1#! /usr/bin/env perl
2# Copyright 2017-2025 The OpenSSL Project Authors. All Rights Reserved.
3#
4# Licensed under the Apache License 2.0 (the "License").  You may not use
5# this file except in compliance with the License.  You can obtain a copy
6# in the file LICENSE in the source distribution or at
7# https://www.openssl.org/source/license.html
8
9
10use strict;
11use warnings;
12
13use File::Spec;
14use File::Basename;
15use OpenSSL::Test qw/:DEFAULT with srctop_file bldtop_dir/;
16use OpenSSL::Test::Utils;
17
18setup("test_dgst");
19
20plan tests => 17;
21
22sub tsignverify {
23    my $testtext = shift;
24    my $privkey = shift;
25    my $pubkey = shift;
26
27    my $data_to_sign = srctop_file('test', 'data.bin');
28    my $other_data = srctop_file('test', 'data2.bin');
29
30    my $sigfile = basename($privkey, '.pem') . '.sig';
31    plan tests => 4;
32
33    ok(run(app(['openssl', 'dgst', '-sign', $privkey,
34                '-out', $sigfile,
35                $data_to_sign])),
36       $testtext.": Generating signature");
37
38    ok(run(app(['openssl', 'dgst', '-prverify', $privkey,
39                '-signature', $sigfile,
40                $data_to_sign])),
41       $testtext.": Verify signature with private key");
42
43    ok(run(app(['openssl', 'dgst', '-verify', $pubkey,
44                '-signature', $sigfile,
45                $data_to_sign])),
46       $testtext.": Verify signature with public key");
47
48    ok(!run(app(['openssl', 'dgst', '-verify', $pubkey,
49                 '-signature', $sigfile,
50                 $other_data])),
51       $testtext.": Expect failure verifying mismatching data");
52}
53
54sub tsignverify_sha512 {
55    my $testtext = shift;
56    my $privkey = shift;
57    my $pubkey = shift;
58
59    my $data_to_sign = srctop_file('test', 'data.bin');
60    my $other_data = srctop_file('test', 'data2.bin');
61
62    my $sigfile = basename($privkey, '.pem') . '.sig';
63    plan tests => 5;
64
65    ok(run(app(['openssl', 'sha512', '-sign', $privkey,
66                '-out', $sigfile,
67                $data_to_sign])),
68       $testtext.": Generating signature using sha512 command");
69
70    ok(run(app(['openssl', 'sha512', '-verify', $pubkey,
71                '-signature', $sigfile,
72                $data_to_sign])),
73       $testtext.": Verify signature with public key using sha512 command");
74
75    ok(run(app(['openssl', 'dgst', '-sha512', '-prverify', $privkey,
76                '-signature', $sigfile,
77                $data_to_sign])),
78       $testtext.": Verify signature with private key");
79
80    ok(run(app(['openssl', 'dgst', '-sha512', '-verify', $pubkey,
81                '-signature', $sigfile,
82                $data_to_sign])),
83       $testtext.": Verify signature with public key");
84
85    ok(!run(app(['openssl', 'dgst', '-sha512', '-verify', $pubkey,
86                 '-signature', $sigfile,
87                 $other_data])),
88       $testtext.": Expect failure verifying mismatching data");
89}
90
91SKIP: {
92    skip "RSA is not supported by this OpenSSL build", 1
93        if disabled("rsa");
94
95    subtest "RSA signature generation and verification with `dgst` CLI" => sub {
96        tsignverify("RSA",
97                    srctop_file("test","testrsa.pem"),
98                    srctop_file("test","testrsapub.pem"));
99    };
100
101    subtest "RSA signature generation and verification with `sha512` CLI" => sub {
102        tsignverify_sha512("RSA",
103                           srctop_file("test","testrsa2048.pem"),
104                           srctop_file("test","testrsa2048pub.pem"));
105    };
106}
107
108SKIP: {
109    skip "DSA is not supported by this OpenSSL build", 1
110        if disabled("dsa");
111
112    subtest "DSA signature generation and verification with `dgst` CLI" => sub {
113        tsignverify("DSA",
114                    srctop_file("test","testdsa.pem"),
115                    srctop_file("test","testdsapub.pem"));
116    };
117}
118
119SKIP: {
120    skip "ECDSA is not supported by this OpenSSL build", 1
121        if disabled("ec");
122
123    subtest "ECDSA signature generation and verification with `dgst` CLI" => sub {
124        tsignverify("ECDSA",
125                    srctop_file("test","testec-p256.pem"),
126                    srctop_file("test","testecpub-p256.pem"));
127    };
128}
129
130SKIP: {
131    skip "EdDSA is not supported by this OpenSSL build", 2
132        if disabled("ecx");
133
134    subtest "Ed25519 signature generation and verification with `dgst` CLI" => sub {
135        tsignverify("Ed25519",
136                    srctop_file("test","tested25519.pem"),
137                    srctop_file("test","tested25519pub.pem"));
138    };
139
140    subtest "Ed448 signature generation and verification with `dgst` CLI" => sub {
141        tsignverify("Ed448",
142                    srctop_file("test","tested448.pem"),
143                    srctop_file("test","tested448pub.pem"));
144    };
145}
146
147SKIP: {
148    skip "ML-DSA is not supported by this OpenSSL build", 3
149        if disabled("ml-dsa");
150
151    subtest "ML-DSA-44 signature generation and verification with `dgst` CLI" => sub {
152        tsignverify("Ml-DSA-44",
153                    srctop_file("test","testmldsa44.pem"),
154                    srctop_file("test","testmldsa44pub.pem"));
155    };
156    subtest "ML-DSA-65 signature generation and verification with `dgst` CLI" => sub {
157        tsignverify("Ml-DSA-65",
158                    srctop_file("test","testmldsa65.pem"),
159                    srctop_file("test","testmldsa65pub.pem"));
160    };
161    subtest "ML-DSA-87 signature generation and verification with `dgst` CLI" => sub {
162        tsignverify("Ml-DSA-87",
163                    srctop_file("test","testmldsa87.pem"),
164                    srctop_file("test","testmldsa87pub.pem"));
165    };
166}
167
168SKIP: {
169    skip "dgst with engine is not supported by this OpenSSL build", 1
170        if disabled("engine") || disabled("dynamic-engine");
171
172    subtest "SHA1 generation by engine with `dgst` CLI" => sub {
173        plan tests => 1;
174
175        my $testdata = srctop_file('test', 'data.bin');
176        # intentionally using -engine twice, please do not remove the duplicate line
177        my @macdata = run(app(['openssl', 'dgst', '-sha1',
178                               '-engine', "ossltest",
179                               '-engine', "ossltest",
180                               $testdata]), capture => 1);
181        chomp(@macdata);
182        my $expected = qr/SHA1\(\Q$testdata\E\)= 000102030405060708090a0b0c0d0e0f10111213/;
183        ok($macdata[0] =~ $expected, "SHA1: Check HASH value is as expected ($macdata[0]) vs ($expected)");
184    }
185}
186
187subtest "HMAC generation with `dgst` CLI" => sub {
188    plan tests => 2;
189
190    my $testdata = srctop_file('test', 'data.bin');
191    #HMAC the data twice to check consistency
192    my @hmacdata = run(app(['openssl', 'dgst', '-sha256', '-hmac', '123456',
193                            $testdata, $testdata]), capture => 1);
194    chomp(@hmacdata);
195    my $expected = qr/HMAC-SHA2-256\(\Q$testdata\E\)= 6f12484129c4a761747f13d8234a1ff0e074adb34e9e9bf3a155c391b97b9a7c/;
196    ok($hmacdata[0] =~ $expected, "HMAC: Check HMAC value is as expected ($hmacdata[0]) vs ($expected)");
197    ok($hmacdata[1] =~ $expected,
198       "HMAC: Check second HMAC value is consistent with the first ($hmacdata[1]) vs ($expected)");
199};
200
201subtest "HMAC generation with `dgst` CLI, default digest" => sub {
202    plan tests => 2;
203
204    my $testdata = srctop_file('test', 'data.bin');
205    #HMAC the data twice to check consistency
206    my @hmacdata = run(app(['openssl', 'dgst', '-hmac', '123456',
207                            $testdata, $testdata]), capture => 1);
208    chomp(@hmacdata);
209    my $expected = qr/HMAC-SHA256\(\Q$testdata\E\)= 6f12484129c4a761747f13d8234a1ff0e074adb34e9e9bf3a155c391b97b9a7c/;
210    ok($hmacdata[0] =~ $expected, "HMAC: Check HMAC value is as expected ($hmacdata[0]) vs ($expected)");
211    ok($hmacdata[1] =~ $expected,
212       "HMAC: Check second HMAC value is consistent with the first ($hmacdata[1]) vs ($expected)");
213};
214
215subtest "HMAC generation with `dgst` CLI, key via option" => sub {
216    plan tests => 2;
217
218    my $testdata = srctop_file('test', 'data.bin');
219    #HMAC the data twice to check consistency
220    my @hmacdata = run(app(['openssl', 'dgst', '-sha256', '-mac', 'HMAC',
221                            '-macopt', 'hexkey:FFFF',
222                            $testdata, $testdata]), capture => 1);
223    chomp(@hmacdata);
224    my $expected = qr/HMAC-SHA2-256\(\Q$testdata\E\)= 7c02d4a17d2560a5bb6763edbf33f3a34f415398f8f2e07f04b83ffd7c087dae/;
225    ok($hmacdata[0] =~ $expected, "HMAC: Check HMAC value is as expected ($hmacdata[0]) vs ($expected)");
226    ok($hmacdata[1] =~ $expected,
227       "HMAC: Check second HMAC value is consistent with the first ($hmacdata[1]) vs ($expected)");
228};
229
230subtest "Custom length XOF digest generation with `dgst` CLI" => sub {
231    plan tests => 2;
232
233    my $testdata = srctop_file('test', 'data.bin');
234    #Digest the data twice to check consistency
235    my @xofdata = run(app(['openssl', 'dgst', '-shake128', '-xoflen', '64',
236                           $testdata, $testdata]), capture => 1);
237    chomp(@xofdata);
238    my $expected = qr/SHAKE-128\(\Q$testdata\E\)= bb565dac72640109e1c926ef441d3fa64ffd0b3e2bf8cd73d5182dfba19b6a8a2eab96d2df854b647b3795ef090582abe41ba4e0717dc4df40bc4e17d88e4677/;
239    ok($xofdata[0] =~ $expected, "XOF: Check digest value is as expected ($xofdata[0]) vs ($expected)");
240    ok($xofdata[1] =~ $expected,
241       "XOF: Check second digest value is consistent with the first ($xofdata[1]) vs ($expected)");
242};
243
244subtest "SHAKE digest generation with no xoflen set `dgst` CLI" => sub {
245    plan tests => 2;
246
247    my $testdata = srctop_file('test', 'data.bin');
248    ok(!run(app(['openssl', 'dgst', '-shake128', $testdata])), "SHAKE128 must fail without xoflen");
249    ok(!run(app(['openssl', 'dgst', '-shake256', $testdata])), "SHAKE256 must fail without xoflen");
250};
251
252SKIP: {
253    skip "ECDSA is not supported by this OpenSSL build", 2
254        if disabled("ec");
255
256    subtest "signing with xoflen is not supported `dgst` CLI" => sub {
257        plan tests => 1;
258        my $data_to_sign = srctop_file('test', 'data.bin');
259
260        ok(!run(app(['openssl', 'dgst', '-shake256', '-xoflen', '64',
261                     '-sign', srctop_file("test","testec-p256.pem"),
262                     '-out', 'test.sig',
263                     srctop_file('test', 'data.bin')])),
264                     "Generating signature with xoflen should fail");
265    };
266
267    subtest "signing using the nonce-type sigopt" => sub {
268        plan tests => 1;
269        my $data_to_sign = srctop_file('test', 'data.bin');
270
271        ok(run(app(['openssl', 'dgst', '-sha256',
272                     '-sign', srctop_file("test","testec-p256.pem"),
273                     '-out', 'test.sig',
274                     '-sigopt', 'nonce-type:1',
275                     srctop_file('test', 'data.bin')])),
276                     "Sign using the nonce-type sigopt");
277    }
278}
279