5
5
//! Typically, you will not use these directly, but as part of a JWS or JWE.
6
6
use std:: fmt;
7
7
8
- use ring:: { aead, digest, hmac, rand, signature} ;
9
8
use ring:: constant_time:: verify_slices_are_equal;
10
9
use ring:: rand:: SystemRandom ;
11
- use serde :: Serialize ;
10
+ use ring :: { aead , digest , hmac , rand , signature } ;
12
11
use serde:: de:: DeserializeOwned ;
12
+ use serde:: Serialize ;
13
13
use untrusted;
14
14
15
15
use errors:: Error ;
@@ -25,8 +25,9 @@ const AES_GCM_NONCE_LENGTH: usize = 96 / 8;
25
25
26
26
/// A zeroed AES GCM Nonce EncryptionOptions
27
27
lazy_static ! {
28
- static ref AES_GCM_ZEROED_NONCE : EncryptionOptions =
29
- EncryptionOptions :: AES_GCM { nonce: vec![ 0 ; AES_GCM_NONCE_LENGTH ] } ;
28
+ static ref AES_GCM_ZEROED_NONCE : EncryptionOptions = EncryptionOptions :: AES_GCM {
29
+ nonce: vec![ 0 ; AES_GCM_NONCE_LENGTH ] ,
30
+ } ;
30
31
}
31
32
32
33
/// A default `None` `EncryptionOptions`
@@ -472,10 +473,7 @@ impl KeyManagementAlgorithm {
472
473
A128GCMKW | A192GCMKW | A256GCMKW => self . aes_gcm_encrypt ( payload, key, options) ,
473
474
DirectSymmetricKey => match * options {
474
475
EncryptionOptions :: None => Ok ( Default :: default ( ) ) ,
475
- ref other => Err ( unexpected_encryption_options_error ! (
476
- EncryptionOptions :: None ,
477
- other
478
- ) ) ,
476
+ ref other => Err ( unexpected_encryption_options_error ! ( EncryptionOptions :: None , other) ) ,
479
477
} ,
480
478
_ => Err ( Error :: UnsupportedOperation ) ,
481
479
}
@@ -513,10 +511,7 @@ impl KeyManagementAlgorithm {
513
511
514
512
let nonce = match * options {
515
513
EncryptionOptions :: AES_GCM { ref nonce } => Ok ( nonce) ,
516
- ref others => Err ( unexpected_encryption_options_error ! (
517
- AES_GCM_ZEROED_NONCE ,
518
- others
519
- ) ) ,
514
+ ref others => Err ( unexpected_encryption_options_error ! ( AES_GCM_ZEROED_NONCE , others) ) ,
520
515
} ?;
521
516
// FIXME: Should we check the nonce length here or leave it to ring?
522
517
@@ -627,10 +622,7 @@ impl ContentEncryptionAlgorithm {
627
622
628
623
let nonce = match * options {
629
624
EncryptionOptions :: AES_GCM { ref nonce } => Ok ( nonce) ,
630
- ref others => Err ( unexpected_encryption_options_error ! (
631
- AES_GCM_ZEROED_NONCE ,
632
- others
633
- ) ) ,
625
+ ref others => Err ( unexpected_encryption_options_error ! ( AES_GCM_ZEROED_NONCE , others) ) ,
634
626
} ?;
635
627
// FIXME: Should we check the nonce length here or leave it to ring?
636
628
@@ -730,8 +722,8 @@ mod tests {
730
722
use ring:: constant_time:: verify_slices_are_equal;
731
723
732
724
use super :: * ;
733
- use CompactPart ;
734
725
use jwa;
726
+ use CompactPart ;
735
727
736
728
#[ test]
737
729
fn sign_and_verify_none ( ) {
@@ -740,22 +732,17 @@ mod tests {
740
732
not_err ! ( SignatureAlgorithm :: None . sign( "payload" . to_string( ) . as_bytes( ) , & Secret :: None , ) ) ;
741
733
assert_eq ! ( expected_signature, actual_signature) ;
742
734
743
- not_err ! ( SignatureAlgorithm :: None . verify(
744
- vec![ ] . as_slice( ) ,
745
- "payload" . to_string( ) . as_bytes( ) ,
746
- & Secret :: None ,
747
- ) ) ;
735
+ not_err ! ( SignatureAlgorithm :: None . verify( vec![ ] . as_slice( ) , "payload" . to_string( ) . as_bytes( ) , & Secret :: None ) ) ;
748
736
}
749
737
750
738
#[ test]
751
739
fn sign_and_verify_hs256 ( ) {
752
740
let expected_base64 = "uC_LeRrOxXhZuYm0MKgmSIzi5Hn9-SMmvQoug3WkK6Q" ;
753
741
let expected_bytes: Vec < u8 > = not_err ! ( CompactPart :: from_base64( & expected_base64) ) ;
754
742
755
- let actual_signature = not_err ! ( SignatureAlgorithm :: HS256 . sign(
756
- "payload" . to_string( ) . as_bytes( ) ,
757
- & Secret :: bytes_from_str( "secret" ) ,
758
- ) ) ;
743
+ let actual_signature = not_err ! (
744
+ SignatureAlgorithm :: HS256 . sign( "payload" . to_string( ) . as_bytes( ) , & Secret :: bytes_from_str( "secret" ) , )
745
+ ) ;
759
746
assert_eq ! ( & * not_err!( actual_signature. to_base64( ) ) , expected_base64) ;
760
747
761
748
not_err ! ( SignatureAlgorithm :: HS256 . verify(
@@ -789,11 +776,7 @@ mod tests {
789
776
assert_eq ! ( & * not_err!( actual_signature. to_base64( ) ) , expected_signature) ;
790
777
791
778
let public_key = Secret :: public_key_from_file ( "test/fixtures/rsa_public_key.der" ) . unwrap ( ) ;
792
- not_err ! ( SignatureAlgorithm :: RS256 . verify(
793
- expected_signature_bytes. as_slice( ) ,
794
- payload_bytes,
795
- & public_key,
796
- ) ) ;
779
+ not_err ! ( SignatureAlgorithm :: RS256 . verify( expected_signature_bytes. as_slice( ) , payload_bytes, & public_key, ) ) ;
797
780
}
798
781
799
782
/// This signature is non-deterministic.
@@ -836,18 +819,15 @@ mod tests {
836
819
/// This signature is non-deterministic.
837
820
#[ test]
838
821
fn sign_and_verify_es256_round_trip ( ) {
839
- let private_key = Secret :: ecdsa_keypair_from_file ( SignatureAlgorithm :: ES256 , "test/fixtures/ecdsa_private_key.p8" ) . unwrap ( ) ;
822
+ let private_key =
823
+ Secret :: ecdsa_keypair_from_file ( SignatureAlgorithm :: ES256 , "test/fixtures/ecdsa_private_key.p8" ) . unwrap ( ) ;
840
824
let payload = "payload" . to_string ( ) ;
841
825
let payload_bytes = payload. as_bytes ( ) ;
842
826
843
827
let actual_signature = not_err ! ( SignatureAlgorithm :: ES256 . sign( payload_bytes, & private_key) ) ;
844
828
845
829
let public_key = Secret :: public_key_from_file ( "test/fixtures/ecdsa_public_key.der" ) . unwrap ( ) ;
846
- not_err ! ( SignatureAlgorithm :: ES256 . verify(
847
- actual_signature. as_slice( ) ,
848
- payload_bytes,
849
- & public_key,
850
- ) ) ;
830
+ not_err ! ( SignatureAlgorithm :: ES256 . verify( actual_signature. as_slice( ) , payload_bytes, & public_key, ) ) ;
851
831
}
852
832
853
833
/// Test case from https://github.com/briansmith/ring/blob/a13b8e2/src/ec/suite_b/ecdsa_verify_fixed_tests.txt
@@ -899,11 +879,7 @@ mod tests {
899
879
let invalid_signature = "broken" . to_string ( ) ;
900
880
let signature_bytes = invalid_signature. as_bytes ( ) ;
901
881
let _ = SignatureAlgorithm :: None
902
- . verify (
903
- signature_bytes,
904
- "payload" . to_string ( ) . as_bytes ( ) ,
905
- & Secret :: None ,
906
- )
882
+ . verify ( signature_bytes, "payload" . to_string ( ) . as_bytes ( ) , & Secret :: None )
907
883
. unwrap ( ) ;
908
884
}
909
885
@@ -928,11 +904,7 @@ mod tests {
928
904
let invalid_signature = "broken" . to_string ( ) ;
929
905
let signature_bytes = invalid_signature. as_bytes ( ) ;
930
906
let _ = SignatureAlgorithm :: RS256
931
- . verify (
932
- signature_bytes,
933
- "payload" . to_string ( ) . as_bytes ( ) ,
934
- & public_key,
935
- )
907
+ . verify ( signature_bytes, "payload" . to_string ( ) . as_bytes ( ) , & public_key)
936
908
. unwrap ( ) ;
937
909
}
938
910
@@ -943,11 +915,7 @@ mod tests {
943
915
let invalid_signature = "broken" . to_string ( ) ;
944
916
let signature_bytes = invalid_signature. as_bytes ( ) ;
945
917
let _ = SignatureAlgorithm :: PS256
946
- . verify (
947
- signature_bytes,
948
- "payload" . to_string ( ) . as_bytes ( ) ,
949
- & public_key,
950
- )
918
+ . verify ( signature_bytes, "payload" . to_string ( ) . as_bytes ( ) , & public_key)
951
919
. unwrap ( ) ;
952
920
}
953
921
@@ -958,11 +926,7 @@ mod tests {
958
926
let invalid_signature = "broken" . to_string ( ) ;
959
927
let signature_bytes = invalid_signature. as_bytes ( ) ;
960
928
let _ = SignatureAlgorithm :: ES256
961
- . verify (
962
- signature_bytes,
963
- "payload" . to_string ( ) . as_bytes ( ) ,
964
- & public_key,
965
- )
929
+ . verify ( signature_bytes, "payload" . to_string ( ) . as_bytes ( ) , & public_key)
966
930
. unwrap ( ) ;
967
931
}
968
932
@@ -1125,12 +1089,7 @@ mod tests {
1125
1089
let encrypted_cek = not_err ! ( cek_alg. wrap_key( cek. octect_key( ) . unwrap( ) , & key, & options) ) ;
1126
1090
let decrypted_cek = not_err ! ( cek_alg. unwrap_key( & encrypted_cek, enc_alg, & key) ) ;
1127
1091
1128
- assert ! (
1129
- verify_slices_are_equal(
1130
- cek. octect_key( ) . unwrap( ) ,
1131
- decrypted_cek. octect_key( ) . unwrap( ) ,
1132
- ) . is_ok( )
1133
- ) ;
1092
+ assert ! ( verify_slices_are_equal( cek. octect_key( ) . unwrap( ) , decrypted_cek. octect_key( ) . unwrap( ) , ) . is_ok( ) ) ;
1134
1093
}
1135
1094
1136
1095
#[ test]
@@ -1158,12 +1117,7 @@ mod tests {
1158
1117
let encrypted_cek = not_err ! ( cek_alg. wrap_key( cek. octect_key( ) . unwrap( ) , & key, & options) ) ;
1159
1118
let decrypted_cek = not_err ! ( cek_alg. unwrap_key( & encrypted_cek, enc_alg, & key) ) ;
1160
1119
1161
- assert ! (
1162
- verify_slices_are_equal(
1163
- cek. octect_key( ) . unwrap( ) ,
1164
- decrypted_cek. octect_key( ) . unwrap( ) ,
1165
- ) . is_ok( )
1166
- ) ;
1120
+ assert ! ( verify_slices_are_equal( cek. octect_key( ) . unwrap( ) , decrypted_cek. octect_key( ) . unwrap( ) , ) . is_ok( ) ) ;
1167
1121
}
1168
1122
1169
1123
/// `ContentEncryptionAlgorithm::A128GCM` generates CEK of the right length
0 commit comments