From c70ff166952b3d7c325a6db8d42751e82f86ae31 Mon Sep 17 00:00:00 2001
From: Rasmus Dahlberg <rasmus.dahlberg@kau.se>
Date: Fri, 27 Nov 2020 20:15:58 +0100
Subject: added verifySignature tests

---
 crypto_test.go | 67 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 66 insertions(+), 1 deletion(-)

diff --git a/crypto_test.go b/crypto_test.go
index b7179f3..b6c168b 100644
--- a/crypto_test.go
+++ b/crypto_test.go
@@ -6,6 +6,9 @@ import (
 	"fmt"
 	"testing"
 
+	"crypto/ed25519"
+	"crypto/tls"
+
 	cttestdata "github.com/google/certificate-transparency-go/trillian/testdata"
 	"github.com/system-transparency/stfe/x509util"
 	"github.com/system-transparency/stfe/x509util/testdata"
@@ -100,8 +103,70 @@ func TestBuildChainFromDerList(t *testing.T) {
 	}
 }
 
-// TODO: TestVerifySignature
 func TestVerifySignature(t *testing.T) {
+	lp := makeTestLogParameters(t, nil)
+	for _, table := range []struct {
+		description string
+		certificate []byte // pem
+		key         []byte // pem
+		scheme      tls.SignatureScheme
+		wantErr     bool
+	}{
+		{
+			description: "invalid signature scheme",
+			certificate: testdata.EndEntityCertificate,
+			key:         testdata.EndEntityPrivateKey,
+			scheme:      tls.ECDSAWithP256AndSHA256,
+			wantErr:     true,
+		},
+		{
+			description: "invalid signature: certificate and key mismatch",
+			certificate: testdata.EndEntityCertificate,
+			key:         testdata.EndEntityPrivateKey2,
+			scheme:      tls.Ed25519,
+			wantErr:     true,
+		},
+		{
+			description: "valid signature",
+			certificate: testdata.EndEntityCertificate,
+			key:         testdata.EndEntityPrivateKey,
+			scheme:      tls.Ed25519,
+		},
+	} {
+		msg := []byte("msg")
+		key, err := x509util.NewEd25519PrivateKey(table.key)
+		if err != nil {
+			t.Fatalf("must make ed25519 signing key: %v", err)
+		}
+		list, err := x509util.NewCertificateList(table.certificate)
+		if err != nil {
+			t.Fatalf("must make certificate list: %v", err)
+		}
+		if len(list) != 1 {
+			t.Fatalf("must make one certificate: got %d", len(list))
+		}
+		certificate := list[0]
+		sig := ed25519.Sign(key, msg)
+
+		err = lp.verifySignature(certificate, table.scheme, msg, sig)
+		if got, want := err != nil, table.wantErr; got != want {
+			t.Errorf("got error=%v but wanted %v in test %q: %v", got, want, table.description, err)
+		}
+		if err != nil {
+			continue
+		}
+
+		msg[0] += 1 // modify message
+		if err = lp.verifySignature(certificate, table.scheme, msg, sig); err == nil {
+			t.Errorf("got no error for modified msg in test %q", table.description)
+		}
+
+		msg[0] -= 1 // restore message
+		sig[0] += 1 // modify signature
+		if err = lp.verifySignature(certificate, table.scheme, msg, sig); err == nil {
+			t.Errorf("got no error for modified signature in test %q", table.description)
+		}
+	}
 }
 
 // TestGenV1Sdi tests that a signature failure works as expected, and that
-- 
cgit v1.2.3