c2pa-rs

commit 2d98327a55396f82e2cd04b1a79a911ac6701564
parent d946902ef88208dea482bab49236d0e77508fb04
Author: mauricefisher64 <92736594+mauricefisher64@users.noreply.github.com>
Date:   Wed, 20 Dec 2023 15:10:26 -0500

Openssl update to version 3.x (#357)

* OpenSSL 3 support and update

* Include CRT to speed things up when possible
Diffstat:
M
sdk/Cargo.toml
 | 
5
++---
M
sdk/src/openssl/rsa_signer.rs
 | 
36
++++++++++++++++++++++++++++++++++--
M
sdk/src/openssl/rsa_validator.rs
 | 
9
++++++++-

3 files changed, 44 insertions(+), 6 deletions(-)
diff --git a/sdk/Cargo.toml b/sdk/Cargo.toml
@@ -32,7 +32,7 @@ serialize_thumbnails = []
 xmp_write = ["xmp_toolkit"]
 no_interleaved_io = ["file_io"]
 fetch_remote_manifests = ["file_io"]
-openssl_sign = ["openssl", "openssl-sys"]
+openssl_sign = ["openssl"]
 json_schema = ["dep:schemars"]
 pdf = ["dep:lopdf"]
 
@@ -109,8 +109,7 @@ x509-certificate = "0.19.0"
 ureq = "2.4.0"
 image = { version = "0.24.7", default-features = false, features = ["jpeg", "png"], optional = true }
 instant = "0.1.12"
-openssl = { version = "0.10.48", features = ["vendored"], optional = true }
-openssl-sys = { version = "=0.9.92", optional = true }
+openssl = { version = "0.10.61", features = ["vendored"], optional = true }
 xmp_toolkit = { version = "1.6", optional = true }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
diff --git a/sdk/src/openssl/rsa_signer.rs b/sdk/src/openssl/rsa_signer.rs
@@ -17,7 +17,7 @@ use std::cell::Cell;
 use openssl::{
     hash::MessageDigest,
     pkey::{PKey, Private},
-    rsa::Rsa,
+    rsa::{Rsa, RsaPrivateKeyBuilder},
     x509::X509,
 };
 
@@ -74,7 +74,39 @@ impl ConfigurableSigner for RsaSigner {
     ) -> Result<Self> {
         let signcerts = X509::stack_from_pem(signcert).map_err(wrap_openssl_err)?;
         let rsa = Rsa::private_key_from_pem(pkey).map_err(wrap_openssl_err)?;
-        let pkey = PKey::from_rsa(rsa).map_err(wrap_openssl_err)?;
+
+        // rebuild RSA keys to eliminate incompatible values
+        let n = rsa.n().to_owned().map_err(wrap_openssl_err)?;
+        let e = rsa.e().to_owned().map_err(wrap_openssl_err)?;
+        let d = rsa.d().to_owned().map_err(wrap_openssl_err)?;
+        let po = rsa.p();
+        let qo = rsa.q();
+        let dmp1o = rsa.dmp1();
+        let dmq1o = rsa.dmq1();
+        let iqmpo = rsa.iqmp();
+        let mut builder = RsaPrivateKeyBuilder::new(n, e, d).map_err(wrap_openssl_err)?;
+
+        if let Some(p) = po {
+            if let Some(q) = qo {
+                builder = builder
+                    .set_factors(p.to_owned()?, q.to_owned()?)
+                    .map_err(wrap_openssl_err)?;
+            }
+        }
+
+        if let Some(dmp1) = dmp1o {
+            if let Some(dmq1) = dmq1o {
+                if let Some(iqmp) = iqmpo {
+                    builder = builder
+                        .set_crt_params(dmp1.to_owned()?, dmq1.to_owned()?, iqmp.to_owned()?)
+                        .map_err(wrap_openssl_err)?;
+                }
+            }
+        }
+
+        let new_rsa = builder.build();
+
+        let pkey = PKey::from_rsa(new_rsa).map_err(wrap_openssl_err)?;
 
         // make sure cert chains are in order
         if !check_chain_order(&signcerts) {
diff --git a/sdk/src/openssl/rsa_validator.rs b/sdk/src/openssl/rsa_validator.rs
@@ -28,7 +28,14 @@ impl RsaValidator {
 impl CoseValidator for RsaValidator {
     fn validate(&self, sig: &[u8], data: &[u8], pkey: &[u8]) -> Result<bool> {
         let rsa = Rsa::public_key_from_der(pkey)?;
-        let pkey = PKey::from_rsa(rsa)?;
+
+        // rebuild RSA keys to eliminate incompatible values
+        let n = rsa.n().to_owned()?;
+        let e = rsa.e().to_owned()?;
+
+        let new_rsa = Rsa::from_public_components(n, e)?;
+
+        let pkey = PKey::from_rsa(new_rsa)?;
 
         let mut verifier = match self.alg {
             SigningAlg::Ps256 => {