Skip to content

Commit ac7fd3b

Browse files
lumaglumag
committed
Get rid of rsa::Hash
Fully replace rsa::Hash with AssociatedOid usage. Signed-off-by: Dmitry Baryshkov <[email protected]>
1 parent b2108bd commit ac7fd3b

File tree

5 files changed

+51
-131
lines changed

5 files changed

+51
-131
lines changed

‎src/hash.rs

Lines changed: 0 additions & 85 deletions
This file was deleted.

‎src/key.rs

Lines changed: 21 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ use zeroize::Zeroize;
1212
use crate::algorithms::{generate_multi_prime_key, generate_multi_prime_key_with_exp};
1313
use crate::dummy_rng::DummyRng;
1414
use crate::errors::{Error, Result};
15-
use crate::hash::Hash;
1615

1716
use crate::padding::PaddingScheme;
1817
use crate::raw::{DecryptionPrimitive, EncryptionPrimitive};
@@ -217,9 +216,13 @@ impl PublicKey for RsaPublicKey {
217216

218217
fn verify(&self, padding: PaddingScheme, hashed: &[u8], sig: &[u8]) -> Result<()> {
219218
match padding {
220-
PaddingScheme::PKCS1v15Sign { ref hash } => {
221-
let prefix = hash_info(*hash, hashed.len())?;
222-
pkcs1v15::verify(self, prefix, hashed, sig)
219+
PaddingScheme::PKCS1v15Sign { hash_len, prefix } => {
220+
if let Some(hash_len) = hash_len {
221+
if hashed.len() != hash_len {
222+
return Err(Error::InputNotHashed);
223+
}
224+
}
225+
pkcs1v15::verify(self, prefix.as_ref(), hashed, sig)
223226
}
224227
PaddingScheme::PSS { mut digest, .. } => pss::verify(self, hashed, sig, &mut *digest),
225228
_ => Err(Error::InvalidPaddingScheme),
@@ -511,9 +514,13 @@ impl RsaPrivateKey {
511514
pub fn sign(&self, padding: PaddingScheme, digest_in: &[u8]) -> Result<Vec<u8>> {
512515
match padding {
513516
// need to pass any Rng as the type arg, so the type checker is happy, it is not actually used for anything
514-
PaddingScheme::PKCS1v15Sign { ref hash } => {
515-
let prefix = hash_info(*hash, digest_in.len())?;
516-
pkcs1v15::sign::<DummyRng, _>(None, self, prefix, digest_in)
517+
PaddingScheme::PKCS1v15Sign { hash_len, prefix } => {
518+
if let Some(hash_len) = hash_len {
519+
if digest_in.len() != hash_len {
520+
return Err(Error::InputNotHashed);
521+
}
522+
}
523+
pkcs1v15::sign::<DummyRng, _>(None, self, prefix.as_ref(), digest_in)
517524
}
518525
_ => Err(Error::InvalidPaddingScheme),
519526
}
@@ -547,9 +554,13 @@ impl RsaPrivateKey {
547554
digest_in: &[u8],
548555
) -> Result<Vec<u8>> {
549556
match padding {
550-
PaddingScheme::PKCS1v15Sign { ref hash } => {
551-
let prefix = hash_info(*hash, digest_in.len())?;
552-
pkcs1v15::sign(Some(rng), self, prefix, digest_in)
557+
PaddingScheme::PKCS1v15Sign { hash_len, prefix } => {
558+
if let Some(hash_len) = hash_len {
559+
if digest_in.len() != hash_len {
560+
return Err(Error::InputNotHashed);
561+
}
562+
}
563+
pkcs1v15::sign(Some(rng), self, prefix.as_ref(), digest_in)
553564
}
554565
PaddingScheme::PSS {
555566
mut digest,
@@ -560,22 +571,6 @@ impl RsaPrivateKey {
560571
}
561572
}
562573

563-
#[inline]
564-
fn hash_info(hash: Option<Hash>, digest_len: usize) -> Result<&'static [u8]> {
565-
match hash {
566-
Some(hash) => {
567-
let hash_len = hash.size();
568-
if digest_len != hash_len {
569-
return Err(Error::InputNotHashed);
570-
}
571-
572-
Ok(hash.asn1_prefix())
573-
}
574-
// this means the data is signed directly
575-
None => Ok(&[]),
576-
}
577-
}
578-
579574
/// Check that the public key is well formed and has an exponent within acceptable bounds.
580575
#[inline]
581576
pub fn check_public(public_key: &impl PublicKeyParts) -> Result<()> {

‎src/lib.rs

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -200,8 +200,6 @@ pub use rand_core;
200200
pub mod algorithms;
201201
/// Error types.
202202
pub mod errors;
203-
/// Supported hash functions.
204-
pub mod hash;
205203
/// Supported padding schemes.
206204
pub mod padding;
207205
/// RSASSA-PKCS1-v1_5 Signature support
@@ -218,7 +216,6 @@ mod raw;
218216
pub use pkcs1;
219217
pub use pkcs8;
220218

221-
pub use self::hash::Hash;
222219
pub use self::key::{PublicKey, PublicKeyParts, RsaPrivateKey, RsaPublicKey};
223220
pub use self::padding::PaddingScheme;
224221

‎src/padding.rs

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,19 @@ use alloc::string::{String, ToString};
33
use core::fmt;
44

55
use digest::{Digest, DynDigest};
6+
use pkcs8::AssociatedOid;
67

7-
use crate::hash::Hash;
8+
use crate::pkcs1v15;
89

910
/// Available padding schemes.
1011
pub enum PaddingScheme {
1112
/// Encryption and Decryption using PKCS1v15 padding.
1213
PKCS1v15Encrypt,
1314
/// Sign and Verify using PKCS1v15 padding.
14-
PKCS1v15Sign { hash: Option<Hash> },
15+
PKCS1v15Sign {
16+
hash_len: Option<usize>,
17+
prefix: Box<[u8]>,
18+
},
1519
/// Encryption and Decryption using [OAEP padding](https://datatracker.ietf.org/doc/html/rfc3447#section-7.1.1).
1620
///
1721
/// - `digest` is used to hash the label. The maximum possible plaintext length is `m = k - 2 * h_len - 2`,
@@ -38,8 +42,8 @@ impl fmt::Debug for PaddingScheme {
3842
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
3943
match self {
4044
PaddingScheme::PKCS1v15Encrypt => write!(f, "PaddingScheme::PKCS1v15Encrypt"),
41-
PaddingScheme::PKCS1v15Sign { ref hash } => {
42-
write!(f, "PaddingScheme::PKCS1v15Sign({:?})", hash)
45+
PaddingScheme::PKCS1v15Sign { prefix, .. } => {
46+
write!(f, "PaddingScheme::PKCS1v15Sign({:?})", prefix)
4347
}
4448
PaddingScheme::OAEP { ref label, .. } => {
4549
// TODO: How to print the digest name?
@@ -58,8 +62,21 @@ impl PaddingScheme {
5862
PaddingScheme::PKCS1v15Encrypt
5963
}
6064

61-
pub fn new_pkcs1v15_sign(hash: Option<Hash>) -> Self {
62-
PaddingScheme::PKCS1v15Sign { hash }
65+
pub fn new_pkcs1v15_sign_raw() -> Self {
66+
PaddingScheme::PKCS1v15Sign {
67+
hash_len: None,
68+
prefix: Box::new([]),
69+
}
70+
}
71+
72+
pub fn new_pkcs1v15_sign<D>() -> Self
73+
where
74+
D: Digest + AssociatedOid,
75+
{
76+
PaddingScheme::PKCS1v15Sign {
77+
hash_len: Some(<D as Digest>::output_size()),
78+
prefix: pkcs1v15::generate_prefix::<D>().into_boxed_slice(),
79+
}
6380
}
6481

6582
/// Create a new OAEP `PaddingScheme`, using `T` as the hash function for the default (empty) label, and `U` as the hash function for MGF1.

‎src/pkcs1v15.rs

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,7 @@ pub(crate) fn verify<PK: PublicKey>(
209209

210210
// prefix = 0x30 <oid_len + 8 + digest_len> 0x30 <oid_len + 4> 0x06 <oid_len> oid 0x05 0x00 0x04 <digest_len>
211211
#[inline]
212-
fn generate_prefix<D>() -> Vec<u8>
212+
pub(crate) fn generate_prefix<D>() -> Vec<u8>
213213
where
214214
D: Digest + AssociatedOid,
215215
{
@@ -497,7 +497,7 @@ mod tests {
497497
use sha1::{Digest, Sha1};
498498
use signature::{RandomizedSigner, Signature, Signer, Verifier};
499499

500-
use crate::{Hash, PaddingScheme, PublicKey, PublicKeyParts, RsaPrivateKey, RsaPublicKey};
500+
use crate::{PaddingScheme, PublicKey, PublicKeyParts, RsaPrivateKey, RsaPublicKey};
501501

502502
#[test]
503503
fn test_non_zero_bytes() {
@@ -603,7 +603,7 @@ mod tests {
603603
let digest = Sha1::digest(text.as_bytes()).to_vec();
604604

605605
let out = priv_key
606-
.sign(PaddingScheme::new_pkcs1v15_sign(Some(Hash::SHA1)), &digest)
606+
.sign(PaddingScheme::new_pkcs1v15_sign::<Sha1>(), &digest)
607607
.unwrap();
608608
assert_ne!(out, digest);
609609
assert_eq!(out, expected);
@@ -612,7 +612,7 @@ mod tests {
612612
let out2 = priv_key
613613
.sign_blinded(
614614
&mut rng,
615-
PaddingScheme::new_pkcs1v15_sign(Some(Hash::SHA1)),
615+
PaddingScheme::new_pkcs1v15_sign::<Sha1>(),
616616
&digest,
617617
)
618618
.unwrap();
@@ -703,11 +703,7 @@ mod tests {
703703
for (text, sig, expected) in &tests {
704704
let digest = Sha1::digest(text.as_bytes()).to_vec();
705705

706-
let result = pub_key.verify(
707-
PaddingScheme::new_pkcs1v15_sign(Some(Hash::SHA1)),
708-
&digest,
709-
sig,
710-
);
706+
let result = pub_key.verify(PaddingScheme::new_pkcs1v15_sign::<Sha1>(), &digest, sig);
711707
match expected {
712708
true => result.expect("failed to verify"),
713709
false => {
@@ -801,13 +797,13 @@ mod tests {
801797
let priv_key = get_private_key();
802798

803799
let sig = priv_key
804-
.sign(PaddingScheme::new_pkcs1v15_sign(None), msg)
800+
.sign(PaddingScheme::new_pkcs1v15_sign_raw(), msg)
805801
.unwrap();
806802
assert_eq!(expected_sig, sig);
807803

808804
let pub_key: RsaPublicKey = priv_key.into();
809805
pub_key
810-
.verify(PaddingScheme::new_pkcs1v15_sign(None), msg, &sig)
806+
.verify(PaddingScheme::new_pkcs1v15_sign_raw(), msg, &sig)
811807
.expect("failed to verify");
812808
}
813809

0 commit comments

Comments
 (0)