Source file src/crypto/x509/pem_decrypt_test.go

     1  // Copyright 2012 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package x509
     6  
     7  import (
     8  	"bytes"
     9  	"crypto/rand"
    10  	"encoding/base64"
    11  	"encoding/pem"
    12  	"strings"
    13  	"testing"
    14  )
    15  
    16  func TestDecrypt(t *testing.T) {
    17  	for i, data := range testData {
    18  		t.Logf("test %v. %v", i, data.kind)
    19  		block, rest := pem.Decode(data.pemData)
    20  		if len(rest) > 0 {
    21  			t.Error("extra data")
    22  		}
    23  		der, err := DecryptPEMBlock(block, data.password)
    24  		if err != nil {
    25  			t.Error("decrypt failed: ", err)
    26  			continue
    27  		}
    28  		if _, err := ParsePKCS1PrivateKey(der); err != nil {
    29  			t.Error("invalid private key: ", err)
    30  		}
    31  		plainDER, err := base64.StdEncoding.DecodeString(data.plainDER)
    32  		if err != nil {
    33  			t.Fatal("cannot decode test DER data: ", err)
    34  		}
    35  		if !bytes.Equal(der, plainDER) {
    36  			t.Error("data mismatch")
    37  		}
    38  	}
    39  }
    40  
    41  func TestEncrypt(t *testing.T) {
    42  	for i, data := range testData {
    43  		t.Logf("test %v. %v", i, data.kind)
    44  		plainDER, err := base64.StdEncoding.DecodeString(data.plainDER)
    45  		if err != nil {
    46  			t.Fatal("cannot decode test DER data: ", err)
    47  		}
    48  		password := []byte("kremvax1")
    49  		block, err := EncryptPEMBlock(rand.Reader, "RSA PRIVATE KEY", plainDER, password, data.kind)
    50  		if err != nil {
    51  			t.Error("encrypt: ", err)
    52  			continue
    53  		}
    54  		if !IsEncryptedPEMBlock(block) {
    55  			t.Error("PEM block does not appear to be encrypted")
    56  		}
    57  		if block.Type != "RSA PRIVATE KEY" {
    58  			t.Errorf("unexpected block type; got %q want %q", block.Type, "RSA PRIVATE KEY")
    59  		}
    60  		if block.Headers["Proc-Type"] != "4,ENCRYPTED" {
    61  			t.Errorf("block does not have correct Proc-Type header")
    62  		}
    63  		der, err := DecryptPEMBlock(block, password)
    64  		if err != nil {
    65  			t.Error("decrypt: ", err)
    66  			continue
    67  		}
    68  		if !bytes.Equal(der, plainDER) {
    69  			t.Errorf("data mismatch")
    70  		}
    71  	}
    72  }
    73  
    74  var testData = []struct {
    75  	kind     PEMCipher
    76  	password []byte
    77  	pemData  []byte
    78  	plainDER string
    79  }{
    80  	{
    81  		kind:     PEMCipherDES,
    82  		password: []byte("asdf"),
    83  		pemData: []byte(testingKey(`
    84  -----BEGIN RSA TESTING KEY-----
    85  Proc-Type: 4,ENCRYPTED
    86  DEK-Info: DES-CBC,34F09A4FC8DE22B5
    87  
    88  WXxy8kbZdiZvANtKvhmPBLV7eVFj2A5z6oAxvI9KGyhG0ZK0skfnt00C24vfU7m5
    89  ICXeoqP67lzJ18xCzQfHjDaBNs53DSDT+Iz4e8QUep1xQ30+8QKX2NA2coee3nwc
    90  6oM1cuvhNUDemBH2i3dKgMVkfaga0zQiiOq6HJyGSncCMSruQ7F9iWEfRbFcxFCx
    91  qtHb1kirfGKEtgWTF+ynyco6+2gMXNu70L7nJcnxnV/RLFkHt7AUU1yrclxz7eZz
    92  XOH9VfTjb52q/I8Suozq9coVQwg4tXfIoYUdT//O+mB7zJb9HI9Ps77b9TxDE6Gm
    93  4C9brwZ3zg2vqXcwwV6QRZMtyll9rOpxkbw6NPlpfBqkc3xS51bbxivbO/Nve4KD
    94  r12ymjFNF4stXCfJnNqKoZ50BHmEEUDu5Wb0fpVn82XrGw7CYc4iug==
    95  -----END RSA TESTING KEY-----`)),
    96  		plainDER: `
    97  MIIBPAIBAAJBAPASZe+tCPU6p80AjHhDkVsLYa51D35e/YGa8QcZyooeZM8EHozo
    98  KD0fNiKI+53bHdy07N+81VQ8/ejPcRoXPlsCAwEAAQJBAMTxIuSq27VpR+zZ7WJf
    99  c6fvv1OBvpMZ0/d1pxL/KnOAgq2rD5hDtk9b0LGhTPgQAmrrMTKuSeGoIuYE+gKQ
   100  QvkCIQD+GC1m+/do+QRurr0uo46Kx1LzLeSCrjBk34wiOp2+dwIhAPHfTLRXS2fv
   101  7rljm0bYa4+eDZpz+E8RcXEgzhhvcQQ9AiAI5eHZJGOyml3MXnQjiPi55WcDOw0w
   102  glcRgT6QCEtz2wIhANSyqaFtosIkHKqrDUGfz/bb5tqMYTAnBruVPaf/WEOBAiEA
   103  9xORWeRG1tRpso4+dYy4KdDkuLPIO01KY6neYGm3BCM=`,
   104  	},
   105  	{
   106  		kind:     PEMCipher3DES,
   107  		password: []byte("asdf"),
   108  		pemData: []byte(testingKey(`
   109  -----BEGIN RSA TESTING KEY-----
   110  Proc-Type: 4,ENCRYPTED
   111  DEK-Info: DES-EDE3-CBC,C1F4A6A03682C2C7
   112  
   113  0JqVdBEH6iqM7drTkj+e2W/bE3LqakaiWhb9WUVonFkhyu8ca/QzebY3b5gCvAZQ
   114  YwBvDcT/GHospKqPx+cxDHJNsUASDZws6bz8ZXWJGwZGExKzr0+Qx5fgXn44Ms3x
   115  8g1ENFuTXtxo+KoNK0zuAMAqp66Llcds3Fjl4XR18QaD0CrVNAfOdgATWZm5GJxk
   116  Fgx5f84nT+/ovvreG+xeOzWgvtKo0UUZVrhGOgfKLpa57adumcJ6SkUuBtEFpZFB
   117  ldw5w7WC7d13x2LsRkwo8ZrDKgIV+Y9GNvhuCCkTzNP0V3gNeJpd201HZHR+9n3w
   118  3z0VjR/MGqsfcy1ziEWMNOO53At3zlG6zP05aHMnMcZoVXadEK6L1gz++inSSDCq
   119  gI0UJP4e3JVB7AkgYymYAwiYALAkoEIuanxoc50njJk=
   120  -----END RSA TESTING KEY-----`)),
   121  		plainDER: `
   122  MIIBOwIBAAJBANOCXKdoNS/iP/MAbl9cf1/SF3P+Ns7ZeNL27CfmDh0O6Zduaax5
   123  NBiumd2PmjkaCu7lQ5JOibHfWn+xJsc3kw0CAwEAAQJANX/W8d1Q/sCqzkuAn4xl
   124  B5a7qfJWaLHndu1QRLNTRJPn0Ee7OKJ4H0QKOhQM6vpjRrz+P2u9thn6wUxoPsef
   125  QQIhAP/jCkfejFcy4v15beqKzwz08/tslVjF+Yq41eJGejmxAiEA05pMoqfkyjcx
   126  fyvGhpoOyoCp71vSGUfR2I9CR65oKh0CIC1Msjs66LlfJtQctRq6bCEtFCxEcsP+
   127  eEjYo/Sk6WphAiEAxpgWPMJeU/shFT28gS+tmhjPZLpEoT1qkVlC14u0b3ECIQDX
   128  tZZZxCtPAm7shftEib0VU77Lk8MsXJcx2C4voRsjEw==`,
   129  	},
   130  	{
   131  		kind:     PEMCipherAES128,
   132  		password: []byte("asdf"),
   133  		pemData: []byte(testingKey(`
   134  -----BEGIN RSA TESTING KEY-----
   135  Proc-Type: 4,ENCRYPTED
   136  DEK-Info: AES-128-CBC,D4492E793FC835CC038A728ED174F78A
   137  
   138  EyfQSzXSjv6BaNH+NHdXRlkHdimpF9izWlugVJAPApgXrq5YldPe2aGIOFXyJ+QE
   139  ZIG20DYqaPzJRjTEbPNZ6Es0S2JJ5yCpKxwJuDkgJZKtF39Q2i36JeGbSZQIuWJE
   140  GZbBpf1jDH/pr0iGonuAdl2PCCZUiy+8eLsD2tyviHUkFLOB+ykYoJ5t8ngZ/B6D
   141  33U43LLb7+9zD4y3Q9OVHqBFGyHcxCY9+9Qh4ZnFp7DTf6RY5TNEvE3s4g6aDpBs
   142  3NbvRVvYTgs8K9EPk4K+5R+P2kD8J8KvEIGxVa1vz8QoCJ/jr7Ka2rvNgPCex5/E
   143  080LzLHPCrXKdlr/f50yhNWq08ZxMWQFkui+FDHPDUaEELKAXV8/5PDxw80Rtybo
   144  AVYoCVIbZXZCuCO81op8UcOgEpTtyU5Lgh3Mw5scQL0=
   145  -----END RSA TESTING KEY-----`)),
   146  		plainDER: `
   147  MIIBOgIBAAJBAMBlj5FxYtqbcy8wY89d/S7n0+r5MzD9F63BA/Lpl78vQKtdJ5dT
   148  cDGh/rBt1ufRrNp0WihcmZi7Mpl/3jHjiWECAwEAAQJABNOHYnKhtDIqFYj1OAJ3
   149  k3GlU0OlERmIOoeY/cL2V4lgwllPBEs7r134AY4wMmZSBUj8UR/O4SNO668ElKPE
   150  cQIhAOuqY7/115x5KCdGDMWi+jNaMxIvI4ETGwV40ykGzqlzAiEA0P9oEC3m9tHB
   151  kbpjSTxaNkrXxDgdEOZz8X0uOUUwHNsCIAwzcSCiGLyYJTULUmP1ESERfW1mlV78
   152  XzzESaJpIM/zAiBQkSTcl9VhcJreQqvjn5BnPZLP4ZHS4gPwJAGdsj5J4QIhAOVR
   153  B3WlRNTXR2WsJ5JdByezg9xzdXzULqmga0OE339a`,
   154  	},
   155  	{
   156  		kind:     PEMCipherAES192,
   157  		password: []byte("asdf"),
   158  		pemData: []byte(testingKey(`
   159  -----BEGIN RSA TESTING KEY-----
   160  Proc-Type: 4,ENCRYPTED
   161  DEK-Info: AES-192-CBC,E2C9FB02BCA23ADE1829F8D8BC5F5369
   162  
   163  cqVslvHqDDM6qwU6YjezCRifXmKsrgEev7ng6Qs7UmDJOpHDgJQZI9fwMFUhIyn5
   164  FbCu1SHkLMW52Ld3CuEqMnzWMlhPrW8tFvUOrMWPYSisv7nNq88HobZEJcUNL2MM
   165  Y15XmHW6IJwPqhKyLHpWXyOCVEh4ODND2nV15PCoi18oTa475baxSk7+1qH7GuIs
   166  Rb7tshNTMqHbCpyo9Rn3UxeFIf9efdl8YLiMoIqc7J8E5e9VlbeQSdLMQOgDAQJG
   167  ReUtTw8exmKsY4gsSjhkg5uiw7/ZB1Ihto0qnfQJgjGc680qGkT1d6JfvOfeYAk6
   168  xn5RqS/h8rYAYm64KnepfC9vIujo4NqpaREDmaLdX5MJPQ+SlytITQvgUsUq3q/t
   169  Ss85xjQEZH3hzwjQqdJvmA4hYP6SUjxYpBM+02xZ1Xw=
   170  -----END RSA TESTING KEY-----`)),
   171  		plainDER: `
   172  MIIBOwIBAAJBAMGcRrZiNNmtF20zyS6MQ7pdGx17aFDl+lTl+qnLuJRUCMUG05xs
   173  OmxmL/O1Qlf+bnqR8Bgg65SfKg21SYuLhiMCAwEAAQJBAL94uuHyO4wux2VC+qpj
   174  IzPykjdU7XRcDHbbvksf4xokSeUFjjD3PB0Qa83M94y89ZfdILIqS9x5EgSB4/lX
   175  qNkCIQD6cCIqLfzq/lYbZbQgAAjpBXeQVYsbvVtJrPrXJAlVVQIhAMXpDKMeFPMn
   176  J0g2rbx1gngx0qOa5r5iMU5w/noN4W2XAiBjf+WzCG5yFvazD+dOx3TC0A8+4x3P
   177  uZ3pWbaXf5PNuQIgAcdXarvhelH2w2piY1g3BPeFqhzBSCK/yLGxR82KIh8CIQDD
   178  +qGKsd09NhQ/G27y/DARzOYtml1NvdmCQAgsDIIOLA==`,
   179  	},
   180  	{
   181  		kind:     PEMCipherAES256,
   182  		password: []byte("asdf"),
   183  		pemData: []byte(testingKey(`
   184  -----BEGIN RSA TESTING KEY-----
   185  Proc-Type: 4,ENCRYPTED
   186  DEK-Info: AES-256-CBC,8E7ED5CD731902CE938957A886A5FFBD
   187  
   188  4Mxr+KIzRVwoOP0wwq6caSkvW0iS+GE2h2Ov/u+n9ZTMwL83PRnmjfjzBgfRZLVf
   189  JFPXxUK26kMNpIdssNnqGOds+DhB+oSrsNKoxgxSl5OBoYv9eJTVYm7qOyAFIsjr
   190  DRKAcjYCmzfesr7PVTowwy0RtHmYwyXMGDlAzzZrEvaiySFFmMyKKvtoavwaFoc7
   191  Pz3RZScwIuubzTGJ1x8EzdffYOsdCa9Mtgpp3L136+23dOd6L/qK2EG2fzrJSHs/
   192  2XugkleBFSMKzEp9mxXKRfa++uidQvMZTFLDK9w5YjrRvMBo/l2BoZIsq0jAIE1N
   193  sv5Z/KwlX+3MDEpPQpUwGPlGGdLnjI3UZ+cjgqBcoMiNc6HfgbBgYJSU6aDSHuCk
   194  clCwByxWkBNgJ2GrkwNrF26v+bGJJJNR4SKouY1jQf0=
   195  -----END RSA TESTING KEY-----`)),
   196  		plainDER: `
   197  MIIBOgIBAAJBAKy3GFkstoCHIEeUU/qO8207m8WSrjksR+p9B4tf1w5k+2O1V/GY
   198  AQ5WFCApItcOkQe/I0yZZJk/PmCqMzSxrc8CAwEAAQJAOCAz0F7AW9oNelVQSP8F
   199  Sfzx7O1yom+qWyAQQJF/gFR11gpf9xpVnnyu1WxIRnDUh1LZwUsjwlDYb7MB74id
   200  oQIhANPcOiLwOPT4sIUpRM5HG6BF1BI7L77VpyGVk8xNP7X/AiEA0LMHZtk4I+lJ
   201  nClgYp4Yh2JZ1Znbu7IoQMCEJCjwKDECIGd8Dzm5tViTkUW6Hs3Tlf73nNs65duF
   202  aRnSglss8I3pAiEAonEnKruawgD8RavDFR+fUgmQiPz4FnGGeVgfwpGG1JECIBYq
   203  PXHYtPqxQIbD2pScR5qum7iGUh11lEUPkmt+2uqS`,
   204  	},
   205  	{
   206  		// generated with:
   207  		// openssl genrsa -aes128 -passout pass:asdf -out server.orig.key 128
   208  		kind:     PEMCipherAES128,
   209  		password: []byte("asdf"),
   210  		pemData: []byte(testingKey(`
   211  -----BEGIN RSA TESTING KEY-----
   212  Proc-Type: 4,ENCRYPTED
   213  DEK-Info: AES-128-CBC,74611ABC2571AF11B1BF9B69E62C89E7
   214  
   215  6ei/MlytjE0FFgZOGQ+jrwomKfpl8kdefeE0NSt/DMRrw8OacHAzBNi3pPEa0eX3
   216  eND9l7C9meCirWovjj9QWVHrXyugFuDIqgdhQ8iHTgCfF3lrmcttVrbIfMDw+smD
   217  hTP8O1mS/MHl92NE0nhv0w==
   218  -----END RSA TESTING KEY-----`)),
   219  		plainDER: `
   220  MGMCAQACEQC6ssxmYuauuHGOCDAI54RdAgMBAAECEQCWIn6Yv2O+kBcDF7STctKB
   221  AgkA8SEfu/2i3g0CCQDGNlXbBHX7kQIIK3Ww5o0cYbECCQDCimPb0dYGsQIIeQ7A
   222  jryIst8=`,
   223  	},
   224  }
   225  
   226  var incompleteBlockPEM = testingKey(`
   227  -----BEGIN RSA TESTING KEY-----
   228  Proc-Type: 4,ENCRYPTED
   229  DEK-Info: AES-128-CBC,74611ABC2571AF11B1BF9B69E62C89E7
   230  
   231  6L8yXK2MTQUWBk4ZD6OvCiYp+mXyR1594TQ1K38MxGvDw5pwcDME2Lek8RrR5fd40P2XsL2Z4KKt
   232  ai+OP1BZUetfK6AW4MiqB2FDyIdOAJ8XeWuZy21Wtsh8wPD6yYOFM/w7WZL8weX3Y0TSeG/T
   233  -----END RSA TESTING KEY-----`)
   234  
   235  func TestIncompleteBlock(t *testing.T) {
   236  	// incompleteBlockPEM contains ciphertext that is not a multiple of the
   237  	// block size. This previously panicked. See #11215.
   238  	block, _ := pem.Decode([]byte(incompleteBlockPEM))
   239  	_, err := DecryptPEMBlock(block, []byte("foo"))
   240  	if err == nil {
   241  		t.Fatal("Bad PEM data decrypted successfully")
   242  	}
   243  	const expectedSubstr = "block size"
   244  	if e := err.Error(); !strings.Contains(e, expectedSubstr) {
   245  		t.Fatalf("Expected error containing %q but got: %q", expectedSubstr, e)
   246  	}
   247  }
   248  
   249  func testingKey(s string) string { return strings.ReplaceAll(s, "TESTING KEY", "PRIVATE KEY") }
   250  

View as plain text