cms/
enveloped_data.rs

1//! EnvelopedData-related types
2
3use crate::cert::IssuerAndSerialNumber;
4use crate::content_info::CmsVersion;
5use crate::revocation::RevocationInfoChoices;
6use crate::signed_data::CertificateSet;
7
8use core::cmp::Ordering;
9use der::asn1::{BitString, GeneralizedTime, ObjectIdentifier, OctetString, SetOfVec};
10use der::{Any, Choice, Sequence, ValueOrd};
11use spki::AlgorithmIdentifierOwned;
12use x509_cert::attr::{Attribute, Attributes};
13use x509_cert::ext::pkix::SubjectKeyIdentifier;
14use x509_cert::impl_newtype;
15
16/// The `EnvelopedData` type is defined in [RFC 5652 Section 6.1].
17///
18/// ```text
19///   EnvelopedData ::= SEQUENCE {
20///       version CMSVersion,
21///       originatorInfo [0] IMPLICIT OriginatorInfo OPTIONAL,
22///       recipientInfos RecipientInfos,
23///       encryptedContentInfo EncryptedContentInfo,
24///       ...,
25///       [[2: unprotectedAttrs [1] IMPLICIT Attributes
26///           {{ UnprotectedEnvAttributes }} OPTIONAL ]] }
27/// ```
28///
29/// [RFC 5652 Section 6.1]: https://www.rfc-editor.org/rfc/rfc5652#section-6.1
30#[derive(Clone, Debug, Eq, PartialEq, Sequence)]
31#[allow(missing_docs)]
32pub struct EnvelopedData {
33    pub version: CmsVersion,
34    #[asn1(
35        context_specific = "0",
36        tag_mode = "IMPLICIT",
37        constructed = "true",
38        optional = "true"
39    )]
40    pub originator_info: Option<OriginatorInfo>,
41    pub recip_infos: RecipientInfos,
42    pub encrypted_content: EncryptedContentInfo,
43    #[asn1(
44        context_specific = "1",
45        tag_mode = "IMPLICIT",
46        constructed = "true",
47        optional = "true"
48    )]
49    pub unprotected_attrs: Option<Attributes>,
50}
51
52/// The `OriginatorInfo` type is defined in [RFC 5652 Section 6.1].
53///
54/// ```text
55///   OriginatorInfo ::= SEQUENCE {
56///       certs [0] IMPLICIT CertificateSet OPTIONAL,
57///       crls [1] IMPLICIT RevocationInfoChoices OPTIONAL }
58/// ```
59///
60/// [RFC 5652 Section 6.1]: https://www.rfc-editor.org/rfc/rfc5652#section-6.1
61#[derive(Clone, Debug, Eq, PartialEq, Sequence)]
62#[allow(missing_docs)]
63pub struct OriginatorInfo {
64    #[asn1(
65        context_specific = "0",
66        tag_mode = "IMPLICIT",
67        constructed = "true",
68        optional = "true"
69    )]
70    pub certs: Option<CertificateSet>,
71    #[asn1(
72        context_specific = "1",
73        tag_mode = "IMPLICIT",
74        constructed = "true",
75        optional = "true"
76    )]
77    pub crls: Option<RevocationInfoChoices>,
78}
79
80/// The `RecipientInfos` type is defined in [RFC 5652 Section 6.1].
81///
82/// ```text
83///   RecipientInfos ::= SET SIZE (1..MAX) OF RecipientInfo
84/// ```
85///
86/// [RFC 5652 Section 6.1]: https://www.rfc-editor.org/rfc/rfc5652#section-6.1
87#[derive(Clone, Debug, Default, PartialEq, Eq)]
88pub struct RecipientInfos(pub SetOfVec<RecipientInfo>);
89impl_newtype!(RecipientInfos, SetOfVec<RecipientInfo>);
90
91#[cfg(feature = "std")]
92impl TryFrom<std::vec::Vec<RecipientInfo>> for RecipientInfos {
93    type Error = der::Error;
94
95    fn try_from(vec: std::vec::Vec<RecipientInfo>) -> der::Result<RecipientInfos> {
96        Ok(RecipientInfos(SetOfVec::try_from(vec)?))
97    }
98}
99
100/// The `EncryptedContentInfo` type is defined in [RFC 5652 Section 6.1].
101///
102/// ```text
103///   EncryptedContentInfo ::= SEQUENCE {
104///       contentType ContentType,
105///       contentEncryptionAlgorithm ContentEncryptionAlgorithmIdentifier,
106///       encryptedContent [0] IMPLICIT EncryptedContent OPTIONAL }
107/// ```
108///
109/// [RFC 5652 Section 6.1]: https://www.rfc-editor.org/rfc/rfc5652#section-6.1
110#[derive(Clone, Debug, Eq, PartialEq, Sequence)]
111#[allow(missing_docs)]
112pub struct EncryptedContentInfo {
113    pub content_type: ObjectIdentifier,
114    pub content_enc_alg: AlgorithmIdentifierOwned,
115    #[asn1(context_specific = "0", tag_mode = "IMPLICIT", optional = "true")]
116    pub encrypted_content: Option<OctetString>,
117}
118
119/// The `RecipientInfo` type is defined in [RFC 5652 Section 6.2].
120///
121/// ```text
122///   RecipientInfo ::= CHOICE {
123///       ktri           KeyTransRecipientInfo,
124///       ...,
125///       [[3: kari  [1] KeyAgreeRecipientInfo ]],
126///       [[4: kekri [2] KEKRecipientInfo]],
127///       [[5: pwri  [3] PasswordRecipientInfo,
128///            ori   [4] OtherRecipientInfo ]] }
129/// ```
130///
131/// [RFC 5652 Section 6.2]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2
132#[derive(Clone, Debug, Eq, PartialEq, Choice)]
133#[allow(missing_docs)]
134pub enum RecipientInfo {
135    Ktri(KeyTransRecipientInfo),
136    #[asn1(context_specific = "1", tag_mode = "IMPLICIT", constructed = "true")]
137    Kari(KeyAgreeRecipientInfo),
138    #[asn1(context_specific = "2", tag_mode = "IMPLICIT", constructed = "true")]
139    Kekri(KekRecipientInfo),
140    #[asn1(context_specific = "3", tag_mode = "IMPLICIT", constructed = "true")]
141    Pwri(PasswordRecipientInfo),
142    #[asn1(context_specific = "4", tag_mode = "IMPLICIT", constructed = "true")]
143    Ori(OtherRecipientInfo),
144}
145
146impl ValueOrd for RecipientInfo {
147    fn value_cmp(&self, other: &Self) -> der::Result<Ordering> {
148        use der::DerOrd;
149        use der::Encode;
150        self.to_der()?.der_cmp(&other.to_der()?)
151    }
152}
153
154/// The `EncryptedKey` type is defined in [RFC 5652 Section 6.2].
155///
156/// ```text
157///   EncryptedKey ::= OCTET STRING
158/// ```
159///
160/// [RFC 5652 Section 6.2]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2
161pub type EncryptedKey = OctetString;
162
163/// The `KeyTransRecipientInfo` type is defined in [RFC 5652 Section 6.2.1].
164///
165/// ```text
166///   KeyTransRecipientInfo ::= SEQUENCE {
167///       version CMSVersion,  -- always set to 0 or 2
168///       rid RecipientIdentifier,
169///       keyEncryptionAlgorithm AlgorithmIdentifier
170///           {KEY-TRANSPORT, {KeyTransportAlgorithmSet}},
171///       encryptedKey EncryptedKey }
172/// ```
173///
174/// [RFC 5652 Section 6.2.1]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2.1
175#[derive(Clone, Debug, Eq, PartialEq, Sequence)]
176#[allow(missing_docs)]
177pub struct KeyTransRecipientInfo {
178    pub version: CmsVersion,
179    pub rid: RecipientIdentifier,
180    pub key_enc_alg: AlgorithmIdentifierOwned,
181    pub enc_key: EncryptedKey,
182}
183
184/// The `RecipientIdentifier` type is defined in [RFC 5652 Section 6.2.1].
185///
186/// ```text
187///   RecipientIdentifier ::= CHOICE {
188///       issuerAndSerialNumber IssuerAndSerialNumber,
189///       ...,
190///       [[2: subjectKeyIdentifier [0] SubjectKeyIdentifier ]] }
191/// ```
192///
193/// [RFC 5652 Section 6.2.1]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2.1
194#[derive(Clone, Debug, Eq, PartialEq, Choice)]
195#[allow(missing_docs)]
196pub enum RecipientIdentifier {
197    IssuerAndSerialNumber(IssuerAndSerialNumber),
198
199    #[asn1(context_specific = "0", tag_mode = "IMPLICIT")]
200    SubjectKeyIdentifier(SubjectKeyIdentifier),
201}
202
203/// The `KeyAgreeRecipientInfo` type is defined in [RFC 5652 Section 6.2.2].
204///
205/// ```text
206///   KeyAgreeRecipientInfo ::= SEQUENCE {
207///       version CMSVersion,  -- always set to 3
208///       originator [0] EXPLICIT OriginatorIdentifierOrKey,
209///       ukm [1] EXPLICIT UserKeyingMaterial OPTIONAL,
210///       keyEncryptionAlgorithm AlgorithmIdentifier
211///           {KEY-AGREE, {KeyAgreementAlgorithmSet}},
212///       recipientEncryptedKeys RecipientEncryptedKeys }
213/// ```
214///
215/// [RFC 5652 Section 6.2.2]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2.2
216#[derive(Clone, Debug, Eq, PartialEq, Sequence)]
217#[allow(missing_docs)]
218pub struct KeyAgreeRecipientInfo {
219    pub version: CmsVersion,
220    #[asn1(context_specific = "0", tag_mode = "EXPLICIT")]
221    pub originator: OriginatorIdentifierOrKey,
222    #[asn1(context_specific = "1", tag_mode = "EXPLICIT", optional = "true")]
223    pub ukm: Option<UserKeyingMaterial>,
224    pub key_enc_alg: AlgorithmIdentifierOwned,
225    pub recipient_enc_keys: RecipientEncryptedKeys,
226}
227
228/// The `OriginatorIdentifierOrKey` type is defined in [RFC 5652 Section 6.2.2].
229///
230/// ```text
231///   OriginatorIdentifierOrKey ::= CHOICE {
232///       issuerAndSerialNumber IssuerAndSerialNumber,
233///       subjectKeyIdentifier [0] SubjectKeyIdentifier,
234///       originatorKey [1] OriginatorPublicKey }
235/// ```
236///
237/// [RFC 5652 Section 6.2.2]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2.2
238#[derive(Clone, Debug, Eq, PartialEq, Choice)]
239#[allow(missing_docs)]
240pub enum OriginatorIdentifierOrKey {
241    IssuerAndSerialNumber(IssuerAndSerialNumber),
242    #[asn1(context_specific = "0", tag_mode = "IMPLICIT")]
243    SubjectKeyIdentifier(SubjectKeyIdentifier),
244    #[asn1(context_specific = "1", tag_mode = "IMPLICIT", constructed = "true")]
245    OriginatorKey(OriginatorPublicKey),
246}
247
248/// The `OriginatorPublicKey` type is defined in [RFC 5652 Section 6.2.2].
249///
250/// ```text
251///   OriginatorPublicKey ::= SEQUENCE {
252///       algorithm AlgorithmIdentifier {PUBLIC-KEY, {OriginatorKeySet}},
253///       publicKey BIT STRING }
254/// ```
255///
256/// [RFC 5652 Section 6.2.2]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2.2
257#[derive(Clone, Debug, Eq, PartialEq, Sequence)]
258#[allow(missing_docs)]
259pub struct OriginatorPublicKey {
260    pub algorithm: AlgorithmIdentifierOwned,
261    pub public_key: BitString,
262}
263
264/// The `RecipientEncryptedKeys` type is defined in [RFC 5652 Section 6.2.2].
265///
266/// ```text
267///   RecipientEncryptedKeys ::= SEQUENCE OF RecipientEncryptedKey
268/// ```
269///
270/// [RFC 5652 Section 6.2.2]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2.2
271pub type RecipientEncryptedKeys = alloc::vec::Vec<RecipientEncryptedKey>;
272
273/// The `RecipientEncryptedKey` type is defined in [RFC 5652 Section 6.2.2].
274///
275/// ```text
276///   RecipientEncryptedKey ::= SEQUENCE {
277///       rid KeyAgreeRecipientIdentifier,
278///       encryptedKey EncryptedKey }
279/// ```
280///
281/// [RFC 5652 Section 6.2.2]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2.2
282#[derive(Clone, Debug, Eq, PartialEq, Sequence)]
283#[allow(missing_docs)]
284pub struct RecipientEncryptedKey {
285    pub rid: KeyAgreeRecipientIdentifier,
286    pub enc_key: EncryptedKey,
287}
288
289/// The `KeyAgreeRecipientIdentifier` type is defined in [RFC 5652 Section 6.2.2].
290///
291/// ```text
292///   KeyAgreeRecipientIdentifier ::= CHOICE {
293///       issuerAndSerialNumber IssuerAndSerialNumber,
294///       rKeyId [0] IMPLICIT RecipientKeyIdentifier }
295/// ```
296///
297/// [RFC 5652 Section 6.2.2]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2.2
298#[derive(Clone, Debug, Eq, PartialEq, Choice)]
299#[allow(missing_docs)]
300pub enum KeyAgreeRecipientIdentifier {
301    IssuerAndSerialNumber(IssuerAndSerialNumber),
302    #[asn1(context_specific = "0", tag_mode = "IMPLICIT")]
303    RKeyId(RecipientKeyIdentifier),
304}
305
306/// The `RecipientKeyIdentifier` type is defined in [RFC 5652 Section 6.2.2].
307///
308/// ```text
309///   RecipientKeyIdentifier ::= SEQUENCE {
310///       subjectKeyIdentifier SubjectKeyIdentifier,
311///       date GeneralizedTime OPTIONAL,
312///       other OtherKeyAttribute OPTIONAL }
313/// ```
314///
315/// [RFC 5652 Section 6.2.2]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2.2
316#[derive(Clone, Debug, Eq, PartialEq, Sequence)]
317#[allow(missing_docs)]
318pub struct RecipientKeyIdentifier {
319    pub subject_key_identifier: SubjectKeyIdentifier,
320    pub date: Option<GeneralizedTime>,
321    pub other: Option<Attribute>,
322}
323
324//   SubjectKeyIdentifier ::= OCTET STRING
325// reusing from x509-cert crate
326
327/// The `KEKRecipientInfo` type is defined in [RFC 5652 Section 6.2.3].
328///
329/// ```text
330///   KEKRecipientInfo ::= SEQUENCE {
331///       version CMSVersion,  -- always set to 4
332///       kekid KEKIdentifier,
333///       keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier,
334///       encryptedKey EncryptedKey }
335/// ```
336///
337/// [RFC 5652 Section 6.2.3]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2.3
338#[derive(Clone, Debug, Eq, PartialEq, Sequence)]
339#[allow(missing_docs)]
340pub struct KekRecipientInfo {
341    pub version: CmsVersion,
342    pub kek_id: KekIdentifier,
343    pub key_enc_alg: AlgorithmIdentifierOwned,
344    pub encrypted_key: EncryptedKey,
345}
346
347/// The `KEKIdentifier` type is defined in [RFC 5652 Section 6.2.3].
348///
349/// ```text
350///   KEKIdentifier ::= SEQUENCE {
351///       keyIdentifier OCTET STRING,
352///       date GeneralizedTime OPTIONAL,
353///       other OtherKeyAttribute OPTIONAL }
354/// ```
355///
356/// [RFC 5652 Section 6.2.3]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2.3
357#[derive(Clone, Debug, Eq, PartialEq, Sequence)]
358#[allow(missing_docs)]
359pub struct KekIdentifier {
360    pub kek_identifier: OctetString,
361    pub date: Option<GeneralizedTime>,
362    pub other: Option<Attribute>,
363}
364
365/// The `PasswordRecipientInfo` type is defined in [RFC 5652 Section 6.2.4].
366///
367/// ```text
368///   PasswordRecipientInfo ::= SEQUENCE {
369///       version CMSVersion,   -- always set to 0
370///       keyDerivationAlgorithm [0] KeyDerivationAlgorithmIdentifier
371///                               OPTIONAL,
372///       keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier,
373///       encryptedKey EncryptedKey }
374/// ```
375///
376/// [RFC 5652 Section 6.2.4]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2.4
377#[derive(Clone, Debug, Eq, PartialEq, Sequence)]
378#[allow(missing_docs)]
379pub struct PasswordRecipientInfo {
380    pub version: CmsVersion,
381    #[asn1(
382        context_specific = "0",
383        tag_mode = "IMPLICIT",
384        constructed = "true",
385        optional = "true"
386    )]
387    pub key_derivation_alg: Option<AlgorithmIdentifierOwned>,
388    pub key_enc_alg: AlgorithmIdentifierOwned,
389    pub enc_key: EncryptedKey,
390}
391
392/// The `OtherRecipientInfo` type is defined in [RFC 5652 Section 6.2.5].
393///
394/// ```text
395///   OtherRecipientInfo ::= SEQUENCE {
396///       oriType    OTHER-RECIPIENT.
397///               &id({SupportedOtherRecipInfo}),
398///       oriValue   OTHER-RECIPIENT.
399///               &Type({SupportedOtherRecipInfo}{@oriType})}
400/// ```
401///
402/// [RFC 5652 Section 6.2.5]: https://www.rfc-editor.org/rfc/rfc5652#section-6.2.5
403#[derive(Clone, Debug, Eq, PartialEq, Sequence)]
404#[allow(missing_docs)]
405pub struct OtherRecipientInfo {
406    pub ori_type: ObjectIdentifier,
407    pub ori_value: Any,
408}
409
410/// The `UserKeyingMaterial` type is defined in [RFC 5652 Section 10.2.6].
411///
412/// ```text
413///   UserKeyingMaterial ::= OCTET STRING
414/// ```
415///
416/// [RFC 5652 Section 10.2.5]: https://www.rfc-editor.org/rfc/rfc5652#section-10.2.5
417pub type UserKeyingMaterial = OctetString;
cms/enveloped_data.rs

cms/
enveloped_data.rs
