Something went wrong. Try again.
we (web engine): Experimental web browser project to understand the limits of Claude
Something went wrong. Try again.
Rust
at url-parser
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836//! RSA PKCS#1 v1.5 signature verification (RFC 8017).//!//! Supports RSA key sizes of 2048, 3072, and 4096 bits. Parses public keys//! from DER-encoded PKCS#1 RSAPublicKey and PKCS#8 SubjectPublicKeyInfo//! formats. Verifies RSASSA-PKCS1-v1_5 signatures with SHA-256 and SHA-384.
use crate::asn1::{ self, Asn1Error, OID_RSA_ENCRYPTION, OID_SHA256, OID_SHA384, OID_SHA512, TAG_NULL, TAG_SEQUENCE,};use crate::bigint::BigUint;use crate::sha2::{sha256, sha384, sha512};
use core::fmt;
// ---------------------------------------------------------------------------// Error type// ---------------------------------------------------------------------------
#[derive(Debug, Clone, PartialEq, Eq)]pub enum RsaError { /// ASN.1 parsing error. Asn1(Asn1Error), /// RSA modulus is too small (< 2048 bits). ModulusTooSmall, /// RSA modulus is too large (> 4096 bits). ModulusTooLarge, /// Public exponent is invalid (not odd, or too small). InvalidExponent, /// Signature length doesn't match modulus length. InvalidSignatureLength, /// Signature value is >= modulus. SignatureOutOfRange, /// EMSA-PKCS1-v1_5 encoding verification failed. InvalidPadding, /// DigestInfo doesn't match the expected hash. DigestMismatch, /// Unsupported hash algorithm. UnsupportedAlgorithm, /// Invalid key format. InvalidKeyFormat,}
impl fmt::Display for RsaError { fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { match self { Self::Asn1(e) => write!(f, "ASN.1 error: {e}"), Self::ModulusTooSmall => write!(f, "RSA modulus too small (< 2048 bits)"), Self::ModulusTooLarge => write!(f, "RSA modulus too large (> 4096 bits)"), Self::InvalidExponent => write!(f, "invalid RSA public exponent"), Self::InvalidSignatureLength => write!(f, "signature length doesn't match modulus"), Self::SignatureOutOfRange => write!(f, "signature value >= modulus"), Self::InvalidPadding => write!(f, "invalid PKCS#1 v1.5 padding"), Self::DigestMismatch => write!(f, "digest mismatch"), Self::UnsupportedAlgorithm => write!(f, "unsupported hash algorithm"), Self::InvalidKeyFormat => write!(f, "invalid RSA key format"), } }}
impl From<Asn1Error> for RsaError { fn from(e: Asn1Error) -> Self { Self::Asn1(e) }}
pub type Result<T> = core::result::Result<T, RsaError>;
// ---------------------------------------------------------------------------// Hash algorithm identifiers// ---------------------------------------------------------------------------
/// Hash algorithm used with RSA signature verification.#[derive(Debug, Clone, Copy, PartialEq, Eq)]pub enum HashAlgorithm { Sha256, Sha384, Sha512,}
impl HashAlgorithm { /// DER-encoded DigestInfo prefix (AlgorithmIdentifier + digest wrapper) /// per RFC 8017 Section 9.2 Notes. fn digest_info_prefix(&self) -> &'static [u8] { match self { // DigestInfo for SHA-256: // SEQUENCE { SEQUENCE { OID sha256, NULL }, OCTET STRING (32 bytes) } Self::Sha256 => &[ 0x30, 0x31, // SEQUENCE, 49 bytes 0x30, 0x0d, // SEQUENCE, 13 bytes 0x06, 0x09, // OID, 9 bytes 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, // sha256 0x05, 0x00, // NULL 0x04, 0x20, // OCTET STRING, 32 bytes ], // DigestInfo for SHA-384: Self::Sha384 => &[ 0x30, 0x41, // SEQUENCE, 65 bytes 0x30, 0x0d, // SEQUENCE, 13 bytes 0x06, 0x09, // OID, 9 bytes 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, // sha384 0x05, 0x00, // NULL 0x04, 0x30, // OCTET STRING, 48 bytes ], // DigestInfo for SHA-512: Self::Sha512 => &[ 0x30, 0x51, // SEQUENCE, 81 bytes 0x30, 0x0d, // SEQUENCE, 13 bytes 0x06, 0x09, // OID, 9 bytes 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, // sha512 0x05, 0x00, // NULL 0x04, 0x40, // OCTET STRING, 64 bytes ], } }
/// Compute the hash of the given message. fn hash(&self, msg: &[u8]) -> Vec<u8> { match self { Self::Sha256 => sha256(msg).to_vec(), Self::Sha384 => sha384(msg).to_vec(), Self::Sha512 => sha512(msg).to_vec(), } }
/// Length of the hash output in bytes. fn hash_len(&self) -> usize { match self { Self::Sha256 => 32, Self::Sha384 => 48, Self::Sha512 => 64, } }}
// ---------------------------------------------------------------------------// RSA public key// ---------------------------------------------------------------------------
/// An RSA public key.#[derive(Debug, Clone)]pub struct RsaPublicKey { /// The modulus n. pub n: BigUint, /// The public exponent e. pub e: BigUint, /// Key size in bytes (octet length of modulus). pub key_len: usize,}
impl RsaPublicKey { /// Parse an RSA public key from DER-encoded PKCS#1 RSAPublicKey format. /// /// ```asn1 /// RSAPublicKey ::= SEQUENCE { /// modulus INTEGER, /// publicExponent INTEGER /// } /// ``` pub fn from_pkcs1_der(data: &[u8]) -> Result<Self> { let seq = asn1::parse_one(data)?; if seq.tag != TAG_SEQUENCE { return Err(RsaError::InvalidKeyFormat); }
let items = seq.sequence_items()?; if items.len() != 2 { return Err(RsaError::InvalidKeyFormat); }
let n_bytes = items[0].as_positive_integer()?; let e_bytes = items[1].as_positive_integer()?;
Self::from_components(n_bytes, e_bytes) }
/// Parse an RSA public key from DER-encoded PKCS#8 SubjectPublicKeyInfo format. /// /// ```asn1 /// SubjectPublicKeyInfo ::= SEQUENCE { /// algorithm AlgorithmIdentifier, /// subjectPublicKey BIT STRING /// } /// AlgorithmIdentifier ::= SEQUENCE { /// algorithm OBJECT IDENTIFIER, /// parameters ANY OPTIONAL /// } /// ``` pub fn from_pkcs8_der(data: &[u8]) -> Result<Self> { let seq = asn1::parse_one(data)?; if seq.tag != TAG_SEQUENCE { return Err(RsaError::InvalidKeyFormat); }
let items = seq.sequence_items()?; if items.len() != 2 { return Err(RsaError::InvalidKeyFormat); }
// Parse AlgorithmIdentifier. let alg_id = &items[0]; if alg_id.tag != TAG_SEQUENCE { return Err(RsaError::InvalidKeyFormat); } let alg_items = alg_id.sequence_items()?; if alg_items.is_empty() { return Err(RsaError::InvalidKeyFormat); }
// Verify the algorithm OID is rsaEncryption. let oid = alg_items[0].as_oid()?; if !oid.matches(OID_RSA_ENCRYPTION) { return Err(RsaError::InvalidKeyFormat); }
// The parameters should be NULL (or absent). if alg_items.len() > 1 && alg_items[1].tag != TAG_NULL { return Err(RsaError::InvalidKeyFormat); }
// Parse the BIT STRING containing the RSAPublicKey. let (unused_bits, key_data) = items[1].as_bit_string()?; if unused_bits != 0 { return Err(RsaError::InvalidKeyFormat); }
// The BIT STRING content is a DER-encoded RSAPublicKey. Self::from_pkcs1_der(key_data) }
/// Try to parse from either PKCS#1 or PKCS#8 format. pub fn from_der(data: &[u8]) -> Result<Self> { // Try PKCS#8 first (more common in certificates). if let Ok(key) = Self::from_pkcs8_der(data) { return Ok(key); } // Fall back to PKCS#1. Self::from_pkcs1_der(data) }
/// Create from raw modulus and exponent bytes (big-endian, no leading zeros). fn from_components(n_bytes: &[u8], e_bytes: &[u8]) -> Result<Self> { let n = BigUint::from_be_bytes(n_bytes); let e = BigUint::from_be_bytes(e_bytes);
let bit_len = n.bit_len(); if bit_len < 2048 { return Err(RsaError::ModulusTooSmall); } if bit_len > 4096 { return Err(RsaError::ModulusTooLarge); }
// Public exponent must be odd and >= 3. if e_bytes.is_empty() || !e.bit(0) { return Err(RsaError::InvalidExponent); }
let key_len = bit_len.div_ceil(8);
Ok(Self { n, e, key_len }) }
/// Verify an RSASSA-PKCS1-v1_5 signature. /// /// `hash_alg` specifies the hash algorithm used. /// `message` is the original message that was signed. /// `signature` is the signature bytes. pub fn verify_pkcs1v15( &self, hash_alg: HashAlgorithm, message: &[u8], signature: &[u8], ) -> Result<()> { // Step 1: Length check. if signature.len() != self.key_len { return Err(RsaError::InvalidSignatureLength); }
// Step 2: RSA verification primitive (RSAVP1). let s = BigUint::from_be_bytes(signature); if s.cmp(&self.n) != core::cmp::Ordering::Less { return Err(RsaError::SignatureOutOfRange); }
// m = s^e mod n let m = s.modpow(&self.e, &self.n); let em = m.to_be_bytes_padded(self.key_len);
// Step 3: EMSA-PKCS1-v1_5 encoding. let hash = hash_alg.hash(message); let expected_em = emsa_pkcs1_v15_encode(&hash, hash_alg, self.key_len)?;
// Step 4: Compare. if !constant_time_eq(&em, &expected_em) { return Err(RsaError::InvalidPadding); }
Ok(()) }
/// Verify a signature where the hash has already been computed. /// /// `hash_alg` specifies which hash algorithm was used. /// `hash` is the pre-computed hash of the message. /// `signature` is the signature bytes. pub fn verify_pkcs1v15_prehashed( &self, hash_alg: HashAlgorithm, hash: &[u8], signature: &[u8], ) -> Result<()> { if hash.len() != hash_alg.hash_len() { return Err(RsaError::DigestMismatch); }
// Step 1: Length check. if signature.len() != self.key_len { return Err(RsaError::InvalidSignatureLength); }
// Step 2: RSAVP1. let s = BigUint::from_be_bytes(signature); if s.cmp(&self.n) != core::cmp::Ordering::Less { return Err(RsaError::SignatureOutOfRange); }
let m = s.modpow(&self.e, &self.n); let em = m.to_be_bytes_padded(self.key_len);
// Step 3: EMSA-PKCS1-v1_5 encoding. let expected_em = emsa_pkcs1_v15_encode(hash, hash_alg, self.key_len)?;
// Step 4: Compare. if !constant_time_eq(&em, &expected_em) { return Err(RsaError::InvalidPadding); }
Ok(()) }}
// ---------------------------------------------------------------------------// EMSA-PKCS1-v1_5 encoding (RFC 8017 Section 9.2)// ---------------------------------------------------------------------------
/// Construct EMSA-PKCS1-v1_5 encoded message:/// EM = 0x00 || 0x01 || PS || 0x00 || DigestInfo////// where PS is padding of 0xFF bytes, and DigestInfo = prefix || hash.fn emsa_pkcs1_v15_encode(hash: &[u8], hash_alg: HashAlgorithm, em_len: usize) -> Result<Vec<u8>> { let prefix = hash_alg.digest_info_prefix(); let t_len = prefix.len() + hash.len();
// em_len must be >= t_len + 11 (0x00 + 0x01 + at least 8 bytes of PS + 0x00 + T) if em_len < t_len + 11 { return Err(RsaError::InvalidPadding); }
let ps_len = em_len - t_len - 3; let mut em = Vec::with_capacity(em_len); em.push(0x00); em.push(0x01); em.extend(std::iter::repeat_n(0xFF, ps_len)); em.push(0x00); em.extend_from_slice(prefix); em.extend_from_slice(hash);
debug_assert_eq!(em.len(), em_len); Ok(em)}
// ---------------------------------------------------------------------------// Utility: parse algorithm OID from a signature's DigestInfo// ---------------------------------------------------------------------------
/// Identify the hash algorithm from a DigestInfo DER encoding.pub fn parse_digest_info_algorithm(digest_info: &[u8]) -> Result<HashAlgorithm> { let seq = asn1::parse_one(digest_info)?; if seq.tag != TAG_SEQUENCE { return Err(RsaError::InvalidKeyFormat); } let items = seq.sequence_items()?; if items.len() != 2 { return Err(RsaError::InvalidKeyFormat); }
// AlgorithmIdentifier let alg_id = &items[0]; if alg_id.tag != TAG_SEQUENCE { return Err(RsaError::InvalidKeyFormat); } let alg_items = alg_id.sequence_items()?; if alg_items.is_empty() { return Err(RsaError::InvalidKeyFormat); }
let oid = alg_items[0].as_oid()?; if oid.matches(OID_SHA256) { Ok(HashAlgorithm::Sha256) } else if oid.matches(OID_SHA384) { Ok(HashAlgorithm::Sha384) } else if oid.matches(OID_SHA512) { Ok(HashAlgorithm::Sha512) } else { Err(RsaError::UnsupportedAlgorithm) }}
// ---------------------------------------------------------------------------// Constant-time comparison// ---------------------------------------------------------------------------
/// Constant-time byte slice comparison to prevent timing attacks.fn constant_time_eq(a: &[u8], b: &[u8]) -> bool { if a.len() != b.len() { return false; } let mut diff = 0u8; for (x, y) in a.iter().zip(b.iter()) { diff |= x ^ y; } diff == 0}
// ---------------------------------------------------------------------------// Tests// ---------------------------------------------------------------------------
#[cfg(test)]mod tests { use super::*;
// ----------------------------------------------------------------------- // Test EMSA-PKCS1-v1_5 encoding // -----------------------------------------------------------------------
#[test] fn emsa_encoding_sha256() { let hash = sha256(b"test"); let em = emsa_pkcs1_v15_encode(&hash, HashAlgorithm::Sha256, 256).unwrap();
// Check structure: 0x00 0x01 [0xFF padding] 0x00 [DigestInfo] assert_eq!(em[0], 0x00); assert_eq!(em[1], 0x01);
let prefix = HashAlgorithm::Sha256.digest_info_prefix(); let t_len = prefix.len() + 32; // 19 + 32 = 51 let ps_len = 256 - t_len - 3; // 256 - 51 - 3 = 202
for i in 2..2 + ps_len { assert_eq!(em[i], 0xFF, "byte {i} should be 0xFF"); } assert_eq!(em[2 + ps_len], 0x00); assert_eq!(&em[3 + ps_len..3 + ps_len + prefix.len()], prefix); assert_eq!(&em[3 + ps_len + prefix.len()..], &hash[..]); }
#[test] fn emsa_encoding_too_short() { let hash = sha256(b"test"); // em_len too small. let result = emsa_pkcs1_v15_encode(&hash, HashAlgorithm::Sha256, 50); assert!(result.is_err()); }
// ----------------------------------------------------------------------- // DER construction helpers // -----------------------------------------------------------------------
/// Encode a DER length. fn der_length(len: usize) -> Vec<u8> { if len < 0x80 { vec![len as u8] } else if len < 0x100 { vec![0x81, len as u8] } else { vec![0x82, (len >> 8) as u8, len as u8] } }
/// Build a DER TLV (tag + length + value). fn der_tlv(tag: u8, value: &[u8]) -> Vec<u8> { let mut out = vec![tag]; out.extend_from_slice(&der_length(value.len())); out.extend_from_slice(value); out }
/// Build a DER INTEGER from unsigned big-endian bytes (adds leading 0 if needed). fn der_integer(bytes: &[u8]) -> Vec<u8> { let needs_pad = !bytes.is_empty() && bytes[0] & 0x80 != 0; let mut value = Vec::new(); if needs_pad { value.push(0x00); } value.extend_from_slice(bytes); der_tlv(0x02, &value) }
/// Build a PKCS#1 RSAPublicKey DER from modulus and exponent bytes. fn build_pkcs1_key(modulus: &[u8], exponent: &[u8]) -> Vec<u8> { let n_int = der_integer(modulus); let e_int = der_integer(exponent); let mut content = Vec::new(); content.extend_from_slice(&n_int); content.extend_from_slice(&e_int); der_tlv(0x30, &content) }
/// Build a PKCS#8 SubjectPublicKeyInfo DER for RSA. fn build_pkcs8_key(modulus: &[u8], exponent: &[u8]) -> Vec<u8> { // AlgorithmIdentifier: SEQUENCE { OID rsaEncryption, NULL } let oid = der_tlv(0x06, OID_RSA_ENCRYPTION); let null = vec![0x05, 0x00]; let mut alg_content = Vec::new(); alg_content.extend_from_slice(&oid); alg_content.extend_from_slice(&null); let alg_id = der_tlv(0x30, &alg_content);
// BIT STRING containing RSAPublicKey let rsa_pub_key = build_pkcs1_key(modulus, exponent); let mut bit_string_value = vec![0x00]; // unused bits = 0 bit_string_value.extend_from_slice(&rsa_pub_key); let bit_string = der_tlv(0x03, &bit_string_value);
let mut content = Vec::new(); content.extend_from_slice(&alg_id); content.extend_from_slice(&bit_string); der_tlv(0x30, &content) }
// ----------------------------------------------------------------------- // Test RSA public key parsing // -----------------------------------------------------------------------
#[test] fn parse_pkcs1_key() { // 2048-bit modulus (256 bytes, top bit set). let mut modulus = vec![0x80; 256]; modulus[255] = 0x01; // make it odd let exponent = vec![0x01, 0x00, 0x01]; // 65537
let key_der = build_pkcs1_key(&modulus, &exponent); let key = RsaPublicKey::from_pkcs1_der(&key_der).unwrap(); assert!(key.n.bit_len() >= 2048); assert_eq!(key.e, BigUint::from_u64(65537)); }
#[test] fn parse_pkcs8_key() { let mut modulus = vec![0x80; 256]; modulus[255] = 0x01; let exponent = vec![0x01, 0x00, 0x01];
let key_der = build_pkcs8_key(&modulus, &exponent); let key = RsaPublicKey::from_pkcs8_der(&key_der).unwrap(); assert!(key.n.bit_len() >= 2048); assert_eq!(key.e, BigUint::from_u64(65537)); }
#[test] fn parse_from_der_auto_detect() { let mut modulus = vec![0x80; 256]; modulus[255] = 0x01; let exponent = vec![0x01, 0x00, 0x01];
// PKCS#8 auto-detect. let pkcs8 = build_pkcs8_key(&modulus, &exponent); let key = RsaPublicKey::from_der(&pkcs8).unwrap(); assert_eq!(key.e, BigUint::from_u64(65537));
// PKCS#1 auto-detect. let pkcs1 = build_pkcs1_key(&modulus, &exponent); let key = RsaPublicKey::from_der(&pkcs1).unwrap(); assert_eq!(key.e, BigUint::from_u64(65537)); }
#[test] fn reject_small_modulus() { let modulus = vec![0xFF; 128]; // 1024-bit let exponent = vec![0x01, 0x00, 0x01]; let key_der = build_pkcs1_key(&modulus, &exponent); let result = RsaPublicKey::from_pkcs1_der(&key_der); assert_eq!(result.unwrap_err(), RsaError::ModulusTooSmall); }
#[test] fn reject_even_exponent() { let mut modulus = vec![0xFF; 256]; modulus[255] = 0xFB; let exponent = vec![0x02]; // even let key_der = build_pkcs1_key(&modulus, &exponent); let result = RsaPublicKey::from_pkcs1_der(&key_der); assert_eq!(result.unwrap_err(), RsaError::InvalidExponent); }
// ----------------------------------------------------------------------- // End-to-end signature verification test // -----------------------------------------------------------------------
#[test] fn verify_pkcs1v15_sha256_constructed() { // Construct a test case using known values. // We create a valid EMSA-PKCS1-v1_5 encoded message and verify the // mathematical relationship holds: sig^e mod n == EM. // // Use small-ish but valid RSA parameters for a fast test. // For a real test we'd use a 2048-bit key, but we test the encoding logic // with a constructed example.
let message = b"hello world"; let hash = sha256(message);
// Verify EMSA encoding is deterministic. let em1 = emsa_pkcs1_v15_encode(&hash, HashAlgorithm::Sha256, 256).unwrap(); let em2 = emsa_pkcs1_v15_encode(&hash, HashAlgorithm::Sha256, 256).unwrap(); assert_eq!(em1, em2); }
#[test] fn verify_signature_wrong_length() { let mut modulus = vec![0x80; 256]; modulus[255] = 0x01; let exponent = vec![0x01, 0x00, 0x01]; let key_der = build_pkcs1_key(&modulus, &exponent); let key = RsaPublicKey::from_pkcs1_der(&key_der).unwrap();
// Wrong signature length. let sig = vec![0u8; 128]; // should be 256 let result = key.verify_pkcs1v15(HashAlgorithm::Sha256, b"test", &sig); assert_eq!(result.unwrap_err(), RsaError::InvalidSignatureLength); }
#[test] fn verify_signature_out_of_range() { let mut modulus = vec![0x80; 256]; modulus[255] = 0x01; let exponent = vec![0x01, 0x00, 0x01]; let key_der = build_pkcs1_key(&modulus, &exponent); let key = RsaPublicKey::from_pkcs1_der(&key_der).unwrap();
// Signature >= modulus. let sig = vec![0xFF; 256]; let result = key.verify_pkcs1v15(HashAlgorithm::Sha256, b"test", &sig); assert_eq!(result.unwrap_err(), RsaError::SignatureOutOfRange); }
#[test] fn constant_time_eq_works() { assert!(constant_time_eq(b"hello", b"hello")); assert!(!constant_time_eq(b"hello", b"world")); assert!(!constant_time_eq(b"hello", b"hell")); assert!(constant_time_eq(b"", b"")); }
#[test] fn emsa_encoding_sha384() { let hash = sha384(b"test"); let em = emsa_pkcs1_v15_encode(&hash, HashAlgorithm::Sha384, 256).unwrap();
assert_eq!(em[0], 0x00); assert_eq!(em[1], 0x01);
let prefix = HashAlgorithm::Sha384.digest_info_prefix(); let t_len = prefix.len() + 48; let ps_len = 256 - t_len - 3;
for i in 2..2 + ps_len { assert_eq!(em[i], 0xFF); } assert_eq!(em[2 + ps_len], 0x00); assert_eq!(&em[3 + ps_len..3 + ps_len + prefix.len()], prefix); assert_eq!(&em[3 + ps_len + prefix.len()..], &hash[..]); }
#[test] fn emsa_encoding_sha512() { let hash = sha512(b"test"); let em = emsa_pkcs1_v15_encode(&hash, HashAlgorithm::Sha512, 256).unwrap();
assert_eq!(em[0], 0x00); assert_eq!(em[1], 0x01);
let prefix = HashAlgorithm::Sha512.digest_info_prefix(); let t_len = prefix.len() + 64; let ps_len = 256 - t_len - 3;
for i in 2..2 + ps_len { assert_eq!(em[i], 0xFF); } assert_eq!(em[2 + ps_len], 0x00); }
#[test] fn parse_digest_info_sha256() { // Build a DigestInfo for SHA-256. let hash = [0u8; 32]; let mut digest_info = Vec::new(); let prefix = HashAlgorithm::Sha256.digest_info_prefix(); // The prefix includes the outer SEQUENCE header; build the full DigestInfo. digest_info.extend_from_slice(prefix); digest_info.extend_from_slice(&hash); // Actually, the prefix already has the outer SEQUENCE, so we need to // parse just the prefix part up to (but not including) the OCTET STRING value. // For parse_digest_info_algorithm we need the full DigestInfo as a SEQUENCE. // Let's build it properly: let mut di = Vec::new(); di.push(0x30); // SEQUENCE di.push(0x31); // length = 49 di.push(0x30); // SEQUENCE (AlgorithmIdentifier) di.push(0x0d); // length = 13 di.push(0x06); // OID di.push(0x09); // length = 9 di.extend_from_slice(OID_SHA256); di.push(0x05); // NULL di.push(0x00); di.push(0x04); // OCTET STRING di.push(0x20); // length = 32 di.extend_from_slice(&hash);
let alg = parse_digest_info_algorithm(&di).unwrap(); assert_eq!(alg, HashAlgorithm::Sha256); }
#[test] fn parse_digest_info_sha384() { let hash = [0u8; 48]; let mut di = Vec::new(); di.push(0x30); // SEQUENCE di.push(0x41); // length = 65 di.push(0x30); // SEQUENCE (AlgorithmIdentifier) di.push(0x0d); // length = 13 di.push(0x06); // OID di.push(0x09); // length = 9 di.extend_from_slice(OID_SHA384); di.push(0x05); // NULL di.push(0x00); di.push(0x04); // OCTET STRING di.push(0x30); // length = 48 di.extend_from_slice(&hash);
let alg = parse_digest_info_algorithm(&di).unwrap(); assert_eq!(alg, HashAlgorithm::Sha384); }
// ----------------------------------------------------------------------- // Signature rejection tests with PKCS#8 key // -----------------------------------------------------------------------
#[test] fn verify_invalid_signature_rejected() { let mut modulus = vec![0x80; 256]; modulus[255] = 0x01; let exponent = vec![0x01, 0x00, 0x01]; let key_der = build_pkcs8_key(&modulus, &exponent); let key = RsaPublicKey::from_pkcs8_der(&key_der).unwrap();
// Random signature should fail (invalid padding after modpow). let mut sig = vec![0x42; 256]; sig[0] = 0x01; // Ensure < modulus let result = key.verify_pkcs1v15(HashAlgorithm::Sha256, b"test message", &sig); assert!(result.is_err()); }
#[test] fn verify_tampered_signature_rejected() { let mut modulus = vec![0x80; 256]; modulus[255] = 0x01; let exponent = vec![0x01, 0x00, 0x01]; let key_der = build_pkcs8_key(&modulus, &exponent); let key = RsaPublicKey::from_pkcs8_der(&key_der).unwrap();
// All-zero signature should fail. let sig = vec![0u8; 256]; let result = key.verify_pkcs1v15(HashAlgorithm::Sha256, b"test", &sig); assert!(result.is_err());
// Signature of all 0x01 should fail. let sig = vec![0x01; 256]; let result = key.verify_pkcs1v15(HashAlgorithm::Sha256, b"test", &sig); assert!(result.is_err()); }
// ----------------------------------------------------------------------- // Mathematical verification test // ----------------------------------------------------------------------- // // We construct a scenario where we know sig^e mod n == EM, by computing // EM first and setting sig = EM (with e=1, which is degenerate but tests // the EMSA encoding path).
#[test] fn verify_with_exponent_one() { // With e=1, sig^1 mod n = sig (if sig < n). // So if sig == EMSA(msg), verification passes. let mut mod_bytes = vec![0xFF; 256]; mod_bytes[255] = 0xFD; // make it odd let exponent = vec![0x01]; // e=1
let key_der = build_pkcs1_key(&mod_bytes, &exponent); let key = RsaPublicKey::from_pkcs1_der(&key_der).unwrap();
// Construct the expected EM for "hello" with SHA-256. let hash = sha256(b"hello"); let em = emsa_pkcs1_v15_encode(&hash, HashAlgorithm::Sha256, 256).unwrap();
// With e=1, sig = EM should verify. let result = key.verify_pkcs1v15(HashAlgorithm::Sha256, b"hello", &em); assert!(result.is_ok(), "verification should pass: {result:?}");
// Wrong message should fail. let result = key.verify_pkcs1v15(HashAlgorithm::Sha256, b"world", &em); assert!(result.is_err()); }
#[test] fn verify_prehashed() { let mut mod_bytes = vec![0xFF; 256]; mod_bytes[255] = 0xFD; let exponent = vec![0x01]; // e=1
let key_der = build_pkcs1_key(&mod_bytes, &exponent); let key = RsaPublicKey::from_pkcs1_der(&key_der).unwrap();
let hash = sha256(b"hello"); let em = emsa_pkcs1_v15_encode(&hash, HashAlgorithm::Sha256, 256).unwrap();
let result = key.verify_pkcs1v15_prehashed(HashAlgorithm::Sha256, &hash, &em); assert!(result.is_ok());
// Wrong hash length should fail. let result = key.verify_pkcs1v15_prehashed(HashAlgorithm::Sha256, &hash[..16], &em); assert_eq!(result.unwrap_err(), RsaError::DigestMismatch); }}