Skip to content

Commit 0ae3b87

Browse files
sidrubssidrubs
committed
feat(crypto): Add RSA family
1 parent 4225e1f commit 0ae3b87

File tree

9 files changed

+249
-56
lines changed

9 files changed

+249
-56
lines changed

‎Cargo.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ time = { version = "0.3", features = ["wasm-bindgen"] }
6060
criterion = { version = "0.4", default-features = false }
6161

6262
[features]
63-
default = ["use_pem", "rust_crypto"]
63+
default = ["use_pem", "aws_lc_rs"]
6464
use_pem = ["pem", "simple_asn1", 'p256/pem', 'p384/pem']
6565
rust_crypto = ["hmac"]
6666
aws_lc_rs = ["aws-lc-rs"]

‎src/crypto/aws_lc/hmac.rs

+70-25
Original file line numberDiff line numberDiff line change
@@ -4,101 +4,146 @@
44
use aws_lc_rs::hmac;
55
use signature::{Signer, Verifier};
66

7+
use crate::crypto::utils::{
8+
try_get_hmac_secret_from_decoding_key, try_get_hmac_secret_from_encoding_key,
9+
};
710
use crate::crypto::{JwtSigner, JwtVerifier};
811
use crate::errors::Result;
9-
use crate::{Algorithm, HmacSecret};
12+
use crate::{Algorithm, DecodingKey, EncodingKey};
1013

11-
pub struct Hs256(hmac::Key);
14+
pub struct Hs256Signer(hmac::Key);
1215

13-
impl Hs256 {
14-
pub(crate) fn new(secret: HmacSecret) -> Result<Self> {
15-
Ok(Self(hmac::Key::new(hmac::HMAC_SHA256, &secret)))
16+
impl Hs256Signer {
17+
pub(crate) fn new(encoding_key: &EncodingKey) -> Result<Self> {
18+
Ok(Self(hmac::Key::new(
19+
hmac::HMAC_SHA256,
20+
try_get_hmac_secret_from_encoding_key(encoding_key)?,
21+
)))
1622
}
1723
}
1824

19-
impl Signer<Vec<u8>> for Hs256 {
25+
impl Signer<Vec<u8>> for Hs256Signer {
2026
fn try_sign(&self, msg: &[u8]) -> std::result::Result<Vec<u8>, signature::Error> {
2127
Ok(hmac::sign(&self.0, msg).as_ref().to_vec())
2228
}
2329
}
2430

25-
impl JwtSigner for Hs256 {
31+
impl JwtSigner for Hs256Signer {
2632
fn algorithm(&self) -> Algorithm {
2733
Algorithm::HS256
2834
}
2935
}
3036

31-
impl Verifier<Vec<u8>> for Hs256 {
37+
pub struct Hs256Verifier(hmac::Key);
38+
39+
impl Hs256Verifier {
40+
pub(crate) fn new(decoding_key: &DecodingKey) -> Result<Self> {
41+
Ok(Self(hmac::Key::new(
42+
hmac::HMAC_SHA256,
43+
try_get_hmac_secret_from_decoding_key(decoding_key)?,
44+
)))
45+
}
46+
}
47+
48+
impl Verifier<Vec<u8>> for Hs256Verifier {
3249
fn verify(&self, msg: &[u8], signature: &Vec<u8>) -> std::result::Result<(), signature::Error> {
3350
hmac::verify(&self.0, msg, &signature).map_err(|err| signature::Error::from_source(err))
3451
}
3552
}
3653

37-
impl JwtVerifier for Hs256 {
54+
impl JwtVerifier for Hs256Verifier {
3855
fn algorithm(&self) -> Algorithm {
3956
Algorithm::HS256
4057
}
4158
}
4259

43-
pub struct Hs384(hmac::Key);
60+
pub struct Hs384Signer(hmac::Key);
4461

45-
impl Hs384 {
46-
pub(crate) fn new(secret: HmacSecret) -> Result<Self> {
47-
Ok(Self(hmac::Key::new(hmac::HMAC_SHA384, &secret)))
62+
impl Hs384Signer {
63+
pub(crate) fn new(encoding_key: &EncodingKey) -> Result<Self> {
64+
Ok(Self(hmac::Key::new(
65+
hmac::HMAC_SHA384,
66+
try_get_hmac_secret_from_encoding_key(encoding_key)?,
67+
)))
4868
}
4969
}
5070

51-
impl Signer<Vec<u8>> for Hs384 {
71+
impl Signer<Vec<u8>> for Hs384Signer {
5272
fn try_sign(&self, msg: &[u8]) -> std::result::Result<Vec<u8>, signature::Error> {
5373
Ok(hmac::sign(&self.0, msg).as_ref().to_vec())
5474
}
5575
}
5676

57-
impl JwtSigner for Hs384 {
77+
impl JwtSigner for Hs384Signer {
5878
fn algorithm(&self) -> Algorithm {
5979
Algorithm::HS384
6080
}
6181
}
6282

63-
impl Verifier<Vec<u8>> for Hs384 {
83+
pub struct Hs384Verifier(hmac::Key);
84+
85+
impl Hs384Verifier {
86+
pub(crate) fn new(decoding_key: &DecodingKey) -> Result<Self> {
87+
Ok(Self(hmac::Key::new(
88+
hmac::HMAC_SHA384,
89+
try_get_hmac_secret_from_decoding_key(decoding_key)?,
90+
)))
91+
}
92+
}
93+
94+
impl Verifier<Vec<u8>> for Hs384Verifier {
6495
fn verify(&self, msg: &[u8], signature: &Vec<u8>) -> std::result::Result<(), signature::Error> {
6596
hmac::verify(&self.0, msg, &signature).map_err(|err| signature::Error::from_source(err))
6697
}
6798
}
6899

69-
impl JwtVerifier for Hs384 {
100+
impl JwtVerifier for Hs384Verifier {
70101
fn algorithm(&self) -> Algorithm {
71102
Algorithm::HS384
72103
}
73104
}
74105

75-
pub struct Hs512(hmac::Key);
106+
pub struct Hs512Signer(hmac::Key);
76107

77-
impl Hs512 {
78-
pub(crate) fn new(secret: HmacSecret) -> Result<Self> {
79-
Ok(Self(hmac::Key::new(hmac::HMAC_SHA512, &secret)))
108+
impl Hs512Signer {
109+
pub(crate) fn new(encoding_key: &EncodingKey) -> Result<Self> {
110+
Ok(Self(hmac::Key::new(
111+
hmac::HMAC_SHA512,
112+
try_get_hmac_secret_from_encoding_key(encoding_key)?,
113+
)))
80114
}
81115
}
82116

83-
impl Signer<Vec<u8>> for Hs512 {
117+
impl Signer<Vec<u8>> for Hs512Signer {
84118
fn try_sign(&self, msg: &[u8]) -> std::result::Result<Vec<u8>, signature::Error> {
85119
Ok(hmac::sign(&self.0, msg).as_ref().to_vec())
86120
}
87121
}
88122

89-
impl JwtSigner for Hs512 {
123+
impl JwtSigner for Hs512Signer {
90124
fn algorithm(&self) -> Algorithm {
91125
Algorithm::HS512
92126
}
93127
}
94128

95-
impl Verifier<Vec<u8>> for Hs512 {
129+
pub struct Hs512Verifier(hmac::Key);
130+
131+
impl Hs512Verifier {
132+
pub(crate) fn new(decoding_key: &DecodingKey) -> Result<Self> {
133+
Ok(Self(hmac::Key::new(
134+
hmac::HMAC_SHA512,
135+
try_get_hmac_secret_from_decoding_key(decoding_key)?,
136+
)))
137+
}
138+
}
139+
140+
impl Verifier<Vec<u8>> for Hs512Verifier {
96141
fn verify(&self, msg: &[u8], signature: &Vec<u8>) -> std::result::Result<(), signature::Error> {
97142
hmac::verify(&self.0, msg, &signature).map_err(|err| signature::Error::from_source(err))
98143
}
99144
}
100145

101-
impl JwtVerifier for Hs512 {
146+
impl JwtVerifier for Hs512Verifier {
102147
fn algorithm(&self) -> Algorithm {
103148
Algorithm::HS512
104149
}

‎src/crypto/aws_lc/mod.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
pub(crate) mod hmac;
2-
// pub(crate) mod rsa;
2+
pub(crate) mod rsa;

‎src/crypto/aws_lc/rsa.rs

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
//! Implementations of the [`JwtSigner`] and [`JwtVerifier`] traits for the
2+
//! RSA family of algorithms using [`aws_lc_rs`]
3+
4+
use aws_lc_rs::{rand, signature as crypto_sig};
5+
use signature::{Signer, Verifier};
6+
7+
use crate::crypto::utils::{
8+
try_get_rsa_components_from_decoding_key, try_get_rsa_pem_from_encoding_key,
9+
};
10+
use crate::crypto::{JwtSigner, JwtVerifier};
11+
use crate::errors::{ErrorKind, Result};
12+
use crate::{Algorithm, DecodingKey, EncodingKey};
13+
14+
pub struct Rsa256Signer(crypto_sig::RsaKeyPair);
15+
16+
impl Rsa256Signer {
17+
pub(crate) fn new(encoding_key: &EncodingKey) -> Result<Self> {
18+
let key_pair =
19+
crypto_sig::RsaKeyPair::from_der(try_get_rsa_pem_from_encoding_key(encoding_key)?)
20+
.map_err(|e| ErrorKind::InvalidRsaKey(e.to_string()))?;
21+
22+
Ok(Self(key_pair))
23+
}
24+
}
25+
26+
impl Signer<Vec<u8>> for Rsa256Signer {
27+
fn try_sign(&self, msg: &[u8]) -> std::result::Result<Vec<u8>, signature::Error> {
28+
let mut signature = vec![0; self.0.public_modulus_len()];
29+
let rng = rand::SystemRandom::new();
30+
self.0
31+
.sign(&crypto_sig::RSA_PKCS1_SHA256, &rng, msg, &mut signature)
32+
.map_err(|err| signature::Error::from_source(err))?;
33+
34+
Ok(signature)
35+
}
36+
}
37+
38+
impl JwtSigner for Rsa256Signer {
39+
fn algorithm(&self) -> Algorithm {
40+
Algorithm::RS256
41+
}
42+
}
43+
44+
pub struct Rsa256Verifier(crypto_sig::RsaPublicKeyComponents<Vec<u8>>);
45+
46+
impl Rsa256Verifier {
47+
pub(crate) fn new(decoding_key: &DecodingKey) -> Result<Self> {
48+
let components = try_get_rsa_components_from_decoding_key(decoding_key)?;
49+
let pub_key = crypto_sig::RsaPublicKeyComponents {
50+
n: components.0.to_vec(),
51+
e: components.1.to_vec(),
52+
};
53+
54+
Ok(Self(pub_key))
55+
}
56+
}
57+
58+
impl Verifier<Vec<u8>> for Rsa256Verifier {
59+
fn verify(&self, msg: &[u8], signature: &Vec<u8>) -> std::result::Result<(), signature::Error> {
60+
self.0
61+
.verify(&crypto_sig::RSA_PKCS1_2048_8192_SHA256, msg, signature)
62+
.map_err(|err| signature::Error::from_source(err))
63+
}
64+
}
65+
66+
impl JwtVerifier for Rsa256Verifier {
67+
fn algorithm(&self) -> Algorithm {
68+
Algorithm::RS256
69+
}
70+
}

‎src/crypto/mod.rs

+1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ use crate::algorithms::Algorithm;
88
pub(crate) mod aws_lc;
99
#[cfg(feature = "rust_crypto")]
1010
pub(crate) mod rust_crypto;
11+
pub(crate) mod utils;
1112

1213
use signature::{Signer, Verifier};
1314

‎src/crypto/rust_crypto/hmac.rs

+6-5
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,10 @@ use hmac::{Hmac, Mac};
55
use sha2::{Sha256, Sha384, Sha512};
66
use signature::{Signer, Verifier};
77

8+
use crate::crypto::utils::{
9+
try_get_hmac_secret_from_decoding_key, try_get_hmac_secret_from_encoding_key,
10+
};
811
use crate::crypto::{JwtSigner, JwtVerifier};
9-
use crate::decoding::try_get_hmac_secret_from_decoding_key;
10-
use crate::encoding::try_get_hmac_secret_from_encoding_key;
1112
use crate::errors::Result;
1213
use crate::{Algorithm, DecodingKey, EncodingKey};
1314

@@ -48,7 +49,7 @@ pub struct Hs256Verifier(HmacSha256);
4849
impl Hs256Verifier {
4950
pub(crate) fn new(decoding_key: &DecodingKey) -> Result<Self> {
5051
let inner =
51-
HmacSha256::new_from_slice(&try_get_hmac_secret_from_decoding_key(decoding_key)?)
52+
HmacSha256::new_from_slice(try_get_hmac_secret_from_decoding_key(decoding_key)?)
5253
.map_err(|_e| crate::errors::ErrorKind::InvalidKeyFormat)?;
5354

5455
Ok(Self(inner))
@@ -104,7 +105,7 @@ pub struct Hs384Verifier(HmacSha384);
104105
impl Hs384Verifier {
105106
pub(crate) fn new(decoding_key: &DecodingKey) -> Result<Self> {
106107
let inner =
107-
HmacSha384::new_from_slice(&try_get_hmac_secret_from_decoding_key(decoding_key)?)
108+
HmacSha384::new_from_slice(try_get_hmac_secret_from_decoding_key(decoding_key)?)
108109
.map_err(|_e| crate::errors::ErrorKind::InvalidKeyFormat)?;
109110

110111
Ok(Self(inner))
@@ -160,7 +161,7 @@ pub struct Hs512Verifier(HmacSha512);
160161
impl Hs512Verifier {
161162
pub(crate) fn new(decoding_key: &DecodingKey) -> Result<Self> {
162163
let inner =
163-
HmacSha512::new_from_slice(&try_get_hmac_secret_from_decoding_key(decoding_key)?)
164+
HmacSha512::new_from_slice(try_get_hmac_secret_from_decoding_key(decoding_key)?)
164165
.map_err(|_e| crate::errors::ErrorKind::InvalidKeyFormat)?;
165166

166167
Ok(Self(inner))

‎src/crypto/utils.rs

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
//! # Todo
2+
//!
3+
//! - Put in documentation
4+
5+
use crate::{
6+
algorithms::AlgorithmFamily,
7+
decoding::DecodingKeyKind,
8+
errors::{self, new_error, ErrorKind, Result},
9+
DecodingKey, EncodingKey,
10+
};
11+
12+
pub(crate) fn try_get_hmac_secret_from_encoding_key(encoding_key: &EncodingKey) -> Result<&[u8]> {
13+
if encoding_key.family == AlgorithmFamily::Hmac {
14+
Ok(encoding_key.inner())
15+
} else {
16+
Err(new_error(ErrorKind::InvalidKeyFormat))
17+
}
18+
}
19+
20+
pub(crate) fn try_get_hmac_secret_from_decoding_key(decoding_key: &DecodingKey) -> Result<&[u8]> {
21+
if decoding_key.family != AlgorithmFamily::Hmac {
22+
return Err(new_error(ErrorKind::InvalidKeyFormat));
23+
}
24+
25+
Ok(decoding_key.as_bytes())
26+
}
27+
28+
pub(crate) fn try_get_rsa_pem_from_encoding_key(encoding_key: &EncodingKey) -> Result<&[u8]> {
29+
if encoding_key.family == AlgorithmFamily::Rsa {
30+
Ok(encoding_key.inner())
31+
} else {
32+
Err(new_error(ErrorKind::InvalidKeyFormat))
33+
}
34+
}
35+
36+
pub(crate) fn try_get_rsa_components_from_decoding_key(
37+
decoding_key: &DecodingKey,
38+
) -> Result<(&[u8], &[u8])> {
39+
if decoding_key.family != AlgorithmFamily::Rsa {
40+
return Err(new_error(ErrorKind::InvalidKeyFormat));
41+
}
42+
43+
match &decoding_key.kind {
44+
DecodingKeyKind::SecretOrDer(_) => unreachable!(),
45+
DecodingKeyKind::RsaModulusExponent { n, e } => Ok((n, e)),
46+
}
47+
}

0 commit comments

Comments
 (0)