ed_validator.rs (3172B)
1 // Copyright 2022 Adobe. All rights reserved. 2 // This file is licensed to you under the Apache License, 3 // Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0) 4 // or the MIT license (http://opensource.org/licenses/MIT), 5 // at your option. 6 7 // Unless required by applicable law or agreed to in writing, 8 // this software is distributed on an "AS IS" BASIS, WITHOUT 9 // WARRANTIES OR REPRESENTATIONS OF ANY KIND, either express or 10 // implied. See the LICENSE-MIT and LICENSE-APACHE files for the 11 // specific language governing permissions and limitations under 12 // each license. 13 14 use openssl::pkey::PKey; 15 16 use crate::{validator::CoseValidator, Error, Result, SigningAlg}; 17 18 pub struct EdValidator { 19 _alg: SigningAlg, 20 } 21 22 impl EdValidator { 23 pub const fn new(alg: SigningAlg) -> Self { 24 EdValidator { _alg: alg } 25 } 26 } 27 28 impl CoseValidator for EdValidator { 29 fn validate(&self, sig: &[u8], data: &[u8], pkey: &[u8]) -> Result<bool> { 30 let public_key = PKey::public_key_from_der(pkey).map_err(|_err| Error::CoseSignature)?; 31 32 let mut verifier = openssl::sign::Verifier::new_without_digest(&public_key) 33 .map_err(|_err| Error::CoseSignature)?; 34 35 verifier 36 .verify_oneshot(sig, data) 37 .map_err(|_err| Error::CoseSignature) 38 } 39 } 40 41 #[cfg(test)] 42 #[cfg(feature = "file_io")] 43 mod tests { 44 #![allow(clippy::unwrap_used)] 45 46 use super::*; 47 use crate::{openssl::temp_signer, utils::test::fixture_path, Signer}; 48 49 #[test] 50 fn sign_and_validate() { 51 let cert_dir = fixture_path("certs"); 52 53 let (signer, cert_path) = temp_signer::get_ed_signer(cert_dir, SigningAlg::Ed25519, None); 54 55 let data = b"some sample content to sign"; 56 println!("data len = {}", data.len()); 57 58 let signature = signer.sign(data).unwrap(); 59 println!("signature.len = {}", signature.len()); 60 assert!(signature.len() >= 64); 61 assert!(signature.len() <= signer.reserve_size()); 62 63 let cert_bytes = std::fs::read(cert_path).unwrap(); 64 65 let signcert = openssl::x509::X509::from_pem(&cert_bytes).unwrap(); 66 let pub_key = signcert.public_key().unwrap().public_key_to_der().unwrap(); 67 let validator = EdValidator::new(SigningAlg::Ed25519); 68 assert!(validator.validate(&signature, data, &pub_key).unwrap()); 69 } 70 71 #[test] 72 fn bad_data() { 73 let cert_dir = fixture_path("certs"); 74 75 let (signer, cert_path) = temp_signer::get_ed_signer(cert_dir, SigningAlg::Ed25519, None); 76 77 let mut data = b"some sample content to sign".to_vec(); 78 println!("data len = {}", data.len()); 79 let signature = signer.sign(&data).unwrap(); 80 81 data[5] = 10; 82 data[6] = 11; 83 84 let cert_bytes = std::fs::read(cert_path).unwrap(); 85 let signcert = openssl::x509::X509::from_pem(&cert_bytes).unwrap(); 86 let pub_key = signcert.public_key().unwrap().public_key_to_der().unwrap(); 87 88 let validator = EdValidator::new(SigningAlg::Es256); 89 // ^^ REVIEW with @mfisher: Is this correct? Shouldn't it be ed25519? 90 91 assert!(!validator.validate(&signature, &data, &pub_key).unwrap()); 92 } 93 }