Skip to content

Latest commit

 

History

History
66 lines (50 loc) · 2.8 KB

README.md

File metadata and controls

66 lines (50 loc) · 2.8 KB
Raw

pkcs11Test: A PKCS#11 Test Suite

Warning: Do not run this test suite against a PKCS#11 token that contains real data; some of the tests may erase or permanently lock the token.

This repository holds a test suite for, and is therefore derived from, the RSA Security Inc. PKCS #11 Cryptographic Token Interface (Cryptoki).

The test suite exercises v2.2 of the PKCS#11 interface, and covers:

  • library management (init.cc)
  • slot and token management (slot.cc)
  • session management (session.cc, login.cc)
  • object management (object.cc)
  • key management (key.cc)
  • symmetric encryption and decryption (cipher.cc)
  • asymmetric encryption and decryption (cipher.cc)
  • signing and verification (sign.cc, hmac.cc)
  • message digesting (digest.cc)
  • dual-function mechanisms (dual.cc)

To build the test program on Linux, just run make. To run the tests against common Linux PKCS#11 implementations:

This is NOT an official Google product.

Additional make options:

  • PKCS11_LONG_SIZE=32 - set CK_LONG/CK_ULONG size to int32_t/uint32_t. Normally set to long int, which is machine/compiler dependent.
  • STRICT_P11=1 - set structures to packed, which tests against fully compliant PKCS11 implementations.

Example:

make PKCS11_LONG_SIZE=32 STRICT_P11=1

Test Options

The test program requires the following command-line parameters to be set:

  • -m libname: Provide the name of the PKCS#11 library to test.
  • -l libpath: Provide the path holding the PKCS#11 library.

There are also several optional command-line parameters:

  • -s slotid: Provide the slot ID that will be used for the tests
  • -v: Generate verbose output.
  • -u pwd: Provide the user PIN/password.
  • -o pwd: Provide the security officer PIN/password.
  • -w cnm: Name of cipher to use for keys being wrapped in key-wrapping tests. One of { 3DES-CBC, 3DES-ECB, AES-CBC , AES-ECB, ARIA-CBC, ARIA-CBC-PAD , ARIA-ECB, CAMELLIA-CBC, CAMELLIA-CBC-PAD , CAMELLIA-ECB, DES-CBC, DES-ECB , IDEA-CBC, IDEA-ECB }
  • -I: Perform token initialization tests. This will wipe the contents of the PKCS#11 token

The test program uses Google Test, and the Google Test command line options are also available. In particular, --gtest_filter=<filter> can be used to run a subset of the tests.