?? tokentest.c
字號:
/*____________________________________________________________________________
TokenTest.c
Copyright (C) 2003,2004 PGP Corporation
All rights reserved.
FIPS 140-2 Operational Test: Token/Smartcard test
$Id: TokenTest.c 48493 2006-10-12 21:19:56Z vinnie $
____________________________________________________________________________*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "pgpErrors.h"
#include "pgpKeys.h"
#include "pgpMemoryMgr.h"
#include "pgpUtilities.h"
#include "pgpPublicKey.h"
#include "optest.h"
/* Plain-text test message */
static PGPByte testData[] = {
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff,
0x55, 0xaa, 0x55, 0xaa, 0x55, 0xaa, 0x55, 0xaa,
0xaa, 0x55, 0xaa, 0x55, 0xaa, 0x55, 0xaa, 0x55
};
static PGPError printTokenInfo(PGPContextRef context, PGPUInt32 tokNum)
{
PGPError err = kPGPError_NoErr;
PGPPublicKeyAlgorithm keyGenAlgorithm = kPGPPublicKeyAlgorithm_Invalid;
PGPUInt32 numPrivKeys;
PGPUInt32 numPubKeys;
PGPUInt32 minPinLen;
PGPUInt32 maxPinLen;
PGPUInt32 minKeySize;
PGPUInt32 maxKeySize;
PGPByte manufacturerID[33];
PGPByte model[17];
PGPByte serialNumber[80];
PGPByte label[80];
PGPSize sizeout;
err = PGPGetTokenInfoNumericProperty(context, tokNum, kPGPTokenProperty_KeyGenAlgorithm ,(PGPUInt32*) &keyGenAlgorithm); CKERR;
err = PGPGetTokenInfoNumericProperty(context, tokNum, kPGPTokenProperty_PrivateKeys ,&numPrivKeys); CKERR;
err = PGPGetTokenInfoNumericProperty(context, tokNum, kPGPTokenProperty_PublicKeys ,&numPubKeys); CKERR;
err = PGPGetTokenInfoNumericProperty(context, tokNum, kPGPTokenProperty_MinPINSize ,&minPinLen); CKERR;
err = PGPGetTokenInfoNumericProperty(context, tokNum, kPGPTokenProperty_MaxPINSize ,&maxPinLen); CKERR;
err = PGPGetTokenInfoNumericProperty(context, tokNum, kPGPTokenProperty_MinKeySize ,&minKeySize); CKERR;
err = PGPGetTokenInfoNumericProperty(context, tokNum, kPGPTokenProperty_MaxKeySize ,&maxKeySize); CKERR;
err = PGPGetTokenInfoDataProperty(context, tokNum,
kPGPTokenProperty_ManufacturerID, &manufacturerID, sizeof( manufacturerID),&sizeout); CKERR;
err = PGPGetTokenInfoDataProperty(context, tokNum,
kPGPTokenProperty_Model, &model, sizeof( model),&sizeout); CKERR;
err = PGPGetTokenInfoDataProperty(context, tokNum,
kPGPTokenProperty_SerialNumber, &serialNumber, sizeof( serialNumber),&sizeout); CKERR;
err = PGPGetTokenInfoDataProperty(context, tokNum,
kPGPTokenProperty_TokenLabel, &label, sizeof( label), &sizeout); CKERR;
OPTESTPrintF("\t [%d]\tMfg : %s\n",tokNum, manufacturerID);
OPTESTPrintF("\t \tModel : %s\n", model);
OPTESTPrintF("\t \tSerialNo : %s\n", serialNumber);
OPTESTPrintF("\t \tLabel : %s\n", label);
OPTESTPrintF("\t \tPinLen : %d < %d\n",minPinLen, maxPinLen );
OPTESTPrintF("\t \tKeySize : %d < %d\n",minKeySize, maxKeySize );
OPTESTPrintF("\t \tPrivKeys : %d\n",numPrivKeys );
OPTESTPrintF("\t \tPubKeys : %d\n",numPubKeys);
OPTESTPrintF("\t \tGenKeyAlg: %s\n",key_algor_table(keyGenAlgorithm));
done:
return err;
}
static PGPError listAvailableTokens( PGPContextRef context, PGPUInt32* keys, PGPUInt32* tokens, TokenTestFlags testFlags)
{
PGPError err = kPGPError_NoErr;
PGPKeyDBRef keyDB = kInvalidPGPKeyDBRef;
PGPKeyIterRef iter = kInvalidPGPKeyIterRef;
PGPKeyDBObjRef theKey = kInvalidPGPKeyDBObjRef;
PGPBoolean hadChanges;
PGPUInt32 numKeys = 0;
PGPUInt32 numTokens = 0;
PGPUInt32 i;
/* create a temp key database to read the token keys into */
err = PGPNewKeyDB( context, &keyDB ); CKERR;
/* make an iterator */
err = PGPNewKeyIterFromKeyDB( keyDB, &iter); CKERR;
/* sync the keys into the database */
err = PGPSyncTokenKeys( context, -1, keyDB, &hadChanges);
/* get a count of what we have */
err = PGPCountTokens(context, &numTokens ); CKERR;
err = PGPCountKeysInKeyDB(keyDB, &numKeys); CKERR;
OPTESTPrintF("\t%d token%s found\n", numTokens, numTokens==1?"":"s");
for(i = 0; i < numTokens; i++)
{
err = printTokenInfo(context, i); CKERR;
}
/* check passphrase */
if(gTokenUserPIN)
{
OPTESTPrintF("\n");
for(i = 0; i < numTokens; i++)
{
OPTESTPrintF("\tChecking Token %d Passphrase: \"%s\"\n",i,gTokenUserPIN);
err = PGPTokenPassphraseIsValid(context, i, (PGPByte*)gTokenUserPIN, strlen(gTokenUserPIN)); CKERR;
}
}
if(numKeys)
{
OPTESTPrintF("\n\t%d key%s from tokens\n",numKeys, numKeys==1?"":"s");
err = PGPKeyIterRewind(iter, kPGPKeyDBObjType_Key); CKERR;
/* Iterate through each key */
for(i = 1; IsntPGPError( PGPKeyIterNextKeyDBObj( iter, kPGPKeyDBObjType_Key, &theKey) ); i++)
{
char header[32];
sprintf(header, " [%d] ", i);
if(gVerbose_flag)
{
printKeyDetails(header,FALSE,theKey);
OPTESTPrintF("\n");
}
else
printKeyInfo(header,theKey);
if( (testFlags & kTokenTestFlags_KeyTest)
&& gTokenUserPIN != NULL
&& (canKeyDecrypt(theKey) || canKeySignMessages(theKey)))
{
OPTESTPrintF("\t ");
err = TestKeyCertificate(context, theKey, (PGPByte*) gTokenUserPIN,
testData, sizeof(testData),
testData, sizeof(testData),
NULL, 0 ); CKERR;
OPTESTPrintF("\n");
}
}
}
if(keys) *keys = numKeys;
if(tokens) *tokens = numTokens;
done:
if( PGPKeyIterRefIsValid( iter ) )
PGPFreeKeyIter( iter );
if( PGPKeyDBRefIsValid( keyDB ) )
PGPFreeKeyDB( keyDB );
return err;
}
static PGPError formatToken(PGPContextRef context, PGPUInt32 tokNum, char *SO, char *PIN )
{
PGPError err = kPGPError_NoErr;
if(!SO || (strlen(SO) == 0) || !PIN || (strlen(PIN) == 0))
FAIL("Can not format a token without SO and User PIN\n");
OPTESTPrintF("\n\tFormating Token %d\n\t PIN0 = \"%s\"\n\t PIN1 = \"%s\"\n", tokNum, SO ,PIN );
err = PGPFormatToken( context, tokNum, (PGPByte*)SO, strlen(SO), (PGPByte*)PIN, strlen(PIN)); CKERR
OPTESTPrintF("\n");
done:
return err;
}
static PGPError wipeToken(PGPContextRef context, PGPUInt32 tokNum, char *PIN )
{
PGPError err = kPGPError_NoErr;
if( !PIN || (strlen(PIN) == 0))
FAIL("Can not Wipe a token without User PIN\n");
OPTESTPrintF("\n\tWiping Token %d PIN = \"%s\"\n", tokNum ,PIN );
err = PGPWipeToken( context, tokNum, (PGPByte*)PIN, strlen(PIN) ); CKERR
OPTESTPrintF("\n");
done:
return err;
}
static PGPError genKeyOnToken(PGPContextRef context, PGPUInt32 tokNum, char *PIN )
{
PGPError err = kPGPError_NoErr;
PGPKeyDBRef keyDB = kInvalidPGPKeyDBRef;
PGPKeyDBObjRef key = kInvalidPGPKeyDBObjRef;
PGPKeyDBObjRef subkey = kInvalidPGPKeyDBObjRef;
char *keyName = "Token Generated test key";
if( !PIN || (strlen(PIN) == 0))
FAIL("Can not Generate key on a token without User PIN\n");
err = PGPNewKeyDB( context, &keyDB ); CKERR;
OPTESTPrintF("\tPGPGenerateKey() on token %d\n", tokNum);
err = PGPGenerateKey( context, &key,
PGPOKeyGenParams( context,kPGPPublicKeyAlgorithm_RSA, 1024),
PGPOKeyGenName( context, (PGPByte*)keyName, strlen(keyName)),
PGPOTokenNumber(context, tokNum),
PGPOExpiration(context, 30),
PGPOKeyDBRef( context, keyDB ),
PGPOPassphrase( context, PIN ),
PGPOKeyGenFast( context, TRUE ),
PGPOKeyFlags( context, kPGPKeyPropertyFlags_UsageSign | kPGPKeyPropertyFlags_UsageEncrypt ),
PGPOLastOption( context ) ); CKERR;
OPTESTPrintF("\tPGPGenerateSubKey()\n");
err = PGPGenerateSubKey( context, &subkey,
PGPOKeyGenMasterKey( context, key ),
PGPOKeyGenParams( context,kPGPPublicKeyAlgorithm_RSA, 1024),
PGPOTokenNumber(context, tokNum),
PGPOExpiration(context, 30),
PGPOPassphrase( context, PIN ),
PGPOKeyGenFast( context, TRUE ),
PGPOKeyFlags( context, kPGPKeyPropertyFlags_UsageEncrypt ),
PGPOLastOption( context ) ); CKERR;
OPTESTPrintF("\n");
done:
if( PGPKeyDBRefIsValid( keyDB ) )
PGPFreeKeyDB( keyDB );
return err;
}
static PGPError exportKeytoToken(PGPContextRef context, PGPUInt32 tokNum, char *PIN )
{
PGPError err = kPGPError_NoErr;
PGPKeyDBRef keyDB = kInvalidPGPKeyDBRef;
PGPKeyDBObjRef key = kInvalidPGPKeyDBObjRef;
PGPKeyID theKeyID;
if( !PIN || (strlen(PIN) == 0))
FAIL("Can not Export key on to token without User PIN\n");
/* Read in the test keys and get a ref to it */
err = importKeys(context,gTestKeysPath, kPGPInputFormat_PGP, &keyDB); CKERR;
/* Find a key to sign the cert req with */
err = PGPNewKeyIDFromString( kOptestCAKeyIDString, kPGPPublicKeyAlgorithm_Invalid, &theKeyID); CKERR;
err = PGPFindKeyByKeyID( keyDB, &theKeyID, &key); CKERR;
OPTESTPrintF("\tExport test key %s to Token %d ", kOptestCAKeyIDString, tokNum);
err = PGPExport( context,
PGPOExportKeyDBObj(context, key),
PGPOOutputToken(context, tokNum),
PGPOPassphrase( context, kOptestCAKeyPassPhrase ),
PGPOPassphrase( context, PIN ),
PGPOLastOption( context ) ); CKERR;
OPTESTPrintF("\n");
done:
if( PGPKeyDBRefIsValid( keyDB ) )
PGPFreeKeyDB( keyDB );
return err;
}
/*
Run Token/SmartCard test
*/
// Athena "/usr/libexec/SmartCardServices/pkcs11/libASEPKCS11.dylib"
PGPError TestTokens(PGPContextRef context, TokenTestFlags testFlags)
{
PGPError err = kPGPError_NoErr;
PGPKeyDBRef keyDB = kInvalidPGPKeyDBRef;
PGPFileSpecRef pubKeysFileSpec = kInvalidPGPFileSpecRef;
PGPFileSpecRef privKeysFileSpec = kInvalidPGPFileSpecRef;
PGPUInt32 numKeys = 0;
PGPUInt32 numTokens = 0;
#if USE_IN_MEMORY_DB
err = PGPNewKeyDB( context, &keyDB ); CKERR;
#else
/* create filerefs to the key DB */
{
char buffer[256];
sprintf(buffer, "%s/tokens.pkr", gOutputDirectory );
err = PGPNewFileSpecFromFullPath(context, buffer, &pubKeysFileSpec); CKERR;
sprintf(buffer, "%s/tokens.skr", gOutputDirectory );
err = PGPNewFileSpecFromFullPath(context, buffer, &privKeysFileSpec); CKERR;
err = PGPOpenKeyDBFile( context,
kPGPOpenKeyDBFileOptions_Create | kPGPOpenKeyDBFileOptions_Mutable,
pubKeysFileSpec,
privKeysFileSpec,
&keyDB ); CKERR;
}
#endif
OPTESTPrintF("\tpkcs11 module: %s\n", gP11Module?gP11Module:"<DEFAULT>");
err = PGPSetPKCS11DrvFile(gP11Module); CKERR;
err = listAvailableTokens(context, &numKeys, &numTokens, testFlags); CKERR;
/* Format Token */
if((numTokens > 0) && (testFlags & kTokenTestFlags_Format))
{
err = formatToken(context, gTokNumber, gTokenSOPIN, gTokenUserPIN); CKERR;
}
/* Wipe Token Keys */
if((numTokens > 0) && (testFlags & kTokenTestFlags_Wipe))
{
err = wipeToken(context, gTokNumber, gTokenUserPIN); CKERR;
}
/* Generate Key on Token */
if((numTokens > 0) && (testFlags & kTokenTestFlags_Generate))
{
err = genKeyOnToken(context, gTokNumber, gTokenUserPIN); CKERR;
}
/* Export Key to Token */
if((numTokens > 0) && (testFlags & kTokenTestFlags_Export))
{
err = exportKeytoToken(context, gTokNumber, gTokenUserPIN); CKERR;
}
if(testFlags & (kTokenTestFlags_Generate | kTokenTestFlags_Export))
{
OPTESTPrintF("\tRescan Token\n");
err = listAvailableTokens(context, &numKeys, &numTokens, kTokenTestFlags_KeyTest); CKERR;
}
done:
if( PGPFileSpecRefIsValid(pubKeysFileSpec))
PGPFreeFileSpec(pubKeysFileSpec);
if( PGPFileSpecRefIsValid(privKeysFileSpec))
PGPFreeFileSpec(privKeysFileSpec);
if( PGPKeyDBRefIsValid( keyDB ) )
PGPFreeKeyDB( keyDB );
return err;
}
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -