Skip to content

Commit 5166b73

Browse files
feggefegge
committed
Updated signature operations test query
1 parent 5884c71 commit 5166b73

File tree

14 files changed

+258
-16
lines changed

14 files changed

+258
-16
lines changed

‎java/ql/lib/experimental/quantum/BouncyCastle/AlgorithmInstances.qll‎

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,13 @@ import FlowAnalysis
88
*/
99
abstract private class EllipticCurveAlgorithmInstance extends Crypto::EllipticCurveInstance {
1010
override Crypto::TEllipticCurveType getEllipticCurveType() {
11-
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.getRawEllipticCurveName(), _, result)
11+
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.getRawEllipticCurveName().toUpperCase(),
12+
_, result)
1213
}
1314

1415
override int getKeySize() {
15-
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.getRawEllipticCurveName(), result, _)
16+
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.getRawEllipticCurveName().toUpperCase(),
17+
result, _)
1618
}
1719
}
1820

@@ -22,7 +24,7 @@ abstract private class EllipticCurveAlgorithmInstance extends Crypto::EllipticCu
2224
class EllipticCurveStringLiteralInstance extends EllipticCurveAlgorithmInstance instanceof StringLiteral
2325
{
2426
EllipticCurveStringLiteralInstance() {
25-
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.getValue(), _, _)
27+
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.getValue().toUpperCase(), _, _)
2628
}
2729

2830
override string getRawEllipticCurveName() { result = super.getValue() }
@@ -76,7 +78,9 @@ class DSASignatureAlgorithmInstance extends SignatureAlgorithmInstance instanceo
7678

7779
abstract private class EllipticCurveSignatureAlgorithmInstance extends SignatureAlgorithmInstance,
7880
EllipticCurveAlgorithmInstance
79-
{ }
81+
{
82+
override Crypto::EllipticCurveInstance getEllipticCurve() { result = this }
83+
}
8084

8185
/**
8286
* Ed25519, Ed25519ph, and Ed25519ctx signers.
@@ -133,7 +137,6 @@ class ECDSASignatureAlgorithmInstance extends SignatureAlgorithmInstance instanc
133137
}
134138

135139
override Crypto::KeyOpAlg::Algorithm getAlgorithmType() {
136-
// We need to specify this explicitly since the key size is not fixed.
137140
result = Crypto::KeyOpAlg::TSignature(Crypto::KeyOpAlg::ECDSA())
138141
}
139142

@@ -181,7 +184,7 @@ class Ed25519KeyGenerationAlgorithmInstance extends EllipticCurveKeyGenerationAl
181184
super.getConstructedType().getName().matches("Ed25519%")
182185
}
183186

184-
override string getRawEllipticCurveName() { result = "CURVE25519" }
187+
override string getRawEllipticCurveName() { result = "Curve25519" }
185188
}
186189

187190
class Ed448KeyGenerationAlgorithmInstance extends EllipticCurveKeyGenerationAlgorithmInstance instanceof ClassInstanceExpr
@@ -191,7 +194,7 @@ class Ed448KeyGenerationAlgorithmInstance extends EllipticCurveKeyGenerationAlgo
191194
super.getConstructedType().getName().matches("Ed448%")
192195
}
193196

194-
override string getRawEllipticCurveName() { result = "CURVE25519" }
197+
override string getRawEllipticCurveName() { result = "Curve25519" }
195198
}
196199

197200
/**
@@ -208,7 +211,15 @@ class GenericEllipticCurveKeyGenerationAlgorithmInstance extends KeyGenerationAl
208211
}
209212

210213
override string getRawAlgorithmName() {
211-
typeNameToRawAlgorithmName(super.getConstructedType().getName(), result)
214+
// The generator constructs an elliptic curve key pair, but the algorithm is
215+
// not determined at key generation. As an example, the key could be used
216+
// for either ECDSA or ECDH For this reason, we just return "EllipticCurve".
217+
result = "EllipticCurve"
218+
}
219+
220+
override Crypto::KeyOpAlg::Algorithm getAlgorithmType() {
221+
// The algorithm type is not known. See above.
222+
result = Crypto::KeyOpAlg::TUnknownKeyOperationAlgorithmType()
212223
}
213224
}
214225

‎java/ql/test/experimental/library-tests/quantum/BouncyCastle/ECDSAP256SignAndVerify.java‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
import java.security.Security;
2+
import java.security.SecureRandom;
3+
import org.bouncycastle.crypto.AsymmetricCipherKeyPair;
4+
import org.bouncycastle.crypto.generators.ECKeyPairGenerator;
5+
import org.bouncycastle.crypto.params.ECDomainParameters;
6+
import org.bouncycastle.crypto.params.ECKeyGenerationParameters;
7+
import org.bouncycastle.crypto.params.ECPrivateKeyParameters;
8+
import org.bouncycastle.crypto.params.ECPublicKeyParameters;
9+
import org.bouncycastle.crypto.signers.ECDSASigner;
10+
import org.bouncycastle.jce.provider.BouncyCastleProvider;
11+
import org.bouncycastle.asn1.sec.SECNamedCurves;
12+
import org.bouncycastle.asn1.x9.X9ECParameters;
13+
14+
/**
15+
* Example of using Bouncy Castle's low-level API for ECDSA signing and verification over P-256.
16+
*/
17+
public class ECDSAP256SignAndVerify {
18+
public static void main(String[] args) {
19+
// Add Bouncy Castle provider
20+
Security.addProvider(new BouncyCastleProvider());
21+
22+
try {
23+
// Get P-256 curve parameters using BouncyCastle's SECNamedCurves
24+
String curveName = "secp256r1";
25+
X9ECParameters ecParams = SECNamedCurves.getByName(curveName);
26+
ECDomainParameters domainParams = new ECDomainParameters(ecParams);
27+
28+
// Generate a key pair
29+
SecureRandom random = new SecureRandom();
30+
ECKeyPairGenerator keyPairGenerator = new ECKeyPairGenerator();
31+
ECKeyGenerationParameters keyGenParams = new ECKeyGenerationParameters(domainParams, random);
32+
keyPairGenerator.init(keyGenParams);
33+
AsymmetricCipherKeyPair keyPair = keyPairGenerator.generateKeyPair();
34+
35+
ECPrivateKeyParameters privateKey = (ECPrivateKeyParameters) keyPair.getPrivate();
36+
ECPublicKeyParameters publicKey = (ECPublicKeyParameters) keyPair.getPublic();
37+
38+
byte[] message = "Hello, ECDSA P-256 signature!".getBytes("UTF-8");
39+
40+
// Sign the message
41+
ECDSASigner signer = new ECDSASigner();
42+
signer.init(true, privateKey); // true for signing
43+
// Note: ECDSA typically signs a hash of the message, not the message directly
44+
// For simplicity, we're signing the message bytes directly here
45+
java.math.BigInteger[] signature = signer.generateSignature(message);
46+
47+
System.out.println("Signature generated!");
48+
System.out.println("Signature r: " + signature[0].toString(16));
49+
System.out.println("Signature s: " + signature[1].toString(16));
50+
51+
// Verify the signature
52+
ECDSASigner verifier = new ECDSASigner();
53+
verifier.init(false, publicKey); // false for verification
54+
boolean verified = verifier.verifySignature(message, signature[0], signature[1]);
55+
56+
System.out.println("Signature verified: " + verified);
57+
} catch (Exception e) {
58+
e.printStackTrace();
59+
}
60+
}
61+
}

‎java/ql/test/experimental/library-tests/quantum/BouncyCastle/key_artifacts.expected‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
| Ed448SignAndVerify.java:21:47:21:80 | Key | CURVE25519 |
1+
| ECDSAP256SignAndVerify.java:33:47:33:80 | Key | Unknown |
2+
| ECDSAP256SignAndVerify.java:33:47:33:80 | Key | secp256r1 |
3+
| Ed448SignAndVerify.java:21:47:21:80 | Key | Curve25519 |
24
| Ed448SignAndVerify.java:21:47:21:80 | Key | Ed448 |
3-
| Ed25519SignAndVerify.java:21:47:21:80 | Key | CURVE25519 |
5+
| Ed25519SignAndVerify.java:21:47:21:80 | Key | Curve25519 |
46
| Ed25519SignAndVerify.java:21:47:21:80 | Key | Ed25519 |

‎java/ql/test/experimental/library-tests/quantum/BouncyCastle/key_generation_operations.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
| ECDSAP256SignAndVerify.java:33:47:33:80 | KeyGeneration | ECDSAP256SignAndVerify.java:24:32:24:42 | EllipticCurve | ECDSAP256SignAndVerify.java:33:47:33:80 | Key |
2+
| ECDSAP256SignAndVerify.java:33:47:33:80 | KeyGeneration | ECDSAP256SignAndVerify.java:30:51:30:74 | KeyOperationAlgorithm | ECDSAP256SignAndVerify.java:33:47:33:80 | Key |
13
| Ed448SignAndVerify.java:21:47:21:80 | KeyGeneration | Ed448SignAndVerify.java:19:54:19:80 | EllipticCurve | Ed448SignAndVerify.java:21:47:21:80 | Key |
24
| Ed448SignAndVerify.java:21:47:21:80 | KeyGeneration | Ed448SignAndVerify.java:19:54:19:80 | KeyOperationAlgorithm | Ed448SignAndVerify.java:21:47:21:80 | Key |
35
| Ed25519SignAndVerify.java:21:47:21:80 | KeyGeneration | Ed25519SignAndVerify.java:19:56:19:84 | EllipticCurve | Ed25519SignAndVerify.java:21:47:21:80 | Key |

‎java/ql/test/experimental/library-tests/quantum/BouncyCastle/signature_operations.expected‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
| Ed448SignAndVerify.java:32:32:32:57 | SignOperation | Ed448SignAndVerify.java:30:31:30:40 | Key | Ed448SignAndVerify.java:31:27:31:33 | Message | KeyOperationOutput |
2-
| Ed448SignAndVerify.java:40:32:40:66 | VerifyOperation | Ed448SignAndVerify.java:38:34:38:42 | Key | Ed448SignAndVerify.java:39:29:39:35 | Message | |
3-
| Ed25519SignAndVerify.java:32:32:32:57 | SignOperation | Ed25519SignAndVerify.java:30:31:30:40 | Key | Ed25519SignAndVerify.java:31:27:31:33 | Message | KeyOperationOutput |
4-
| Ed25519SignAndVerify.java:40:32:40:66 | VerifyOperation | Ed25519SignAndVerify.java:38:34:38:42 | Key | Ed25519SignAndVerify.java:39:29:39:35 | Message | |
1+
| ECDSAP256SignAndVerify.java:45:48:45:80 | SignOperation | ECDSAP256SignAndVerify.java:41:34:41:50 | KeyOperationAlgorithm | ECDSAP256SignAndVerify.java:42:31:42:40 | Key | ECDSAP256SignAndVerify.java:45:73:45:79 | Message | | SignatureOutput |
2+
| ECDSAP256SignAndVerify.java:54:32:54:92 | VerifyOperation | ECDSAP256SignAndVerify.java:52:36:52:52 | KeyOperationAlgorithm | ECDSAP256SignAndVerify.java:53:34:53:42 | Key | ECDSAP256SignAndVerify.java:54:57:54:63 | Message | SignatureInput | |
3+
| Ed448SignAndVerify.java:32:32:32:57 | SignOperation | Ed448SignAndVerify.java:29:34:29:70 | KeyOperationAlgorithm | Ed448SignAndVerify.java:30:31:30:40 | Key | Ed448SignAndVerify.java:31:27:31:33 | Message | | SignatureOutput |
4+
| Ed448SignAndVerify.java:40:32:40:66 | VerifyOperation | Ed448SignAndVerify.java:37:36:37:72 | KeyOperationAlgorithm | Ed448SignAndVerify.java:38:34:38:42 | Key | Ed448SignAndVerify.java:39:29:39:35 | Message | SignatureInput | |
5+
| Ed25519SignAndVerify.java:32:32:32:57 | SignOperation | Ed25519SignAndVerify.java:29:36:29:54 | KeyOperationAlgorithm | Ed25519SignAndVerify.java:30:31:30:40 | Key | Ed25519SignAndVerify.java:31:27:31:33 | Message | | SignatureOutput |
6+
| Ed25519SignAndVerify.java:40:32:40:66 | VerifyOperation | Ed25519SignAndVerify.java:37:38:37:56 | KeyOperationAlgorithm | Ed25519SignAndVerify.java:38:34:38:42 | Key | Ed25519SignAndVerify.java:39:29:39:35 | Message | SignatureInput | |

‎java/ql/test/experimental/library-tests/quantum/BouncyCastle/signature_operations.ql‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,15 @@
11
import java
22
import experimental.quantum.Language
33

4-
string getAnOutputArtifact(Crypto::KeyOperationNode n) {
4+
string getASignatureInput(Crypto::SignatureOperationNode n) {
5+
exists(Crypto::SignatureArtifactNode input |
6+
input = n.getASignatureArtifact() and result = input.toString()
7+
)
8+
or
9+
not exists(n.getASignatureArtifact()) and result = ""
10+
}
11+
12+
string getASignatureOutput(Crypto::SignatureOperationNode n) {
513
exists(Crypto::KeyOperationOutputNode output |
614
output = n.getAnOutputArtifact() and result = output.toString()
715
)
@@ -10,4 +18,5 @@ string getAnOutputArtifact(Crypto::KeyOperationNode n) {
1018
}
1119

1220
from Crypto::SignatureOperationNode n
13-
select n, n.getAKey(), n.getAnInputArtifact(), getAnOutputArtifact(n)
21+
select n, n.getAKnownAlgorithm(), n.getAKey(), n.getAnInputArtifact(), getASignatureInput(n),
22+
getASignatureOutput(n)

‎java/ql/test/stubs/bcprov-lts8on-2.73.7/org/bouncycastle/asn1/sec/SECNamedCurves.java‎

Lines changed: 13 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/ql/test/stubs/bcprov-lts8on-2.73.7/org/bouncycastle/asn1/x9/X9ECParameters.java‎

Lines changed: 27 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/ql/test/stubs/bcprov-lts8on-2.73.7/org/bouncycastle/crypto/generators/ECKeyPairGenerator.java‎

Lines changed: 16 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/ql/test/stubs/bcprov-lts8on-2.73.7/org/bouncycastle/crypto/params/ECDomainParameters.java‎

Lines changed: 15 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)