#!/bin/bash

PROOFFILE=kigen_euicc_hack_proof.txt

PRVKEY=prvkey.pem

PUBKEY=pubkey.pem
CERTPUBKEY=cert3_pubkey.pem

DIGEST=digest.dat
SIGNATURE=signature.dat

CERT1=cert1.pem
CERT2=cert2.pem
CERT3=cert3.pem

CERTCHAIN=cert_chain.pem

# print proof file
echo "* proof file"
cat $PROOFFILE

# gen cert chain for verification
if [ ! -f $CERTCHAIN ]; then
 echo "* generating $CERTCHAIN"
 cp $CERT2 $CERTCHAIN
 cat $CERT3 >> $CERTCHAIN 
fi

# verify cert chain
echo "* verifying $CERTCHAIN"
CERTCHECK=$(openssl verify -CAfile $CERT1 $CERTCHAIN)

echo "  "$CERTCHECK

# extract pubkey from prvkey.pem
if [ ! -f $PUBKEY ]; then
 echo "* extracting $PUBKEY"
 openssl ec -in $PRVKEY -pubout > $PUBKEY
fi

# extract pubkey from leaf cert
if [ ! -f $CERTPUBKEY ]; then
 echo "* extracting $CERTPUBKEY"
 openssl x509 -in cert3.pem -noout -pubkey > $CERTPUBKEY
fi

# compare extracted pubkeys
echo "* comparing pub keys"

DIFF=$(diff $PUBKEY $CERTPUBKEY)

if [ "$DIFF" == "" ]
then
 echo "  OK"
fi

# generate digest
if [ ! -f $DIGEST ]; then
 echo "* generating digest"
 openssl dgst -sha256 -binary $PROOFFILE > $DIGEST
fi

# generate signature
if [ ! -f $SIGNATURE ]; then
 echo "* generating signature"
 openssl pkeyutl -sign -inkey $PRVKEY -in $DIGEST > $SIGNATURE
fi

# verify signature
echo "* verifying signature"

SIGCHECK=$(openssl pkeyutl -verify -in $DIGEST -sigfile $SIGNATURE -inkey $PUBKEY -pubin)

echo "  "$SIGCHECK
