50 lines
2.4 KiB
Bash
Executable File
50 lines
2.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ©AngelaMos | 2026
|
|
# demo.sh
|
|
|
|
set -euo pipefail
|
|
|
|
MOD="${HSM_MODULE:-/hsm/lib/libhsm.so.0.1.0}"
|
|
SO_PIN=12345678
|
|
PIN=1234
|
|
WORK="$(mktemp -d)"
|
|
mkdir -p "$(dirname "$ANGELAMOS_HSM_TOKEN")" "$(dirname "$ANGELAMOS_HSM_OBJECTS")"
|
|
|
|
line() { printf '\n\033[1m== %s ==\033[0m\n' "$1"; }
|
|
|
|
line "AngelaMos HSM — PKCS#11 module loaded by OpenSC pkcs11-tool"
|
|
pkcs11-tool --module "$MOD" --init-token --label angelamos --so-pin "$SO_PIN" >/dev/null
|
|
pkcs11-tool --module "$MOD" --init-pin --so-pin "$SO_PIN" --pin "$PIN" >/dev/null
|
|
pkcs11-tool --module "$MOD" -I
|
|
|
|
line "Supported mechanisms"
|
|
pkcs11-tool --module "$MOD" -M
|
|
|
|
line "RSA-2048 — generate, sign (SHA256-RSA-PKCS), verify"
|
|
pkcs11-tool --module "$MOD" --login --pin "$PIN" --keypairgen --key-type RSA:2048 --label rsa --id 01 2>/dev/null
|
|
printf 'invoice #42 total $1000' > "$WORK/msg"
|
|
pkcs11-tool --module "$MOD" --login --pin "$PIN" --sign --mechanism SHA256-RSA-PKCS --id 01 -i "$WORK/msg" -o "$WORK/rsa.sig" 2>/dev/null
|
|
pkcs11-tool --module "$MOD" --login --pin "$PIN" --verify --mechanism SHA256-RSA-PKCS --id 01 -i "$WORK/msg" --signature-file "$WORK/rsa.sig"
|
|
|
|
line "EC P-256 — generate, sign (ECDSA-SHA256), verify"
|
|
pkcs11-tool --module "$MOD" --login --pin "$PIN" --keypairgen --key-type EC:prime256v1 --label ec --id 02 2>/dev/null
|
|
pkcs11-tool --module "$MOD" --login --pin "$PIN" --sign --mechanism ECDSA-SHA256 --id 02 -i "$WORK/msg" -o "$WORK/ec.sig" 2>/dev/null
|
|
pkcs11-tool --module "$MOD" --login --pin "$PIN" --verify --mechanism ECDSA-SHA256 --id 02 -i "$WORK/msg" --signature-file "$WORK/ec.sig"
|
|
|
|
line "AES-256 — generate, encrypt (AES-CBC), decrypt, compare"
|
|
pkcs11-tool --module "$MOD" --login --pin "$PIN" --keygen --key-type AES:32 --label aes --id 03 2>/dev/null
|
|
printf '0123456789ABCDEF' > "$WORK/pt"
|
|
IV=000102030405060708090a0b0c0d0e0f
|
|
pkcs11-tool --module "$MOD" --login --pin "$PIN" --encrypt --mechanism AES-CBC --id 03 --iv "$IV" -i "$WORK/pt" -o "$WORK/ct" 2>/dev/null
|
|
pkcs11-tool --module "$MOD" --login --pin "$PIN" --decrypt --mechanism AES-CBC --id 03 --iv "$IV" -i "$WORK/ct" -o "$WORK/dec" 2>/dev/null
|
|
if cmp -s "$WORK/pt" "$WORK/dec"; then
|
|
echo "AES-CBC round-trip: plaintext recovered OK"
|
|
else
|
|
echo "AES-CBC round-trip: MISMATCH" && exit 1
|
|
fi
|
|
|
|
line "Token objects (private material sealed at rest under Argon2id(User-PIN))"
|
|
pkcs11-tool --module "$MOD" --login --pin "$PIN" -O
|
|
|
|
line "Demo complete — RSA + ECDSA signatures verified, AES-CBC round-trip OK"
|