From: Eric Biggers <ebiggers@xxxxxxxxxx> As part of all the ciphertext verification tests, verify that the filesystem correctly computed the key identifier from the key the test generated. This uses fscrypt-crypt-util to compute the key identifier. Previously this was only being tested indirectly, via the tests that happen to use the hardcoded $TEST_RAW_KEY and $TEST_KEY_IDENTIFIER. The new check provides better coverage. Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx> --- common/encrypt | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/common/encrypt b/common/encrypt index cf402570..d8e2dba9 100644 --- a/common/encrypt +++ b/common/encrypt @@ -902,6 +902,18 @@ _verify_ciphertext_for_encryption_policy() fi local raw_key_hex=$(echo "$raw_key" | tr -d '\\x') + if (( policy_version > 1 )); then + echo "Verifying key identifier" >> $seqres.full + expected_identifier=$($here/src/fscrypt-crypt-util \ + --dump-key-identifier "$raw_key_hex" \ + $crypt_util_args) + if [ "$expected_identifier" != "$keyspec" ]; then + echo "KEY IDENTIFIER MISMATCH!" + echo " Expected: $expected_identifier" + echo " Actual: $keyspec" + fi + fi + echo echo -e "Verifying ciphertext with parameters:" echo -e "\tcontents_encryption_mode: $contents_encryption_mode" -- 2.35.1
