Ensure CMS with Explicit EC works

src/objects.c

@@ -4264,7 +4264,7 @@ static CK_RV import_ec_params(P11PROV_OBJ *key, const OSSL_PARAM params[])
     }
 
     curve_nid = EC_GROUP_get_curve_name(group);
-    if (curve_nid == NID_undef) {
+    if (curve_nid != NID_undef) {
         curve_name = OSSL_EC_curve_nid2name(curve_nid);
         if (!curve_name) {
             P11PROV_raise(ctx, CKR_KEY_INDIGESTIBLE, "Unknown curve");

tests/meson.build

@@ -114,6 +114,7 @@ test_programs = {
   'tpkey': ['tpkey.c', 'util.c'],
   'pincache': ['pincache.c'],
   'ccerts': ['ccerts.c', 'util.c'],
+  'tecx': ['tecx.c', 'util.c'],
 }
 
 test_executables = []

tests/setup.sh

@@ -391,9 +391,9 @@ else
     ECXCRTN="ecExplicitCert"
 
     ptool --write-object="${TESTSSRCDIR}/explicit_ec.key.der" --type=privkey \
-          --id="$KEYID" --label="${ECXCRTN}" 2>&1
+          --id="$KEYID" --label="${ECXCRTN}" --usage-sign --usage-derive 2>&1
     ptool --write-object="${TESTSSRCDIR}/explicit_ec.pub.der" --type=pubkey \
-          --id="$KEYID" --label="${ECXCRTN}" 2>&1
+          --id="$KEYID" --label="${ECXCRTN}" --usage-sign --usage-derive 2>&1
 
     ECXBASEURIWITHPINVALUE="pkcs11:id=${URIKEYID}?pin-value=${PINVALUE}"
     ECXBASEURIWITHPINSOURCE="pkcs11:id=${URIKEYID}?pin-source=file:${PINFILE}"

tests/tecx.c

@@ -0,0 +1,64 @@
+/* Copyright (C) 2023 Timo Teräs <[email protected]>
+   SPDX-License-Identifier: Apache-2.0 */
+
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <openssl/err.h>
+#include <openssl/store.h>
+#include <openssl/core_names.h>
+#include "util.h"
+
+static void ecdh_test(EVP_PKEY *a, EVP_PKEY *b)
+{
+    unsigned char secret[64];
+    size_t secretlen = 64;
+    EVP_PKEY_CTX *derivectx;
+
+    derivectx = EVP_PKEY_CTX_new_from_pkey(NULL, a, NULL);
+    if (!derivectx) {
+        fprintf(stderr, "EVP_PKEY_CTX_new_from_pkey failed!");
+        ossl_err_print();
+        exit(EXIT_FAILURE);
+    }
+
+    if (EVP_PKEY_derive_init(derivectx) != 1) {
+        fprintf(stderr, "EVP_PKEY_derive_init failed!");
+        ossl_err_print();
+        exit(EXIT_FAILURE);
+    }
+
+    if (EVP_PKEY_derive_set_peer(derivectx, b) != 1) {
+        fprintf(stderr, "EVP_PKEY_derive_set_peer failed!");
+        ossl_err_print();
+        exit(EXIT_FAILURE);
+    }
+
+    if (EVP_PKEY_derive(derivectx, secret, &secretlen) != 1) {
+        fprintf(stderr, "EVP_PKEY_derive failed!");
+        ossl_err_print();
+        exit(EXIT_FAILURE);
+    }
+
+    EVP_PKEY_CTX_free(derivectx);
+}
+
+int main(int argc, char *argv[])
+{
+    EVP_PKEY *a, *b;
+
+    if (argc != 3) {
+        fprintf(stderr, "Usage: %s [keyuri-a] [keyuri-b]\n", argv[0]);
+        exit(EXIT_FAILURE);
+    }
+    a = load_key(argv[1]);
+    b = load_key(argv[2]);
+
+    ecdh_test(a, b);
+
+    EVP_PKEY_free(a);
+    EVP_PKEY_free(b);
+
+    PRINTERR("ALL A-OK!\n");
+    exit(EXIT_SUCCESS);
+}

tests/tecxc

@@ -133,4 +133,8 @@ req -new -batch -key "${ECXPRIURI}" -out ${TMPPDIR}/ecdsa_csr.pem'
 ossl '
 req -in ${TMPPDIR}/ecdsa_csr.pem -verify -noout'
 
+title PARA "Additional test with Explicit EC keys"
+$CHECKER "${TESTBLDDIR}/tecx" "${ECXPRIURI}" "${ECXPUBURI}"
+
+
 exit 0