Adds more functions to `Verifier`/`Signer` for RSA keys (724dd6f8) · Commits · Public Repositories / Rust Openssl

openssl-sys/src/lib.rs

+37 −0

Original line number	Diff line number	Diff line
		@@ -228,9 +228,24 @@ pub const EVP_PKEY_EC: c_int = NID_X9_62_id_ecPublicKey;
		pub const EVP_PKEY_ALG_CTRL: c_int = 0x1000;

		pub const EVP_PKEY_CTRL_RSA_PADDING: c_int = EVP_PKEY_ALG_CTRL + 1;
		pub const EVP_PKEY_CTRL_RSA_PSS_SALTLEN: c_int = EVP_PKEY_ALG_CTRL + 2;

		pub const EVP_PKEY_CTRL_RSA_MGF1_MD: c_int = EVP_PKEY_ALG_CTRL + 5;
		pub const EVP_PKEY_CTRL_GET_RSA_PADDING: c_int = EVP_PKEY_ALG_CTRL + 6;

		pub const EVP_PKEY_OP_SIGN: c_int = 1 << 3;
		pub const EVP_PKEY_OP_VERIFY: c_int = 1 << 4;
		pub const EVP_PKEY_OP_VERIFYRECOVER: c_int = 1 << 5;
		pub const EVP_PKEY_OP_SIGNCTX: c_int = 1 << 6;
		pub const EVP_PKEY_OP_VERIFYCTX: c_int = 1 << 7;
		pub const EVP_PKEY_OP_ENCRYPT: c_int = 1 << 8;
		pub const EVP_PKEY_OP_DECRYPT: c_int = 1 << 9;

		pub const EVP_PKEY_OP_TYPE_SIG: c_int = EVP_PKEY_OP_SIGN \| EVP_PKEY_OP_VERIFY
		\| EVP_PKEY_OP_VERIFYRECOVER \| EVP_PKEY_OP_SIGNCTX \| EVP_PKEY_OP_VERIFYCTX;

		pub const EVP_PKEY_OP_TYPE_CRYPT: c_int = EVP_PKEY_OP_ENCRYPT \| EVP_PKEY_OP_DECRYPT;

		pub const EVP_CTRL_GCM_SET_IVLEN: c_int = 0x9;
		pub const EVP_CTRL_GCM_GET_TAG: c_int = 0x10;
		pub const EVP_CTRL_GCM_SET_TAG: c_int = 0x11;
		@@ -1478,6 +1493,28 @@ pub unsafe fn EVP_PKEY_CTX_get_rsa_padding(ctx: mut EVP_PKEY_CTX, ppad: mut c_
		)
		}

		pub unsafe fn EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx: *mut EVP_PKEY_CTX, len: c_int) -> c_int {
		EVP_PKEY_CTX_ctrl(
		ctx,
		EVP_PKEY_RSA,
		EVP_PKEY_OP_SIGN \| EVP_PKEY_OP_VERIFY,
		EVP_PKEY_CTRL_RSA_PSS_SALTLEN,
		len,
		ptr::null_mut(),
		)
		}

		pub unsafe fn EVP_PKEY_CTX_set_rsa_mgf1_md(ctx: mut EVP_PKEY_CTX, md: mut EVP_MD) -> c_int {
		EVP_PKEY_CTX_ctrl(
		ctx,
		EVP_PKEY_RSA,
		EVP_PKEY_OP_TYPE_SIG \| EVP_PKEY_OP_TYPE_CRYPT,
		EVP_PKEY_CTRL_RSA_MGF1_MD,
		0,
		md as *mut c_void,
		)
		}

		pub unsafe fn SSL_CTX_set_mode(ctx: *mut SSL_CTX, op: c_long) -> c_long {
		SSL_CTX_ctrl(ctx, SSL_CTRL_MODE, op, ptr::null_mut())
		}

openssl/src/sign.rs

+87 −0

Original line number	Diff line number	Diff line
		@@ -66,6 +66,7 @@ use foreign_types::ForeignTypeRef;
		use std::io::{self, Write};
		use std::marker::PhantomData;
		use std::ptr;
		use libc::c_int;

		use {cvt, cvt_p};
		use hash::MessageDigest;
		@@ -160,6 +161,38 @@ impl<'a> Signer<'a> {
		}
		}

		/// Sets the RSA PSS salt length.
		///
		/// This is only useful for RSA keys.
		///
		/// This corresponds to [`EVP_PKEY_CTX_set_rsa_pss_saltlen`].
		///
		/// [`EVP_PKEY_CTX_set_rsa_pss_saltlen`]: https://www.openssl.org/docs/man1.1.0/crypto/EVP_PKEY_CTX_set_rsa_pss_saltlen.html
		pub fn set_rsa_pss_saltlen(&mut self, len: c_int) -> Result<(), ErrorStack> {
		unsafe {
		cvt(ffi::EVP_PKEY_CTX_set_rsa_pss_saltlen(
		self.pctx,
		len,
		)).map(\|_\| ())
		}
		}

		/// Sets the RSA MGF1 algorithm.
		///
		/// This is only useful for RSA keys.
		///
		/// This corresponds to [`EVP_PKEY_CTX_set_rsa_mgf1_md`].
		///
		/// [`EVP_PKEY_CTX_set_rsa_mgf1_md`]: https://www.openssl.org/docs/manmaster/man7/RSA-PSS.html
		pub fn set_rsa_mgf1_md(&mut self, md: MessageDigest) -> Result<(), ErrorStack> {
		unsafe {
		cvt(ffi::EVP_PKEY_CTX_set_rsa_mgf1_md(
		self.pctx,
		md.as_ptr() as *mut _,
		)).map(\|_\| ())
		}
		}

		/// Feeds more data into the `Signer`.
		///
		/// OpenSSL documentation at [`EVP_DigestUpdate`].
		@@ -320,6 +353,38 @@ impl<'a> Verifier<'a> {
		}
		}

		/// Sets the RSA PSS salt length.
		///
		/// This is only useful for RSA keys.
		///
		/// This corresponds to [`EVP_PKEY_CTX_set_rsa_pss_saltlen`].
		///
		/// [`EVP_PKEY_CTX_set_rsa_pss_saltlen`]: https://www.openssl.org/docs/man1.1.0/crypto/EVP_PKEY_CTX_set_rsa_pss_saltlen.html
		pub fn set_rsa_pss_saltlen(&mut self, len: c_int) -> Result<(), ErrorStack> {
		unsafe {
		cvt(ffi::EVP_PKEY_CTX_set_rsa_pss_saltlen(
		self.pctx,
		len,
		)).map(\|_\| ())
		}
		}

		/// Sets the RSA MGF1 algorithm.
		///
		/// This is only useful for RSA keys.
		///
		/// This corresponds to [`EVP_PKEY_CTX_set_rsa_mgf1_md`].
		///
		/// [`EVP_PKEY_CTX_set_rsa_mgf1_md`]: https://www.openssl.org/docs/manmaster/man7/RSA-PSS.html
		pub fn set_rsa_mgf1_md(&mut self, md: MessageDigest) -> Result<(), ErrorStack> {
		unsafe {
		cvt(ffi::EVP_PKEY_CTX_set_rsa_mgf1_md(
		self.pctx,
		md.as_ptr() as *mut _,
		)).map(\|_\| ())
		}
		}

		/// Feeds more data into the `Verifier`.
		///
		/// OpenSSL documentation at [`EVP_DigestUpdate`].
		@@ -559,4 +624,26 @@ mod test {
		verifier.update(b"hello world").unwrap();
		assert!(verifier.verify(&signature).unwrap());
		}

		#[test]
		fn rsa_sign_verify() {
		let key = include_bytes!("../test/rsa.pem");
		let private_key = Rsa::private_key_from_pem(key).unwrap();
		let pkey = PKey::from_rsa(private_key).unwrap();

		let mut signer = Signer::new(MessageDigest::sha256(), &pkey).unwrap();
		signer.set_rsa_padding(Padding::PKCS1_PSS).unwrap();
		assert_eq!(signer.rsa_padding().unwrap(), Padding::PKCS1_PSS);
		signer.set_rsa_pss_saltlen(-1).unwrap();
		signer.set_rsa_mgf1_md(MessageDigest::sha256()).unwrap();
		signer.update(&Vec::from_hex(INPUT).unwrap()).unwrap();
		let signature = signer.sign_to_vec().unwrap();

		let mut verifier = Verifier::new(MessageDigest::sha256(), &pkey).unwrap();
		verifier.set_rsa_padding(Padding::PKCS1_PSS).unwrap();
		verifier.set_rsa_pss_saltlen(-1).unwrap();
		verifier.set_rsa_mgf1_md(MessageDigest::sha256()).unwrap();
		verifier.update(&Vec::from_hex(INPUT).unwrap()).unwrap();
		assert!(verifier.verify(&signature).unwrap());
		}
		}