use super::{super::PUBLIC_KEY_PUBLIC_MODULUS_MAX_LEN, Padding, RsaEncoding, Verification};
use crate::{bits, digest, error, io::der, rand};
#[derive(Debug)]
pub struct PKCS1 {
digest_alg: &'static digest::Algorithm,
digestinfo_prefix: &'static [u8],
}
impl crate::sealed::Sealed for PKCS1 {}
impl Padding for PKCS1 {
fn digest_alg(&self) -> &'static digest::Algorithm {
self.digest_alg
}
}
impl RsaEncoding for PKCS1 {
fn encode(
&self,
m_hash: digest::Digest,
m_out: &mut [u8],
_mod_bits: bits::BitLength,
_rng: &dyn rand::SecureRandom,
) -> Result<(), error::Unspecified> {
pkcs1_encode(self, m_hash, m_out);
Ok(())
}
}
impl Verification for PKCS1 {
fn verify(
&self,
m_hash: digest::Digest,
m: &mut untrusted::Reader,
mod_bits: bits::BitLength,
) -> Result<(), error::Unspecified> {
let mut calculated = [0u8; PUBLIC_KEY_PUBLIC_MODULUS_MAX_LEN];
let calculated = &mut calculated[..mod_bits.as_usize_bytes_rounded_up()];
pkcs1_encode(self, m_hash, calculated);
if m.read_bytes_to_end().as_slice_less_safe() != calculated {
return Err(error::Unspecified);
}
Ok(())
}
}
fn pkcs1_encode(pkcs1: &PKCS1, m_hash: digest::Digest, m_out: &mut [u8]) {
let em = m_out;
let digest_len = pkcs1.digestinfo_prefix.len() + pkcs1.digest_alg.output_len();
assert!(em.len() >= digest_len + 11);
let pad_len = em.len() - digest_len - 3;
em[0] = 0;
em[1] = 1;
for i in 0..pad_len {
em[2 + i] = 0xff;
}
em[2 + pad_len] = 0;
let (digest_prefix, digest_dst) = em[3 + pad_len..].split_at_mut(pkcs1.digestinfo_prefix.len());
digest_prefix.copy_from_slice(pkcs1.digestinfo_prefix);
digest_dst.copy_from_slice(m_hash.as_ref());
}
macro_rules! rsa_pkcs1_padding {
( $vis:vis $PADDING_ALGORITHM:ident, $digest_alg:expr, $digestinfo_prefix:expr,
$doc_str:expr ) => {
#[doc=$doc_str]
$vis static $PADDING_ALGORITHM: PKCS1 = PKCS1 {
digest_alg: $digest_alg,
digestinfo_prefix: $digestinfo_prefix,
};
};
}
rsa_pkcs1_padding!(
pub(in super::super) RSA_PKCS1_SHA1_FOR_LEGACY_USE_ONLY,
&digest::SHA1_FOR_LEGACY_USE_ONLY,
&SHA1_PKCS1_DIGESTINFO_PREFIX,
"PKCS#1 1.5 padding using SHA-1 for RSA signatures."
);
rsa_pkcs1_padding!(
pub RSA_PKCS1_SHA256,
&digest::SHA256,
&SHA256_PKCS1_DIGESTINFO_PREFIX,
"PKCS#1 1.5 padding using SHA-256 for RSA signatures."
);
rsa_pkcs1_padding!(
pub RSA_PKCS1_SHA384,
&digest::SHA384,
&SHA384_PKCS1_DIGESTINFO_PREFIX,
"PKCS#1 1.5 padding using SHA-384 for RSA signatures."
);
rsa_pkcs1_padding!(
pub RSA_PKCS1_SHA512,
&digest::SHA512,
&SHA512_PKCS1_DIGESTINFO_PREFIX,
"PKCS#1 1.5 padding using SHA-512 for RSA signatures."
);
macro_rules! pkcs1_digestinfo_prefix {
( $name:ident, $digest_len:expr, $digest_oid_len:expr,
[ $( $digest_oid:expr ),* ] ) => {
static $name: [u8; 2 + 8 + $digest_oid_len] = [
der::Tag::Sequence as u8, 8 + $digest_oid_len + $digest_len,
der::Tag::Sequence as u8, 2 + $digest_oid_len + 2,
der::Tag::OID as u8, $digest_oid_len, $( $digest_oid ),*,
der::Tag::Null as u8, 0,
der::Tag::OctetString as u8, $digest_len,
];
}
}
pkcs1_digestinfo_prefix!(
SHA1_PKCS1_DIGESTINFO_PREFIX,
20,
5,
[0x2b, 0x0e, 0x03, 0x02, 0x1a]
);
pkcs1_digestinfo_prefix!(
SHA256_PKCS1_DIGESTINFO_PREFIX,
32,
9,
[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01]
);
pkcs1_digestinfo_prefix!(
SHA384_PKCS1_DIGESTINFO_PREFIX,
48,
9,
[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02]
);
pkcs1_digestinfo_prefix!(
SHA512_PKCS1_DIGESTINFO_PREFIX,
64,
9,
[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03]
);