Skip to content

Commit 78e84c1

Browse files
sidrubssidrubs
committed
feat(crypto): Add RSA family
1 parent 4225e1f commit 78e84c1

File tree

11 files changed

+412
-150
lines changed

11 files changed

+412
-150
lines changed

‎Cargo.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ time = { version = "0.3", features = ["wasm-bindgen"] }
6060
criterion = { version = "0.4", default-features = false }
6161

6262
[features]
63-
default = ["use_pem", "rust_crypto"]
63+
default = ["use_pem", "aws_lc_rs"]
6464
use_pem = ["pem", "simple_asn1", 'p256/pem', 'p384/pem']
6565
rust_crypto = ["hmac"]
6666
aws_lc_rs = ["aws-lc-rs"]

‎src/crypto/aws_lc/hmac.rs

+70-25
Original file line numberDiff line numberDiff line change
@@ -4,101 +4,146 @@
44
use aws_lc_rs::hmac;
55
use signature::{Signer, Verifier};
66

7+
use crate::crypto::utils::{
8+
try_get_hmac_secret_from_decoding_key, try_get_hmac_secret_from_encoding_key,
9+
};
710
use crate::crypto::{JwtSigner, JwtVerifier};
811
use crate::errors::Result;
9-
use crate::{Algorithm, HmacSecret};
12+
use crate::{Algorithm, DecodingKey, EncodingKey};
1013

11-
pub struct Hs256(hmac::Key);
14+
pub struct Hs256Signer(hmac::Key);
1215

13-
impl Hs256 {
14-
pub(crate) fn new(secret: HmacSecret) -> Result<Self> {
15-
Ok(Self(hmac::Key::new(hmac::HMAC_SHA256, &secret)))
16+
impl Hs256Signer {
17+
pub(crate) fn new(encoding_key: &EncodingKey) -> Result<Self> {
18+
Ok(Self(hmac::Key::new(
19+
hmac::HMAC_SHA256,
20+
try_get_hmac_secret_from_encoding_key(encoding_key)?,
21+
)))
1622
}
1723
}
1824

19-
impl Signer<Vec<u8>> for Hs256 {
25+
impl Signer<Vec<u8>> for Hs256Signer {
2026
fn try_sign(&self, msg: &[u8]) -> std::result::Result<Vec<u8>, signature::Error> {
2127
Ok(hmac::sign(&self.0, msg).as_ref().to_vec())
2228
}
2329
}
2430

25-
impl JwtSigner for Hs256 {
31+
impl JwtSigner for Hs256Signer {
2632
fn algorithm(&self) -> Algorithm {
2733
Algorithm::HS256
2834
}
2935
}
3036

31-
impl Verifier<Vec<u8>> for Hs256 {
37+
pub struct Hs256Verifier(hmac::Key);
38+
39+
impl Hs256Verifier {
40+
pub(crate) fn new(decoding_key: &DecodingKey) -> Result<Self> {
41+
Ok(Self(hmac::Key::new(
42+
hmac::HMAC_SHA256,
43+
try_get_hmac_secret_from_decoding_key(decoding_key)?,
44+
)))
45+
}
46+
}
47+
48+
impl Verifier<Vec<u8>> for Hs256Verifier {
3249
fn verify(&self, msg: &[u8], signature: &Vec<u8>) -> std::result::Result<(), signature::Error> {
3350
hmac::verify(&self.0, msg, &signature).map_err(|err| signature::Error::from_source(err))
3451
}
3552
}
3653

37-
impl JwtVerifier for Hs256 {
54+
impl JwtVerifier for Hs256Verifier {
3855
fn algorithm(&self) -> Algorithm {
3956
Algorithm::HS256
4057
}
4158
}
4259

43-
pub struct Hs384(hmac::Key);
60+
pub struct Hs384Signer(hmac::Key);
4461

45-
impl Hs384 {
46-
pub(crate) fn new(secret: HmacSecret) -> Result<Self> {
47-
Ok(Self(hmac::Key::new(hmac::HMAC_SHA384, &secret)))
62+
impl Hs384Signer {
63+
pub(crate) fn new(encoding_key: &EncodingKey) -> Result<Self> {
64+
Ok(Self(hmac::Key::new(
65+
hmac::HMAC_SHA384,
66+
try_get_hmac_secret_from_encoding_key(encoding_key)?,
67+
)))
4868
}
4969
}
5070

51-
impl Signer<Vec<u8>> for Hs384 {
71+
impl Signer<Vec<u8>> for Hs384Signer {
5272
fn try_sign(&self, msg: &[u8]) -> std::result::Result<Vec<u8>, signature::Error> {
5373
Ok(hmac::sign(&self.0, msg).as_ref().to_vec())
5474
}
5575
}
5676

57-
impl JwtSigner for Hs384 {
77+
impl JwtSigner for Hs384Signer {
5878
fn algorithm(&self) -> Algorithm {
5979
Algorithm::HS384
6080
}
6181
}
6282

63-
impl Verifier<Vec<u8>> for Hs384 {
83+
pub struct Hs384Verifier(hmac::Key);
84+
85+
impl Hs384Verifier {
86+
pub(crate) fn new(decoding_key: &DecodingKey) -> Result<Self> {
87+
Ok(Self(hmac::Key::new(
88+
hmac::HMAC_SHA384,
89+
try_get_hmac_secret_from_decoding_key(decoding_key)?,
90+
)))
91+
}
92+
}
93+
94+
impl Verifier<Vec<u8>> for Hs384Verifier {
6495
fn verify(&self, msg: &[u8], signature: &Vec<u8>) -> std::result::Result<(), signature::Error> {
6596
hmac::verify(&self.0, msg, &signature).map_err(|err| signature::Error::from_source(err))
6697
}
6798
}
6899

69-
impl JwtVerifier for Hs384 {
100+
impl JwtVerifier for Hs384Verifier {
70101
fn algorithm(&self) -> Algorithm {
71102
Algorithm::HS384
72103
}
73104
}
74105

75-
pub struct Hs512(hmac::Key);
106+
pub struct Hs512Signer(hmac::Key);
76107

77-
impl Hs512 {
78-
pub(crate) fn new(secret: HmacSecret) -> Result<Self> {
79-
Ok(Self(hmac::Key::new(hmac::HMAC_SHA512, &secret)))
108+
impl Hs512Signer {
109+
pub(crate) fn new(encoding_key: &EncodingKey) -> Result<Self> {
110+
Ok(Self(hmac::Key::new(
111+
hmac::HMAC_SHA512,
112+
try_get_hmac_secret_from_encoding_key(encoding_key)?,
113+
)))
80114
}
81115
}
82116

83-
impl Signer<Vec<u8>> for Hs512 {
117+
impl Signer<Vec<u8>> for Hs512Signer {
84118
fn try_sign(&self, msg: &[u8]) -> std::result::Result<Vec<u8>, signature::Error> {
85119
Ok(hmac::sign(&self.0, msg).as_ref().to_vec())
86120
}
87121
}
88122

89-
impl JwtSigner for Hs512 {
123+
impl JwtSigner for Hs512Signer {
90124
fn algorithm(&self) -> Algorithm {
91125
Algorithm::HS512
92126
}
93127
}
94128

95-
impl Verifier<Vec<u8>> for Hs512 {
129+
pub struct Hs512Verifier(hmac::Key);
130+
131+
impl Hs512Verifier {
132+
pub(crate) fn new(decoding_key: &DecodingKey) -> Result<Self> {
133+
Ok(Self(hmac::Key::new(
134+
hmac::HMAC_SHA512,
135+
try_get_hmac_secret_from_decoding_key(decoding_key)?,
136+
)))
137+
}
138+
}
139+
140+
impl Verifier<Vec<u8>> for Hs512Verifier {
96141
fn verify(&self, msg: &[u8], signature: &Vec<u8>) -> std::result::Result<(), signature::Error> {
97142
hmac::verify(&self.0, msg, &signature).map_err(|err| signature::Error::from_source(err))
98143
}
99144
}
100145

101-
impl JwtVerifier for Hs512 {
146+
impl JwtVerifier for Hs512Verifier {
102147
fn algorithm(&self) -> Algorithm {
103148
Algorithm::HS512
104149
}

‎src/crypto/aws_lc/mod.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
pub(crate) mod hmac;
2-
// pub(crate) mod rsa;
2+
pub(crate) mod rsa;

‎src/crypto/aws_lc/rsa.rs

+200
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
//! Implementations of the [`JwtSigner`] and [`JwtVerifier`] traits for the
2+
//! RSA family of algorithms using [`aws_lc_rs`]
3+
4+
use aws_lc_rs::{rand, signature as crypto_sig};
5+
use signature::{Signer, Verifier};
6+
7+
use crate::algorithms::AlgorithmFamily;
8+
use crate::crypto::{JwtSigner, JwtVerifier};
9+
use crate::decoding::DecodingKeyKind;
10+
use crate::errors::{new_error, ErrorKind, Result};
11+
use crate::{Algorithm, DecodingKey, EncodingKey};
12+
13+
/// Try to sign the `message` using an `RSA` `algorithm`.
14+
fn try_sign_rsa(
15+
algorithm: &'static dyn crypto_sig::RsaEncoding,
16+
encoding_key: &EncodingKey,
17+
msg: &[u8],
18+
) -> std::result::Result<Vec<u8>, signature::Error> {
19+
let key_pair = crypto_sig::RsaKeyPair::from_der(encoding_key.inner())
20+
.map_err(|err| signature::Error::from_source(err))?;
21+
22+
let mut signature = vec![0; key_pair.public_modulus_len()];
23+
let rng = rand::SystemRandom::new();
24+
key_pair
25+
.sign(algorithm, &rng, msg, &mut signature)
26+
.map_err(|err| signature::Error::from_source(err))?;
27+
28+
Ok(signature)
29+
}
30+
31+
/// Return a `aws_lc_rs` RSA public key from a [`DecodingKey`]
32+
///
33+
/// # Errors
34+
///
35+
/// - If `decoding_key` is not from the RSA family.
36+
fn verify_rsa(
37+
algorithm: &'static crypto_sig::RsaParameters,
38+
decoding_key: &DecodingKey,
39+
msg: &[u8],
40+
signature: &[u8],
41+
) -> std::result::Result<(), signature::Error> {
42+
match &decoding_key.kind {
43+
DecodingKeyKind::SecretOrDer(bytes) => {
44+
let public_key = crypto_sig::UnparsedPublicKey::new(algorithm, bytes);
45+
public_key.verify(msg, signature).map_err(|err| signature::Error::from_source(err))?;
46+
}
47+
DecodingKeyKind::RsaModulusExponent { n, e } => {
48+
let public_key = crypto_sig::RsaPublicKeyComponents { n, e };
49+
public_key
50+
.verify(algorithm, msg, &signature)
51+
.map_err(|err| signature::Error::from_source(err))?;
52+
}
53+
};
54+
55+
Ok(())
56+
}
57+
58+
pub struct Rsa256Signer(EncodingKey);
59+
60+
impl Rsa256Signer {
61+
pub(crate) fn new(encoding_key: &EncodingKey) -> Result<Self> {
62+
if encoding_key.family != AlgorithmFamily::Rsa {
63+
return Err(new_error(ErrorKind::InvalidKeyFormat));
64+
}
65+
66+
Ok(Self(encoding_key.clone()))
67+
}
68+
}
69+
70+
impl Signer<Vec<u8>> for Rsa256Signer {
71+
fn try_sign(&self, msg: &[u8]) -> std::result::Result<Vec<u8>, signature::Error> {
72+
try_sign_rsa(&crypto_sig::RSA_PKCS1_SHA256, &self.0, msg)
73+
}
74+
}
75+
76+
impl JwtSigner for Rsa256Signer {
77+
fn algorithm(&self) -> Algorithm {
78+
Algorithm::RS256
79+
}
80+
}
81+
82+
pub struct Rsa256Verifier(DecodingKey);
83+
84+
impl Rsa256Verifier {
85+
pub(crate) fn new(decoding_key: &DecodingKey) -> Result<Self> {
86+
if decoding_key.family != AlgorithmFamily::Rsa {
87+
return Err(new_error(ErrorKind::InvalidKeyFormat));
88+
}
89+
90+
Ok(Self(decoding_key.clone()))
91+
}
92+
}
93+
94+
impl Verifier<Vec<u8>> for Rsa256Verifier {
95+
fn verify(&self, msg: &[u8], signature: &Vec<u8>) -> std::result::Result<(), signature::Error> {
96+
verify_rsa(&crypto_sig::RSA_PKCS1_2048_8192_SHA256, &self.0, msg, signature)
97+
}
98+
}
99+
100+
impl JwtVerifier for Rsa256Verifier {
101+
fn algorithm(&self) -> Algorithm {
102+
Algorithm::RS256
103+
}
104+
}
105+
106+
pub struct Rsa384Signer(EncodingKey);
107+
108+
impl Rsa384Signer {
109+
pub(crate) fn new(encoding_key: &EncodingKey) -> Result<Self> {
110+
if encoding_key.family != AlgorithmFamily::Rsa {
111+
return Err(new_error(ErrorKind::InvalidKeyFormat));
112+
}
113+
114+
Ok(Self(encoding_key.clone()))
115+
}
116+
}
117+
118+
impl Signer<Vec<u8>> for Rsa384Signer {
119+
fn try_sign(&self, msg: &[u8]) -> std::result::Result<Vec<u8>, signature::Error> {
120+
try_sign_rsa(&crypto_sig::RSA_PKCS1_SHA384, &self.0, msg)
121+
}
122+
}
123+
124+
impl JwtSigner for Rsa384Signer {
125+
fn algorithm(&self) -> Algorithm {
126+
Algorithm::RS384
127+
}
128+
}
129+
130+
pub struct Rsa384Verifier(DecodingKey);
131+
132+
impl Rsa384Verifier {
133+
pub(crate) fn new(decoding_key: &DecodingKey) -> Result<Self> {
134+
if decoding_key.family != AlgorithmFamily::Rsa {
135+
return Err(new_error(ErrorKind::InvalidKeyFormat));
136+
}
137+
138+
Ok(Self(decoding_key.clone()))
139+
}
140+
}
141+
142+
impl Verifier<Vec<u8>> for Rsa384Verifier {
143+
fn verify(&self, msg: &[u8], signature: &Vec<u8>) -> std::result::Result<(), signature::Error> {
144+
verify_rsa(&crypto_sig::RSA_PKCS1_2048_8192_SHA384, &self.0, msg, signature)
145+
}
146+
}
147+
148+
impl JwtVerifier for Rsa384Verifier {
149+
fn algorithm(&self) -> Algorithm {
150+
Algorithm::RS384
151+
}
152+
}
153+
154+
pub struct Rsa512Signer(EncodingKey);
155+
156+
impl Rsa512Signer {
157+
pub(crate) fn new(encoding_key: &EncodingKey) -> Result<Self> {
158+
if encoding_key.family != AlgorithmFamily::Rsa {
159+
return Err(new_error(ErrorKind::InvalidKeyFormat));
160+
}
161+
162+
Ok(Self(encoding_key.clone()))
163+
}
164+
}
165+
166+
impl Signer<Vec<u8>> for Rsa512Signer {
167+
fn try_sign(&self, msg: &[u8]) -> std::result::Result<Vec<u8>, signature::Error> {
168+
try_sign_rsa(&crypto_sig::RSA_PKCS1_SHA512, &self.0, msg)
169+
}
170+
}
171+
172+
impl JwtSigner for Rsa512Signer {
173+
fn algorithm(&self) -> Algorithm {
174+
Algorithm::RS512
175+
}
176+
}
177+
178+
pub struct Rsa512Verifier(DecodingKey);
179+
180+
impl Rsa512Verifier {
181+
pub(crate) fn new(decoding_key: &DecodingKey) -> Result<Self> {
182+
if decoding_key.family != AlgorithmFamily::Rsa {
183+
return Err(new_error(ErrorKind::InvalidKeyFormat));
184+
}
185+
186+
Ok(Self(decoding_key.clone()))
187+
}
188+
}
189+
190+
impl Verifier<Vec<u8>> for Rsa512Verifier {
191+
fn verify(&self, msg: &[u8], signature: &Vec<u8>) -> std::result::Result<(), signature::Error> {
192+
verify_rsa(&crypto_sig::RSA_PKCS1_2048_8192_SHA512, &self.0, msg, signature)
193+
}
194+
}
195+
196+
impl JwtVerifier for Rsa512Verifier {
197+
fn algorithm(&self) -> Algorithm {
198+
Algorithm::RS512
199+
}
200+
}

‎src/crypto/mod.rs

+1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ use crate::algorithms::Algorithm;
88
pub(crate) mod aws_lc;
99
#[cfg(feature = "rust_crypto")]
1010
pub(crate) mod rust_crypto;
11+
pub(crate) mod utils;
1112

1213
use signature::{Signer, Verifier};
1314

0 commit comments

Comments
 (0)