Skip to content

Commit 4afde59

Browse files
Xynnn007Xynnn007
Xynnn007
authored and
Xynnn007
committed
feat: add rsa key module
Close #27 Signed-off-by: Xynnn007 <[email protected]>
1 parent d825b23 commit 4afde59

File tree

12 files changed

+1081
-63
lines changed

12 files changed

+1081
-63
lines changed

‎Cargo.toml

+3-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ picky = { version = "7.0.0-rc.3", default-features = false, features = [ "x509",
2828
regex = "1.5.5"
2929
serde_json = "1.0.79"
3030
serde = { version = "1.0.136", features = ["derive"] }
31-
sha2 = "0.10.2"
31+
sha2 = { version = "0.10.6", features = ["oid"] }
3232
thiserror = "1.0.30"
3333
tokio = { version = "1.17.0", features = ["full"] }
3434
tough = { version = "0.12.4", features = [ "http" ] }
@@ -48,6 +48,8 @@ digest = "0.10.3"
4848
signature = { version = "1.5.0", features = [ "digest-preview" ] }
4949
ed25519 = { version = "1", features = [ "alloc" ] }
5050
ed25519-dalek-fiat = "0.1.0"
51+
rsa = "0.7.0-rc.1"
52+
pkcs1 = "0.4.0"
5153

5254
[dev-dependencies]
5355
anyhow = "1.0.54"

‎examples/key_interface/key_pair_import/main.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ fn main() -> Result<()> {
7171
inner.to_sigstore_signer()?;
7272
println!("Converted SigStoreKeyPair to SigStoreSigner.");
7373
}
74-
SigStoreKeyPair::ED25519(_) => bail!("Wrong key pair type."),
74+
_ => bail!("Wrong key pair type."),
7575
}
7676

7777
Ok(())

‎src/cosign/verification_constraint.rs

+1
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ impl PublicKeyVerifier {
8888
/// The `key_raw` variable holds a PEM encoded rapresentation of the
8989
/// public key to be used at verification time. The verification
9090
/// algorithm will be derived from the public key type:
91+
/// * `RSA public key`: `RSA_PSS_SHA256`
9192
/// * `EC public key with P-256 curve`: `ECDSA_P256_SHA256_ASN1`
9293
/// * `EC public key with P-384 curve`: `ECDSA_P384_SHA384_ASN1`
9394
/// * `Ed25519 public key`: `Ed25519`

‎src/crypto/mod.rs

+68-1
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,19 @@ pub use signing_key::SigStoreSigner;
2424
pub use verification_key::CosignVerificationKey;
2525

2626
/// Different digital signature algorithms.
27+
/// * `RSA_PSS_SHA256`: RSA PSS padding using SHA-256
28+
/// for RSA signatures. All the `usize` member inside
29+
/// an RSA enum represents the key size of the RSA key.
30+
/// * `RSA_PSS_SHA384`: RSA PSS padding using SHA-384
31+
/// for RSA signatures.
32+
/// * `RSA_PSS_SHA512`: RSA PSS padding using SHA-512
33+
/// for RSA signatures.
34+
/// * `RSA_PKCS1_SHA256`: PKCS#1 1.5 padding using
35+
/// SHA-256 for RSA signatures.
36+
/// * `RSA_PKCS1_SHA384`: PKCS#1 1.5 padding using
37+
/// SHA-384 for RSA signatures.
38+
/// * `RSA_PKCS1_SHA512`: PKCS#1 1.5 padding using
39+
/// SHA-512 for RSA signatures.
2740
/// * `ECDSA_P256_SHA256_ASN1`: ASN.1 DER-encoded ECDSA
2841
/// signatures using the P-256 curve and SHA-256. It
2942
/// is the default signing scheme.
@@ -36,7 +49,12 @@ pub use verification_key::CosignVerificationKey;
3649
#[allow(non_camel_case_types)]
3750
#[derive(Debug, Clone, Copy)]
3851
pub enum SigningScheme {
39-
// TODO: Support RSA
52+
RSA_PSS_SHA256(usize),
53+
RSA_PSS_SHA384(usize),
54+
RSA_PSS_SHA512(usize),
55+
RSA_PKCS1_SHA256(usize),
56+
RSA_PKCS1_SHA384(usize),
57+
RSA_PKCS1_SHA512(usize),
4058
ECDSA_P256_SHA256_ASN1,
4159
ECDSA_P384_SHA384_ASN1,
4260
ED25519,
@@ -50,6 +68,12 @@ impl TryFrom<&str> for SigningScheme {
5068
"ECDSA_P256_SHA256_ASN1" => Ok(Self::ECDSA_P256_SHA256_ASN1),
5169
"ECDSA_P384_SHA384_ASN1" => Ok(Self::ECDSA_P384_SHA384_ASN1),
5270
"ED25519" => Ok(Self::ED25519),
71+
"RSA_PSS_SHA256" => Ok(Self::RSA_PSS_SHA256(DEFAULT_KEY_SIZE)),
72+
"RSA_PSS_SHA384" => Ok(Self::RSA_PSS_SHA384(DEFAULT_KEY_SIZE)),
73+
"RSA_PSS_SHA512" => Ok(Self::RSA_PSS_SHA512(DEFAULT_KEY_SIZE)),
74+
"RSA_PKCS1_SHA256" => Ok(Self::RSA_PKCS1_SHA256(DEFAULT_KEY_SIZE)),
75+
"RSA_PKCS1_SHA384" => Ok(Self::RSA_PKCS1_SHA384(DEFAULT_KEY_SIZE)),
76+
"RSA_PKCS1_SHA512" => Ok(Self::RSA_PKCS1_SHA512(DEFAULT_KEY_SIZE)),
5377
unknown => Err(format!("Unsupported signing algorithm: {}", unknown)),
5478
}
5579
}
@@ -68,6 +92,48 @@ impl SigningScheme {
6892
SigningScheme::ED25519 => {
6993
SigStoreSigner::ED25519(Ed25519Signer::from_ed25519_keys(&Ed25519Keys::new()?)?)
7094
}
95+
SigningScheme::RSA_PSS_SHA256(bit_size) => {
96+
SigStoreSigner::RSA_PSS_SHA256(RSASigner::from_rsa_keys(
97+
&RSAKeys::new(*bit_size)?,
98+
DigestAlgorithm::Sha256,
99+
PaddingScheme::PSS,
100+
))
101+
}
102+
SigningScheme::RSA_PSS_SHA384(bit_size) => {
103+
SigStoreSigner::RSA_PSS_SHA384(RSASigner::from_rsa_keys(
104+
&RSAKeys::new(*bit_size)?,
105+
DigestAlgorithm::Sha384,
106+
PaddingScheme::PSS,
107+
))
108+
}
109+
SigningScheme::RSA_PSS_SHA512(bit_size) => {
110+
SigStoreSigner::RSA_PSS_SHA512(RSASigner::from_rsa_keys(
111+
&RSAKeys::new(*bit_size)?,
112+
DigestAlgorithm::Sha512,
113+
PaddingScheme::PSS,
114+
))
115+
}
116+
SigningScheme::RSA_PKCS1_SHA256(bit_size) => {
117+
SigStoreSigner::RSA_PKCS1_SHA256(RSASigner::from_rsa_keys(
118+
&RSAKeys::new(*bit_size)?,
119+
DigestAlgorithm::Sha256,
120+
PaddingScheme::PKCS1v15,
121+
))
122+
}
123+
SigningScheme::RSA_PKCS1_SHA384(bit_size) => {
124+
SigStoreSigner::RSA_PKCS1_SHA384(RSASigner::from_rsa_keys(
125+
&RSAKeys::new(*bit_size)?,
126+
DigestAlgorithm::Sha384,
127+
PaddingScheme::PKCS1v15,
128+
))
129+
}
130+
SigningScheme::RSA_PKCS1_SHA512(bit_size) => {
131+
SigStoreSigner::RSA_PKCS1_SHA512(RSASigner::from_rsa_keys(
132+
&RSAKeys::new(*bit_size)?,
133+
DigestAlgorithm::Sha512,
134+
PaddingScheme::PKCS1v15,
135+
))
136+
}
71137
})
72138
}
73139
}
@@ -98,6 +164,7 @@ pub mod verification_key;
98164
use self::signing_key::{
99165
ecdsa::ec::{EcdsaKeys, EcdsaSigner},
100166
ed25519::{Ed25519Keys, Ed25519Signer},
167+
rsa::{keypair::RSAKeys, DigestAlgorithm, PaddingScheme, RSASigner, DEFAULT_KEY_SIZE},
101168
};
102169

103170
pub mod signing_key;

‎src/crypto/signing_key/mod.rs

+45-3
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,17 @@
2222
//! * [`SigStoreSigner`]: an abstraction for digital signing algorithms.
2323
//!
2424
//! The [`SigStoreKeyPair`] now includes the key types of the following algorithms:
25-
//! * [`SigStoreKeyPair::ECDSA`]: Elliptic curve digital signing algorithm
26-
//! * [`SigStoreKeyPair::ED25519`]: Edwards curve-25519 digital signing algorithm
25+
//! * [`SigStoreKeyPair::RSA`]: RSA key pair
26+
//! * [`SigStoreKeyPair::ECDSA`]: Elliptic curve key pair
27+
//! * [`SigStoreKeyPair::ED25519`]: Edwards curve-25519 key pair
2728
//!
2829
//! The [`SigStoreSigner`] now includes the following signing schemes:
30+
//! * [`SigStoreSigner::RSA_PSS_SHA256`]: RSA signatures using PSS padding and SHA-256.
31+
//! * [`SigStoreSigner::RSA_PSS_SHA384`]: RSA signatures using PSS padding and SHA-384.
32+
//! * [`SigStoreSigner::RSA_PSS_SHA512`]: RSA signatures using PSS padding and SHA-512.
33+
//! * [`SigStoreSigner::RSA_PKCS1_SHA256`]: RSA signatures using PKCS#1v1.5 padding and SHA-256.
34+
//! * [`SigStoreSigner::RSA_PKCS1_SHA384`]: RSA signatures using PKCS#1v1.5 padding and SHA-384.
35+
//! * [`SigStoreSigner::RSA_PKCS1_SHA512`]: RSA signatures using PKCS#1v1.5 padding and SHA-512.
2936
//! * [`SigStoreSigner::ECDSA_P256_SHA256_ASN1`]: ASN.1 DER-encoded ECDSA
3037
//! signatures using the P-256 curve and SHA-256.
3138
//! * [`SigStoreSigner::ECDSA_P384_SHA384_ASN1`]: ASN.1 DER-encoded ECDSA
@@ -68,6 +75,7 @@ use crate::errors::*;
6875
use self::{
6976
ecdsa::{ec::EcdsaSigner, ECDSAKeys},
7077
ed25519::{Ed25519Keys, Ed25519Signer},
78+
rsa::{keypair::RSAKeys, RSASigner},
7179
};
7280

7381
use super::{verification_key::CosignVerificationKey, SigningScheme};
@@ -89,6 +97,9 @@ pub const SIGSTORE_PRIVATE_KEY_PEM_LABEL: &str = "ENCRYPTED SIGSTORE PRIVATE KEY
8997
/// The label for pem of private keys.
9098
pub const PRIVATE_KEY_PEM_LABEL: &str = "PRIVATE KEY";
9199

100+
/// The label for pem of RSA private keys.
101+
pub const RSA_PRIVATE_KEY_PEM_LABEL: &str = "RSA PRIVATE KEY";
102+
92103
/// Every signing scheme must implement this interface.
93104
/// All private export methods using the wrapper `Zeroizing`.
94105
/// It will tell the compiler when the
@@ -125,7 +136,7 @@ pub trait KeyPair {
125136
pub enum SigStoreKeyPair {
126137
ECDSA(ECDSAKeys),
127138
ED25519(Ed25519Keys),
128-
// RSA,
139+
RSA(RSAKeys),
129140
}
130141

131142
/// This macro helps to reduce duplicated code.
@@ -147,6 +158,7 @@ macro_rules! sigstore_keypair_code {
147158
match $obj {
148159
SigStoreKeyPair::ECDSA(keys) => keys.as_inner().$func($($args,)*),
149160
SigStoreKeyPair::ED25519(keys) => keys.$func($($args,)*),
161+
SigStoreKeyPair::RSA(keys) => keys.$func($($args,)*),
150162
}
151163
}
152164
}
@@ -217,6 +229,12 @@ pub trait Signer {
217229

218230
#[allow(non_camel_case_types)]
219231
pub enum SigStoreSigner {
232+
RSA_PSS_SHA256(RSASigner),
233+
RSA_PSS_SHA384(RSASigner),
234+
RSA_PSS_SHA512(RSASigner),
235+
RSA_PKCS1_SHA256(RSASigner),
236+
RSA_PKCS1_SHA384(RSASigner),
237+
RSA_PKCS1_SHA512(RSASigner),
220238
ECDSA_P256_SHA256_ASN1(EcdsaSigner<p256::NistP256, sha2::Sha256>),
221239
ECDSA_P384_SHA384_ASN1(EcdsaSigner<p384::NistP384, sha2::Sha384>),
222240
ED25519(Ed25519Signer),
@@ -230,6 +248,12 @@ impl SigStoreSigner {
230248
SigStoreSigner::ECDSA_P256_SHA256_ASN1(inner) => inner,
231249
SigStoreSigner::ECDSA_P384_SHA384_ASN1(inner) => inner,
232250
SigStoreSigner::ED25519(inner) => inner,
251+
SigStoreSigner::RSA_PSS_SHA256(inner) => inner,
252+
SigStoreSigner::RSA_PSS_SHA384(inner) => inner,
253+
SigStoreSigner::RSA_PSS_SHA512(inner) => inner,
254+
SigStoreSigner::RSA_PKCS1_SHA256(inner) => inner,
255+
SigStoreSigner::RSA_PKCS1_SHA384(inner) => inner,
256+
SigStoreSigner::RSA_PKCS1_SHA512(inner) => inner,
233257
}
234258
}
235259

@@ -244,6 +268,12 @@ impl SigStoreSigner {
244268
SigStoreSigner::ECDSA_P256_SHA256_ASN1(_) => SigningScheme::ECDSA_P256_SHA256_ASN1,
245269
SigStoreSigner::ECDSA_P384_SHA384_ASN1(_) => SigningScheme::ECDSA_P384_SHA384_ASN1,
246270
SigStoreSigner::ED25519(_) => SigningScheme::ED25519,
271+
SigStoreSigner::RSA_PSS_SHA256(_) => SigningScheme::RSA_PSS_SHA256(0),
272+
SigStoreSigner::RSA_PSS_SHA384(_) => SigningScheme::RSA_PSS_SHA384(0),
273+
SigStoreSigner::RSA_PSS_SHA512(_) => SigningScheme::RSA_PSS_SHA512(0),
274+
SigStoreSigner::RSA_PKCS1_SHA256(_) => SigningScheme::RSA_PKCS1_SHA256(0),
275+
SigStoreSigner::RSA_PKCS1_SHA384(_) => SigningScheme::RSA_PKCS1_SHA384(0),
276+
SigStoreSigner::RSA_PKCS1_SHA512(_) => SigningScheme::RSA_PKCS1_SHA512(0),
247277
};
248278
self.as_inner()
249279
.key_pair()
@@ -262,6 +292,18 @@ impl SigStoreSigner {
262292
SigStoreSigner::ED25519(inner) => {
263293
SigStoreKeyPair::ED25519(Ed25519Keys::from_ed25519key(inner.ed25519_keys())?)
264294
}
295+
SigStoreSigner::RSA_PSS_SHA256(inner) => SigStoreKeyPair::RSA(inner.rsa_keys().clone()),
296+
SigStoreSigner::RSA_PSS_SHA384(inner) => SigStoreKeyPair::RSA(inner.rsa_keys().clone()),
297+
SigStoreSigner::RSA_PSS_SHA512(inner) => SigStoreKeyPair::RSA(inner.rsa_keys().clone()),
298+
SigStoreSigner::RSA_PKCS1_SHA256(inner) => {
299+
SigStoreKeyPair::RSA(inner.rsa_keys().clone())
300+
}
301+
SigStoreSigner::RSA_PKCS1_SHA384(inner) => {
302+
SigStoreKeyPair::RSA(inner.rsa_keys().clone())
303+
}
304+
SigStoreSigner::RSA_PKCS1_SHA512(inner) => {
305+
SigStoreKeyPair::RSA(inner.rsa_keys().clone())
306+
}
265307
})
266308
}
267309
}

‎src/crypto/signing_key/rsa.rs

-18
This file was deleted.

0 commit comments

Comments
 (0)