-
Notifications
You must be signed in to change notification settings - Fork 276
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'chenzhenjia-wasm_support' into new-backends
- Loading branch information
Showing
20 changed files
with
400 additions
and
213 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,38 +1,74 @@ | ||
| use ring::{rand, signature}; | ||
|
|
||
| use crate::algorithms::Algorithm; | ||
| use crate::errors::Result; | ||
| use crate::serialization::b64_encode; | ||
| use crate::serialization::{b64_decode, b64_encode}; | ||
|
|
||
| /// Only used internally when validating EC, to map from our enum to the Ring EcdsaVerificationAlgorithm structs. | ||
| pub(crate) fn alg_to_ec_verification( | ||
| alg: Algorithm, | ||
| ) -> &'static signature::EcdsaVerificationAlgorithm { | ||
| /// The actual ECDSA signing + encoding | ||
| /// The key needs to be in PKCS8 format | ||
| pub(crate) fn sign(alg: Algorithm, key: &[u8], message: &[u8]) -> Result<String> { | ||
| match alg { | ||
| Algorithm::ES256 => &signature::ECDSA_P256_SHA256_FIXED, | ||
| Algorithm::ES384 => &signature::ECDSA_P384_SHA384_FIXED, | ||
| Algorithm::ES256 => es256_sign(key, message), | ||
| Algorithm::ES384 => es384_sign(key, message), | ||
|
|
||
| _ => unreachable!("Tried to get EC alg for a non-EC algorithm"), | ||
| } | ||
| } | ||
|
|
||
| /// Only used internally when signing EC, to map from our enum to the Ring EcdsaVerificationAlgorithm structs. | ||
| pub(crate) fn alg_to_ec_signing(alg: Algorithm) -> &'static signature::EcdsaSigningAlgorithm { | ||
| fn es256_sign(key: &[u8], message: &[u8]) -> Result<String> { | ||
| use p256::ecdsa::signature::Signer; | ||
| use p256::ecdsa::{Signature, SigningKey}; | ||
| use p256::pkcs8::DecodePrivateKey; | ||
| use p256::SecretKey; | ||
| let secret_key = | ||
| SecretKey::from_pkcs8_der(key).map_err(|_e| crate::errors::ErrorKind::InvalidEcdsaKey)?; | ||
| let signing_key: SigningKey = secret_key.into(); | ||
|
|
||
| let signature: Signature = signing_key.sign(message); | ||
| let bytes = signature.to_bytes(); | ||
| Ok(b64_encode(bytes)) | ||
| } | ||
|
|
||
| fn es384_sign(key: &[u8], message: &[u8]) -> Result<String> { | ||
| use p384::ecdsa::signature::Signer; | ||
| use p384::ecdsa::{Signature, SigningKey}; | ||
| use p384::pkcs8::DecodePrivateKey; | ||
| use p384::SecretKey; | ||
| let secret_key = | ||
| SecretKey::from_pkcs8_der(key).map_err(|_e| crate::errors::ErrorKind::InvalidEcdsaKey)?; | ||
| let signing_key: SigningKey = secret_key.into(); | ||
| let signature: Signature = signing_key.sign(message); | ||
| let bytes = signature.to_bytes(); | ||
| Ok(b64_encode(bytes)) | ||
| } | ||
|
|
||
| pub(crate) fn verify(alg: Algorithm, signature: &str, message: &[u8], key: &[u8]) -> Result<bool> { | ||
| match alg { | ||
| Algorithm::ES256 => &signature::ECDSA_P256_SHA256_FIXED_SIGNING, | ||
| Algorithm::ES384 => &signature::ECDSA_P384_SHA384_FIXED_SIGNING, | ||
| Algorithm::ES256 => es256_verify(signature, message, key), | ||
| Algorithm::ES384 => es384_verify(signature, message, key), | ||
| _ => unreachable!("Tried to get EC alg for a non-EC algorithm"), | ||
| } | ||
| } | ||
|
|
||
| /// The actual ECDSA signing + encoding | ||
| /// The key needs to be in PKCS8 format | ||
| pub fn sign( | ||
| alg: &'static signature::EcdsaSigningAlgorithm, | ||
| key: &[u8], | ||
| message: &[u8], | ||
| ) -> Result<String> { | ||
| let rng = rand::SystemRandom::new(); | ||
| let signing_key = signature::EcdsaKeyPair::from_pkcs8(alg, key, &rng)?; | ||
| let out = signing_key.sign(&rng, message)?; | ||
| Ok(b64_encode(out)) | ||
| fn es384_verify(signature: &str, message: &[u8], key: &[u8]) -> Result<bool> { | ||
| use p384::ecdsa::signature::Verifier; | ||
| use p384::ecdsa::{Signature, VerifyingKey}; | ||
| use p384::PublicKey; | ||
|
|
||
| let public_key = | ||
| PublicKey::from_sec1_bytes(key).map_err(|_e| crate::errors::ErrorKind::InvalidEcdsaKey)?; | ||
| let verifying_key: VerifyingKey = public_key.into(); | ||
| let signature = Signature::from_slice(&b64_decode(signature)?) | ||
| .map_err(|_e| crate::errors::ErrorKind::InvalidSignature)?; | ||
| Ok(verifying_key.verify(message, &signature).is_ok()) | ||
| } | ||
|
|
||
| fn es256_verify(signature: &str, message: &[u8], key: &[u8]) -> Result<bool> { | ||
| use p256::ecdsa::signature::Verifier; | ||
| use p256::ecdsa::{Signature, VerifyingKey}; | ||
| use p256::PublicKey; | ||
| let public_key = | ||
| PublicKey::from_sec1_bytes(key).map_err(|_e| crate::errors::ErrorKind::InvalidEcdsaKey)?; | ||
| let verifying_key: VerifyingKey = public_key.into(); | ||
| let signature = Signature::from_slice(&b64_decode(signature)?) | ||
| .map_err(|_e| crate::errors::ErrorKind::InvalidSignature)?; | ||
| Ok(verifying_key.verify(message, &signature).is_ok()) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,23 +1,29 @@ | ||
| use ring::signature; | ||
| use ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey}; | ||
|
|
||
| use crate::algorithms::Algorithm; | ||
| use crate::errors::Result; | ||
| use crate::serialization::b64_encode; | ||
| use crate::errors::{new_error, ErrorKind, Result}; | ||
| use crate::serialization::{b64_decode, b64_encode}; | ||
|
|
||
| /// Only used internally when signing or validating EdDSA, to map from our enum to the Ring EdDSAParameters structs. | ||
| pub(crate) fn alg_to_ec_verification(alg: Algorithm) -> &'static signature::EdDSAParameters { | ||
| // To support additional key subtypes, like Ed448, we would need to match on the JWK's ("crv") | ||
| // parameter. | ||
| match alg { | ||
| Algorithm::EdDSA => &signature::ED25519, | ||
| _ => unreachable!("Tried to get EdDSA alg for a non-EdDSA algorithm"), | ||
| } | ||
| fn parse_key(key: &[u8]) -> Result<SigningKey> { | ||
| let key = key.try_into().map_err(|_| new_error(ErrorKind::InvalidEddsaKey))?; | ||
| let signing_key = SigningKey::from_bytes(key); | ||
| Ok(signing_key) | ||
| } | ||
|
|
||
| pub(crate) fn verify(signature: &str, message: &[u8], key: &[u8]) -> Result<bool> { | ||
| let signature = b64_decode(signature)?; | ||
| let signature = | ||
| Signature::from_slice(&signature).map_err(|_e| new_error(ErrorKind::InvalidSignature))?; | ||
| let key = key.try_into().map_err(|_| new_error(ErrorKind::InvalidEddsaKey))?; | ||
| let verifying_key = | ||
| VerifyingKey::from_bytes(key).map_err(|_| new_error(ErrorKind::InvalidEddsaKey))?; | ||
| Ok(verifying_key.verify(message, &signature).is_ok()) | ||
| } | ||
|
|
||
| /// The actual EdDSA signing + encoding | ||
| /// The key needs to be in PKCS8 format | ||
| pub fn sign(key: &[u8], message: &[u8]) -> Result<String> { | ||
| let signing_key = signature::Ed25519KeyPair::from_pkcs8_maybe_unchecked(key)?; | ||
| let key = key[16..].into(); | ||
| let signing_key = parse_key(key)?; | ||
| let out = signing_key.sign(message); | ||
| Ok(b64_encode(out)) | ||
| Ok(b64_encode(out.to_bytes())) | ||
| } |
Oops, something went wrong.