[xmlsectool] 01/02: XSTJ-83 - add some tests for Elliptic Curve credentials
Ian Young
ian at iay.org.uk
Tue Oct 20 14:47:12 UTC 2020
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch main
in repository xmlsectool.
View the commit online:
http://git.shibboleth.net/view/?p=xmlsectool.git;a=commit;h=4cbe6d1333c46ac0d570cc994169f8e0664d4754
commit 4cbe6d1333c46ac0d570cc994169f8e0664d4754
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Tue Oct 20 15:45:10 2020 +0100
XSTJ-83 - add some tests for Elliptic Curve credentials
https://issues.shibboleth.net/jira/browse/XSTJ-83
---
.../net/shibboleth/tool/xmlsectool/XSTJ83Test.java | 144 +++++++++++++++++++++
.../net/shibboleth/tool/xmlsectool/XSTJ83-meta.xml | 119 +++++++++++++++++
.../tool/xmlsectool/XSTJ83-secp256r1.key | 5 +
.../shibboleth/tool/xmlsectool/XSTJ83-server.pem | 14 ++
.../net/shibboleth/tool/xmlsectool/ecsign384.crt | 15 +++
.../net/shibboleth/tool/xmlsectool/ecsign384.key | 6 +
6 files changed, 303 insertions(+)
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ83Test.java b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ83Test.java
new file mode 100644
index 0000000..49d3389
--- /dev/null
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ83Test.java
@@ -0,0 +1,144 @@
+package net.shibboleth.tool.xmlsectool;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.InputStream;
+import java.security.interfaces.ECPublicKey;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.dom.DOMSource;
+import javax.xml.transform.stream.StreamResult;
+
+import org.opensaml.xmlsec.signature.KeyInfo;
+import org.opensaml.xmlsec.signature.KeyValue;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+
+import net.shibboleth.utilities.java.support.xml.ElementSupport;
+import net.shibboleth.utilities.java.support.xml.SchemaBuilder.SchemaLanguage;
+
+/**
+ * Test for basic EC signatures.
+ */
+public class XSTJ83Test extends BaseTest {
+
+ XSTJ83Test() {
+ super(XSTJ83Test.class);
+ }
+
+ /**
+ * Test a single credential.
+ *
+ * @param keyFile file holding the EC key
+ * @param certFile file holding the certificate
+ * @param size expected size of the EC key
+ * @param testResource name of the (class-relative) test resource
+ *
+ * @throws Exception if something goes wrong
+ */
+ private void testSingle(@Nonnull final File keyFile, @Nonnull final File certFile,
+ final int size, @Nonnull final String testResource)
+ throws Exception {
+ // command-line arguments for signature
+ final String[] args = {
+ "--sign",
+ "--inFile", testResource,
+ "--outFile", "out.xml",
+ "--key", keyFile.getAbsolutePath(),
+ "--certificate", certFile.getAbsolutePath(),
+ };
+ final CommandLineArguments cli = new CommandLineArguments();
+ cli.parseCommandLineArguments(args);
+ XMLSecTool.initLogging(cli);
+
+ final var signingCredential = CredentialHelper.getFileBasedCredentials(cli.getKey(), "",
+ certFile.getAbsolutePath());
+ Assert.assertNotNull(signingCredential);
+ final var verifyCredential = CredentialHelper.getFileBasedCredentials(null, "",
+ cli.getCertificate());
+ Assert.assertNotNull(verifyCredential);
+
+ var pubKey = signingCredential.getPublicKey();
+ Assert.assertNotNull(pubKey);
+ System.out.println(pubKey.getClass());
+ Assert.assertEquals(pubKey.getAlgorithm(), "EC");
+ Assert.assertTrue(pubKey instanceof ECPublicKey);
+ var ecPubKey = (ECPublicKey) pubKey;
+ Assert.assertEquals(ecPubKey.getParams().getCurve().getField().getFieldSize(), size);
+
+ // acquire a document to sign
+ final Document xml = readXMLDocument(testResource);
+
+ // perform signature operation
+ XMLSecTool.sign(cli, signingCredential, xml);
+
+ // verify the signature using our own code for consistency
+ XMLSecTool.verifySignature(cli, verifyCredential, xml);
+
+ // take a careful look at the signature
+ final Element signatureElement = XMLSecTool.getSignatureElement(xml);
+ final Element keyInfoElement = ElementSupport.getFirstChildElement(signatureElement,
+ KeyInfo.DEFAULT_ELEMENT_NAME);
+ final List<Element> keyInfoChildren = ElementSupport.getChildElements(keyInfoElement);
+ Assert.assertFalse(keyInfoChildren.isEmpty());
+ final List<Element> keyValues = ElementSupport.getChildElements(keyInfoElement, KeyValue.DEFAULT_ELEMENT_NAME);
+ for (final Element keyValue : keyValues) {
+ Assert.assertNotNull(ElementSupport.getFirstChildElement(keyValue), "empty KeyValue element");
+ }
+
+ // validate the resulting XML; this will also show up any error
+ final SchemaValidator validator = new SchemaValidator(SchemaLanguage.XML, getSchemaDirectory());
+ validator.validate(new DOMSource(xml));
+
+ // Now serialise the document
+ final byte[] bytes;
+ try (var out = new ByteArrayOutputStream()) {
+ final TransformerFactory tfac = TransformerFactory.newInstance();
+ final Transformer serializer = tfac.newTransformer();
+ serializer.setOutputProperty("encoding", "UTF-8");
+ serializer.transform(new DOMSource(xml), new StreamResult(out));
+ bytes = out.toByteArray();
+ }
+
+ // Read it back in again
+ final Document doc2;
+ try (final InputStream input = new ByteArrayInputStream(bytes)) {
+ doc2 = getParserPool().parse(input);
+ }
+
+ // verify the signature using our own code for consistency
+ XMLSecTool.verifySignature(cli, verifyCredential, doc2);
+
+ }
+
+ /**
+ * Test with one of our own credentials.
+ *
+ * @throws Exception if something goes wrong
+ */
+ @Test
+ public void testOpenSSHKey() throws Exception {
+ final var keyFile = packageRelativeFile("ecsign384.key");
+ final var certFile = packageRelativeFile("ecsign384.crt");
+ testSingle(keyFile, certFile, 384, "meta.xml");
+ }
+
+ /**
+ * Test with the credential from the submission.
+ *
+ * @throws Exception if something goes wrong
+ */
+ @Test
+ public void testProvidedKey() throws Exception {
+ final var keyFile = classRelativeFile("secp256r1.key");
+ final var certFile = classRelativeFile("server.pem");
+ testSingle(keyFile, certFile, 256, "meta.xml");
+ }
+
+}
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ83-meta.xml b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ83-meta.xml
new file mode 100644
index 0000000..cd3c3f0
--- /dev/null
+++ b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ83-meta.xml
@@ -0,0 +1,119 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:ukfedlabel="http://ukfederation.org.uk/2006/11/label"
+ xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:metadata ../xml/saml-schema-metadata-2.0.xsd
+ urn:oasis:names:tc:SAML:metadata:algsupport ../xml/sstc-saml-metadata-algsupport-v1.0.xsd
+ urn:oasis:names:tc:SAML:metadata:ui ../xml/sstc-saml-metadata-ui-v1.0.xsd
+ urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol ../xml/sstc-saml-idp-discovery.xsd
+ urn:oasis:names:tc:SAML:profiles:SSO:request-init ../xml/sstc-request-initiation.xsd
+ urn:mace:shibboleth:metadata:1.0 ../xml/shibboleth-metadata-1.0.xsd
+ http://ukfederation.org.uk/2006/11/label ../xml/uk-fed-label.xsd
+ http://www.w3.org/2001/04/xmlenc# ../xml/xenc-schema.xsd
+ http://www.w3.org/2000/09/xmldsig# ../xml/xmldsig-core-schema.xsd"
+ ID="uk001480" entityID="https://idp.shibboleth.net/idp/shibboleth">
+ <!--
+ This is a shibboleth.net Shibboleth 2 IdP for the JISC Services Management Company Ltd.
+ -->
+ <Extensions>
+ <shibmd:Scope regexp="false">shibboleth.net</shibmd:Scope>
+ <ukfedlabel:UKFederationMember/>
+ <ukfedlabel:ExportOptIn date="2011-12-07"/>
+ <ukfedlabel:Software fullVersion="2.3.8" version="2" name="Shibboleth" date="2012-12-07"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+ </Extensions>
+ <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+ <Extensions>
+ <shibmd:Scope regexp="false">shibboleth.net</shibmd:Scope>
+ <mdui:UIInfo xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">
+ <mdui:DisplayName xml:lang="en">Shibboleth.net</mdui:DisplayName>
+ <mdui:Description xml:lang="en">An identity provider hosted and used by the
+ developers of Shibboleth.</mdui:Description>
+ <mdui:Logo height="82" width="64">https://shibboleth.net/images/gryphon_64x82.png</mdui:Logo>
+ </mdui:UIInfo>
+ </Extensions>
+ <KeyDescriptor>
+ <ds:KeyInfo>
+ <ds:X509Data>
+ <ds:X509Certificate>
+ MIIDNDCCAhygAwIBAgIVAKyBWnv1/h1U11C7kHvV33FIrEsJMA0GCSqGSIb3DQEB
+ BQUAMB0xGzAZBgNVBAMTEmlkcC5zaGliYm9sZXRoLm5ldDAeFw0xMDEyMjkwMDA5
+ MTlaFw0zMDEyMjkwMDA5MTlaMB0xGzAZBgNVBAMTEmlkcC5zaGliYm9sZXRoLm5l
+ dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKjWAdpUx/82FUzrRMfA
+ M63PkZZYCm3RnT3eiL+DeJcbGdcEJx/o+32vgHXJgJOBt14YdVam5GErIYgk4SGq
+ 5Z5RYl0PpQn6HQG/9prGnYCu6p5zfb0557o51Eh8TcVehS6Y2ruyCjAF0jgVMwh5
+ /0Oh8EE9wG93pSpm70DAiiaTVCb8WoT1aZYtxbBmmuH10bU+wge/NMmaHuVAe599
+ pyezFIL4FoI2g+1Q6nG4Yl1Z07I81tTApXKVMWRt/4/M3m2D7PUMOQ9qsxthp2L/
+ LovIeNo0bTyeW290T2Y/JRZhKOgeDqkhuu82DPri2Vm5G/unB69KfRB7CF9QWIc3
+ y80CAwEAAaNrMGkwSAYDVR0RBEEwP4ISaWRwLnNoaWJib2xldGgubmV0hilodHRw
+ czovL2lkcC5zaGliYm9sZXRoLm5ldC9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQU
+ 3uZ32tKXJBzPCTp2dtHSLV0FvGgwDQYJKoZIhvcNAQEFBQADggEBAAYXYuzp0UTj
+ 3yLRvUCbEtaw9b80+weOELkVv3WFY3QAG8pIKEblrMMtzrzLFWZwYwwMZDab/HnH
+ egmgjZBthrOedEmoJ+OHRmIiS8zdZxVGEadJhTUaeIkO6kwK7Ht3nQePoiXV7TI5
+ +A9SpmZGoukC85Za4wGDw4xWGs5t5l6tBuuV+1s0oC6T8ih5n/NyThfpbihSW0d7
+ iBfSUickgpoM2BLM3FCnbO8HOsX1rGV4ypG9ZGDDvr2jrzalXXmc05gSlL2qd9ce
+ Q1M+9vavusPCqlj2zZf2/HfzhyiFcb/OgA0oTFWW2ynXji6UarIV5QaPoi/XmGmx
+ BXD36HfGBXk=
+ </ds:X509Certificate>
+ </ds:X509Data>
+ </ds:KeyInfo>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
+ </KeyDescriptor>
+ <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+ Location="https://shibboleth.net/idp/profile/SAML2/POST/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://shibboleth.net/idp/profile/SAML2/POST-SimpleSign/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+ Location="https://shibboleth.net/idp/profile/SAML2/Redirect/SSO"/>
+ </IDPSSODescriptor>
+ <Organization>
+ <OrganizationName xml:lang="en">JISC Services Management Company Ltd</OrganizationName>
+ <OrganizationDisplayName xml:lang="en">Shibboleth.net</OrganizationDisplayName>
+ <OrganizationURL xml:lang="en">http://www.shibboleth.net/</OrganizationURL>
+ </Organization>
+ <ContactPerson contactType="support">
+ <GivenName>Shibboleth.Net Technical Support</GivenName>
+ <EmailAddress>mailto:contact at shibboleth.net</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="technical">
+ <GivenName>Scott</GivenName>
+ <SurName>Cantor</SurName>
+ <EmailAddress>mailto:cantor.2 at osu.edu</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="technical">
+ <GivenName>Ian</GivenName>
+ <SurName>Young</SurName>
+ <EmailAddress>mailto:ukfed at iay.org.uk</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="administrative">
+ <GivenName>Scott</GivenName>
+ <SurName>Cantor</SurName>
+ <EmailAddress>mailto:cantor.2 at osu.edu</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="administrative">
+ <GivenName>Ian</GivenName>
+ <SurName>Young</SurName>
+ <EmailAddress>mailto:ian at iay.org.uk</EmailAddress>
+ </ContactPerson>
+</EntityDescriptor>
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ83-secp256r1.key b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ83-secp256r1.key
new file mode 100644
index 0000000..30e7fc4
--- /dev/null
+++ b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ83-secp256r1.key
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIEiXruWXFcoC2vOn39oX259LdE1zfcgL0ecCtmemgEi3oAoGCCqGSM49
+AwEHoUQDQgAEjkozl/axSC/+B7+iuYz2DEExV30GHeQBFvBMCKgnaBr9sbYAHBBN
+7Sd2d57azB1tnVpyvV+YocLJcL9xQK47HQ==
+-----END EC PRIVATE KEY-----
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ83-server.pem b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ83-server.pem
new file mode 100644
index 0000000..fe5de5b
--- /dev/null
+++ b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ83-server.pem
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICHDCCAcGgAwIBAgIUJrYJqrXaInf2AwSHSCeXrM3ncdswCgYIKoZIzj0EAwIw
+YzELMAkGA1UEBhMCQVUxDDAKBgNVBAgMA05TVzEPMA0GA1UEBwwGU3lkbmV5MRsw
+GQYDVQQKDBJBbHBoYVdhbGx0IFB0eSBMdGQxGDAWBgNVBAMMD2FscGhhd2FsbGV0
+LmNvbTAeFw0yMDEwMDgxMDQyMjFaFw0yMDExMDcxMDQyMjFaMGMxCzAJBgNVBAYT
+AkFVMQwwCgYDVQQIDANOU1cxDzANBgNVBAcMBlN5ZG5leTEbMBkGA1UECgwSQWxw
+aGFXYWxsdCBQdHkgTHRkMRgwFgYDVQQDDA9hbHBoYXdhbGxldC5jb20wWTATBgcq
+hkjOPQIBBggqhkjOPQMBBwNCAASOSjOX9rFIL/4Hv6K5jPYMQTFXfQYd5AEW8EwI
+qCdoGv2xtgAcEE3tJ3Z3ntrMHW2dWnK9X5ihwslwv3FArjsdo1MwUTAdBgNVHQ4E
+FgQUPef3sjWeU9Yil99hF68LBGbXqqMwHwYDVR0jBBgwFoAUPef3sjWeU9Yil99h
+F68LBGbXqqMwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNJADBGAiEAwdaF
+5Ax+ikkELuvI1cLmc5Wo99SmhUQr+6r2j1jo7NwCIQDuYQ/STCorYveGUOPz3/0D
+3vyHnhMevHIyfrOG8/7QJQ==
+-----END CERTIFICATE-----
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/ecsign384.crt b/src/test/resources/net/shibboleth/tool/xmlsectool/ecsign384.crt
new file mode 100644
index 0000000..ed10573
--- /dev/null
+++ b/src/test/resources/net/shibboleth/tool/xmlsectool/ecsign384.crt
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICXDCCAeOgAwIBAgIJAJnrL3SN9G0gMAkGByqGSM49BAEwbTELMAkGA1UEBhMC
+R0IxETAPBgNVBAgMCFNjb3RsYW5kMRIwEAYDVQQHDAlFZGluYnVyZ2gxGzAZBgNV
+BAoMElNoaWJib2xldGggUHJvamVjdDEaMBgGA1UEAwwRRUNEU0EgVGVzdCBTaWdu
+ZXIwHhcNMTMwMzA4MTgwMDUyWhcNMTMwNDA3MTgwMDUyWjBtMQswCQYDVQQGEwJH
+QjERMA8GA1UECAwIU2NvdGxhbmQxEjAQBgNVBAcMCUVkaW5idXJnaDEbMBkGA1UE
+CgwSU2hpYmJvbGV0aCBQcm9qZWN0MRowGAYDVQQDDBFFQ0RTQSBUZXN0IFNpZ25l
+cjB2MBAGByqGSM49AgEGBSuBBAAiA2IABJOTcWHcnuaawymYM9ppSrexyjctFpLJ
+uKtnYW54Tr9KAXSX8V2co9leb+v5jCltACx5OkbIOIDmuZOp4O5t8/gBrLN/sv73
+Pb4sIp9a5OHDuojy06mmGqh3D+RLMqjXiKNQME4wHQYDVR0OBBYEFPkX7lxo3PJk
+SfXjs8YVx2QjHp4NMB8GA1UdIwQYMBaAFPkX7lxo3PJkSfXjs8YVx2QjHp4NMAwG
+A1UdEwQFMAMBAf8wCQYHKoZIzj0EAQNoADBlAjEAt2UvyCA7GgvfC6OsmA2Qr5oA
+pjdE/YiVlCexQQADZiuZ5GIvF3dXd5MxrAj0mMP/AjBoxJbpCfKoXzzW+KULUxg3
+RxjaWBJRNfk6Tv0kLvjF2syGmVVdlEfjQLsXQx+Rkvs=
+-----END CERTIFICATE-----
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/ecsign384.key b/src/test/resources/net/shibboleth/tool/xmlsectool/ecsign384.key
new file mode 100644
index 0000000..cc0ae83
--- /dev/null
+++ b/src/test/resources/net/shibboleth/tool/xmlsectool/ecsign384.key
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDDVE9MOjWl0v+kvIzdb
+ps4vjBNYekt0erO88OUOKQ8tps7iuk/fgamC8kZ214DK9AahZANiAASTk3Fh3J7m
+msMpmDPaaUq3sco3LRaSybirZ2FueE6/SgF0l/FdnKPZXm/r+YwpbQAseTpGyDiA
+5rmTqeDubfP4Aayzf7L+9z2+LCKfWuThw7qI8tOpphqodw/kSzKo14g=
+-----END PRIVATE KEY-----
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list