testing/crypto_testing.h

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

// Utilities for testing crypto code.
#ifndef THIRD_PARTY_CREDENTIO_TESTING_CRYPTO_TESTING_H_
#define THIRD_PARTY_CREDENTIO_TESTING_CRYPTO_TESTING_H_

#include <cstddef>
#include <cstdint>
#include <optional>
#include <string>
#include <vector>

#include "absl/strings/string_view.h"
#include "absl/time/time.h"
#include "openssl/base.h"
#include "openssl/x509.h"

namespace credentio {

// OID of the C2PA claim signing EKU. See
// https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html#_trust_lists.
inline constexpr absl::string_view kC2paClaimSigningEkuOid =
    "1.3.6.1.4.1.62558.2.1";
// OID of the `id-kp-timeStamping` EKU (RFC 5280).
inline constexpr absl::string_view kTimeStampingEkuOid = "1.3.6.1.5.5.7.3.8";

struct TestCertificateOptions {
  std::string subject_common_name;
  std::string issuer_common_name;
  absl::Time not_before = absl::FromUnixSeconds(1);
  absl::Time not_after = absl::FromUnixSeconds(int64_t{86400} * 365 * 100);
  EVP_PKEY* signing_key = nullptr;
  EVP_PKEY* private_key = nullptr;

  // If set, the certificate's serial number is set to this value.
  std::optional<int64_t> serial_number;

  // If set, adds a critical `basicConstraints` extension with the given `cA`
  // value, along with a critical `keyUsage` extension asserting `keyCertSign`
  // and `cRLSign` when true, or `digitalSignature` when false.
  std::optional<bool> is_ca;

  // If non-empty, adds an `extendedKeyUsage` extension with these OIDs.
  std::vector<std::string> extended_key_usage_oids;
  bool extended_key_usage_critical = false;
};

// Generates an X.509 certificate based on `options`.
bssl::UniquePtr<X509> CreateTestCertificate(
    const TestCertificateOptions& options);

bssl::UniquePtr<EVP_PKEY> CreateTestEcKey(int nid);

bssl::UniquePtr<EVP_PKEY> CreateTestRsaKey(size_t num_bits);

bssl::UniquePtr<EVP_PKEY> CreateTestEdKey();

// Returns the PEM encoding of `key`. CHECK-fails on error.
std::string KeyToPem(EVP_PKEY* key);

// Returns the PEM encoding of `cert`. CHECK-fails on error.
std::string CertToPem(X509* cert);

// Returns the DER encoding of `cert`. CHECK-fails on error.
std::string CertToDer(X509* cert);

// A generated private key with its certificate, in the encodings that C2PA
// APIs consume.
struct TestKeyPair {
  std::string key_pem;
  std::string cert_pem;
  std::string cert_der;
};

// A self-signed root CA along with the leaf certificates it issued, suitable
// for exercising C2PA claim signer and TSA trust checks end to end.
struct TestPki {
  TestKeyPair root_ca;
  // Leaf with the C2PA claim signing EKU, issued by `root_ca`.
  TestKeyPair claim_signer;
  // Leaf with the time stamping EKU, issued by `root_ca`.
  TestKeyPair tsa;
};

// Creates a `TestPki` using freshly generated EC P-256 keys.
TestPki CreateTestPki();

}  // namespace credentio

#endif  // THIRD_PARTY_CREDENTIO_TESTING_CRYPTO_TESTING_H_