test_keysize.js (4496B)
1 // -*- indent-tabs-mode: nil; js-indent-level: 2 -*- 2 // This Source Code Form is subject to the terms of the Mozilla Public 3 // License, v. 2.0. If a copy of the MPL was not distributed with this 4 // file, You can obtain one at http://mozilla.org/MPL/2.0/. 5 "use strict"; 6 7 // Checks that RSA certs with key sizes below 1024 bits are rejected. 8 // Checks that ECC certs using curves other than the NIST P-256, P-384 or P-521 9 // curves are rejected. 10 11 do_get_profile(); // must be called before getting nsIX509CertDB 12 const certdb = Cc["@mozilla.org/security/x509certdb;1"].getService( 13 Ci.nsIX509CertDB 14 ); 15 16 /** 17 * Tests a cert chain. 18 * 19 * @param {string} rootKeyType 20 * The key type of the root certificate, or the name of an elliptic 21 * curve, as output by the 'openssl ecparam -list_curves' command. 22 * @param {number} rootKeySize 23 * @param {string} intKeyType 24 * @param {number} intKeySize 25 * @param {string} eeKeyType 26 * @param {number} eeKeySize 27 * @param {PRErrorCode} eeExpectedError 28 * @returns {Promise} a promise that will resolve when the verification has 29 * completed 30 */ 31 function checkChain( 32 rootKeyType, 33 rootKeySize, 34 intKeyType, 35 intKeySize, 36 eeKeyType, 37 eeKeySize, 38 eeExpectedError 39 ) { 40 let rootName = "root_" + rootKeyType + "_" + rootKeySize; 41 let intName = "int_" + intKeyType + "_" + intKeySize; 42 let eeName = "ee_" + eeKeyType + "_" + eeKeySize; 43 44 let intFullName = intName + "-" + rootName; 45 let eeFullName = eeName + "-" + intName + "-" + rootName; 46 47 addCertFromFile(certdb, `test_keysize/${rootName}.pem`, "CTu,CTu,CTu"); 48 addCertFromFile(certdb, `test_keysize/${intFullName}.pem`, ",,"); 49 let eeCert = constructCertFromFile(`test_keysize/${eeFullName}.pem`); 50 51 info("cert o=" + eeCert.organization); 52 info("cert issuer o=" + eeCert.issuerOrganization); 53 return checkCertErrorGeneric( 54 certdb, 55 eeCert, 56 eeExpectedError, 57 Ci.nsIX509CertDB.verifyUsageTLSServer 58 ); 59 } 60 61 /** 62 * Tests various RSA chains. 63 * 64 * @param {number} inadequateKeySize 65 * @param {number} adequateKeySize 66 */ 67 async function checkRSAChains(inadequateKeySize, adequateKeySize) { 68 // Chain with certs that have adequate sizes for DV 69 await checkChain( 70 "rsa", 71 adequateKeySize, 72 "rsa", 73 adequateKeySize, 74 "rsa", 75 adequateKeySize, 76 PRErrorCodeSuccess 77 ); 78 79 // Chain with a root cert that has an inadequate size for DV 80 await checkChain( 81 "rsa", 82 inadequateKeySize, 83 "rsa", 84 adequateKeySize, 85 "rsa", 86 adequateKeySize, 87 MOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE 88 ); 89 90 // Chain with an intermediate cert that has an inadequate size for DV 91 await checkChain( 92 "rsa", 93 adequateKeySize, 94 "rsa", 95 inadequateKeySize, 96 "rsa", 97 adequateKeySize, 98 MOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE 99 ); 100 101 // Chain with an end entity cert that has an inadequate size for DV 102 await checkChain( 103 "rsa", 104 adequateKeySize, 105 "rsa", 106 adequateKeySize, 107 "rsa", 108 inadequateKeySize, 109 MOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE 110 ); 111 } 112 113 async function checkECCChains() { 114 await checkChain( 115 "secp256r1", 116 256, 117 "secp384r1", 118 384, 119 "secp521r1", 120 521, 121 PRErrorCodeSuccess 122 ); 123 await checkChain( 124 "secp256r1", 125 256, 126 "secp224r1", 127 224, 128 "secp256r1", 129 256, 130 SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE 131 ); 132 await checkChain( 133 "secp256r1", 134 256, 135 "secp256r1", 136 256, 137 "secp224r1", 138 224, 139 SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE 140 ); 141 await checkChain( 142 "secp224r1", 143 224, 144 "secp256r1", 145 256, 146 "secp256r1", 147 256, 148 SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE 149 ); 150 await checkChain( 151 "secp256r1", 152 256, 153 "secp256r1", 154 256, 155 "secp256k1", 156 256, 157 SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE 158 ); 159 await checkChain( 160 "secp256k1", 161 256, 162 "secp256r1", 163 256, 164 "secp256r1", 165 256, 166 SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE 167 ); 168 } 169 170 async function checkCombinationChains() { 171 await checkChain( 172 "rsa", 173 2048, 174 "secp256r1", 175 256, 176 "secp384r1", 177 384, 178 PRErrorCodeSuccess 179 ); 180 await checkChain( 181 "rsa", 182 2048, 183 "secp256r1", 184 256, 185 "secp224r1", 186 224, 187 SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE 188 ); 189 await checkChain( 190 "secp256r1", 191 256, 192 "rsa", 193 1016, 194 "secp256r1", 195 256, 196 MOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE 197 ); 198 } 199 200 add_task(async function () { 201 await checkRSAChains(1016, 1024); 202 await checkECCChains(); 203 await checkCombinationChains(); 204 });