Merge branch 'development' into development-eddsa

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
2023-11-06 23:11:08 +01:00
parent b94810d31d 98e9b72b42
commit ba562da00e
44 changed files with 821 additions and 160 deletions
--- a/tests/build-in-docker.sh
+++ b/tests/build-in-docker.sh
@@ -1,7 +1,14 @@
 #!/bin/bash -eu

 source tests/docker_env.sh
+build_image
 #run_in_docker rm -rf CMakeFiles
 run_in_docker mkdir -p build_in_docker
-run_in_docker -w "$PWD/build_in_docker" cmake -DENABLE_EMULATION=1 ..
+run_in_docker -w "$PWD/build_in_docker" cmake -DENABLE_EMULATION=1 -D__FOR_CI=1 ..
 run_in_docker -w "$PWD/build_in_docker" make -j ${NUM_PROC}
+docker create --name temp_container pico-hsm-test:bullseye
+docker cp $PWD/build_in_docker/pico_hsm temp_container:/pico_hsm
+docker commit temp_container pico-hsm-test:bullseye
+docker stop temp_container
+docker rm temp_container
+docker image prune -f
--- a/tests/docker/bullseye/Dockerfile
+++ b/tests/docker/bullseye/Dockerfile
@@ -4,6 +4,8 @@ ARG DEBIAN_FRONTEND=noninteractive

 RUN apt update && apt upgrade -y
 RUN apt install -y apt-utils
+RUN apt autoremove -y
+RUN rm -rf /var/cache/apt/archives/*
 RUN apt install -y libccid \
    libpcsclite-dev \
    git \
@@ -15,16 +17,33 @@ RUN apt install -y libccid \
    gcc \
    make \
    build-essential \
-    opensc \
    python3 \
    python3-pip \
    swig \
+    libssl-dev \
    cmake \
+    vsmartcard-vpcd \
    && rm -rf /var/lib/apt/lists/*
-RUN pip3 install pytest pycvc cryptography pyscard
-RUN git clone https://github.com/polhenarejos/vsmartcard.git
-WORKDIR /vsmartcard/virtualsmartcard
-RUN autoreconf --verbose --install
-RUN ./configure --sysconfdir=/etc
-RUN make && make install
+RUN pip3 install pytest pycvc cryptography pyscard base58
+WORKDIR /
+RUN git clone https://github.com/OpenSC/OpenSC
+WORKDIR /OpenSC
+RUN git checkout tags/0.23.0
+RUN ./bootstrap
+RUN ./configure --enable-openssl
+RUN make -j `nproc`
+RUN make install
+RUN make clean
+RUN ldconfig
+WORKDIR /
+RUN git clone https://github.com/polhenarejos/pypicohsm.git
+RUN pip3 install -e pypicohsm
+RUN git clone https://github.com/CardContact/sc-hsm-embedded
+WORKDIR /sc-hsm-embedded
+RUN autoreconf -fi
+RUN ./configure
+RUN make -j `nproc`
+RUN make install
+RUN cp ./src/tests/sc-hsm-pkcs11-test /usr/local/bin/sc-hsm-pkcs11-test
+RUN make clean
 WORKDIR /
--- a/tests/docker_env.sh
+++ b/tests/docker_env.sh
@@ -72,14 +72,16 @@ else
    NUM_PROC="$(nproc)"
 fi

-# Build the Docker image
-echo "Getting docker image up to date (this may take a few minutes)..."
-${DOCKER} image build \
-    -t ${DOCKER_IMAGE_TAG} \
-    --cache-from=${DOCKER_IMAGE_TAG} \
-    --network host \
-    --build-arg MAKEFLAGS_PARALLEL="-j ${NUM_PROC}" \
-    tests/docker/${MBEDTLS_DOCKER_GUEST}
+build_image() {
+    # Build the Docker image
+    echo "Getting docker image up to date (this may take a few minutes)..."
+    ${DOCKER} image build \
+        -t ${DOCKER_IMAGE_TAG} \
+        --cache-from=${DOCKER_IMAGE_TAG} \
+        --network host \
+        --build-arg MAKEFLAGS_PARALLEL="-j ${NUM_PROC}" \
+        tests/docker/${MBEDTLS_DOCKER_GUEST}
+}

 run_in_docker()
 {
--- a/tests/run-test-in-docker.sh
+++ b/tests/run-test-in-docker.sh
@@ -1,5 +1,11 @@
 #!/bin/bash -eu

 source tests/docker_env.sh
-run_in_docker ./tests/start-up-and-test.sh

+if [[ $1 == "pkcs11" ]]; then
+    run_in_docker ./tests/start-up-and-test-pkcs11.sh
+elif [[ $1 == "sc-hsm-pkcs11" ]]; then
+    run_in_docker ./tests/scripts/sc_hsm_test.sh
+else
+    run_in_docker ./tests/start-up-and-test.sh
+fi
--- a/tests/scripts/aes.sh
+++ b/tests/scripts/aes.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+reset
+test $? -eq 0 || exit $?
+
+TEST_DATA="This is a text."
+
+echo "${TEST_DATA}" > test
+
+sc_tool() {
+    pkcs11-tool --module /usr/local/lib/libsc-hsm-pkcs11.so -l --pin 648219 $@
+}
+
+aeses=("16" "24" "32")
+
+for aes in ${aeses[*]}; do
+    echo "  Test AES (AES:${aes})"
+    echo -n "    Keygen... "
+    sc_tool --keygen --key-type "AES:${aes}" --id 1 --label "AES:${aes}" > /dev/null 2>&1
+    test $? -eq 0 && echo -n "." || exit $?
+    e=$(sc_tool --list-object --type secrkey 2>&1)
+    test $? -eq 0 && echo -n "." || exit $?
+    grep -q "AES length ${aes}" <<< $e && echo -n "." || exit $?
+    grep -q "AES:${aes}" <<< $e && echo -e ".\t${OK}" || exit $?
+
+    echo -n "    Encryption..."
+    sc_tool --encrypt --id 1 --input-file test --mechanism aes-cbc > crypted.aes 2>/dev/null
+    test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+    echo -n "    Decryption..."
+    e=$(sc_tool --decrypt --id 1 --input-file crypted.aes --mechanism aes-cbc 2>/dev/null)
+    test $? -eq 0 && echo -n "." || exit $?
+    grep -q "${TEST_DATA}" <<< $e && echo -e ".\t${OK}" || exit $?
+
+    sc_tool --delete --type secrkey --id 1 > /dev/null 2>&1
+done
+rm -rf test crypted.aes
--- a/tests/scripts/asym_cipher.sh
+++ b/tests/scripts/asym_cipher.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+reset
+test $? -eq 0 || exit $?
+
+rsa_encrypt_decrypt() {
+    openssl pkeyutl -encrypt -pubin -inkey 1.pub $2 -in $1 -out data.crypt
+    test $? -eq 0 && echo -n "." || exit $?
+    TDATA=$(tr -d '\0' < <(pkcs11-tool --id 1 --pin 648219 --decrypt $3 -i data.crypt 2>/dev/null))
+    test $? -eq 0 && echo -n "." || exit $?
+    if [[ ${TEST_STRING} != "$TDATA" ]]; then
+        exit 1
+    fi
+    test $? -eq 0 && echo -n "." || exit $?
+}
+
+TEST_STRING="This is a test string. Be safe, be secure."
+
+echo ${TEST_STRING} > data
+
+echo -n "  Keygen RSA 2048..."
+keygen_and_export rsa:2048
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+echo -n "  Test RSA-PKCS ciphering..."
+rsa_encrypt_decrypt data "-pkeyopt rsa_padding_mode:pkcs1" "--mechanism RSA-PKCS"
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+echo -n "  Test RSA-X-509 ciphering..."
+cp data data_pad
+tlen=${#TEST_STRING}
+dd if=/dev/zero bs=1 count=$((256-$tlen-1)) >> data_pad 2> /dev/null
+test $? -eq 0 && echo -n "." || exit $?
+rsa_encrypt_decrypt data_pad "-pkeyopt rsa_padding_mode:none" "--mechanism RSA-X-509"
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+echo -n "  Test RSA-PKCS-OAEP ciphering..."
+rsa_encrypt_decrypt data "-pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha256" "--mechanism RSA-PKCS-OAEP"
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+rm -rf data* 1.*
+pkcs11-tool -l --pin 648219 --delete-object --type privkey --id 1 > /dev/null 2>&1
+
+algs=("secp192r1" "secp256r1" "secp384r1" "secp521r1" "brainpoolP256r1" "brainpoolP384r1" "brainpoolP512r1" "secp192k1" "secp256k1")
+for alg in ${algs[*]}; do
+    echo -n "  Test EC derive with ${alg}..."
+    keygen_and_export ec:${alg}
+    test $? -eq 0 && echo -n "." || exit $?
+    openssl ecparam -genkey -name ${alg} > bob.pem 2>/dev/null
+    test $? -eq 0 && echo -n "." || exit $?
+    openssl ec -in bob.pem -pubout -outform DER > bob.der 2>/dev/null
+    test $? -eq 0 && echo -n "." || exit $?
+    pkcs11-tool --pin 648219 --id 1 --derive -i bob.der -o mine-bob.der > /dev/null 2>&1
+    test $? -eq 0 && echo -n "." || exit $?
+    openssl pkeyutl -derive -out bob-mine.der -inkey bob.pem -peerkey 1.pub 2>/dev/null
+    test $? -eq 0 && echo -n "." || exit $?
+    cmp bob-mine.der mine-bob.der
+    test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+    rm -rf data* 1.*
+    pkcs11-tool -l --pin 648219 --delete-object --type privkey --id 1 > /dev/null 2>&1
+done
--- a/tests/scripts/backup.sh
+++ b/tests/scripts/backup.sh
@@ -0,0 +1,60 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+reset
+test $? -eq 0 || exit $?
+
+sc_backup() {
+    for i in $(seq 1 $1); do
+        sc-hsm-tool --create-dkek-share dkek.${i}.pbe --password testpw > /dev/null 2>&1
+        test $? -eq 0 && echo -n "." || exit $?
+    done
+    sc-hsm-tool --initialize --so-pin 3537363231383830 --pin 648219 --dkek-shares $1 > /dev/null 2>&1
+    test $? -eq 0 && echo -n "." || exit $?
+    pkcs11-tool -l --pin 648219 -I > /dev/null 2>&1
+    test $? -eq 0 && echo -n "." || exit $?
+    for i in $(seq 1 $1); do
+        e=$(sc-hsm-tool --import-dkek-share dkek.${i}.pbe --password testpw 2>&1)
+        test $? -eq 0 && echo -n "." || exit $?
+        grep -q "DKEK share imported" <<< $e && echo -n "." || exit $?
+        grep -q "DKEK shares[[:blank:]]*: $1" <<< $e && echo -n "." || exit $?
+        if [[ $i -lt $1 ]]; then
+            grep -q "DKEK import pending, $(( $1 - $i ))" <<< $e && echo -n "." || exit $?
+        fi
+    done
+    # Store DKEK, since it is not logged in
+    pkcs11-tool -l --pin 648219 -I > /dev/null 2>&1
+    test $? -eq 0 && echo -n "." || exit $?
+}
+echo -n "  Test single DKEK..."
+sc_backup 1
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+echo -n "  Test multiple DKEK..."
+sc_backup 3
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+rm -rf dkek.*.pbe
+
+echo "  Test backup and restore"
+algs=("rsa:1024" "rsa:2048" "ec:secp192r1" "ec:secp256r1" "ec:secp384r1" "ec:secp521r1" "ec:brainpoolP256r1" "ec:brainpoolP384r1" "ec:brainpoolP512r1" "ec:secp192k1" "ec:secp256k1")
+for alg in ${algs[*]}; do
+    echo -n "    Keygen ${alg}..."
+    gen_and_check ${alg}
+    test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+    echo -n "    Wrap key..."
+    sc-hsm-tool --wrap-key wrap-key.bin --key-reference 1 --pin 648219 > /dev/null 2>&1
+    test $? -eq 0 && echo -n "." || exit $?
+    e=$(pkcs15-tool -D 2>&1)
+    grep -q "Key ref[[:blank:]]*: 10" <<< $e && exit $? || echo -e ".\t${OK}"
+    echo -n "    Unwrap key..."
+    sc-hsm-tool --unwrap-key wrap-key.bin --key-reference 10 --pin 648219 --force > /dev/null 2>&1
+    test $? -eq 0 && echo -n "." || exit $?
+    e=$(pkcs15-tool -D 2>&1)
+    grep -q "Key ref[[:blank:]]*: 10" <<< $e && echo -e ".\t${OK}" || exit $?
+    echo -n "    Cleaning..."
+    pkcs11-tool -l --pin 648219 --delete-object --type privkey --id 1 > /dev/null 2>&1
+    test $? -eq 0 && echo -n "." || exit $?
+    pkcs11-tool -l --pin 648219 --delete-object --type privkey --id 1 > /dev/null 2>&1
+    test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+done
--- a/tests/scripts/func.sh
+++ b/tests/scripts/func.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+
+OK="\033[32mok\033[0m"
+FAIL="\033[31mfail\033[0m"
+
+gen_and_check() {
+    e=$(pkcs11-tool -l --pin 648219 --keypairgen --key-type $1 --id 1 --label "TestLabel" 2>&1)
+    test $? -eq 0 && echo -n "." || exit $?
+    glabel=""
+    case $1 in
+    *"192"*)
+        glabel="EC_POINT 192 bits"
+        ;;
+    *"256"*)
+        glabel="EC_POINT 256 bits"
+        ;;
+    *"384"*)
+        glabel="EC_POINT 384 bits"
+        ;;
+    *"512"*)
+        glabel="EC_POINT 512 bits"
+        ;;
+    *"521"*)
+        glabel="EC_POINT 528 bits"
+        ;;
+    *"rsa"*)
+        IFS=: read -r v1 bits <<< "$1"
+        glabel="RSA ${bits} bits"
+        ;;
+    esac
+    grep -q "${glabel}" <<< $e && echo -n "." || exit $?
+}
+gen_and_delete() {
+    gen_and_check $1
+    test $? -eq 0 && echo -n "." || exit $?
+    pkcs11-tool -l --pin 648219 --delete-object --type privkey --id 1 > /dev/null 2>&1
+    test $? -eq 0 && echo -n "." || exit $?
+}
+reset() {
+    python3 tools/pico-hsm-tool.py --pin 648219 initialize --so-pin 57621880 --silent > /dev/null 2>&1
+    test $? -eq 0 || exit $?
+}
+
+keygen_and_export() {
+    gen_and_check $1
+    test $? -eq 0 && echo -n "." || exit $?
+    pkcs11-tool --read-object --pin 648219 --id 1 --type pubkey > 1.der 2>/dev/null
+    test $? -eq 0 && echo -n "." || exit $?
+    IFS=: read -r mk bts <<< "$1"
+    openssl ${mk} -inform DER -outform PEM -in 1.der -pubin > 1.pub 2>/dev/null
+    test $? -eq 0 && echo -n "." || exit $?
+}
--- a/tests/scripts/initialize.sh
+++ b/tests/scripts/initialize.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+reset
+
+# Change SO-PIN
+echo -n "  Test SO-PIN change..."
+pkcs11-tool --login --login-type so --so-pin 3537363231383830 --change-pin --new-pin 0123456789012345 > /dev/null 2>&1
+test $? -eq 0 && echo -n "." || exit $?
+
+pkcs11-tool --login --login-type so --so-pin 0123456789012345 --change-pin --new-pin 3537363231383830 > /dev/null 2>&1
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+# Change PIN
+echo -n "  Test PIN change..."
+pkcs11-tool --login --pin 648219 --change-pin --new-pin 123456 > /dev/null 2>&1
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+# Reset PIN
+echo -n "  Test PIN reset..."
+pkcs11-tool --login --login-type so --so-pin 3537363231383830 --init-pin --new-pin 648219 > /dev/null 2>&1
+test $? -eq 0 && echo -n "." || exit $?
+
+# Change PIN
+pkcs11-tool --login --pin 648219 --change-pin --new-pin 123456 > /dev/null 2>&1
+test $? -eq 0 && echo -n "." || exit $?
+
+pkcs11-tool --login --pin 123456 --change-pin --new-pin 648219 > /dev/null 2>&1
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+# Wrong PIN (1st and 2nd PIN_INCORRECT, 3rd PIN_LOCKED)
+echo -n "  Test wrong PIN attempts..."
+e=$(pkcs11-tool --login --pin 123456 -I 2>&1)
+test $? -eq 1 && echo -n "." || exit $?
+grep -q CKR_PIN_INCORRECT <<< $e && echo -n "." || exit $?
+e=$(pkcs11-tool --login --pin 123456 -I 2>&1)
+test $? -eq 1 && echo -n "." || exit $?
+grep -q CKR_PIN_INCORRECT <<< $e && echo -n "." || exit $?
+e=$(pkcs11-tool --login --pin 123456 -I 2>&1)
+test $? -eq 1 && echo -n "." || exit $?
+grep -q CKR_PIN_LOCKED <<< $e && echo -e "\t${OK}" || exit $?
+
+# Reset PIN
+echo -n "  Test restore PIN..."
+pkcs11-tool --login --login-type so --so-pin 3537363231383830 --init-pin --new-pin 648219 > /dev/null 2>&1
+test $? -eq 0 && echo -n "." || exit $?
+
+pkcs11-tool --login --pin 648219 -I > /dev/null 2>&1
+test $? -eq 0 && echo -e "\t${OK}" || exit $?
--- a/tests/scripts/keygen.sh
+++ b/tests/scripts/keygen.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+reset
+test $? -eq 0 || exit $?
+
+algs=("rsa:1024" "rsa:2048" "ec:secp192r1" "ec:secp256r1" "ec:secp384r1" "ec:secp521r1" "ec:brainpoolP256r1" "ec:brainpoolP384r1" "ec:brainpoolP512r1" "ec:secp192k1" "ec:secp256k1")
+for alg in ${algs[*]}; do
+    IFS=: read -r a s <<< "${alg}"
+    au=$(awk '{print toupper($0)}' <<<${a})
+    echo -n "  Test ${au} ${s}..."
+    gen_and_delete ${alg} && echo -e ".\t${OK}" || exit $?
+done
--- a/tests/scripts/pkcs11.sh
+++ b/tests/scripts/pkcs11.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+echo "==== Test initialization ===="
+./tests/scripts/initialize.sh
+test $? -eq 0 || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
+
+echo "==== Test keygen ===="
+./tests/scripts/keygen.sh
+test $? -eq 0 || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
+
+echo "==== Test sign and verify ===="
+./tests/scripts/sign_and_verify.sh
+test $? -eq 0 || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
+
+echo "==== Test asymmetric ciphering ===="
+./tests/scripts/asym_cipher.sh
+test $? -eq 0 || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
+
+echo "==== Test binary storage ===="
+./tests/scripts/store_binary.sh
+test $? -eq 0 || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
+
+echo "==== Test AES ===="
+./tests/scripts/aes.sh
+test $? -eq 0 || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
+
+echo "==== Test PKCS11-tool ===="
+./tests/scripts/pkcs11_test.sh
+test $? -eq 0 || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
+
+echo "==== Test backup and restore ===="
+./tests/scripts/backup.sh
+test $? -eq 0 || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
--- a/tests/scripts/pkcs11_test.sh
+++ b/tests/scripts/pkcs11_test.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+reset
+test $? -eq 0 || exit $?
+
+echo -n "  Test PKCS11 tool..."
+gen_and_check rsa:2048
+test $? -eq 0 && echo -n "." || exit $?
+e=$(pkcs11-tool --test -l --pin 648219 2>&1)
+test $? -eq 0 && echo -n "." || exit $?
+grep -q "No errors" <<< $e && echo -n "." || exit $?
+pkcs11-tool -l --pin 648219 --delete-object --type privkey --id 1 > /dev/null 2>&1
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+#e=$(pkcs11-tool --test-ec -l --pin 648219 --id 1 --key-type ec:secp256r1 2>&1)
+#test $? -eq 0 && echo -n "." || exit $?
+#grep -q "==> OK" <<< $e && echo -e ".\t${OK}" || exit $?
--- a/tests/scripts/sc_hsm_test.sh
+++ b/tests/scripts/sc_hsm_test.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+source ./tests/startup.sh
+
+echo "==== Test SC HSM ===="
+echo -n "  Running sc-hsm-pkcs11-test..."
+pkcs11-tool -l --pin 648219 --keypairgen --key-type ec:secp256r1 --id 1 --label "TestLabel" > /dev/null 2>&1
+test $? -eq 0 && echo -n "." ||  {
+    echo -e "\t${FAIL}"
+    exit 1
+}
+e=$(/usr/local/bin/sc-hsm-pkcs11-test --module /usr/local/lib/libsc-hsm-pkcs11.so --pin 648219 --invasive 2>&1)
+test $? -eq 0 && echo -n "." || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
+grep -q "338 tests performed" <<< $e && echo -n "." || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
+grep -q "0 tests failed" <<< $e && echo -e ".\t${OK}" || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
--- a/tests/scripts/sign_and_verify.sh
+++ b/tests/scripts/sign_and_verify.sh
@@ -0,0 +1,126 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+reset
+test $? -eq 0 || exit $?
+
+TEST_DATA="This is a test string. Be safe, be secure."
+echo ${TEST_DATA}  > data
+
+create_dgst() {
+    openssl dgst -$1 -binary -out data.$1 data > /dev/null 2>&1
+    test $? -eq 0 && echo -n "." || exit $?
+}
+
+dgsts=("sha1" "sha224" "sha256" "sha384" "sha512")
+for dgst in ${dgsts[*]}; do
+    echo -n "  Create digest ${dgst}..."
+    create_dgst ${dgst}
+    test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+done
+
+# $1 sign mechanism
+# $2 sign input file
+# $3 sign parameters
+# $4 vrfy input file
+# $5 vrfy parameters
+sign_and_verify() {
+    pkcs11-tool --id 1 --sign --pin 648219 --mechanism $1 -i $2 -o data.sig $3 > /dev/null 2>&1
+    test $? -eq 0 && echo -n "." || exit $?
+    e=$(openssl pkeyutl -verify -pubin -inkey 1.pub -in $4 -sigfile data.sig $5 2>&1)
+    test $? -eq 0 && echo -n "." || exit $?
+    grep -q "Signature Verified Successfully" <<< $e && echo -n "." || exit $?
+}
+
+sign_and_verify_rsa_pkcs() {
+    dgstl=$(awk '{print tolower($0)}' <<<$1)
+    dgstu=$(awk '{print toupper($0)}' <<<$1)
+    sign_and_verify "${dgstu}-RSA-PKCS" data "" data.${dgstl} "-pkeyopt digest:${dgstl}"
+    test $? -eq 0 && echo -n "." || exit $?
+}
+
+sign_and_verify_rsa_pss() {
+    dgstl=$(awk '{print tolower($0)}' <<<$1)
+    dgstu=$(awk '{print toupper($0)}' <<<$1)
+    sign_and_verify "RSA-PKCS-PSS" data.${dgstl} "--mgf MGF1-${dgstu} --hash-algorithm ${dgstu}" data.${dgstl} "-pkeyopt rsa_padding_mode:pss -pkeyopt rsa_pss_saltlen:-1 -pkeyopt digest:${dgstl}"
+    test $? -eq 0 && echo -n "." || exit $?
+}
+
+sign_and_verify_rsa_pss_dgst() {
+    dgstl=$(awk '{print tolower($0)}' <<<$1)
+    dgstu=$(awk '{print toupper($0)}' <<<$1)
+    sign_and_verify "${dgstu}-RSA-PKCS-PSS" data "" data.${dgstl} "-pkeyopt rsa_padding_mode:pss -pkeyopt rsa_pss_saltlen:-1 -pkeyopt digest:${dgstl}"
+    test $? -eq 0 && echo -n "." || exit $?
+}
+
+keygen_sign_and_verify_ec() {
+    echo "  Test ECDSA with $1"
+    echo -n "    Keygen $1..."
+    keygen_and_export $1
+    test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+    for dgst in ${dgsts[*]}; do
+        dgstu=$(awk '{print toupper($0)}' <<<${dgst})
+        echo -n "    Test ECDSA with ${dgst} and $1..."
+        sign_and_verify ECDSA "data.${dgst}" "--signature-format openssl" data.${dgst}
+        test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+        echo -n "    Test ECDSA-${dgstu} with $1..."
+        sign_and_verify "ECDSA-${dgstu}" data "--signature-format openssl" data.${dgst}
+        test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+    done
+    echo -n "    Delete $1..."
+    pkcs11-tool -l --pin 648219 --delete-object --type privkey --id 1 > /dev/null 2>&1
+    test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+}
+
+algs=("ec:secp192r1" "ec:secp256r1" "ec:secp384r1" "ec:secp521r1" "ec:brainpoolP256r1" "ec:brainpoolP384r1" "ec:brainpoolP512r1" "ec:secp192k1" "ec:secp256k1")
+for alg in ${algs[*]}; do
+    keygen_sign_and_verify_ec ${alg} || exit $?
+done
+
+echo "  Test RSA PKCS"
+echo -n "    Keygen rsa:2048..."
+keygen_and_export "rsa:2048"
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+echo -n "    Test RSA-PKCS..."
+pkcs11-tool --id 1 --sign --pin 648219 --mechanism RSA-PKCS -i data -o data.sig > /dev/null 2>&1
+test $? -eq 0 && echo -n "." || exit $?
+e=$(openssl pkeyutl -verify -pubin -inkey 1.pub -in data -sigfile data.sig 2>&1)
+test $? -eq 0 && echo -n "." || exit $?
+grep -q "Signature Verified Successfully" <<< $e && echo -e ".\t${OK}" || exit $?
+
+for dgst in ${dgsts[*]}; do
+    dgstu=$(awk '{print toupper($0)}' <<<${dgst})
+    echo -n "    Test RSA-PKCS-${dgstu}..."
+    sign_and_verify_rsa_pkcs ${dgst}
+    test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+done
+
+echo -n "    Test RSA-X-509..."
+cp data data_pad
+test $? -eq 0 && echo -n "." || exit $?
+tlen=${#TEST_DATA}
+dd if=/dev/zero bs=1 count=$((256-$tlen)) >> data_pad > /dev/null 2>&1
+test $? -eq 0 && echo -n "." || exit $?
+pkcs11-tool --id 1 --sign --pin 648219 --mechanism RSA-X-509 -i data_pad -o data.sig > /dev/null 2>&1
+test $? -eq 0 && echo -n "." || exit $?
+TDATA=$(tr -d '\0' < <(openssl rsautl -verify -inkey 1.pub -in data.sig -pubin -raw))
+if [[ ${TEST_DATA} != "$TDATA" ]]; then
+    exit 1
+fi
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+for dgst in ${dgsts[*]}; do
+    dgstu=$(awk '{print toupper($0)}' <<<${dgst})
+    if [[ "${dgst}" != "sha1" ]]; then
+        echo -n "    Test RSA-PKCS-PSS with ${dgst}..."
+        sign_and_verify_rsa_pss ${dgst}
+        test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+    fi
+    echo -n "    Test ${dgstu}-RSA-PKCS-PSS..."
+    sign_and_verify_rsa_pss_dgst ${dgst}
+    test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+done
+
+rm -rf data* 1.*
+pkcs11-tool -l --pin 648219 --delete-object --type privkey --id 1 > /dev/null 2>&1
--- a/tests/scripts/store_binary.sh
+++ b/tests/scripts/store_binary.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+reset
+test $? -eq 0 || exit $?
+
+TEST_DATA="Pico HSM is awesome!"
+
+echo ${TEST_DATA} > test
+
+echo -n "  Test public binary storage..."
+pkcs11-tool --pin 648219 --write-object test --type data --id 1 --label 'test1' > /dev/null 2>&1
+test $? -eq 0 && echo -n "." || exit $?
+e=$(pkcs11-tool --read-object --type data --label 'test1' 2>&1)
+test $? -eq 0 && echo -n "." || exit $?
+grep -q "${TEST_DATA}" <<< $e && echo -e ".\t${OK}" || exit $?
+pkcs11-tool --pin 648219 --delete-object --type data --label 'test1' > /dev/null 2>&1
+
+echo -n "  Test private binary storage..."
+pkcs11-tool --pin 648219 --write-object test --type data --id 1 --label 'test1' --private > /dev/null 2>&1
+test $? -eq 0 && echo -n "." || exit $?
+e=$(pkcs11-tool --read-object --type data --label 'test1' --pin 648219 2>&1)
+test $? -eq 0 && echo -n "." || exit $?
+grep -q "${TEST_DATA}" <<< $e && echo -n "." || exit $?
+e=$(pkcs11-tool --read-object --type data --label 'test1' 2>&1)
+test $? -eq 1 && echo -n "." || exit $?
+grep -q "error: object not found" <<< $e && echo -e ".\t${OK}" || exit $?
+pkcs11-tool --pin 648219 --delete-object --type data --label 'test1' > /dev/null 2>&1
--- a/tests/start-up-and-test-pkcs11.sh
+++ b/tests/start-up-and-test-pkcs11.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+source ./tests/startup.sh
+
+chmod a+x tests/scripts/*.sh
+
+echo "======== PKCS11 Test suite ========"
+./tests/scripts/pkcs11.sh
--- a/tests/start-up-and-test.sh
+++ b/tests/start-up-and-test.sh
@@ -1,11 +1,5 @@
-#!/bin/bash -eu
+#!/bin/bash
+
+source ./tests/startup.sh

-rm -rf pypicohsm
-git clone https://github.com/polhenarejos/pypicohsm.git
-pip3 install -e pypicohsm
-/usr/sbin/pcscd &
-sleep 2
-rm -f memory.flash
-tar -xf tests/memory.tar.gz
-./build_in_docker/pico_hsm > /dev/null &
 pytest tests -W ignore::DeprecationWarning
--- a/tests/startup.sh
+++ b/tests/startup.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+OK="\t\033[32mok\033[0m"
+FAIL="\t\033[31mfail\033[0m"
+
+fail() {
+    echo -e "${FAIL}"
+    exit 1
+}
+
+echo -n "Start PCSC..."
+/usr/sbin/pcscd &
+test $? -eq 0 && echo -e "${OK}" || {
+    echo -e "${FAIL}"
+    exit 1
+}
+sleep 2
+rm -f memory.flash
+tar -xf tests/memory.tar.gz
+echo -n "Start Pico HSM..."
+/pico_hsm > /dev/null 2>&1 &
+test $? -eq 0 && echo -n "." || fail
+sleep 2
+ATR="3b:fe:18:00:00:81:31:fe:45:80:31:81:54:48:53:4d:31:73:80:21:40:81:07:fa"
+e=$(opensc-tool -an 2>&1)
+grep -q "${ATR}" <<< $e && echo -n "." || fail
+test $? -eq 0 && echo -e "${OK}" || fail