Method test_sign_ed25519

tests/x509/test_ocsp.py:1669–1709

(self, backend)

            builder.sign(private_key, hashes.SHA256())

    def test_sign_ed25519(self, backend):
        builder = ocsp.OCSPResponseBuilder()
        cert, issuer = _cert_and_issuer()
        private_key = ed25519.Ed25519PrivateKey.generate()
        root_cert, _ = _generate_root(private_key, None)
        current_time = (
            datetime.datetime.now(datetime.timezone.utc)
            .replace(tzinfo=None)
            .replace(microsecond=0)
        )
        this_update = current_time - datetime.timedelta(days=1)
        next_update = this_update + datetime.timedelta(days=7)
        revoked_date = this_update - datetime.timedelta(days=300)
        builder = builder.responder_id(
            ocsp.OCSPResponderEncoding.NAME, root_cert
        ).add_response(
            cert,
            issuer,
            hashes.SHA1(),
            ocsp.OCSPCertStatus.REVOKED,
            this_update,
            next_update,
            revoked_date,
            x509.ReasonFlags.key_compromise,
        )
        resp = builder.sign(private_key, None)
        assert resp.certificate_status == ocsp.OCSPCertStatus.REVOKED
        assert resp.revocation_reason is x509.ReasonFlags.key_compromise
        _check_ocsp_response_times(
            resp,
            this_update=this_update,
            next_update=next_update,
            revocation_time=revoked_date,
        )
        assert resp.signature_hash_algorithm is None
        assert (
            resp.signature_algorithm_oid == x509.SignatureAlgorithmOID.ED25519
        )
        private_key.public_key().verify(
            resp.signature, resp.tbs_response_bytes
        )

    @pytest.mark.supported(
        only_if=lambda backend: backend.ed448_supported(),