nx_x509_sig_alg_test.nx source

1// nx_x509_sig_alg_test.nx -- KAT for sig-alg OID identification. 2// 3// expect_exit: 0 4// license_tier: ORIGINAL 5 6import "nx_syscalls.nx" 7import "nx_x509_sig_alg.nx" 8 9func main() -> i64 { 10 // ---- Test A: Ed25519 AlgorithmIdentifier ---- 11 // SEQUENCE { OID 1.3.101.112 } = 30 05 06 03 2B 65 70 12 let ed: *u8 = sys_mmap(16) 13 ed[0]=0x30; ed[1]=0x05; ed[2]=0x06; ed[3]=0x03 14 ed[4]=0x2B; ed[5]=0x65; ed[6]=0x70 15 let alg1: i64 = nx_x509_sig_alg_identify(ed, 0, 7) 16 if alg1 != NX_X509_SIG_ALG_ED25519 { return 1 } 17 18 // ---- Test B: Ed25519 with explicit NULL parameter ---- 19 // SEQUENCE { OID 1.3.101.112, NULL } = 30 07 06 03 2B 65 70 05 00 20 // (Note: RFC 8410 §3 says NULL parameter is forbidden but some 21 // implementations include it; our identifier should still match 22 // since we only check the OID itself.) 23 let ed_null: *u8 = sys_mmap(16) 24 ed_null[0]=0x30; ed_null[1]=0x07; ed_null[2]=0x06; ed_null[3]=0x03 25 ed_null[4]=0x2B; ed_null[5]=0x65; ed_null[6]=0x70 26 ed_null[7]=0x05; ed_null[8]=0x00 27 let alg2: i64 = nx_x509_sig_alg_identify(ed_null, 0, 9) 28 if alg2 != NX_X509_SIG_ALG_ED25519 { return 2 } 29 30 // ---- Test C: ecdsa-with-SHA-256 ---- 31 // SEQUENCE { OID 1.2.840.10045.4.3.2 } = 30 0A 06 08 2A 86 48 CE 3D 04 03 02 32 let ec: *u8 = sys_mmap(16) 33 ec[0]=0x30; ec[1]=0x0A; ec[2]=0x06; ec[3]=0x08 34 ec[4]=0x2A; ec[5]=0x86; ec[6]=0x48; ec[7]=0xCE 35 ec[8]=0x3D; ec[9]=0x04; ec[10]=0x03; ec[11]=0x02 36 let alg3: i64 = nx_x509_sig_alg_identify(ec, 0, 12) 37 if alg3 != NX_X509_SIG_ALG_ECDSA_P256_SHA256 { return 3 } 38 39 // ---- Test D: sha256WithRSAEncryption -> RSA_PKCS1_SHA256 ---- 40 // SEQUENCE { OID 1.2.840.113549.1.1.11 } = 30 0B 06 09 2A 86 48 86 F7 0D 01 01 0B 41 let rsa: *u8 = sys_mmap(16) 42 rsa[0]=0x30; rsa[1]=0x0B; rsa[2]=0x06; rsa[3]=0x09 43 rsa[4]=0x2A; rsa[5]=0x86; rsa[6]=0x48; rsa[7]=0x86 44 rsa[8]=0xF7; rsa[9]=0x0D; rsa[10]=0x01; rsa[11]=0x01; rsa[12]=0x0B 45 let alg4: i64 = nx_x509_sig_alg_identify(rsa, 0, 13) 46 if alg4 != NX_X509_SIG_ALG_RSA_PKCS1_SHA256 { return 4 } 47 48 // ---- Test D2: sha384WithRSAEncryption -> RSA_PKCS1_SHA384 ---- 49 // SEQUENCE { OID 1.2.840.113549.1.1.12 } -- last OID byte 0x0C vs 0x0B. 50 let rsa384: *u8 = sys_mmap(16) 51 rsa384[0]=0x30; rsa384[1]=0x0B; rsa384[2]=0x06; rsa384[3]=0x09 52 rsa384[4]=0x2A; rsa384[5]=0x86; rsa384[6]=0x48; rsa384[7]=0x86 53 rsa384[8]=0xF7; rsa384[9]=0x0D; rsa384[10]=0x01; rsa384[11]=0x01; rsa384[12]=0x0C 54 let alg384: i64 = nx_x509_sig_alg_identify(rsa384, 0, 13) 55 if alg384 != NX_X509_SIG_ALG_RSA_PKCS1_SHA384 { return 41 } 56 57 // ---- Test E: Bad outer tag -> UNKNOWN ---- 58 let bad: *u8 = sys_mmap(8) 59 bad[0]=0x99; bad[1]=0x00; bad[2]=0x00; bad[3]=0x00 60 if nx_x509_sig_alg_identify(bad, 0, 4) != NX_X509_SIG_ALG_UNKNOWN { return 5 } 61 62 // ---- Test F: Too short -> UNKNOWN ---- 63 if nx_x509_sig_alg_identify(bad, 0, 2) != NX_X509_SIG_ALG_UNKNOWN { return 6 } 64 65 // ---- Test G: Bad inner tag (not OID) -> UNKNOWN ---- 66 let bad2: *u8 = sys_mmap(8) 67 bad2[0]=0x30; bad2[1]=0x03; bad2[2]=0x99; bad2[3]=0x01; bad2[4]=0x00 68 if nx_x509_sig_alg_identify(bad2, 0, 5) != NX_X509_SIG_ALG_UNKNOWN { return 7 } 69 70 // ---- Test H: Truncated OID body -> UNKNOWN ---- 71 let trunc: *u8 = sys_mmap(8) 72 trunc[0]=0x30; trunc[1]=0x05; trunc[2]=0x06; trunc[3]=0x03 73 trunc[4]=0x2B; trunc[5]=0x65 74 // Only 6 bytes provided but len claims 7 -- expect parse failure -> UNKNOWN 75 if nx_x509_sig_alg_identify(trunc, 0, 7) != NX_X509_SIG_ALG_UNKNOWN { return 8 } 76 77 // ---- Test I: Wrong OID bytes (same length, different content) ---- 78 // Replace 0x2B with 0x2A in Ed25519 OID 79 let mut: *u8 = sys_mmap(16) 80 mut[0]=0x30; mut[1]=0x05; mut[2]=0x06; mut[3]=0x03 81 mut[4]=0x2A; mut[5]=0x65; mut[6]=0x70 82 if nx_x509_sig_alg_identify(mut, 0, 7) != NX_X509_SIG_ALG_UNKNOWN { return 9 } 83 84 // ---- Test J: is_supported sealed-enum gate ---- 85 if nx_x509_sig_alg_is_supported(NX_X509_SIG_ALG_UNKNOWN) != 0 { return 10 } 86 if nx_x509_sig_alg_is_supported(NX_X509_SIG_ALG_ED25519) != 1 { return 11 } 87 if nx_x509_sig_alg_is_supported(NX_X509_SIG_ALG_ECDSA_P256_SHA256) != 1 { return 12 } 88 if nx_x509_sig_alg_is_supported(NX_X509_SIG_ALG_N) != 0 { return 13 } 89 if nx_x509_sig_alg_is_supported(0 - 1) != 0 { return 14 } 90 if nx_x509_sig_alg_is_supported(999) != 0 { return 15 } 91 92 // ---- Test K: identify at nonzero offset (cert-realistic) ---- 93 // Embed Ed25519 alg-id starting at offset 5 of a larger buffer. 94 let bigger: *u8 = sys_mmap(32) 95 var i: i64 = 0 96 while i < 32 { bigger[i] = 0xCC; i = i + 1 } 97 bigger[5]=0x30; bigger[6]=0x05; bigger[7]=0x06; bigger[8]=0x03 98 bigger[9]=0x2B; bigger[10]=0x65; bigger[11]=0x70 99 if nx_x509_sig_alg_identify(bigger, 5, 7) != NX_X509_SIG_ALG_ED25519 { return 16 } 100 101 return 0 102}