Skip to content

Bump signature to v3.0.0-rc.4 #579

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tarcieri merged 1 commit into from
Sep 14, 2025
Merged

Bump signature to v3.0.0-rc.4 #579

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ crypto-bigint = { version = "0.7.0-rc.6", default-features = false, features = [
crypto-primes = { version = "0.7.0-pre.2", default-features = false }
digest = { version = "0.11.0-rc.1", default-features = false, features = ["alloc", "oid"] }
rand_core = { version = "0.9", default-features = false }
signature = { version = "3.0.0-rc.3", default-features = false, features = ["alloc", "digest", "rand_core"] }
signature = { version = "3.0.0-rc.4", default-features = false, features = ["alloc", "digest", "rand_core"] }
subtle = { version = "2.6.1", default-features = false }
zeroize = { version = "1.5", features = ["alloc"] }

Expand Down
19 changes: 11 additions & 8 deletions src/pkcs1v15.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -533,16 +533,16 @@ mod tests {
for (text, expected) in &tests {
let mut digest = Sha1::new();
digest.update(text.as_bytes());
let out = signing_key.sign_digest(digest).to_bytes();
let out = signing_key
.sign_digest(|digest: &mut Sha1| digest.update(text.as_bytes()))
.to_bytes();
assert_ne!(out.as_ref(), text.as_bytes());
assert_ne!(out.as_ref(), &Sha1::digest(text.as_bytes()).to_vec());
assert_eq!(out.as_ref(), expected);

let mut rng = ChaCha8Rng::from_seed([42; 32]);
let mut digest = Sha1::new();
digest.update(text.as_bytes());
let out2 = signing_key
.sign_digest_with_rng(&mut rng, digest)
.sign_digest_with_rng(&mut rng, |digest: &mut Sha1| digest.update(text.as_bytes()))
.to_bytes();
assert_eq!(out2.as_ref(), expected);
}
Expand Down Expand Up @@ -650,10 +650,13 @@ mod tests {
let verifying_key = VerifyingKey::new(pub_key);

for (text, sig, expected) in &tests {
let mut digest = Sha1::new();
digest.update(text.as_bytes());
let result =
verifying_key.verify_digest(digest, &Signature::try_from(sig.as_slice()).unwrap());
let result = verifying_key.verify_digest(
|digest: &mut Sha1| {
digest.update(text.as_bytes());
Ok(())
},
&Signature::try_from(sig.as_slice()).unwrap(),
);
match expected {
true => result.expect("failed to verify"),
false => {
Expand Down
35 changes: 25 additions & 10 deletions src/pkcs1v15/signing_key.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ use crate::{dummy_rng::DummyRng, Result, RsaPrivateKey};
use alloc::vec::Vec;
use const_oid::AssociatedOid;
use core::marker::PhantomData;
use digest::Digest;
use digest::{Digest, FixedOutput, HashMarker, Update};
use rand_core::{CryptoRng, TryCryptoRng};
use signature::{
hazmat::PrehashSigner, DigestSigner, Keypair, MultipartSigner, RandomizedDigestSigner,
Expand Down Expand Up @@ -95,10 +95,15 @@ where

impl<D> DigestSigner<D, Signature> for SigningKey<D>
where
D: Digest,
D: Default + FixedOutput + HashMarker + Update,
{
fn try_sign_digest(&self, digest: D) -> signature::Result<Signature> {
sign::<DummyRng>(None, &self.inner, &self.prefix, &digest.finalize())?
fn try_sign_digest<F: Fn(&mut D) -> signature::Result<()>>(
&self,
f: F,
) -> signature::Result<Signature> {
let mut digest = D::default();
f(&mut digest)?;
sign::<DummyRng>(None, &self.inner, &self.prefix, &digest.finalize_fixed())?
.as_slice()
.try_into()
}
Expand All @@ -117,16 +122,26 @@ where

impl<D> RandomizedDigestSigner<D, Signature> for SigningKey<D>
where
D: Digest,
D: Default + FixedOutput + HashMarker + Update,
{
fn try_sign_digest_with_rng<R: TryCryptoRng + ?Sized>(
fn try_sign_digest_with_rng<
R: TryCryptoRng + ?Sized,
F: Fn(&mut D) -> signature::Result<()>,
>(
&self,
rng: &mut R,
digest: D,
f: F,
) -> signature::Result<Signature> {
sign(Some(rng), &self.inner, &self.prefix, &digest.finalize())?
.as_slice()
.try_into()
let mut digest = D::default();
f(&mut digest)?;
sign(
Some(rng),
&self.inner,
&self.prefix,
&digest.finalize_fixed(),
)?
.as_slice()
.try_into()
}
}

Expand Down
14 changes: 10 additions & 4 deletions src/pkcs1v15/verifying_key.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ use crate::RsaPublicKey;
use alloc::vec::Vec;
use const_oid::AssociatedOid;
use core::marker::PhantomData;
use digest::Digest;
use digest::{Digest, FixedOutput, HashMarker, Update};
use signature::{hazmat::PrehashVerifier, DigestVerifier, Verifier};

#[cfg(feature = "encoding")]
Expand Down Expand Up @@ -71,13 +71,19 @@ where

impl<D> DigestVerifier<D, Signature> for VerifyingKey<D>
where
D: Digest,
D: Default + FixedOutput + HashMarker + Update,
{
fn verify_digest(&self, digest: D, signature: &Signature) -> signature::Result<()> {
fn verify_digest<F: Fn(&mut D) -> signature::Result<()>>(
&self,
f: F,
signature: &Signature,
) -> signature::Result<()> {
let mut digest = D::default();
f(&mut digest)?;
verify(
&self.inner,
&self.prefix,
&digest.finalize(),
&digest.finalize_fixed(),
&signature.inner,
)
.map_err(|e| e.into())
Expand Down
41 changes: 25 additions & 16 deletions src/pss.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -398,10 +398,13 @@ tAboUGBxTDq3ZroNism3DaMIbKPyYrAqhKov1h5V
let verifying_key = VerifyingKey::new(pub_key);

for (text, sig, expected) in &tests {
let mut digest = Sha1::new();
digest.update(text.as_bytes());
let result =
verifying_key.verify_digest(digest, &Signature::try_from(sig.as_slice()).unwrap());
let result = verifying_key.verify_digest(
|digest: &mut Sha1| {
digest.update(text.as_bytes());
Ok(())
},
&Signature::try_from(sig.as_slice()).unwrap(),
);
match expected {
true => result.expect("failed to verify"),
false => {
Expand Down Expand Up @@ -495,14 +498,17 @@ tAboUGBxTDq3ZroNism3DaMIbKPyYrAqhKov1h5V
let verifying_key = signing_key.verifying_key();

for test in &tests {
let mut digest = Sha1::new();
digest.update(test.as_bytes());
let sig = signing_key.sign_digest_with_rng(&mut rng, digest);
let sig = signing_key
.sign_digest_with_rng(&mut rng, |digest: &mut Sha1| digest.update(test.as_bytes()));

let mut digest = Sha1::new();
digest.update(test.as_bytes());
verifying_key
.verify_digest(digest, &sig)
.verify_digest(
|digest: &mut Sha1| {
digest.update(test.as_bytes());
Ok(())
},
&sig,
)
.expect("failed to verify");
}
}
Expand All @@ -517,14 +523,17 @@ tAboUGBxTDq3ZroNism3DaMIbKPyYrAqhKov1h5V
let verifying_key = signing_key.verifying_key();

for test in &tests {
let mut digest = Sha1::new();
digest.update(test.as_bytes());
let sig = signing_key.sign_digest_with_rng(&mut rng, digest);
let sig = signing_key
.sign_digest_with_rng(&mut rng, |digest: &mut Sha1| digest.update(test.as_bytes()));

let mut digest = Sha1::new();
digest.update(test.as_bytes());
verifying_key
.verify_digest(digest, &sig)
.verify_digest(
|digest: &mut Sha1| {
digest.update(test.as_bytes());
Ok(())
},
&sig,
)
.expect("failed to verify");
}
}
Expand Down
13 changes: 9 additions & 4 deletions src/pss/blinded_signing_key.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
use super::{sign_digest, Signature, VerifyingKey};
use crate::{Result, RsaPrivateKey};
use core::marker::PhantomData;
use digest::{Digest, FixedOutputReset};
use digest::{Digest, FixedOutputReset, HashMarker, Update};
use rand_core::{CryptoRng, TryCryptoRng};
use signature::{
hazmat::RandomizedPrehashSigner, Keypair, RandomizedDigestSigner, RandomizedMultipartSigner,
Expand Down Expand Up @@ -122,13 +122,18 @@ where

impl<D> RandomizedDigestSigner<D, Signature> for BlindedSigningKey<D>
where
D: Digest + FixedOutputReset,
D: Default + FixedOutputReset + HashMarker + Update,
{
fn try_sign_digest_with_rng<R: TryCryptoRng + ?Sized>(
fn try_sign_digest_with_rng<
R: TryCryptoRng + ?Sized,
F: Fn(&mut D) -> signature::Result<()>,
>(
&self,
rng: &mut R,
digest: D,
f: F,
) -> signature::Result<Signature> {
let mut digest = D::default();
f(&mut digest)?;
sign_digest::<_, D>(rng, true, &self.inner, &digest.finalize(), self.salt_len)?
.as_slice()
.try_into()
Expand Down
34 changes: 22 additions & 12 deletions src/pss/signing_key.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,14 @@
use super::{sign_digest, Signature, VerifyingKey};
use crate::{Result, RsaPrivateKey};
use core::marker::PhantomData;
use digest::{Digest, FixedOutputReset};
use digest::{Digest, FixedOutputReset, Update};
use rand_core::{CryptoRng, TryCryptoRng};
use signature::{
hazmat::RandomizedPrehashSigner, Keypair, RandomizedDigestSigner, RandomizedMultipartSigner,
RandomizedSigner,
};
use zeroize::ZeroizeOnDrop;

#[cfg(feature = "serde")]
use {
pkcs8::DecodePrivateKey,
Expand All @@ -25,6 +26,7 @@ use {
AssociatedAlgorithmIdentifier, DynSignatureAlgorithmIdentifier,
},
};

#[cfg(feature = "os_rng")]
use {
rand_core::OsRng,
Expand Down Expand Up @@ -95,13 +97,18 @@ where

impl<D> RandomizedDigestSigner<D, Signature> for SigningKey<D>
where
D: Digest + FixedOutputReset,
D: Digest + FixedOutputReset + Update,
{
fn try_sign_digest_with_rng<R: TryCryptoRng + ?Sized>(
fn try_sign_digest_with_rng<
R: TryCryptoRng + ?Sized,
F: Fn(&mut D) -> signature::Result<()>,
>(
&self,
rng: &mut R,
digest: D,
f: F,
) -> signature::Result<Signature> {
let mut digest = D::new();
f(&mut digest)?;
sign_digest::<_, D>(rng, false, &self.inner, &digest.finalize(), self.salt_len)?
.as_slice()
.try_into()
Expand All @@ -110,36 +117,39 @@ where

impl<D> RandomizedSigner<Signature> for SigningKey<D>
where
D: Digest + FixedOutputReset,
D: Digest + FixedOutputReset + Update,
{
fn try_sign_with_rng<R: TryCryptoRng + ?Sized>(
&self,
rng: &mut R,
msg: &[u8],
) -> signature::Result<Signature> {
self.try_sign_digest_with_rng(rng, D::new_with_prefix(msg))
self.try_sign_digest_with_rng(rng, |digest: &mut D| {
Update::update(digest, msg);
Ok(())
})
}
}

impl<D> RandomizedMultipartSigner<Signature> for SigningKey<D>
where
D: Digest + FixedOutputReset,
D: Digest + FixedOutputReset + Update,
{
fn try_multipart_sign_with_rng<R: TryCryptoRng + ?Sized>(
&self,
rng: &mut R,
msg: &[&[u8]],
) -> signature::Result<Signature> {
let mut digest = D::new();
msg.iter()
.for_each(|slice| <D as Digest>::update(&mut digest, slice));
self.try_sign_digest_with_rng(rng, digest)
self.try_sign_digest_with_rng(rng, |digest: &mut D| {
msg.iter().for_each(|slice| Update::update(digest, slice));
Ok(())
})
}
}

impl<D> RandomizedPrehashSigner<Signature> for SigningKey<D>
where
D: Digest + FixedOutputReset,
D: Digest + FixedOutputReset + Update,
{
fn sign_prehash_with_rng<R: TryCryptoRng + ?Sized>(
&self,
Expand Down
12 changes: 9 additions & 3 deletions src/pss/verifying_key.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
use super::{verify_digest, Signature};
use crate::RsaPublicKey;
use core::marker::PhantomData;
use digest::{Digest, FixedOutputReset};
use digest::{Digest, FixedOutputReset, Update};
use signature::{hazmat::PrehashVerifier, DigestVerifier, Verifier};

#[cfg(feature = "encoding")]
Expand Down Expand Up @@ -72,9 +72,15 @@ where

impl<D> DigestVerifier<D, Signature> for VerifyingKey<D>
where
D: Digest + FixedOutputReset,
D: Digest + FixedOutputReset + Update,
{
fn verify_digest(&self, digest: D, signature: &Signature) -> signature::Result<()> {
fn verify_digest<F: Fn(&mut D) -> signature::Result<()>>(
&self,
f: F,
signature: &Signature,
) -> signature::Result<()> {
let mut digest = D::new();
f(&mut digest)?;
verify_digest::<D>(
&self.inner,
&digest.finalize(),
Expand Down