common/encrypt: verify the key identifiers

As part of all the ciphertext verification tests, verify that the
filesystem correctly computed the key identifier from the key the test
generated.  This uses fscrypt-crypt-util to compute the key identifier.

Previously this was only being tested indirectly, via the tests that
happen to use the hardcoded $TEST_RAW_KEY and $TEST_KEY_IDENTIFIER.
The new check provides better coverage.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>

diff --git a/common/encrypt b/common/encrypt
index cf4025703266a0e00557871a262935121dba5ca7..78a574bd0937d7d453cfee7a4f6dae2d8171abe9 100644 (file)
--- a/common/encrypt
+++ b/common/encrypt
@@ -812,6 +812,7 @@ _verify_ciphertext_for_encryption_policy()
        local crypt_util_args=""
        local crypt_util_contents_args=""
        local crypt_util_filename_args=""
+       local expected_identifier
 
        shift 2
        for opt; do
@@ -902,6 +903,18 @@ _verify_ciphertext_for_encryption_policy()
        fi
        local raw_key_hex=$(echo "$raw_key" | tr -d '\\x')
 
+       if (( policy_version > 1 )); then
+               echo "Verifying key identifier" >> $seqres.full
+               expected_identifier=$($here/src/fscrypt-crypt-util  \
+                                     --dump-key-identifier "$raw_key_hex" \
+                                     $crypt_util_args)
+               if [ "$expected_identifier" != "$keyspec" ]; then
+                       echo "KEY IDENTIFIER MISMATCH!"
+                       echo "    Expected: $expected_identifier"
+                       echo "    Actual: $keyspec"
+               fi
+       fi
+
        echo
        echo -e "Verifying ciphertext with parameters:"
        echo -e "\tcontents_encryption_mode: $contents_encryption_mode"