Skip to content

Commit 68b49bb

Browse files
ralienppralienpp
authored
Merge pull request #44 from Guiliano99/UpdateURLSetup
Simplify and Refactor PKIMessage Exchange Flows
2 parents e0f68d5 + d1a945d commit 68b49bb

File tree

11 files changed

+141
-104
lines changed

11 files changed

+141
-104
lines changed

‎resources/keywords.resource‎

Lines changed: 3 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1657,34 +1657,6 @@ Get Composite Issuing URL
16571657
${url}= Add URL Suffix ${CA_BASE_URL} ${COMPOSITE_URL_PREFIX}
16581658
RETURN ${url}
16591659

1660-
Exchange PKIMessage PQ
1661-
[Documentation] Exchange a PKIMessage with the PQ issuing endpoint.
1662-
...
1663-
... Arguments:
1664-
... ---------
1665-
... - `pki_message` (PKIMessage): The PKIMessage to be exchanged.
1666-
...
1667-
... Returns:
1668-
... -------
1669-
... - The response PKIMessage from the PQ issuing endpoint.
1670-
...
1671-
... Examples:
1672-
... --------
1673-
... | ${response}= | Exchange PKIMessage PQ | ${pki_message} |
1674-
...
1675-
[Tags] pqc
1676-
[Arguments] ${pki_message}
1677-
${url}= Get PQ Issuing URL
1678-
${response}= Exchange PKIMessage ${pki_message} ${url}
1679-
RETURN ${response}
1680-
1681-
Exchange PKIMessage PQ Stateful
1682-
[Documentation] Exchange a PKIMessage with the PQ stateful issuing endpoint.
1683-
[Arguments] ${pki_message}
1684-
${url}= Get PQ Stateful Issuing URL
1685-
${response}= Exchange PKIMessage ${pki_message} ${url}
1686-
RETURN ${response}
1687-
16881660
Prepare Related Cert URL
16891661
[Documentation] Prepare the URL for the related certificate, by adding the serial number to the URL.
16901662
...
@@ -1739,10 +1711,10 @@ Setup PQ Sig Cert
17391711
... recipient=${RECIPIENT} exclude_fields=sender,senderKID
17401712
${prot_ir}= Default Protect PKIMessage ${ir}
17411713
END
1742-
${response}= Exchange PKIMessage PQ ${prot_ir}
1714+
${url}= Get PQ Issuing URL
1715+
${response}= Exchange PKIMessage ${prot_ir} url=${url}
17431716
PKIMessage Body Type Must Be ${response} ip
17441717
PKIStatus Must Be ${response} accepted
1745-
${url}= Get PQ Issuing URL
17461718
${pq_cert}= Confirm Certificate If Needed ${response} url=${url} protection=${protection}
17471719
${cert_chain}= Build CMP Chain From PKIMessage ${response} ${pq_cert}
17481720
Write Certs To Dir ${cert_chain} pq_sig_chain
@@ -1769,10 +1741,9 @@ Setup Composite Sig Cert
17691741
... recipient=${RECIPIENT} exclude_fields=sender,senderKID
17701742
${prot_ir}= Default Protect PKIMessage ${ir}
17711743
END
1772-
${response}= Exchange PKIMessage PQ ${prot_ir}
1744+
${response}= Exchange PKIMessage ${prot_ir} url=${url}
17731745
PKIMessage Body Type Must Be ${response} ip
17741746
PKIStatus Must Be ${response} accepted
1775-
${url}= Get PQ Issuing URL
17761747
${comp_cert}= Confirm Certificate If Needed ${response} url=${url} protection=${protection}
17771748
${cert_chain}= Build CMP Chain From PKIMessage ${response} ${comp_cert}
17781749
Write Certs To Dir ${cert_chain} composite_sig_chain

‎resources/setup_keywords.resource‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# SPDX-FileCopyrightText: Copyright 2025 Siemens AG # robocop: off=COM04
2+
#
3+
# SPDX-License-Identifier: Apache-2.0
4+
#
5+
6+
*** Settings ***
7+
Documentation Contain common keywords for setup the CMP tests, like overwriting variables or initializing resources.
8+
Resource ../config/${environment}.robot
9+
Resource ../resources/keywords.resource
10+
11+
12+
*** Variables ***
13+
${environment} cloudpki
14+
15+
16+
*** Keywords ***
17+
Set Up PQ Sig Suite
18+
[Documentation] Initializes the test suite for PQ signature algorithm tests.
19+
...
20+
... Executes the shared suite setup and configures the CMP URL to point to the
21+
... PQ issuing endpoint for certificate requests using stateless PQ signature algorithms
22+
... (e.g., ML-DSA).
23+
...
24+
... The CA_CMP_URL suite variable is updated to the PQ-specific endpoint.
25+
Set Up Test Suite
26+
${url}= Get PQ Issuing URL
27+
VAR ${CA_CMP_URL} ${url} scope=SUITE # robocop: off=VAR05
28+
29+
Set Up PQ Stateful Sig Suite
30+
[Documentation] Initializes the test suite for PQ stateful signature algorithm tests.
31+
...
32+
... Executes the shared suite setup and configures the CMP URL to point to the
33+
... PQ stateful issuing endpoint for certificate requests using XMSS, XMSSMT, or HSS algorithms.
34+
...
35+
... The CA_CMP_URL suite variable is updated to the PQ stateful-specific endpoint.
36+
Set Up Test Suite
37+
${url}= Get PQ Stateful Issuing URL
38+
VAR ${CA_CMP_URL} ${url} scope=SUITE # robocop: off=VAR05
39+
40+
Set Up PQ KEM Suite
41+
[Documentation] Initializes the test suite for PQ KEM (Key Encapsulation Mechanism) tests.
42+
...
43+
... Executes the shared suite setup and configures the CMP URL to point to the
44+
... PQ issuing endpoint for certificate requests using PQ KEM algorithms
45+
... (e.g., ML-KEM).
46+
...
47+
... The CA_CMP_URL suite variable is updated to the PQ-specific endpoint.
48+
Set Up Test Suite
49+
${url}= Get PQ Issuing URL
50+
VAR ${CA_CMP_URL} ${url} scope=SUITE
51+
52+
Set Up Hybrid Sig Suite
53+
[Documentation] Initializes the test suite for hybrid/composite signature algorithm tests.
54+
...
55+
... Executes the shared suite setup and configures the CMP URL to point to the
56+
... composite issuing endpoint for certificate requests using hybrid signature algorithms
57+
... (combinations of PQ and traditional algorithms).
58+
...
59+
... The CA_CMP_URL suite variable is updated to the composite-specific endpoint.
60+
Set Up Test Suite
61+
${url}= Get Composite Issuing URL
62+
VAR ${CA_CMP_URL} ${url} scope=SUITE # robocop: off=VAR05
63+
64+
Set Up Composite Sig Suite
65+
[Documentation] Initializes the test suite for composite signature algorithm tests.
66+
...
67+
... Executes the shared suite setup and configures the CMP URL to point to the
68+
... composite issuing endpoint for certificate requests using composite signature algorithms
69+
... (combinations of PQ and traditional algorithms).
70+
...
71+
... The CA_CMP_URL suite variable is updated to the composite-specific endpoint.
72+
Set Up Test Suite
73+
${url}= Get Composite Issuing URL
74+
VAR ${CA_CMP_URL} ${url} scope=SUITE # robocop: off=VAR05

‎tests_mock_ca/migration.robot‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1232,7 +1232,8 @@ Establish New Composite KEM SS
12321232
[Tags] composite-kem
12331233
[Arguments] ${kem_key} ${kem_cert}
12341234
${genm}= Build KEMBasedMAC General Message ${kem_key} ${kem_cert}
1235-
${genp}= Exchange PKIMessage PQ ${genm}
1235+
${url}= Get PQ Issuing URL
1236+
${genp}= Exchange PKIMessage ${genm} ${url}
12361237
${ss}= Validate Genp KEMCiphertextInfo ${genp} ${kem_key}
12371238
${tx_id}= Get Asn1 Value As Bytes ${genm} header.transactionID
12381239
RETURN ${ss} ${tx_id}

‎tests_pq_and_hybrid/composite_sig_alg_tests.robot‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ Documentation Test cases for Composite Signature Algorithms in all flavors. S
1111
1212
Resource ../config/${environment}.robot
1313
Resource ../resources/keywords.resource
14+
Resource ../resources/setup_keywords.resource
1415
Library Collections
1516
Library OperatingSystem
1617
Library ../resources/utils.py
@@ -25,7 +26,7 @@ Library ../pq_logic/hybrid_prepare.py
2526
Library ../pq_logic/pq_verify_logic.py
2627

2728
Test Tags hybrid hybrid-sig composite-sig verbose-alg verbose-tests pre_hash
28-
Suite Setup Set Up Test Suite
29+
Suite Setup Set Up Composite Sig Suite
2930
Test Template Request With Composite Sig
3031

3132

@@ -176,12 +177,6 @@ Valid COMPOSITE-SIG-13-ML-DSA-87-ECDSA-SECP521R1 Request
176177
177178

178179
*** Keywords ***
179-
Exchange Composite Sig Request
180-
[Documentation] Exchange a composite signature request with the CA.
181-
[Arguments] ${request}
182-
${response}= Exchange Migration PKIMessage ${request} ${CA_BASE_URL} ${COMPOSITE_URL_PREFIX}
183-
RETURN ${response}
184-
185180
Validate BadPOP Or Cert
186181
[Documentation] Validate the response for a bad POP or certificate.
187182
[Arguments] ${response} ${bad_pop} ${alg_name}
@@ -204,5 +199,5 @@ Request With Composite Sig
204199
... use_rsa_pss=${use_rsa_pss}
205200
${ir}= Build Ir From Key ${comp_key} cert_request=${cert_request} popo=${popo}
206201
${protected_ir}= Default Protect PKIMessage ${ir}
207-
${response}= Exchange Composite Sig Request ${protected_ir}
202+
${response}= Exchange PKIMessage ${protected_ir}
208203
Validate BadPOP Or Cert ${response} ${bad_pop} ${alg_name}

‎tests_pq_and_hybrid/hybrid_sig_tests.robot‎

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
Documentation General tests for CMP logic, not necessarily specific to the lightweight profile
77
88
Resource ../resources/keywords.resource
9+
Resource ../resources/setup_keywords.resource
910
Library Collections
1011
Library OperatingSystem
1112
Library ../resources/utils.py
@@ -16,7 +17,7 @@ Library ../resources/certbuildutils.py
1617
Library ../resources/protectionutils.py
1718
Library ../resources/checkutils.py
1819

19-
Suite Setup Set Up Test Suite
20+
Suite Setup Set Up Hybrid Sig Suite
2021
Test Tags pqc hybrid-sig
2122

2223

@@ -155,7 +156,7 @@ CA MUST Reject Composite RSA with invalid RSA key length
155156
${ir}= Build Ir From Key ${key} ${cm}
156157
... spki=${spki} recipient=${RECIPIENT} exclude_fields=sender,senderKID
157158
${protected_ir}= Default Protect PKIMessage ${ir}
158-
${response}= Exchange Composite Request ${protected_ir}
159+
${response}= Exchange PKIMessage ${protected_ir}
159160
PKIMessage Body Type Must Be ${response} error
160161
PKIStatus Must Be ${response} rejection
161162
PKIStatusInfo Failinfo Bit Must Be ${response} badCertTemplate,badDataFormat
@@ -177,7 +178,7 @@ CA MUST Reject Composite Sig with Traditional Revoked key Due Compromise
177178
... protection=signature
178179
... private_key=${revoked_key}
179180
... cert=${revoked_cert}
180-
${response}= Exchange Composite Request ${protected_ir}
181+
${response}= Exchange PKIMessage ${protected_ir}
181182
PKIMessage Body Type Must Be ${response} error
182183
PKIStatus Must Be ${response} rejection
183184

@@ -192,15 +193,6 @@ CA MUST Reject Issuing Already in use Traditional Key
192193
${ir}= Build Ir From Key ${key} cert_template=${cert_template}
193194
... recipient=${RECIPIENT} exclude_fields=senderKID,sender
194195
${protected_ir}= Default Protect PKIMessage ${ir}
195-
${response}= Exchange Composite Request ${protected_ir}
196+
${response}= Exchange PKIMessage ${protected_ir}
196197
PKIStatus Must Be ${response} rejection
197198
PKIStatusInfo Failinfo Bit Must Be ${response} badCertTemplate,badRequest
198-
199-
200-
*** Keywords ***
201-
Exchange Composite Request
202-
[Arguments] ${pki_message}
203-
[Documentation] Exchanges a PKIMessage for a composite algorithm with the CA and return the response.
204-
${url}= Add URL Suffix ${CA_BASE_URL} ${COMPOSITE_URL_PREFIX}
205-
${response}= Exchange PKIMessage ${pki_message} ${url}
206-
RETURN ${response}

‎tests_pq_and_hybrid/kem_tests.robot‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
Documentation General tests for CMP logic, not necessarily specific to the lightweight profile
77
88
Resource ../resources/keywords.resource
9+
Resource ../resources/setup_keywords.resource
910
Library Collections
1011
Library OperatingSystem
1112
Library ../resources/utils.py
@@ -22,7 +23,7 @@ Library ../pq_logic/pq_verify_logic.py
2223

2324
Test Tags kem pqc
2425

25-
Suite Setup Set Up Test Suite
26+
Suite Setup Set Up PQ KEM Suite
2627

2728

2829
*** Keywords ***
@@ -107,12 +108,12 @@ CA MUST support KEMBasedMAC
107108
${result}= Is Certificate And Key Set ${KEM_CERT} ${KEM_KEY}
108109
SKIP IF not ${result} KEM Certificate and Key not set
109110
${genm}= Build KEMBasedMAC General Message ${KEM_KEY} ${KEM_CERT}
110-
${genp}= Exchange PKIMessage PQ ${genm}
111+
${genp}= Exchange PKIMessage ${genm}
111112
${ss}= Validate Genp KEMCiphertextInfo ${genp} ${KEM_KEY}
112113
${tx_id}= Get Asn1 Value As Bytes ${genm} header.transactionID
113114
${protected_ir}= Build IR Request KEMBasedMac Protected
114115
... ${tx_id} ${ss} True
115-
${response}= Exchange PKIMessage PQ ${protected_ir}
116+
${response}= Exchange PKIMessage ${protected_ir}
116117
PKIStatus Must Be ${response} accepted
117118

118119
CA MUST Support KEMBasedMAC Until Certificate Is Confirmed
@@ -126,17 +127,17 @@ CA MUST Support KEMBasedMAC Until Certificate Is Confirmed
126127
${result}= Is Certificate And Key Set ${KEM_CERT} ${KEM_KEY}
127128
SKIP IF not ${result} KEM Certificate and Key not set
128129
${genm}= Build KEMBasedMAC General Message ${KEM_KEY} ${KEM_CERT}
129-
${genp}= Exchange PKIMessage PQ ${genm}
130+
${genp}= Exchange PKIMessage ${genm}
130131
${ss}= Validate Genp KEMCiphertextInfo ${genp} ${KEM_KEY}
131132
${tx_id}= Get Asn1 Value As Bytes ${genm} header.transactionID
132133
${protected_ir}= Build IR Request KEMBasedMac Protected
133134
... ${tx_id} ${ss} True
134-
${response}= Exchange PKIMessage PQ ${protected_ir}
135+
${response}= Exchange PKIMessage ${protected_ir}
135136
PKIStatus Must Be ${response} accepted
136137
${cert_conf}= Build Cert Conf From Resp ${response} sender=${SENDER}
137138
... recipient=${RECIPIENT} for_mac=True
138139
${cert_conf}= Protect PKIMessage KEMBasedMAC ${cert_conf} shared_secret=${ss}
139-
${response}= Exchange PKIMessage PQ ${cert_conf}
140+
${response}= Exchange PKIMessage ${cert_conf}
140141
PKIMessage Body Type Must Be ${response} pkiconf
141142

142143
CA Should Respond with the a valid KEMBasedMAC Protected Message
@@ -149,12 +150,12 @@ CA Should Respond with the a valid KEMBasedMAC Protected Message
149150
${result}= Is Certificate And Key Set ${KEM_CERT} ${KEM_KEY}
150151
SKIP IF not ${result} KEM Certificate and Key not set
151152
${genm}= Build KEMBasedMAC General Message ${KEM_KEY} ${KEM_CERT}
152-
${genp}= Exchange PKIMessage PQ ${genm}
153+
${genp}= Exchange PKIMessage ${genm}
153154
${ss}= Validate Genp KEMCiphertextInfo ${genp} ${KEM_KEY}
154155
${tx_id}= Get Asn1 Value As Bytes ${genm} header.transactionID
155156
${protected_ir}= Build IR Request KEMBasedMac Protected
156157
... ${tx_id} ${ss} True
157-
${response}= Exchange PKIMessage PQ ${protected_ir}
158+
${response}= Exchange PKIMessage ${protected_ir}
158159
PKIStatus Must Be ${response} accepted
159160
${prot_type}= Get Protection Type From PKIMessage ${response}
160161
IF not '${prot_type}' == 'kem_based_mac'
@@ -173,17 +174,17 @@ CA MUST Protect pkiconf message with KEMBasedMAC
173174
${result}= Is Certificate And Key Set ${KEM_CERT} ${KEM_KEY}
174175
SKIP IF not ${result} KEM Certificate and Key not set
175176
${genm}= Build KEMBasedMAC General Message ${KEM_KEY} ${KEM_CERT}
176-
${genp}= Exchange PKIMessage PQ ${genm}
177+
${genp}= Exchange PKIMessage ${genm}
177178
${ss}= Validate Genp KEMCiphertextInfo ${genp} ${KEM_KEY}
178179
${tx_id}= Get Asn1 Value As Bytes ${genm} header.transactionID
179180
${protected_ir}= Build IR Request KEMBasedMac Protected
180181
... ${tx_id} ${ss} True
181-
${response}= Exchange PKIMessage PQ ${protected_ir}
182+
${response}= Exchange PKIMessage ${protected_ir}
182183
PKIStatus Must Be ${response} accepted
183184
${cert_conf}= Build Cert Conf From Resp ${response} sender=${SENDER}
184185
... recipient=${RECIPIENT} for_mac=True
185186
${cert_conf}= Protect PKIMessage KEMBasedMAC ${cert_conf} shared_secret=${ss}
186-
${response}= Exchange PKIMessage PQ ${cert_conf}
187+
${response}= Exchange PKIMessage ${cert_conf}
187188
PKIMessage Body Type Must Be ${response} pkiconf
188189
${prot_type}= Get Protection Type From PKIMessage ${response}
189190
IF not '${prot_type}' == 'kem_based_mac'
@@ -201,12 +202,12 @@ CA Reject invalid KEMBasedMAC Protected Message
201202
${result}= Is Certificate And Key Set ${KEM_CERT} ${KEM_KEY}
202203
SKIP IF not ${result} KEM Certificate and Key not set
203204
${genm}= Build KEMBasedMAC General Message ${KEM_KEY} ${KEM_CERT}
204-
${genp}= Exchange PKIMessage PQ ${genm}
205+
${genp}= Exchange PKIMessage ${genm}
205206
${ss}= Validate Genp KEMCiphertextInfo ${genp} ${KEM_KEY}
206207
${tx_id}= Get Asn1 Value As Bytes ${genm} header.transactionID
207208
${protected_ir}= Build IR Request KEMBasedMac Protected
208209
... ${tx_id} ${ss} True ${None} True
209-
${response}= Exchange PKIMessage PQ ${protected_ir}
210+
${response}= Exchange PKIMessage ${protected_ir}
210211
PKIStatus Must Be ${response} rejection
211212
PKIStatusInfo Failinfo Bit Must Be ${response} badMessageCheck
212213

@@ -222,17 +223,17 @@ CA MUST not reuse the same ss for KEMBASEDMAC
222223
${url}= Get PQ Issuing URL
223224
${cm}= Get Next Common Name
224225
${genm}= Build KEMBasedMAC General Message ${KEM_KEY} ${KEM_CERT}
225-
${genp}= Exchange PKIMessage PQ ${genm}
226+
${genp}= Exchange PKIMessage ${genm}
226227
${ss}= Validate Genp KEMCiphertextInfo ${genp} ${KEM_KEY}
227228
${key}= Generate Default Key
228229
${tx_id}= Get Asn1 Value As Bytes ${genm} header.transactionID
229230
${protected_ir}= Build IR Request KEMBasedMac Protected
230231
... ${tx_id} ${ss} True ${None}
231-
${response}= Exchange PKIMessage PQ ${protected_ir}
232+
${response}= Exchange PKIMessage ${protected_ir}
232233
PKIStatus Must Be ${response} accepted
233234
${protected_ir}= Build IR Request KEMBasedMac Protected
234235
... ${tx_id} ${ss} True ${None}
235-
${response}= Exchange PKIMessage PQ ${protected_ir}
236+
${response}= Exchange PKIMessage ${protected_ir}
236237
PKIStatus Must Be ${response} rejection
237238
PKIStatusInfo Failinfo Bit Must Be ${response} badMessageCheck,badRequest,systemFailure
238239

0 commit comments

Comments
 (0)