76 lines
4.1 KiB
Plaintext
76 lines
4.1 KiB
Plaintext
#include "testlib.h"
|
|
|
|
RENDER(Request& context)
|
|
{
|
|
u64 passed = 0;
|
|
u64 failed = 0;
|
|
u64 skipped = 0;
|
|
auto check = [&](String name, bool ok, String detail)
|
|
{
|
|
site_tests_case(name, ok ? "pass" : "fail", detail);
|
|
if(ok) passed++; else failed++;
|
|
};
|
|
site_tests_page_start("Structured crypto operations", "Algorithm-selected P-256 JWK creation and ES256 JWT signing.");
|
|
DValue key_request;
|
|
key_request["operation"] = "key_generate";
|
|
key_request["algorithm"] = "ES256";
|
|
DValue key = crypto_operation(key_request);
|
|
DValue header;
|
|
header["alg"] = "none";
|
|
header["kid"] = key["kid"];
|
|
DValue claims;
|
|
claims["iss"] = "https://client.example";
|
|
claims["sub"] = "client.example";
|
|
DValue sign_request;
|
|
sign_request["operation"] = "jwt_sign";
|
|
sign_request["algorithm"] = "ES256";
|
|
sign_request["private_jwk"] = key["private_jwk"];
|
|
sign_request["protected_header"] = header;
|
|
sign_request["claims"] = claims;
|
|
DValue signed_result = crypto_operation(sign_request);
|
|
String jwt = signed_result["jwt"].to_string();
|
|
StringList parts = split(jwt, ".");
|
|
String header_b64 = parts.size() == 3 ? parts[0] : "";
|
|
while(header_b64.size() % 4) header_b64 += "=";
|
|
String decoded_header = base64_decode(header_b64);
|
|
DValue wrong_curve = key["private_jwk"];
|
|
wrong_curve["crv"] = "P-384";
|
|
DValue malformed = key["private_jwk"];
|
|
malformed["x"] = "not_base64url=";
|
|
DValue wrong_request = sign_request;
|
|
wrong_request["private_jwk"] = wrong_curve;
|
|
DValue malformed_request = sign_request;
|
|
malformed_request["private_jwk"] = malformed;
|
|
DValue cose_request;
|
|
cose_request["operation"] = "cose_es256_parse";
|
|
cose_request["algorithm"] = "ES256";
|
|
cose_request["cose_key_base64url"] = "pQECAyYgASFYIGsX0fLhLEJH-Lzm5WOkQPJ3A32BLeszoPShOUXYmMKWIlggT-NC4v4af5uO5-tKfA-eFivOM1drMV7Oy7ZAaDe_UfU";
|
|
DValue cose = crypto_operation(cose_request);
|
|
DValue verify_request;
|
|
verify_request["operation"] = "es256_verify";
|
|
verify_request["algorithm"] = "ES256";
|
|
verify_request["cose_key_base64url"] = cose_request["cose_key_base64url"];
|
|
verify_request["message_base64url"] = "d2ViYXV0aG4gZml4ZWQgbWVzc2FnZQ";
|
|
verify_request["signature_der_base64url"] = "MEUCIQCkatZK1VVsjk17uvyzyhjdAkMNWXPjxSOMqWcjmM_8XAIgDaSk3Qufyd0_6r9Dm9A8RQbFco-FdTBulq7bvRGoBC4";
|
|
DValue unsupported;
|
|
unsupported["operation"] = "encrypt";
|
|
unsupported["algorithm"] = "ES256";
|
|
DValue list_header;
|
|
list_header.set_array();
|
|
DValue list_item;
|
|
list_item = "not-an-object";
|
|
list_header.push(list_item);
|
|
DValue list_request = sign_request;
|
|
list_request["protected_header"] = list_header;
|
|
DValue control_request = sign_request;
|
|
control_request["claims"]["bad"] = String("control\nbyte");
|
|
check("crypto_operation() generates an ES256 key", key["ok"].to_bool() && key["private_jwk"]["kty"].to_string() == "EC" && key["private_jwk"]["crv"].to_string() == "P-256" && key["public_jwk"]["d"].to_string() == "" && key["kid"].to_string() == key["thumbprint"].to_string(), key["kid"].to_string());
|
|
check("crypto_operation() signs ES256 JWTs", signed_result["ok"].to_bool() && parts.size() == 3 && parts[2].size() == 86 && decoded_header.find("ES256") != String::npos, signed_result["error"].to_string());
|
|
check("crypto_operation() rejects invalid signing requests", !crypto_operation(wrong_request)["ok"].to_bool() && !crypto_operation(malformed_request)["ok"].to_bool() && !crypto_operation(list_request)["ok"].to_bool() && crypto_operation(control_request)["error"].to_string() == "invalid_request", "signing validation");
|
|
check("crypto_operation() parses an ES256 COSE key", cose["ok"].to_bool(), cose["error"].to_string());
|
|
check("crypto_operation() verifies ES256 DER signatures", crypto_operation(verify_request)["ok"].to_bool() && crypto_operation(verify_request)["valid"].to_bool(), crypto_operation(verify_request)["error"].to_string());
|
|
check("crypto_operation() rejects unsupported operations", crypto_operation(unsupported)["error"].to_string() == "unsupported_operation", crypto_operation(unsupported)["error"].to_string());
|
|
site_tests_summary(passed, failed, skipped, "Structured crypto tests generate ephemeral P-256 keys and retain no key material.");
|
|
site_tests_page_end();
|
|
}
|