(EVP_PKEY_is_opaque(empty.get())); EXPECT_FALSE(EVP_PKEY_eq(empty.get(), empty.get())); EXPECT_TRUE(EVP_PKEY_parameters_eq(empty.get(), empty.get())); EXPECT_FALSE(EVP_PKEY_missing_parameters(empty.get())); EXPECT_EQ(EVP_PKEY_size(empty.get()), 0); EXPECT_EQ(EVP_PKEY_bits(empty.get()), 0); EXPECT_EQ(EVP_PKEY_id(empty.get()), EVP_PKEY_NONE); EXPECT_EQ(EVP_PKEY_get_raw_private_key(empty.get(), nullptr, nullptr), 0); EXPECT_TRUE(ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE)); EXPECT_EQ(EVP_PKEY_get_private_seed(empty.get(), nullptr, nullptr), 0); EXPECT_TRUE(ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE)); EXPECT_EQ(EVP_PKEY_get_raw_public_key(empty.get(), nullptr, nullptr), 0); EXPECT_TRUE(ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE)); EXPECT_EQ(EVP_PKEY_get1_tls_encodedpoint(empty.get(), nullptr), 0u); EXPECT_TRUE(ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE)); EXPECT_EQ(EVP_PKEY_set1_tls_encodedpoint(empty.get(), nullptr, 0u), 0); EXPECT_TRUE(ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE)); } // Due to an OpenSSL API flaw, it is possible to make a half-empty X25519 key. // Using a key in this state is a caller error, but we gracefully handle this // case. TEST(EVPExtraTest, HalfEmptyX25519) { UniquePtr half_empty(EVP_PKEY_new()); ASSERT_TRUE(half_empty); ASSERT_TRUE(EVP_PKEY_set_type(half_empty.get(), EVP_PKEY_X25519)); // A half-empty key has nothing. EXPECT_FALSE(EVP_PKEY_has_public(half_empty.get())); EXPECT_FALSE(EVP_PKEY_has_private(half_empty.get())); // We cannot copy parameters from a half-empty key. EXPECT_TRUE(EVP_PKEY_missing_parameters(half_empty.get())); UniquePtr pkey(EVP_PKEY_new()); ASSERT_TRUE(pkey); EXPECT_FALSE(EVP_PKEY_copy_parameters(pkey.get(), half_empty.get())); // A half-empty key cannot be serialized. ScopedCBB cbb; ASSERT_TRUE(CBB_init(cbb.get(), 0)); EXPECT_FALSE(EVP_marshal_public_key(cbb.get(), half_empty.get())); EXPECT_FALSE(EVP_marshal_private_key(cbb.get(), half_empty.get())); // A half-empty key cannot be used. UniquePtr ctx(EVP_PKEY_CTX_new(half_empty.get(), nullptr)); EXPECT_FALSE(ctx); // Make a real key. UniquePtr real_key(EVP_PKEY_generate_from_alg(EVP_pkey_x25519())); ASSERT_TRUE(real_key); // A half-empty key cannot be compared. EXPECT_FALSE(EVP_PKEY_eq(half_empty.get(), half_empty.get())); EXPECT_FALSE(EVP_PKEY_eq(half_empty.get(), real_key.get())); EXPECT_FALSE(EVP_PKEY_eq(real_key.get(), half_empty.get())); // A half-empty cannot be the peer in a Diffie-Hellman operation. ctx.reset(EVP_PKEY_CTX_new(real_key.get(), nullptr)); ASSERT_TRUE(ctx); ASSERT_TRUE(EVP_PKEY_derive_init(ctx.get())); EXPECT_FALSE(EVP_PKEY_derive_set_peer(ctx.get(), half_empty.get())); } // Test that parsers correctly handle trailing data. TEST(EVPExtraTest, TrailingData) { UniquePtr pkey = LoadExampleRSAKey(); ASSERT_TRUE(pkey); ScopedCBB cbb; ASSERT_TRUE(CBB_init(cbb.get(), 64)); ASSERT_TRUE(EVP_marshal_public_key(cbb.get(), pkey.get())); std::vector spki(CBB_data(cbb.get()), CBB_data(cbb.get()) + CBB_len(cbb.get())); spki.push_back('a'); // |EVP_parse_public_key| should accept trailing data and return the // remainder. CBS cbs(spki); pkey.reset(EVP_parse_public_key(&cbs)); EXPECT_TRUE(pkey); EXPECT_EQ(Bytes(cbs), Bytes("a")); // |EVP_PKEY_from_subject_public_key_info| should not. const EVP_PKEY_ALG *alg = EVP_pkey_rsa(); pkey.reset(EVP_PKEY_from_subject_public_key_info(spki.data(), spki.size(), &alg, 1u)); EXPECT_FALSE(pkey); EXPECT_TRUE( ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP, EVP_R_DECODE_ERROR)); } // Tests that EVP_PKEY_(en|de)capsulate_init correctly handles the stub // OSSL_PARAM struct. TEST(EVPExtraTest, EncapsulateDecapsulateOsslParam) { OSSL_PARAM kOneEndParam[] = {OSSL_PARAM_END}; OSSL_PARAM kTwoEndParams[] = {OSSL_PARAM_END, OSSL_PARAM_END}; OSSL_PARAM kNotEndParam[] = {{"foo", 0, nullptr, 0, 0}}; UniquePtr pkey(EVP_PKEY_generate_from_alg(EVP_pkey_ml_kem_768())); UniquePtr ctx; for (const auto init_func : {&EVP_PKEY_encapsulate_init, &EVP_PKEY_decapsulate_init}) { ctx.reset(EVP_PKEY_CTX_new(pkey.get(), nullptr)); EXPECT_TRUE(init_func(ctx.get(), nullptr)); EXPECT_TRUE(init_func(ctx.get(), kOneEndParam)); EXPECT_TRUE(init_func(ctx.get(), kTwoEndParams)); EXPECT_FALSE(init_func(ctx.get(), kNotEndParam)); EXPECT_TRUE(ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP, EVP_R_INVALID_PARAMETERS)); } } // Test that APIs using the non-alg-based APIs also work when expected. TEST(EVPExtraTest, NewRawKey) { struct { int type; const EVP_PKEY_ALG *alg; bool supports_raw_private_key; } kTests[] = { {EVP_PKEY_X25519, EVP_pkey_x25519(), true}, {EVP_PKEY_ED25519, EVP_pkey_ed25519(), true}, // ML-KEM and ML-DSA do not support raw private keys, only raw public // keys. OpenSSL interprets "raw private key" as the less efficient // semi-expanded representation, instead of seeds. {EVP_PKEY_ML_DSA_44, EVP_pkey_ml_dsa_44(), false}, {EVP_PKEY_ML_DSA_65, EVP_pkey_ml_dsa_65(), false}, {EVP_PKEY_ML_DSA_87, EVP_pkey_ml_dsa_87(), false}, {EVP_PKEY_ML_KEM_768, EVP_pkey_ml_kem_768(), false}, {EVP_PKEY_ML_KEM_1024, EVP_pkey_ml_kem_1024(), false}, }; for (const auto &t : kTests) { SCOPED_TRACE(t.type); UniquePtr pkey(EVP_PKEY_generate_from_alg(t.alg)); ASSERT_TRUE(pkey); { size_t len; ASSERT_TRUE(EVP_PKEY_get_raw_public_key(pkey.get(), nullptr, &len)); std::vector raw(len); ASSERT_TRUE(EVP_PKEY_get_raw_public_key(pkey.get(), raw.data(), &len)); raw.resize(len); UniquePtr pkey2( EVP_PKEY_new_raw_public_key(t.type, nullptr, raw.data(), raw.size())); ASSERT_TRUE(pkey2); EXPECT_EQ(EVP_PKEY_eq(pkey.get(), pkey2.get()), 1); } if (t.supports_raw_private_key) { size_t len; ASSERT_TRUE(EVP_PKEY_get_raw_private_key(pkey.get(), nullptr, &len)); std::vector raw(len); ASSERT_TRUE(EVP_PKEY_get_raw_private_key(pkey.get(), raw.data(), &len)); raw.resize(len); UniquePtr pkey2(EVP_PKEY_new_raw_private_key( t.type, nullptr, raw.data(), raw.size())); ASSERT_TRUE(pkey2); EXPECT_EQ(EVP_PKEY_eq(pkey.get(), pkey2.get()), 1); } } } } // namespace BSSL_NAMESPACE_END