Add PKCS-8 support to public_key

6 files changed, 311 insertions, 25 deletions

diff --git a/lib/public_key/test/Makefile b/lib/public_key/test/Makefile
index 6889ae9a8a..b7f91981a5 100644
--- a/lib/public_key/test/Makefile
+++ b/lib/public_key/test/Makefile
@@ -1,7 +1,7 @@
 #
 # %CopyrightBegin%
 #
-# Copyright Ericsson AB 2008-2010. All Rights Reserved.
+# Copyright Ericsson AB 2008-2011. All Rights Reserved.
 #
 # The contents of this file are subject to the Erlang Public License,
 # Version 1.1, (the "License"); you may not use this file except in
@@ -30,6 +30,7 @@ INCLUDES= -I. -I ../include
 MODULES= \
 	erl_make_certs \
 	public_key_SUITE \
+	pbe_SUITE \
 	pkits_SUITE
 
 ERL_FILES= $(MODULES:%=%.erl)
diff --git a/lib/public_key/test/pbe_SUITE.erl b/lib/public_key/test/pbe_SUITE.erl
new file mode 100644
index 0000000000..1d33976505
--- /dev/null
+++ b/lib/public_key/test/pbe_SUITE.erl
@@ -0,0 +1,251 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2011-2011. All Rights Reserved.
+%%
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+-module(pbe_SUITE).
+
+-include_lib("test_server/include/test_server.hrl").
+
+%% Note: This directive should only be used in test suites.
+-compile(export_all).
+%% Test server callback functions
+%%--------------------------------------------------------------------
+%% Function: init_per_suite(Config) -> Config
+%% Config - [tuple()]
+%%   A list of key/value pairs, holding the test case configuration.
+%% Description: Initialization before the whole suite
+%%
+%% Note: This function is free to add any key/value pairs to the Config
+%% variable, but should NOT alter/remove any existing entries.
+%%--------------------------------------------------------------------
+init_per_suite(Config) ->
+    try crypto:start() of
+	ok ->
+	    Config
+    catch _:_ ->
+	    {skip, "Crypto did not start"}
+    end.
+%%--------------------------------------------------------------------
+%% Function: end_per_suite(Config) -> _
+%% Config - [tuple()]
+%%   A list of key/value pairs, holding the test case configuration.
+%% Description: Cleanup after the whole suite
+%%--------------------------------------------------------------------
+end_per_suite(_Config) ->
+    application:stop(crypto).
+
+%%--------------------------------------------------------------------
+%% Function: init_per_testcase(TestCase, Config) -> Config
+%% Case - atom()
+%%   Name of the test case that is about to be run.
+%% Config - [tuple()]
+%%   A list of key/value pairs, holding the test case configuration.
+%%
+%% Description: Initialization before each test case
+%%
+%% Note: This function is free to add any key/value pairs to the Config
+%% variable, but should NOT alter/remove any existing entries.
+%% Description: Initialization before each test case
+%%--------------------------------------------------------------------
+init_per_testcase(_TestCase, Config) ->
+   Config.
+
+%%--------------------------------------------------------------------
+%% Function: end_per_testcase(TestCase, Config) -> _
+%% Case - atom()
+%%   Name of the test case that is about to be run.
+%% Config - [tuple()]
+%%   A list of key/value pairs, holding the test case configuration.
+%% Description: Cleanup after each test case
+%%--------------------------------------------------------------------
+end_per_testcase(_TestCase, _Config) ->
+   ok.
+
+%%--------------------------------------------------------------------
+%% Function: all(Clause) -> TestCases
+%% Clause - atom() - suite | doc
+%% TestCases - [Case] 
+%% Case - atom()
+%%   Name of a test case.
+%% Description: Returns a list of all test cases in this test suite
+%%--------------------------------------------------------------------
+suite() -> [{ct_hooks,[ts_install_cth]}].
+
+all() -> 
+    [
+     pbdkdf1,
+     pbdkdf2,
+     encrypted_private_key_info].
+
+groups() -> 
+    [].
+
+init_per_group(_GroupName, Config) ->
+    Config.
+
+end_per_group(_GroupName, Config) ->
+    Config.
+
+
+%% Test cases starts here.
+%%--------------------------------------------------------------------
+pbdkdf1(doc) ->
+    ["Test with PKCS #5 PBKDF1 Test Vectors"];
+pbdkdf1(Config) when is_list(Config) ->
+    %%Password = "password"
+    %%     = (0x)70617373776F7264
+    %%Salt     = (0x)78578E5A5D63CB06
+    %%Count    = 1000
+    %%kLen     = 16
+    %%Key      = PBKDF1(Password, Salt, Count, kLen)
+    %%= (0x)DC19847E05C64D2FAF10EBFB4A3D2A20
+
+    Password = "password",
+    Salt = <<16#78,16#57,16#8E,16#5A,16#5D,16#63,16#CB,16#06>>,
+    Count = 1000,
+
+   <<16#DC, 16#19, 16#84, 16#7E,
+     16#05, 16#C6, 16#4D, 16#2F,
+     16#AF, 16#10, 16#EB, 16#FB,
+     16#4A, 16#3D, 16#2A, 16#20, _/binary>> =
+	pubkey_pbe:pbdkdf1(Password, Salt, Count, sha).
+
+pbdkdf2(doc) ->
+    ["Test with PKCS #5 PBKDF2 Test Vectors"];
+pbdkdf2(Config) when is_list(Config) ->
+    %% Input:
+    %%   P = "password" (8 octets)
+    %%   S = "salt" (4 octets)
+    %%   c = 1
+    %%   dkLen = 20
+    
+    %% Output:
+    %%   DK = 0c 60 c8 0f 96 1f 0e 71
+    %%        f3 a9 b5 24 af 60 12 06
+    %%        2f e0 37 a6             (20 octets)
+    
+    <<16#0c, 16#60, 16#c8, 16#0f, 16#96, 16#1f, 16#0e, 16#71,
+      16#f3, 16#a9, 16#b5, 16#24, 16#af, 16#60, 16#12, 16#06,
+      16#2f, 16#e0, 16#37, 16#a6>> = pubkey_pbe:pbdkdf2("password", "salt", 1, 20, fun crypto:sha_mac/3, 20),
+    
+    %% Input:
+    %%   P = "password" (8 octets)
+    %%   S = "salt" (4 octets)
+    %%   c = 2
+    %%   dkLen = 20
+    
+    %% Output:
+    %%   DK = ea 6c 01 4d c7 2d 6f 8c
+    %%   cd 1e d9 2a ce 1d 41 f0
+    %%   d8 de 89 57             (20 octets)
+    
+    <<16#ea, 16#6c, 16#01, 16#4d, 16#c7, 16#2d, 16#6f, 16#8c, 
+      16#cd, 16#1e, 16#d9, 16#2a, 16#ce, 16#1d, 16#41, 16#f0,  
+      16#d8,  16#de,  16#89, 16#57>>  =
+	pubkey_pbe:pbdkdf2("password", "salt", 2, 20, 20, fun crypto:sha_mac/2),
+
+     %% Input:
+     %%   P = "password" (8 octets)
+     %%   S = "salt" (4 octets)
+     %%   c = 4096
+     %%   dkLen = 20
+
+     %% Output:
+     %%   DK = 4b 00 79 01 b7 65 48 9a
+     %%        be ad 49 d9 26 f7 21 d0
+     %%        65 a4 29 c1             (20 octets)
+
+    <<16#4b, 16#00, 16#79, 16#01, 16#b7, 16#65, 16#48, 16#9a,
+      16#be, 16#ad, 16#49, 16#d9, 16#26, 16#f7, 16#21, 16#d0,
+      16#65, 16#a4, 16#29, 16#c1>> = pubkey_pbe:pbdkdf2("password", "salt", 4096, 20, 20, fun crypto:sha_mac/2),
+
+    %% Input:
+    %%    P = "password" (8 octets)
+    %%    S = "salt" (4 octets)
+    %%    c = 16777216
+    %%    dkLen = 20
+
+    %%  Output:
+    %%    DK = ee fe 3d 61 cd 4d a4 e4
+    %%         e9 94 5b 3d 6b a2 15 8c
+    %%         26 34 e9 84             (20 octets)
+
+    
+    <<16#ee, 16#fe, 16#3d, 16#61, 16#cd, 16#4d, 16#a4, 16#e4, 
+      16#e9, 16#94, 16#5b, 16#3d, 16#6b, 16#a2, 16#15, 16#8c, 
+      16#26, 16#34, 16#e9, 16#84>> = pubkey_pbe:pbdkdf2("password", "salt", 16777216, 20, 20, fun crypto:sha_mac/2),
+    
+    %% Input:
+    %%    P = "passwordPASSWORDpassword" (24 octets)
+    %%    S = "saltSALTsaltSALTsaltSALTsaltSALTsalt" (36 octets)
+    %%    c = 4096
+    %%    dkLen = 25
+
+    %%  Output:
+    %%    DK = 3d 2e ec 4f e4 1c 84 9b
+    %%         80 c8 d8 36 62 c0 e4 4a
+    %%         8b 29 1a 96 4c f2 f0 70
+    %%         38                      (25 octets)
+    
+    <<16#3d, 16#2e, 16#ec, 16#4f, 16#e4, 16#1c, 16#84, 16#9b, 
+      16#80, 16#c8, 16#d8, 16#36, 16#62, 16#c0, 16#e4, 16#4a, 
+      16#8b, 16#29, 16#1a, 16#96, 16#4c, 16#f2, 16#f0, 16#70, 
+      16#38>>
+	= pubkey_pbe:pbdkdf2("passwordPASSWORDpassword", 
+			     "saltSALTsaltSALTsaltSALTsaltSALTsalt", 4096, 25, 20, fun crypto:sha_mac/2),
+    
+     %% Input:
+     %%   P = "pass\0word" (9 octets)
+     %%   S = "sa\0lt" (5 octets)
+     %%   c = 4096
+     %%   dkLen = 16
+
+     %% Output:
+     %%   DK = 56 fa 6a a7 55 48 09 9d
+     %%        cc 37 d7 f0 34 25 e0 c3 (16 octets)
+
+    <<16#56, 16#fa, 16#6a, 16#a7, 16#55, 16#48, 16#09, 16#9d, 
+      16#cc, 16#37, 16#d7, 16#f0, 16#34, 16#25, 16#e0, 16#c3>>
+	= pubkey_pbe:pbdkdf2("pass\0word", 
+			     "sa\0lt", 4096, 16, 20, fun crypto:sha_mac/2).
+    
+
+pbe_des_cbc(doc) ->
+    ["Tests reading a password DES-CBC encrypted key file"];
+pbe_des_cbc(Config) when is_list(Config) ->
+    Datadir = ?config(data_dir, Config),
+    {ok, Pem} = file:read_file(filename:join(Datadir, "des_cbc_enc_key.pem")),
+    
+    
+    PemE = public_key:pem_decode(Pem),
+    test_server:format("PemE: ~p" , [PemE]),
+    [{'PrivateKeyInfo', _, _} = PubEntry0] = PemE,
+    Key = public_key:pem_entry_decode(PubEntry0, "password"),
+    test_server:format("Key: ~p" , [Key]).
+
+pbe_des3_ede(doc) ->
+    ["Tests reading a password DES-CBC encrypted key file"];
+pbe_des3_ede(Config) when is_list(Config) ->
+    Datadir = ?config(data_dir, Config),
+    {ok, Pem} = file:read_file(filename:join(Datadir, "des_ede3_cbc_enc_key.pem")),
+
+    PemE = public_key:pem_decode(Pem),
+    test_server:format("PemE: ~p" , [PemE]),
+    [{'PrivateKeyInfo', _, _} = PubEntry0] = PemE,
+    Key = public_key:pem_entry_decode(PubEntry0, "password"),
+    test_server:format("Key: ~p" , [Key]).
diff --git a/lib/public_key/test/pbe_SUITE_data/des_cbc_enc_key.pem b/lib/public_key/test/pbe_SUITE_data/des_cbc_enc_key.pem
new file mode 100644
index 0000000000..eaa06145aa
--- /dev/null
+++ b/lib/public_key/test/pbe_SUITE_data/des_cbc_enc_key.pem
@@ -0,0 +1,11 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIBozA9BgkqhkiG9w0BBQ0wMDAbBgkqhkiG9w0BBQwwDgQIfWBDXwLp4K4CAggA
+MBEGBSsOAwIHBAiaCF/AvOgQ6QSCAWDWX4BdAzCRNSQSANSuNsT5X8mWYO27mr3Y
+9c9LoBVXGNmYWKA77MI4967f7SmjNcgXj3xNE/jmnVz6hhsjS8E5VPT3kfyVkpdZ
+0lr5e9Yk2m3JWpPU7++v5zBkZmC4V/MwV/XuIs6U+vykgzMgpxQg0oZKS9zgmiZo
+f/4dOCL0UtCDnyOSvqT7mCVIcMDIEKu8QbVlgZYBop08l60EuEU3gARUo8WsYQmO
+Dz/ldx0Z+znIT0SXVuOwc+RVItC5T/Qx+aijmmpt+9l14nmaGBrEkmuhmtdvU/4v
+aptewGRgmjOfD6cqK+zs0O5NrrJ3P/6ZSxXj91CQgrThGfOv72bUncXEMNtc8pks
+2jpHFjGMdKufnadAD7XuMgzkkaklEXZ4f5tU6heIIwr51g0GBEGF96gYPFnjnSQM
+75JE02Clo+DfcfXpcybPTwwFg2jd6JTTOfkdf6OdSlA/1XNK43FA
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/lib/public_key/test/pbe_SUITE_data/des_ede3_cbc_enc_key.pem b/lib/public_key/test/pbe_SUITE_data/des_ede3_cbc_enc_key.pem
new file mode 100644
index 0000000000..22ea46d56f
--- /dev/null
+++ b/lib/public_key/test/pbe_SUITE_data/des_ede3_cbc_enc_key.pem
@@ -0,0 +1,11 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIBpjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIeFeOWl1jywYCAggA
+MBQGCCqGSIb3DQMHBAjUJ5eGBhQGtQSCAWBrHrRgqO8UUMLcWzZEtpk1l3mjxiF/
+koCMkHsFwowgyWhEbgIkTgbSViK54LVK8PskekcGNLph+rB6bGZ7pPbL5pbXASJ8
++MkQcG3FZdlS4Ek9tTJDApj3O1UubZGFG4uvTlJJFbF1BOJ3MkY3XQ9Gl1qwv7j5
+6e103Da7Cq9+oIDKmznza78XXQYrUsPo8mJGjUxPskEYlzwvHjKubRnYm/K6RKhi
+5f4zX4BQ/Dt3H812ZjRXrsjAJP0KrD/jyD/jCT7zNBVPH1izBds+RwizyQAHwfNJ
+BFR78TH4cgzB619X47FDVOnT0LqQNVd0O3cSwnPrXE9XR3tPayE+iOB15llFSmi8
+z0ByOXldEpkezCn92Umk++suzIVj1qfsK+bv2phZWJPbLEIWPDRHUbYf76q5ArAr
+u4xtxT/hoK3krEs/IN3d70qjlUJ36SEw1UaZ82PWhakQbdtu39ZraMJB
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/lib/public_key/test/pbe_SUITE_data/rc2_cbc_enc_key.pem b/lib/public_key/test/pbe_SUITE_data/rc2_cbc_enc_key.pem
new file mode 100644
index 0000000000..618cddcfd7
--- /dev/null
+++ b/lib/public_key/test/pbe_SUITE_data/rc2_cbc_enc_key.pem
@@ -0,0 +1,12 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIBrjBIBgkqhkiG9w0BBQ0wOzAeBgkqhkiG9w0BBQwwEQQIrHyQPBZqWLUCAggA
+AgEQMBkGCCqGSIb3DQMCMA0CAToECEhbh7YZKiPSBIIBYCT1zp6o5jpFlIkgwPop
+7bW1+8ACr4exqzkeb3WflQ8cWJ4cURxzVdvxUnXeW1VJdaQZtjS/QHs5GhPTG/0f
+wtvnaPfwrIJ3FeGaZfcg2CrYhalOFmEb4xrE4KyoEQmUN8tb/Cg94uzd16BOPw21
+RDnE8bnPdIGY7TyL95kbkqH23mK53pi7h+xWIgduW+atIqDyyt55f7WMZcvDvlj6
+VpN/V0h+qxBHL274WA4dj6GYgeyUFpi60HdGCK7By2TBy8h1ZvKGjmB9h8jZvkx1
+MkbRumXxyFsowTZawyYvO8Um6lbfEDP9zIEUq0IV8RqH2MRyblsPNSikyYhxX/cz
+tdDxRKhilySbSBg5Kr8OfcwKp9bpinN96nmG4xr3Tch1bnVvqJzOQ5+Vva2WwVvH
+2JkWvYm5WaANg4Q6bRxu9vz7DuhbJjQdZbxFezIAgrJdSe92B00jO/0Kny1WjiVO
+6DA=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/lib/public_key/test/public_key_SUITE.erl b/lib/public_key/test/public_key_SUITE.erl
index b11e4d092a..ddca0c9248 100644
--- a/lib/public_key/test/public_key_SUITE.erl
+++ b/lib/public_key/test/public_key_SUITE.erl
@@ -23,8 +23,8 @@
 %% Note: This directive should only be used in test suites.
 -compile(export_all).
 
--include_lib("common_test/include/ct.hrl").
--include_lib("test_server/include/test_server_line.hrl").
+%%-include_lib("common_test/include/ct.hrl").
+-include_lib("test_server/include/test_server.hrl").
 
 -include_lib("public_key/include/public_key.hrl").
 
@@ -107,7 +107,7 @@ all() ->
      {group, ssh_public_key_decode_encode},
      encrypt_decrypt,
      {group, sign_verify},
-     pkix, pkix_path_validation, deprecated].
+     pkix, pkix_path_validation].
 
 groups() -> 
     [{pem_decode_encode, [], [dsa_pem, rsa_pem, encrypted_pem,
@@ -215,19 +215,19 @@ encrypted_pem(Config) when is_list(Config) ->
 
     Salt0 = crypto:rand_bytes(8),
     Entry0 = public_key:pem_entry_encode('RSAPrivateKey', RSAKey,
-					 {{"DES-EDE3-CBC", Salt0}, "1234abcd"}),
+					 {{"DES-EDE3-CBC", {md5, Salt0}}, "1234abcd"}),
     RSAKey = public_key:pem_entry_decode(Entry0,"1234abcd"),
     Des3KeyFile = filename:join(Datadir, "des3_client_key.pem"),
     erl_make_certs:der_to_pem(Des3KeyFile, [Entry0]),
-    [{'RSAPrivateKey', _, {"DES-EDE3-CBC", Salt0}}] =
+    [{'RSAPrivateKey', _, {"DES-EDE3-CBC", {md5, Salt0}}}] =
 	erl_make_certs:pem_to_der(Des3KeyFile),
 
     Salt1 = crypto:rand_bytes(8),
     Entry1 = public_key:pem_entry_encode('RSAPrivateKey', RSAKey,
-					   {{"DES-CBC", Salt1}, "4567efgh"}),
+					   {{"DES-CBC", {md5, Salt1}}, "4567efgh"}),
     DesKeyFile = filename:join(Datadir, "des_client_key.pem"),
     erl_make_certs:der_to_pem(DesKeyFile, [Entry1]),
-    [{'RSAPrivateKey', _, {"DES-CBC", Salt1}} =Entry2] =
+    [{'RSAPrivateKey', _, {"DES-CBC", {md5, Salt1}}} =Entry2] =
 	erl_make_certs:pem_to_der(DesKeyFile),
     true = check_entry_type(public_key:pem_entry_decode(Entry2, "4567efgh"),
 			     'RSAPrivateKey').
@@ -700,23 +700,23 @@ pkix_path_validation(Config) when is_list(Config) ->
     ok.
 
 %%--------------------------------------------------------------------
-deprecated(doc) -> 
-    ["Check deprecated functions."];
-deprecated(suite) -> 
-    [];
-deprecated(Config) when is_list(Config) -> 
-    Datadir = ?config(data_dir, Config),
-    {ok, [DsaKey = {'DSAPrivateKey', _DsaKey, _}]} =
-	public_key:pem_to_der(filename:join(Datadir, "dsa.pem")), 
-    {ok, [RsaKey = {'RSAPrivateKey', _RsaKey,_}]} =
-	public_key:pem_to_der(filename:join(Datadir, "client_key.pem")),
-    {ok, [ProtectedRsaKey = {'RSAPrivateKey', _ProtectedRsaKey,_}]} =
-	public_key:pem_to_der(filename:join(Datadir, "rsa.pem")),
-
-    {ok, #'DSAPrivateKey'{}} = public_key:decode_private_key(DsaKey),
-    {ok, #'RSAPrivateKey'{}} = public_key:decode_private_key(RsaKey),
-    {ok, #'RSAPrivateKey'{}} = public_key:decode_private_key(ProtectedRsaKey, "abcd1234"),
-    ok.
+%% deprecated(doc) -> 
+%%     ["Check deprecated functions."];
+%% deprecated(suite) -> 
+%%     [];
+%% deprecated(Config) when is_list(Config) -> 
+%%     Datadir = ?config(data_dir, Config),
+%%     {ok, [DsaKey = {'DSAPrivateKey', _DsaKey, _}]} =
+%% 	public_key:pem_to_der(filename:join(Datadir, "dsa.pem")), 
+%%     {ok, [RsaKey = {'RSAPrivateKey', _RsaKey,_}]} =
+%% 	public_key:pem_to_der(filename:join(Datadir, "client_key.pem")),
+%%     {ok, [ProtectedRsaKey = {'RSAPrivateKey', _ProtectedRsaKey,_}]} =
+%% 	public_key:pem_to_der(filename:join(Datadir, "rsa.pem")),
+
+%%     {ok, #'DSAPrivateKey'{}} = public_key:decode_private_key(DsaKey),
+%%     {ok, #'RSAPrivateKey'{}} = public_key:decode_private_key(RsaKey),
+%%     {ok, #'RSAPrivateKey'{}} = public_key:decode_private_key(ProtectedRsaKey, "abcd1234"),
+%%     ok.
 
 %%--------------------------------------------------------------------