Skip to content

Commit 5a1e3eb

Browse files
smo4201smo4201
committed
refactoring: use golang crypto/hash enums
Signed-off-by: Simon Ott <simon.ott@aisec.fraunhofer.de>
1 parent 3fd4a2e commit 5a1e3eb

File tree

13 files changed

+194
-418
lines changed

13 files changed

+194
-418
lines changed

‎api/api.go‎

Lines changed: 19 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -20,16 +20,16 @@ package api
2020
import (
2121
"crypto"
2222
"crypto/rsa"
23-
"errors"
2423
"fmt"
2524
"strings"
2625

2726
ar "github.com/Fraunhofer-AISEC/cmc/attestationreport"
27+
"github.com/Fraunhofer-AISEC/cmc/internal"
2828
)
2929

3030
// The version of the API
3131
const (
32-
apiVersion = "1.2.1"
32+
apiVersion = "1.3.0"
3333
)
3434

3535
func GetVersion() string {
@@ -88,10 +88,10 @@ type VerificationResponse struct {
8888
}
8989

9090
type TLSSignRequest struct {
91-
Version string `json:"version" cbor:"0,keyasint"`
92-
Content []byte `json:"content" cbor:"1,keyasint"`
93-
Hashtype HashFunction `json:"hashType" cbor:"2,keyasint"`
94-
PssOpts *PSSOptions `json:"pssOpts" cbor:"3,keyasint"`
91+
Version string `json:"version" cbor:"0,keyasint"`
92+
Content []byte `json:"content" cbor:"1,keyasint"`
93+
HashAlg string `json:"hashAlg" cbor:"2,keyasint" jsonschema:"enum=SHA-256,enum=SHA-384,enum=SHA-512"`
94+
PssOpts *PSSOptions `json:"pssOpts,omitempty" cbor:"3,keyasint,omitempty"`
9595
}
9696

9797
type TLSSignResponse struct {
@@ -160,30 +160,6 @@ type PSSOptions struct {
160160
SaltLength int32
161161
}
162162

163-
type HashFunction int32
164-
165-
const (
166-
HashFunction_SHA1 HashFunction = 0
167-
HashFunction_SHA224 HashFunction = 1
168-
HashFunction_SHA256 HashFunction = 2
169-
HashFunction_SHA384 HashFunction = 3
170-
HashFunction_SHA512 HashFunction = 4
171-
HashFunction_MD4 HashFunction = 5
172-
HashFunction_MD5 HashFunction = 6
173-
HashFunction_MD5SHA1 HashFunction = 7
174-
HashFunction_RIPEMD160 HashFunction = 8
175-
HashFunction_SHA3_224 HashFunction = 9
176-
HashFunction_SHA3_256 HashFunction = 10
177-
HashFunction_SHA3_384 HashFunction = 11
178-
HashFunction_SHA3_512 HashFunction = 12
179-
HashFunction_SHA512_224 HashFunction = 13
180-
HashFunction_SHA512_256 HashFunction = 14
181-
HashFunction_BLAKE2s_256 HashFunction = 15
182-
HashFunction_BLAKE2b_256 HashFunction = 16
183-
HashFunction_BLAKE2b_384 HashFunction = 17
184-
HashFunction_BLAKE2b_512 HashFunction = 18
185-
)
186-
187163
func TypeToString(t uint32) string {
188164
switch t {
189165
case TypeError:
@@ -209,80 +185,30 @@ func TypeToString(t uint32) string {
209185
}
210186
}
211187

212-
// Converts Protobuf hashtype to crypto.SignerOpts
213-
func HashToSignerOpts(hashtype HashFunction, pssOpts *PSSOptions) (crypto.SignerOpts, error) {
214-
var hash crypto.Hash
215-
var len int
216-
switch hashtype {
217-
case HashFunction_SHA256:
218-
hash = crypto.SHA256
219-
len = 32
220-
case HashFunction_SHA384:
221-
hash = crypto.SHA384
222-
len = 48
223-
case HashFunction_SHA512:
224-
len = 64
225-
hash = crypto.SHA512
226-
default:
227-
return crypto.SHA512, fmt.Errorf("hash function not implemented: %v", hashtype)
188+
// StringToSignerOpts converts hash strings as defined in https://pkg.go.dev/crypto#Hash.String
189+
// to SignerOpts
190+
// Converts hash strings as defined in https://pkg.go.dev/crypto#Hash.String to SignerOpts
191+
func StringToSignerOpts(s string, pssOpts *PSSOptions) (crypto.SignerOpts, error) {
192+
hash, err := internal.HashFromString(s)
193+
if err != nil {
194+
return nil, err
228195
}
196+
return HashToSignerOpts(hash, pssOpts)
197+
}
198+
199+
// HashToSignerOpts converts hashes to crypto.SignerOpts
200+
func HashToSignerOpts(hash crypto.Hash, pssOpts *PSSOptions) (crypto.SignerOpts, error) {
229201
if pssOpts != nil {
230202
saltlen := int(pssOpts.SaltLength)
231203
// go-attestation / go-tpm does not allow -1 as definition for length of hash
232204
if saltlen < 0 {
233-
saltlen = len
205+
saltlen = hash.Size()
234206
}
235207
return &rsa.PSSOptions{SaltLength: saltlen, Hash: hash}, nil
236208
}
237209
return hash, nil
238210
}
239211

240-
// Converts Hash Types from crypto.SignerOpts to the types specified in the CMC interface
241-
func SignerOptsToHash(opts crypto.SignerOpts) (HashFunction, error) {
242-
switch opts.HashFunc() {
243-
case crypto.MD4:
244-
return HashFunction_MD4, nil
245-
case crypto.MD5:
246-
return HashFunction_MD5, nil
247-
case crypto.SHA1:
248-
return HashFunction_SHA1, nil
249-
case crypto.SHA224:
250-
return HashFunction_SHA224, nil
251-
case crypto.SHA256:
252-
return HashFunction_SHA256, nil
253-
case crypto.SHA384:
254-
return HashFunction_SHA384, nil
255-
case crypto.SHA512:
256-
return HashFunction_SHA512, nil
257-
case crypto.MD5SHA1:
258-
return HashFunction_MD5SHA1, nil
259-
case crypto.RIPEMD160:
260-
return HashFunction_RIPEMD160, nil
261-
case crypto.SHA3_224:
262-
return HashFunction_SHA3_224, nil
263-
case crypto.SHA3_256:
264-
return HashFunction_SHA3_256, nil
265-
case crypto.SHA3_384:
266-
return HashFunction_SHA3_384, nil
267-
case crypto.SHA3_512:
268-
return HashFunction_SHA3_512, nil
269-
case crypto.SHA512_224:
270-
return HashFunction_SHA512_224, nil
271-
case crypto.SHA512_256:
272-
return HashFunction_SHA512_256, nil
273-
case crypto.BLAKE2s_256:
274-
return HashFunction_BLAKE2s_256, nil
275-
case crypto.BLAKE2b_256:
276-
return HashFunction_BLAKE2b_256, nil
277-
case crypto.BLAKE2b_384:
278-
return HashFunction_BLAKE2b_384, nil
279-
case crypto.BLAKE2b_512:
280-
return HashFunction_BLAKE2b_512, nil
281-
default:
282-
}
283-
return HashFunction_SHA512, errors.New("could not determine correct Hash function")
284-
}
285-
286212
func (req *AttestationRequest) CheckVersion() error {
287213
if req == nil {
288214
return fmt.Errorf("internal error: AttestationRequest is nil")

‎attestedtls/coap.go‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -203,15 +203,10 @@ func (a CoapApi) fetchSignature(cc *CmcConfig, digest []byte, opts crypto.Signer
203203
ctx, cancel := context.WithTimeout(context.Background(), time.Second)
204204
defer cancel()
205205

206-
hash, err := api.SignerOptsToHash(opts)
207-
if err != nil {
208-
return nil, fmt.Errorf("sign request creation failed: %w", err)
209-
}
210-
211206
req := api.TLSSignRequest{
212-
Version: api.GetVersion(),
213-
Content: digest,
214-
Hashtype: hash,
207+
Version: api.GetVersion(),
208+
Content: digest,
209+
HashAlg: opts.HashFunc().String(),
215210
}
216211

217212
// Parse additional signing options - not implemented fields assume recommend defaults

‎attestedtls/grpc.go‎

Lines changed: 7 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -142,11 +142,12 @@ func (a GrpcApi) verifyAR(
142142
}
143143

144144
// Check results
145-
if result.Summary.Status == ar.StatusSuccess {
145+
switch result.Summary.Status {
146+
case ar.StatusSuccess:
146147
log.Debugf("Attestation report verification successful")
147-
} else if result.Summary.Status == ar.StatusWarn {
148+
case ar.StatusWarn:
148149
log.Debugf("Attestation report verification passed with warnings")
149-
} else {
150+
default:
150151
return errors.New("attestation report verification failed")
151152
}
152153
return nil
@@ -163,14 +164,10 @@ func (a GrpcApi) fetchSignature(cc *CmcConfig, digest []byte, opts crypto.Signer
163164
log.Debug("Contacting backend for sign Operation")
164165

165166
// Create Sign request
166-
hash, err := convertHash(opts)
167-
if err != nil {
168-
return nil, fmt.Errorf("sign request creation failed: %w", err)
169-
}
170167
req := api.TLSSignRequest{
171-
Version: api.GetVersion(),
172-
Content: digest,
173-
Hashtype: hash,
168+
Version: api.GetVersion(),
169+
Content: digest,
170+
HashAlg: opts.HashFunc().String(),
174171
}
175172

176173
// parse additional signing options - not implemented fields assume recommend defaults
@@ -257,49 +254,3 @@ func (a GrpcApi) fetchPeerCache(cc *CmcConfig, fingerprint string) ([]string, er
257254

258255
return resp.Cache, nil
259256
}
260-
261-
// Converts Hash Types from crypto.SignerOpts to the types specified in the CMC interface
262-
func convertHash(opts crypto.SignerOpts) (api.HashFunction, error) {
263-
switch opts.HashFunc() {
264-
case crypto.MD4:
265-
return api.HashFunction_MD4, nil
266-
case crypto.MD5:
267-
return api.HashFunction_MD5, nil
268-
case crypto.SHA1:
269-
return api.HashFunction_SHA1, nil
270-
case crypto.SHA224:
271-
return api.HashFunction_SHA224, nil
272-
case crypto.SHA256:
273-
return api.HashFunction_SHA256, nil
274-
case crypto.SHA384:
275-
return api.HashFunction_SHA384, nil
276-
case crypto.SHA512:
277-
return api.HashFunction_SHA512, nil
278-
case crypto.MD5SHA1:
279-
return api.HashFunction_MD5SHA1, nil
280-
case crypto.RIPEMD160:
281-
return api.HashFunction_RIPEMD160, nil
282-
case crypto.SHA3_224:
283-
return api.HashFunction_SHA3_224, nil
284-
case crypto.SHA3_256:
285-
return api.HashFunction_SHA3_256, nil
286-
case crypto.SHA3_384:
287-
return api.HashFunction_SHA3_384, nil
288-
case crypto.SHA3_512:
289-
return api.HashFunction_SHA3_512, nil
290-
case crypto.SHA512_224:
291-
return api.HashFunction_SHA512_224, nil
292-
case crypto.SHA512_256:
293-
return api.HashFunction_SHA512_256, nil
294-
case crypto.BLAKE2s_256:
295-
return api.HashFunction_BLAKE2s_256, nil
296-
case crypto.BLAKE2b_256:
297-
return api.HashFunction_BLAKE2b_256, nil
298-
case crypto.BLAKE2b_384:
299-
return api.HashFunction_BLAKE2b_384, nil
300-
case crypto.BLAKE2b_512:
301-
return api.HashFunction_BLAKE2b_512, nil
302-
default:
303-
}
304-
return api.HashFunction_SHA512, errors.New("could not determine correct Hash function")
305-
}

‎attestedtls/socket.go‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -216,15 +216,10 @@ func (a SocketApi) fetchSignature(cc *CmcConfig, digest []byte, opts crypto.Sign
216216
return nil, fmt.Errorf("error dialing: %w", err)
217217
}
218218

219-
hash, err := api.SignerOptsToHash(opts)
220-
if err != nil {
221-
return nil, fmt.Errorf("sign request creation failed: %w", err)
222-
}
223-
224219
req := api.TLSSignRequest{
225-
Version: api.GetVersion(),
226-
Content: digest,
227-
Hashtype: hash,
220+
Version: api.GetVersion(),
221+
Content: digest,
222+
HashAlg: opts.HashFunc().String(),
228223
}
229224

230225
// Parse additional signing options - not implemented fields assume recommend defaults

‎cmcd/coap.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ func (s CoapServer) TlsSign(w mux.ResponseWriter, r *mux.Message) {
254254
}
255255

256256
// Get signing options from request
257-
opts, err := api.HashToSignerOpts(req.Hashtype, req.PssOpts)
257+
opts, err := api.StringToSignerOpts(req.HashAlg, req.PssOpts)
258258
if err != nil {
259259
sendCoapError(w, r, codes.InternalServerError,
260260
"failed to choose requested hash function: %v", err)

‎cmcd/grpc.go‎

Lines changed: 14 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -224,7 +224,7 @@ func (s *GrpcServer) TLSSign(ctx context.Context, req *api.TLSSignRequest) (*api
224224
d := s.cmc.Drivers[0]
225225

226226
// get sign opts
227-
opts, err = convertHash(req.GetHashtype(), req.GetPssOpts())
227+
opts, err = stringToSignerOpts(req.GetHashAlg(), req.GetPssOpts())
228228
if err != nil {
229229
return nil, fmt.Errorf("failed to find appropriate hash function: %w", err)
230230
}
@@ -310,29 +310,24 @@ func (s *GrpcServer) PeerCache(ctx context.Context, req *api.PeerCacheRequest) (
310310
return resp, nil
311311
}
312312

313-
// Converts Protobuf hashtype to crypto.SignerOpts
314-
func convertHash(hashtype api.HashFunction, pssOpts *api.PSSOptions) (crypto.SignerOpts, error) {
315-
var hash crypto.Hash
316-
var len int
317-
switch hashtype {
318-
case api.HashFunction_SHA256:
319-
hash = crypto.SHA256
320-
len = 32
321-
case api.HashFunction_SHA384:
322-
hash = crypto.SHA384
323-
len = 48
324-
case api.HashFunction_SHA512:
325-
len = 64
326-
hash = crypto.SHA512
327-
default:
328-
return crypto.SHA512, fmt.Errorf("hash function not implemented: %v", hashtype)
313+
// StringToSignerOpts converts hash strings as defined in https://pkg.go.dev/crypto#Hash.String
314+
// to SignerOpts
315+
// Converts hash strings as defined in https://pkg.go.dev/crypto#Hash.String to SignerOpts
316+
func stringToSignerOpts(s string, pssOpts *api.PSSOptions) (crypto.SignerOpts, error) {
317+
hash, err := internal.HashFromString(s)
318+
if err != nil {
319+
return nil, err
329320
}
321+
return hashToSignerOpts(hash, pssOpts)
322+
}
323+
324+
// HashToSignerOpts converts hashes to crypto.SignerOpts
325+
func hashToSignerOpts(hash crypto.Hash, pssOpts *api.PSSOptions) (crypto.SignerOpts, error) {
330326
if pssOpts != nil {
331327
saltlen := int(pssOpts.SaltLength)
332328
// go-attestation / go-tpm does not allow -1 as definition for length of hash
333329
if saltlen < 0 {
334-
log.Warning("Signature Options: Adapted RSA PSS Salt length to length of hash: ", len)
335-
saltlen = len
330+
saltlen = hash.Size()
336331
}
337332
return &rsa.PSSOptions{SaltLength: saltlen, Hash: hash}, nil
338333
}

‎cmcd/socket.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,7 @@ func tlssign(conn net.Conn, payload []byte, cmc *c.Cmc, s ar.Serializer) {
300300
}
301301

302302
// Get signing options from request
303-
opts, err := api.HashToSignerOpts(req.Hashtype, req.PssOpts)
303+
opts, err := api.StringToSignerOpts(req.HashAlg, req.PssOpts)
304304
if err != nil {
305305
sendError(conn, s, "failed to choose requested hash function: %v", err)
306306
return

‎doc/api/json/api/TLSSignRequest.json‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,13 @@
2222
"type": "string",
2323
"contentEncoding": "base64"
2424
},
25-
"hashType": {
26-
"type": "integer"
25+
"hashAlg": {
26+
"type": "string",
27+
"enum": [
28+
"SHA-256",
29+
"SHA-384",
30+
"SHA-512"
31+
]
2732
},
2833
"pssOpts": {
2934
"$ref": "#/$defs/PSSOptions"
@@ -33,8 +38,7 @@
3338
"required": [
3439
"version",
3540
"content",
36-
"hashType",
37-
"pssOpts"
41+
"hashAlg"
3842
]
3943
}
4044
}

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ require (
2121
github.com/plgd-dev/go-coap/v3 v3.4.1
2222
github.com/robertkrimen/otto v0.5.1
2323
github.com/sirupsen/logrus v1.9.3
24+
github.com/ulikunitz/xz v0.5.15
2425
github.com/urfave/cli/v3 v3.6.1
2526
github.com/veraison/go-cose v1.3.0
2627
go.mozilla.org/pkcs7 v0.9.0
@@ -65,7 +66,6 @@ require (
6566
github.com/quic-go/quic-go v0.57.0 // indirect
6667
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
6768
github.com/ugorji/go/codec v1.3.1 // indirect
68-
github.com/ulikunitz/xz v0.5.15 // indirect
6969
github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
7070
github.com/x448/float16 v0.8.4 // indirect
7171
go.uber.org/atomic v1.11.0 // indirect

0 commit comments

Comments
 (0)