Skip to content

Commit e0f1bb2

Browse files
justsmthjustsmth
committed
Add signature::ParsedPublicKey
1 parent 4ac4434 commit e0f1bb2

File tree

6 files changed

+380
-39
lines changed

6 files changed

+380
-39
lines changed

‎aws-lc-rs/src/ec/signature.rs

Lines changed: 57 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ use crate::aws_lc::{
66
NID_secp384r1, NID_secp521r1, BIGNUM, ECDSA_SIG, EVP_PKEY,
77
};
88

9+
use crate::digest::Digest;
910
use crate::ec::compressed_public_key_size_bytes;
1011
use crate::ec::encoding::parse_ec_public_key;
1112
use crate::ec::encoding::sec1::marshal_sec1_public_point;
@@ -15,7 +16,7 @@ use crate::encoding::{
1516
use crate::error::Unspecified;
1617
use crate::evp_pkey::No_EVP_PKEY_CTX_consumer;
1718
use crate::ptr::{DetachableLcPtr, LcPtr};
18-
use crate::signature::VerificationAlgorithm;
19+
use crate::signature::{ParsedPublicKey, ParsedVerificationAlgorithm, VerificationAlgorithm};
1920
use crate::{digest, sealed};
2021
use core::fmt;
2122
use core::fmt::{Debug, Formatter};
@@ -192,43 +193,86 @@ impl VerificationAlgorithm for EcdsaVerificationAlgorithm {
192193
public_key: &[u8],
193194
msg: &[u8],
194195
signature: &[u8],
196+
) -> Result<(), Unspecified> {
197+
let public_key = parse_ec_public_key(public_key, self.id.nid())?;
198+
self.verify_ecdsa(msg, signature, &public_key)
199+
}
200+
201+
fn verify_digest_sig(
202+
&self,
203+
public_key: &[u8],
204+
digest: &digest::Digest,
205+
signature: &[u8],
206+
) -> Result<(), Unspecified> {
207+
let public_key = parse_ec_public_key(public_key, self.id.nid())?;
208+
209+
self.verify_digest_ecdsa(digest, signature, &public_key)
210+
}
211+
}
212+
213+
impl EcdsaVerificationAlgorithm {
214+
fn verify_ecdsa(
215+
&self,
216+
msg: &[u8],
217+
signature: &[u8],
218+
public_key: &LcPtr<EVP_PKEY>,
195219
) -> Result<(), Unspecified> {
196220
match self.sig_format {
197221
EcdsaSignatureFormat::ASN1 => {
198-
verify_asn1_signature(self.id, self.digest, public_key, msg, signature)
222+
verify_asn1_signature(self.digest, public_key, msg, signature)
199223
}
200224
EcdsaSignatureFormat::Fixed => {
201225
let (out_bytes, out_bytes_len) = convert_fixed_signature(self.id, signature)?;
202-
verify_asn1_signature(self.id, self.digest, public_key, msg, unsafe {
226+
verify_asn1_signature(self.digest, public_key, msg, unsafe {
203227
out_bytes.as_slice(out_bytes_len)
204228
})
205229
}
206230
}
207231
}
208232

209-
fn verify_digest_sig(
233+
fn verify_digest_ecdsa(
210234
&self,
211-
public_key: &[u8],
212-
digest: &digest::Digest,
235+
digest: &Digest,
213236
signature: &[u8],
237+
public_key: &LcPtr<EVP_PKEY>,
214238
) -> Result<(), Unspecified> {
215239
if self.digest != digest.algorithm() {
216240
return Err(Unspecified);
217241
}
218242
match self.sig_format {
219243
EcdsaSignatureFormat::ASN1 => {
220-
verify_asn1_digest_signature(self.id, digest, public_key, signature)
244+
verify_asn1_digest_signature(digest, public_key, signature)
221245
}
222246
EcdsaSignatureFormat::Fixed => {
223247
let (out_bytes, out_bytes_len) = convert_fixed_signature(self.id, signature)?;
224-
verify_asn1_digest_signature(self.id, digest, public_key, unsafe {
248+
verify_asn1_digest_signature(digest, public_key, unsafe {
225249
out_bytes.as_slice(out_bytes_len)
226250
})
227251
}
228252
}
229253
}
230254
}
231255

256+
impl ParsedVerificationAlgorithm for EcdsaVerificationAlgorithm {
257+
fn parsed_verify_sig(
258+
&self,
259+
public_key: &ParsedPublicKey,
260+
msg: &[u8],
261+
signature: &[u8],
262+
) -> Result<(), Unspecified> {
263+
self.verify_ecdsa(msg, signature, public_key.key())
264+
}
265+
266+
fn parsed_verify_digest_sig(
267+
&self,
268+
public_key: &ParsedPublicKey,
269+
digest: &Digest,
270+
signature: &[u8],
271+
) -> Result<(), Unspecified> {
272+
self.verify_digest_ecdsa(digest, signature, public_key.key())
273+
}
274+
}
275+
232276
fn convert_fixed_signature(
233277
alg: &'static AlgorithmID,
234278
signature: &[u8],
@@ -247,24 +291,20 @@ fn convert_fixed_signature(
247291
}
248292

249293
fn verify_asn1_signature(
250-
alg: &'static AlgorithmID,
251294
digest_alg: &'static digest::Algorithm,
252-
public_key: &[u8],
295+
public_key: &LcPtr<EVP_PKEY>,
253296
msg: &[u8],
254297
signature: &[u8],
255298
) -> Result<(), Unspecified> {
256-
let evp_pkey = parse_ec_public_key(public_key, alg.nid())?;
257-
evp_pkey.verify(msg, Some(digest_alg), No_EVP_PKEY_CTX_consumer, signature)
299+
public_key.verify(msg, Some(digest_alg), No_EVP_PKEY_CTX_consumer, signature)
258300
}
259301

260302
fn verify_asn1_digest_signature(
261-
alg: &'static AlgorithmID,
262-
digest: &digest::Digest,
263-
public_key: &[u8],
303+
digest: &Digest,
304+
public_key: &LcPtr<EVP_PKEY>,
264305
signature: &[u8],
265306
) -> Result<(), Unspecified> {
266-
let evp_pkey = parse_ec_public_key(public_key, alg.nid())?;
267-
evp_pkey.verify_digest_sig(digest, No_EVP_PKEY_CTX_consumer, signature)
307+
public_key.verify_digest_sig(digest, No_EVP_PKEY_CTX_consumer, signature)
268308
}
269309

270310
#[inline]

‎aws-lc-rs/src/ed25519.rs

Lines changed: 34 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ use untrusted::Input;
1313
use crate::aws_lc::{EVP_PKEY, EVP_PKEY_ED25519};
1414

1515
use crate::buffer::Buffer;
16+
use crate::digest::Digest;
1617
use crate::encoding::{
1718
AsBigEndian, AsDer, Curve25519SeedBin, Pkcs8V1Der, Pkcs8V2Der, PublicKeyX509Der,
1819
};
@@ -21,7 +22,9 @@ use crate::evp_pkey::No_EVP_PKEY_CTX_consumer;
2122
use crate::pkcs8::{Document, Version};
2223
use crate::ptr::LcPtr;
2324
use crate::rand::SecureRandom;
24-
use crate::signature::{KeyPair, Signature, VerificationAlgorithm};
25+
use crate::signature::{
26+
KeyPair, ParsedPublicKey, ParsedVerificationAlgorithm, Signature, VerificationAlgorithm,
27+
};
2528
use crate::{constant_time, digest, hex, sealed};
2629

2730
/// The length of an Ed25519 public key.
@@ -35,6 +38,28 @@ pub struct EdDSAParameters;
3538

3639
impl sealed::Sealed for EdDSAParameters {}
3740

41+
impl ParsedVerificationAlgorithm for EdDSAParameters {
42+
fn parsed_verify_sig(
43+
&self,
44+
public_key: &ParsedPublicKey,
45+
msg: &[u8],
46+
signature: &[u8],
47+
) -> Result<(), Unspecified> {
48+
public_key
49+
.key()
50+
.verify(msg, None, No_EVP_PKEY_CTX_consumer, signature)
51+
}
52+
53+
fn parsed_verify_digest_sig(
54+
&self,
55+
_public_key: &ParsedPublicKey,
56+
_digest: &Digest,
57+
_signature: &[u8],
58+
) -> Result<(), Unspecified> {
59+
Err(Unspecified)
60+
}
61+
}
62+
3863
impl VerificationAlgorithm for EdDSAParameters {
3964
#[inline]
4065
#[cfg(feature = "ring-sig-verify")]
@@ -44,11 +69,9 @@ impl VerificationAlgorithm for EdDSAParameters {
4469
msg: Input<'_>,
4570
signature: Input<'_>,
4671
) -> Result<(), Unspecified> {
47-
let evp_pkey = try_ed25519_public_key_from_bytes(public_key.as_slice_less_safe())?;
48-
evp_pkey.verify(
72+
self.verify_sig(
73+
public_key.as_slice_less_safe(),
4974
msg.as_slice_less_safe(),
50-
None,
51-
No_EVP_PKEY_CTX_consumer,
5275
signature.as_slice_less_safe(),
5376
)
5477
}
@@ -63,7 +86,7 @@ impl VerificationAlgorithm for EdDSAParameters {
6386
msg: &[u8],
6487
signature: &[u8],
6588
) -> Result<(), Unspecified> {
66-
let evp_pkey = try_ed25519_public_key_from_bytes(public_key)?;
89+
let evp_pkey = parse_ed25519_public_key(public_key)?;
6790
evp_pkey.verify(msg, None, No_EVP_PKEY_CTX_consumer, signature)
6891
}
6992

@@ -81,13 +104,14 @@ impl VerificationAlgorithm for EdDSAParameters {
81104
}
82105
}
83106

84-
fn try_ed25519_public_key_from_bytes(key_bytes: &[u8]) -> Result<LcPtr<EVP_PKEY>, KeyRejected> {
107+
pub(crate) fn parse_ed25519_public_key(key_bytes: &[u8]) -> Result<LcPtr<EVP_PKEY>, KeyRejected> {
85108
// If the length of key bytes matches the raw public key size then it has to be that
86109
if key_bytes.len() == ED25519_PUBLIC_KEY_LEN {
87-
return LcPtr::<EVP_PKEY>::parse_raw_public_key(key_bytes, EVP_PKEY_ED25519);
110+
LcPtr::<EVP_PKEY>::parse_raw_public_key(key_bytes, EVP_PKEY_ED25519)
111+
} else {
112+
// Otherwise we support X.509 SubjectPublicKeyInfo formatted keys which are inherently larger
113+
LcPtr::<EVP_PKEY>::parse_rfc5280_public_key(key_bytes, EVP_PKEY_ED25519)
88114
}
89-
// Otherwise we support X.509 SubjectPublicKeyInfo formatted keys which are inherently larger
90-
LcPtr::<EVP_PKEY>::parse_rfc5280_public_key(key_bytes, EVP_PKEY_ED25519)
91115
}
92116

93117
/// An Ed25519 key pair, for signing.

‎aws-lc-rs/src/pqdsa/signature.rs

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,13 @@
33

44
use crate::aws_lc::EVP_PKEY;
55
use crate::buffer::Buffer;
6+
use crate::digest::Digest;
67
use crate::encoding::{AsDer, PublicKeyX509Der};
78
use crate::error::Unspecified;
89
use crate::evp_pkey::No_EVP_PKEY_CTX_consumer;
910
use crate::pqdsa::{parse_pqdsa_public_key, AlgorithmID};
1011
use crate::ptr::LcPtr;
11-
use crate::signature::VerificationAlgorithm;
12+
use crate::signature::{ParsedPublicKey, ParsedVerificationAlgorithm, VerificationAlgorithm};
1213
use crate::{digest, sealed};
1314
use core::fmt;
1415
use core::fmt::{Debug, Formatter};
@@ -55,6 +56,28 @@ impl PublicKey {
5556
}
5657
}
5758

59+
impl ParsedVerificationAlgorithm for PqdsaVerificationAlgorithm {
60+
fn parsed_verify_sig(
61+
&self,
62+
public_key: &ParsedPublicKey,
63+
msg: &[u8],
64+
signature: &[u8],
65+
) -> Result<(), Unspecified> {
66+
let evp_pkey = public_key.key();
67+
evp_pkey.verify(msg, None, No_EVP_PKEY_CTX_consumer, signature)
68+
}
69+
70+
fn parsed_verify_digest_sig(
71+
&self,
72+
public_key: &ParsedPublicKey,
73+
digest: &Digest,
74+
signature: &[u8],
75+
) -> Result<(), Unspecified> {
76+
let evp_pkey = public_key.key();
77+
evp_pkey.verify_digest_sig(digest, No_EVP_PKEY_CTX_consumer, signature)
78+
}
79+
}
80+
5881
impl VerificationAlgorithm for PqdsaVerificationAlgorithm {
5982
/// Verifies the the signature of `msg` using the public key `public_key`.
6083
///

‎aws-lc-rs/src/rsa/key.rs

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -367,6 +367,10 @@ impl PublicKey {
367367
}
368368
}
369369

370+
pub(crate) fn parse_rsa_public_key(input: &[u8]) -> Result<LcPtr<EVP_PKEY>, KeyRejected> {
371+
rfc8017::decode_public_key_der(input).or(rfc5280::decode_public_key_der(input))
372+
}
373+
370374
impl Debug for PublicKey {
371375
fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), fmt::Error> {
372376
f.write_str(&format!(

‎aws-lc-rs/src/rsa/signature.rs

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ use crate::digest::{self, match_digest_type, Digest};
1313
use crate::error::Unspecified;
1414
use crate::ptr::LcPtr;
1515
use crate::sealed::Sealed;
16-
use crate::signature::VerificationAlgorithm;
16+
use crate::signature::{ParsedPublicKey, ParsedVerificationAlgorithm, VerificationAlgorithm};
1717

1818
use super::encoding;
1919
#[cfg(feature = "ring-sig-verify")]
@@ -52,6 +52,41 @@ impl RsaParameters {
5252
}
5353
}
5454

55+
impl ParsedVerificationAlgorithm for RsaParameters {
56+
fn parsed_verify_sig(
57+
&self,
58+
public_key: &ParsedPublicKey,
59+
msg: &[u8],
60+
signature: &[u8],
61+
) -> Result<(), Unspecified> {
62+
let evp_pkey = public_key.key();
63+
verify_rsa_signature(
64+
self.digest_algorithm(),
65+
self.padding(),
66+
evp_pkey,
67+
msg,
68+
signature,
69+
self.bit_size_range(),
70+
)
71+
}
72+
73+
fn parsed_verify_digest_sig(
74+
&self,
75+
public_key: &ParsedPublicKey,
76+
digest: &Digest,
77+
signature: &[u8],
78+
) -> Result<(), Unspecified> {
79+
let evp_pkey = public_key.key();
80+
verify_rsa_digest_signature(
81+
self.padding(),
82+
evp_pkey,
83+
digest,
84+
signature,
85+
self.bit_size_range(),
86+
)
87+
}
88+
}
89+
5590
impl VerificationAlgorithm for RsaParameters {
5691
#[cfg(feature = "ring-sig-verify")]
5792
fn verify(

0 commit comments

Comments
 (0)