webauthn/

crypto.rs

//! Low-level cryptographic primitives used throughout WebAuthn ceremony verification.
//!
//! All cryptographic operations are delegated to [`ring`], which is a carefully
//! audited, FIPS-aligned library descended from BoringSSL. No custom crypto is
//! implemented here.

use ring::digest;
use ring::rand::{SecureRandom, SystemRandom};
use ring::signature::{self, UnparsedPublicKey};

use crate::credential::Challenge;
pub use crate::der::rsa_components_to_der;
use crate::error::{Result, WebAuthnError};

/// Compute SHA-256 of `data` and return the 32-byte digest.
///
/// Used to hash `clientDataJSON` (→ clientDataHash) and to compute the
/// RP ID hash for comparison against authenticator data.
pub fn sha256(data: &[u8]) -> [u8; 32] {
    let digest = digest::digest(&digest::SHA256, data);
    // SHA256 always produces exactly 32 bytes; the unwrap cannot fail.
    digest
        .as_ref()
        .try_into()
        .expect("SHA-256 digest is always 32 bytes")
}

/// Generate `len` cryptographically random bytes using the OS RNG.
///
/// # Errors
/// Returns [`WebAuthnError::InvalidClientData`] if the system RNG fails
/// (extremely unlikely in practice).
pub fn random_bytes(len: usize) -> Result<Vec<u8>> {
    let rng = SystemRandom::new();
    let mut bytes = vec![0u8; len];
    rng.fill(&mut bytes).map_err(|_| {
        WebAuthnError::InvalidClientData(
            "system random number generator failed to produce bytes".to_string(),
        )
    })?;
    Ok(bytes)
}

/// Verify an ES256 (ECDSA P-256 + SHA-256) signature.
///
/// # Arguments
/// * `public_key_uncompressed` — 65-byte uncompressed P-256 point:
///   `0x04 || x (32 bytes) || y (32 bytes)`.
/// * `message`   — The raw message that was signed (ring hashes internally via SHA-256).
/// * `signature` — DER-encoded ASN.1 ECDSA signature, as produced by authenticators.
///
/// # Errors
/// Returns [`WebAuthnError::SignatureVerificationFailed`] if the signature is
/// invalid, the key is malformed, or the public key does not match.
pub fn verify_es256(
    public_key_uncompressed: &[u8],
    message: &[u8],
    signature: &[u8],
) -> Result<()> {
    let key = UnparsedPublicKey::new(&signature::ECDSA_P256_SHA256_ASN1, public_key_uncompressed);
    key.verify(message, signature)
        .map_err(|_| WebAuthnError::SignatureVerificationFailed)
}

/// Verify an ES384 (ECDSA P-384 + SHA-384) signature.
///
/// # Arguments
/// * `public_key_uncompressed` — 97-byte uncompressed P-384 point:
///   `0x04 || x (48 bytes) || y (48 bytes)`.
/// * `message`   — The raw message that was signed (ring hashes internally via SHA-384).
/// * `signature` — DER-encoded ASN.1 ECDSA signature, as produced by authenticators.
///
/// # Errors
/// Returns [`WebAuthnError::SignatureVerificationFailed`] if the signature is
/// invalid, the key is malformed, or the public key does not match.
pub fn verify_es384(
    public_key_uncompressed: &[u8],
    message: &[u8],
    signature: &[u8],
) -> Result<()> {
    let key = UnparsedPublicKey::new(&signature::ECDSA_P384_SHA384_ASN1, public_key_uncompressed);
    key.verify(message, signature)
        .map_err(|_| WebAuthnError::SignatureVerificationFailed)
}

/// Verify an EdDSA (Ed25519) signature.
///
/// # Arguments
/// * `public_key` — Raw 32-byte Ed25519 public key, as stored in COSE OKP key
///   parameter `-2` (`x`). Ed25519 keys are always exactly 32 bytes.
/// * `message`    — The raw message that was signed. Ed25519 processes the
///   message internally (via SHA-512 internally in ring); do not pre-hash.
/// * `signature`  — Raw 64-byte Ed25519 signature. Unlike ECDSA, Ed25519
///   signatures are a fixed-length raw encoding, not DER.
///
/// # Errors
/// Returns [`WebAuthnError::SignatureVerificationFailed`] if the signature is
/// invalid, the key is not 32 bytes, or the signature is not 64 bytes.
pub fn verify_eddsa(public_key: &[u8], message: &[u8], signature: &[u8]) -> Result<()> {
    let key = UnparsedPublicKey::new(&signature::ED25519, public_key);
    key.verify(message, signature)
        .map_err(|_| WebAuthnError::SignatureVerificationFailed)
}

/// Verify an RS256 (RSA PKCS#1 v1.5 + SHA-256) signature.
///
/// # Arguments
/// * `public_key_der` — DER-encoded RSAPublicKey (`SEQUENCE { INTEGER n, INTEGER e }`)
///   as expected by ring. Build this from raw `(n, e)` components with
///   [`rsa_components_to_der`].
/// * `message`   — The raw message that was signed (ring hashes internally via SHA-256).
/// * `signature` — Raw RSA signature bytes (same length as the modulus).
///
/// # Errors
/// Returns [`WebAuthnError::SignatureVerificationFailed`] if the signature is
/// invalid, the key is malformed, or the key does not meet ring's 2048-bit minimum.
pub fn verify_rs256(public_key_der: &[u8], message: &[u8], signature: &[u8]) -> Result<()> {
    let key = UnparsedPublicKey::new(&signature::RSA_PKCS1_2048_8192_SHA256, public_key_der);
    key.verify(message, signature)
        .map_err(|_| WebAuthnError::SignatureVerificationFailed)
}

/// Generate a fresh 32-byte [`Challenge`] using the OS cryptographic RNG.
///
/// Convenience wrapper around [`Challenge::new`]; prefer that method in new code.
pub fn generate_challenge() -> Result<Challenge> {
    Challenge::new()
}

// ─── Tests ────────────────────────────────────────────────────────────────────

#[cfg(test)]
mod tests {
    use super::*;

    // ── sha256 ───────────────────────────────────────────────────────────────

    #[test]
    fn sha256_known_answer_empty_input() {
        // RFC-specified SHA-256 of the empty string.
        let digest = sha256(b"");
        let expected = hex_to_bytes(
            "e3b0c44298fc1c149afbf4c8996fb924\
                                     27ae41e4649b934ca495991b7852b855",
        );
        assert_eq!(digest, expected.as_slice());
    }

    #[test]
    fn sha256_returns_32_bytes() {
        assert_eq!(sha256(b"anything").len(), 32);
    }

    #[test]
    fn sha256_is_deterministic() {
        assert_eq!(sha256(b"abc"), sha256(b"abc"));
    }

    #[test]
    fn sha256_different_inputs_differ() {
        assert_ne!(sha256(b"abc"), sha256(b"abd"));
        assert_ne!(sha256(b"abc"), sha256(b""));
    }

    // ── random_bytes ─────────────────────────────────────────────────────────

    #[test]
    fn random_bytes_zero_len_returns_empty() {
        let result = random_bytes(0).expect("test setup");
        assert!(result.is_empty());
    }

    #[test]
    fn random_bytes_returns_exact_len() {
        let result = random_bytes(32).expect("test setup");
        assert_eq!(result.len(), 32);
    }

    #[test]
    fn random_bytes_two_calls_differ() {
        let a = random_bytes(32).expect("test setup");
        let b = random_bytes(32).expect("test setup");
        assert_ne!(a, b, "two random 32-byte draws should not match");
    }

    // ── verify_es256 ─────────────────────────────────────────────────────────

    #[test]
    fn verify_es256_rejects_key_missing_prefix() {
        // A 64-byte key (missing the 0x04 uncompressed-point prefix) is invalid.
        let key_64 = vec![0x01u8; 64];
        let err = verify_es256(&key_64, b"msg", b"sig").expect_err("expected error");
        assert!(matches!(err, WebAuthnError::SignatureVerificationFailed));
    }

    #[test]
    fn verify_es256_rejects_empty_key() {
        let err = verify_es256(&[], b"msg", b"sig").expect_err("expected error");
        assert!(matches!(err, WebAuthnError::SignatureVerificationFailed));
    }

    #[test]
    fn verify_es256_rejects_empty_signature() {
        let key = vec![0x04u8; 65];
        let err = verify_es256(&key, b"hello", &[]).expect_err("expected error");
        assert!(matches!(err, WebAuthnError::SignatureVerificationFailed));
    }

    #[test]
    fn verify_es256_rejects_wrong_signature() {
        use ring::rand::SystemRandom;
        use ring::signature::{EcdsaKeyPair, KeyPair, ECDSA_P256_SHA256_ASN1_SIGNING};

        let rng = SystemRandom::new();
        let pkcs8 = EcdsaKeyPair::generate_pkcs8(&ECDSA_P256_SHA256_ASN1_SIGNING, &rng)
            .expect("test setup");
        let kp = EcdsaKeyPair::from_pkcs8(&ECDSA_P256_SHA256_ASN1_SIGNING, pkcs8.as_ref(), &rng)
            .expect("test setup");
        let pk = kp.public_key().as_ref();

        // Sign "message A" but verify against "message B".
        let sig = kp.sign(&rng, b"message A").expect("test setup");
        let err = verify_es256(pk, b"message B", sig.as_ref()).expect_err("expected error");
        assert!(matches!(err, WebAuthnError::SignatureVerificationFailed));
    }

    #[test]
    fn verify_es256_rejects_garbage_der_signature() {
        use ring::rand::SystemRandom;
        use ring::signature::{EcdsaKeyPair, KeyPair, ECDSA_P256_SHA256_ASN1_SIGNING};

        let rng = SystemRandom::new();
        let pkcs8 = EcdsaKeyPair::generate_pkcs8(&ECDSA_P256_SHA256_ASN1_SIGNING, &rng)
            .expect("test setup");
        let kp = EcdsaKeyPair::from_pkcs8(&ECDSA_P256_SHA256_ASN1_SIGNING, pkcs8.as_ref(), &rng)
            .expect("test setup");
        let pk = kp.public_key().as_ref();

        let err =
            verify_es256(pk, b"hello", &[0xDE, 0xAD, 0xBE, 0xEF]).expect_err("expected error");
        assert!(matches!(err, WebAuthnError::SignatureVerificationFailed));
    }

    // ── verify_eddsa ─────────────────────────────────────────────────────────

    #[test]
    fn verify_eddsa_accepts_valid_signature() {
        use ring::signature::{Ed25519KeyPair, KeyPair};

        let rng = SystemRandom::new();
        let pkcs8 = Ed25519KeyPair::generate_pkcs8(&rng).expect("test setup");
        let kp = Ed25519KeyPair::from_pkcs8(pkcs8.as_ref()).expect("test setup");
        let pk = kp.public_key().as_ref();

        let msg = b"test message for EdDSA verification";
        let sig = kp.sign(msg);
        verify_eddsa(pk, msg, sig.as_ref()).expect("valid EdDSA signature should verify");
    }

    #[test]
    fn verify_eddsa_rejects_wrong_message() {
        use ring::signature::{Ed25519KeyPair, KeyPair};

        let rng = SystemRandom::new();
        let pkcs8 = Ed25519KeyPair::generate_pkcs8(&rng).expect("test setup");
        let kp = Ed25519KeyPair::from_pkcs8(pkcs8.as_ref()).expect("test setup");
        let pk = kp.public_key().as_ref();

        let sig = kp.sign(b"message A");
        let err = verify_eddsa(pk, b"message B", sig.as_ref()).expect_err("expected error");
        assert!(matches!(err, WebAuthnError::SignatureVerificationFailed));
    }

    #[test]
    fn verify_eddsa_rejects_empty_key() {
        let err = verify_eddsa(&[], b"msg", &[0u8; 64]).expect_err("expected error");
        assert!(matches!(err, WebAuthnError::SignatureVerificationFailed));
    }

    #[test]
    fn verify_eddsa_rejects_tampered_signature() {
        use ring::signature::{Ed25519KeyPair, KeyPair};

        let rng = SystemRandom::new();
        let pkcs8 = Ed25519KeyPair::generate_pkcs8(&rng).expect("test setup");
        let kp = Ed25519KeyPair::from_pkcs8(pkcs8.as_ref()).expect("test setup");
        let pk = kp.public_key().as_ref();

        let msg = b"test message";
        let sig = kp.sign(msg);
        let mut sig_bytes = sig.as_ref().to_vec();
        sig_bytes[10] ^= 0xFF;
        let err = verify_eddsa(pk, msg, &sig_bytes).expect_err("expected error");
        assert!(matches!(err, WebAuthnError::SignatureVerificationFailed));
    }

    // ── verify_rs256 ─────────────────────────────────────────────────────────

    // RSA 2048-bit test key: private key (PKCS#8 DER) + public key components.
    // This is a test-only key — never use it outside test code.
    const TEST_RSA_PKCS8_DER: &[u8] = &[
        0x30, 0x82, 0x04, 0xbc, 0x02, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
        0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82, 0x04, 0xa6, 0x30, 0x82, 0x04, 0xa2,
        0x02, 0x01, 0x00, 0x02, 0x82, 0x01, 0x01, 0x00, 0xb7, 0xe0, 0x0f, 0xc9, 0xdb, 0xfa, 0xce,
        0x64, 0xa6, 0xe2, 0xb7, 0xfb, 0xa2, 0x1c, 0x09, 0x14, 0xfb, 0xd6, 0x26, 0xe5, 0x17, 0xcc,
        0xf6, 0x6b, 0xf5, 0x8e, 0xbb, 0x69, 0x07, 0x50, 0xc0, 0xbb, 0x4c, 0xe7, 0x6e, 0xd8, 0xa4,
        0x6a, 0x69, 0x29, 0xfc, 0xc9, 0x52, 0x0c, 0xdb, 0x04, 0xec, 0xa2, 0xef, 0x27, 0x7d, 0x8f,
        0xfa, 0x9d, 0xaa, 0x10, 0x59, 0x54, 0x7b, 0x42, 0x78, 0xdb, 0xae, 0xd4, 0x24, 0x0a, 0xd4,
        0x06, 0x69, 0xb0, 0xe2, 0xa5, 0x68, 0xca, 0x2d, 0x41, 0x34, 0xb0, 0x64, 0xaf, 0x61, 0x13,
        0xc9, 0x32, 0xfc, 0x93, 0x56, 0x4f, 0x82, 0x7b, 0xea, 0xff, 0x20, 0xe5, 0x1c, 0x56, 0xb6,
        0xe0, 0xf4, 0xaa, 0x6a, 0x20, 0xd2, 0x1c, 0x46, 0x71, 0xe6, 0x05, 0x9a, 0x96, 0x99, 0xad,
        0x5a, 0x6f, 0x78, 0xfd, 0xa7, 0x06, 0xf8, 0xfd, 0x2d, 0xea, 0x91, 0xf2, 0x9e, 0xac, 0xc0,
        0x43, 0x45, 0x2d, 0x79, 0xb0, 0xf2, 0x24, 0x5a, 0x8c, 0x91, 0xe6, 0xc6, 0xc2, 0xfe, 0x50,
        0x8d, 0x64, 0x82, 0x06, 0x77, 0x6e, 0xef, 0x7d, 0x61, 0x6e, 0x80, 0xd1, 0x87, 0xfb, 0x25,
        0x35, 0xc6, 0xe8, 0x3a, 0xec, 0x38, 0xce, 0x45, 0x70, 0xf8, 0x56, 0xc7, 0x6e, 0xb7, 0x20,
        0xdb, 0x72, 0x51, 0x82, 0xd0, 0xd2, 0xd2, 0xbd, 0xc9, 0xe0, 0x3c, 0xef, 0xbb, 0x93, 0x70,
        0xdd, 0xfb, 0xd4, 0xda, 0x6e, 0xf6, 0x73, 0xb3, 0x79, 0xf7, 0xe8, 0x49, 0x72, 0x22, 0x44,
        0x92, 0xd8, 0xe4, 0x3e, 0x04, 0xbc, 0x83, 0xb2, 0x6c, 0x59, 0x4a, 0x79, 0x11, 0x1e, 0x33,
        0xd6, 0x4b, 0xe6, 0x24, 0x7b, 0xdf, 0x93, 0x18, 0x1d, 0xb3, 0x27, 0x0b, 0x73, 0xbb, 0xff,
        0xa8, 0xe2, 0x13, 0xa0, 0x8f, 0x39, 0x2c, 0x21, 0xc1, 0x5e, 0xf1, 0xa8, 0x82, 0x25, 0x28,
        0x19, 0xae, 0xc9, 0x3f, 0x09, 0x2d, 0x8c, 0x81, 0xa5, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02,
        0x82, 0x01, 0x00, 0x1b, 0x31, 0xd5, 0x8b, 0xf4, 0x8f, 0xbb, 0xca, 0x49, 0x9f, 0x62, 0xf8,
        0x21, 0xb1, 0xf5, 0x4a, 0xe7, 0xf3, 0x34, 0x95, 0xf1, 0xe6, 0xf3, 0xb4, 0x24, 0x61, 0x7b,
        0x88, 0xcd, 0x56, 0xed, 0x66, 0x56, 0x39, 0xad, 0x5c, 0x77, 0xb6, 0xb0, 0x3e, 0x90, 0x3f,
        0x43, 0x36, 0x19, 0x07, 0x79, 0xab, 0x20, 0x65, 0x4e, 0x0e, 0x07, 0x12, 0x1d, 0xf6, 0xa4,
        0x8b, 0x98, 0xde, 0x4c, 0x2b, 0x2b, 0x88, 0x7f, 0x1b, 0x25, 0xe0, 0x1b, 0xee, 0x18, 0x1b,
        0x40, 0x2c, 0x14, 0xb4, 0xdd, 0xe2, 0xcf, 0xc5, 0x5b, 0x7d, 0x76, 0x66, 0xa6, 0xd1, 0xf0,
        0xb4, 0x3a, 0x37, 0x73, 0x1a, 0x50, 0x26, 0x6a, 0x82, 0x4d, 0xb2, 0x68, 0x25, 0x33, 0x24,
        0x8f, 0x06, 0xb5, 0x09, 0x7f, 0xec, 0x68, 0xc0, 0x68, 0xd2, 0xa9, 0x7b, 0x2e, 0xa1, 0x0f,
        0x3c, 0xba, 0x03, 0x11, 0xf1, 0x2d, 0x2c, 0x3d, 0xb9, 0x0d, 0x87, 0x34, 0x84, 0x62, 0x65,
        0xe4, 0xe3, 0x32, 0x0d, 0xbd, 0x90, 0xad, 0x2c, 0x57, 0x74, 0x39, 0xd8, 0x25, 0x42, 0x46,
        0x3c, 0xc9, 0x0b, 0x26, 0xc9, 0x99, 0x75, 0xc2, 0x6e, 0x56, 0x82, 0x41, 0xfb, 0xeb, 0xd9,
        0x80, 0x3d, 0x6e, 0x0e, 0x8b, 0x0b, 0xa3, 0xaf, 0x6c, 0x1d, 0x39, 0x79, 0xf8, 0xa5, 0xae,
        0x6c, 0x9e, 0xdf, 0x1b, 0xd3, 0x7a, 0x16, 0x35, 0xf4, 0x14, 0x6d, 0x1e, 0x4d, 0x7b, 0x6f,
        0xbb, 0xfb, 0xe9, 0x2c, 0x9e, 0xad, 0xf9, 0x0a, 0x53, 0x29, 0x2a, 0xd8, 0xff, 0x9d, 0xb3,
        0xac, 0x9e, 0x2d, 0x86, 0x77, 0x67, 0x4c, 0xa8, 0x74, 0xe3, 0xb2, 0x94, 0xf8, 0xfb, 0xe8,
        0x33, 0xf2, 0x3c, 0x5d, 0x57, 0x79, 0x89, 0x87, 0xd0, 0x9b, 0x52, 0x4b, 0xc9, 0xbc, 0x48,
        0x68, 0xbe, 0x85, 0x1f, 0x25, 0x61, 0x44, 0x7e, 0xa6, 0x40, 0x54, 0x70, 0xaf, 0x65, 0x11,
        0x3a, 0x58, 0xd1, 0x81, 0x02, 0x81, 0x81, 0x00, 0xfd, 0x9e, 0x1a, 0x50, 0x85, 0xd7, 0xa8,
        0x9c, 0x36, 0x6a, 0x8f, 0x1c, 0x9f, 0x2d, 0x6d, 0xdf, 0xb4, 0xe6, 0xc4, 0xd2, 0xcf, 0x99,
        0x6f, 0x5d, 0xc5, 0x71, 0x01, 0xe6, 0x1d, 0x5f, 0xd5, 0x6d, 0x52, 0x86, 0x7c, 0xb6, 0xc2,
        0xc2, 0x1b, 0xcd, 0x4a, 0xd1, 0x0c, 0x79, 0x15, 0x2d, 0x4e, 0x93, 0xe2, 0xc0, 0x7d, 0xe6,
        0xa4, 0xc4, 0x71, 0x41, 0xa3, 0x49, 0x93, 0x2c, 0xf9, 0xe7, 0xc8, 0xe6, 0x79, 0x52, 0x19,
        0xf7, 0xe0, 0x2a, 0xd9, 0xc0, 0x0f, 0x3e, 0xad, 0xdf, 0xf4, 0x96, 0xbd, 0xb9, 0x54, 0x5a,
        0x5a, 0xe8, 0x70, 0x2d, 0xad, 0xf0, 0x5d, 0x63, 0x80, 0xb4, 0x8f, 0x3c, 0x1b, 0xad, 0xd9,
        0x2b, 0x63, 0x16, 0x80, 0xe1, 0x52, 0x8d, 0xd7, 0x8e, 0x2c, 0x37, 0x99, 0x6e, 0x1e, 0x8e,
        0x64, 0xcf, 0x0e, 0x79, 0x32, 0xdd, 0x1a, 0xc1, 0x43, 0x7e, 0x4c, 0x0c, 0xab, 0x29, 0x5b,
        0x25, 0x02, 0x81, 0x81, 0x00, 0xb9, 0x9a, 0x3e, 0x3e, 0x20, 0x74, 0xe5, 0x19, 0x82, 0x8b,
        0x1d, 0x20, 0x2b, 0xe5, 0xa9, 0x8c, 0x71, 0xd5, 0xa8, 0xe6, 0xed, 0x7e, 0x0a, 0x91, 0x8f,
        0x87, 0xf5, 0x80, 0xc8, 0xd4, 0x1d, 0x4e, 0x25, 0x0b, 0xfe, 0x22, 0xb6, 0xdd, 0xc3, 0xfd,
        0x46, 0x78, 0x7f, 0x6c, 0x27, 0x9d, 0xfe, 0xbf, 0xea, 0x66, 0x27, 0x57, 0x2e, 0xc2, 0x7c,
        0xca, 0x63, 0x1a, 0xc8, 0xb8, 0xda, 0x2f, 0xf3, 0x03, 0xfc, 0x03, 0xcb, 0xf4, 0x0c, 0x8a,
        0x00, 0x2f, 0x5d, 0x78, 0x7a, 0xff, 0x9e, 0x84, 0xc5, 0x0b, 0xd6, 0xae, 0xf6, 0xf8, 0xc7,
        0x6f, 0x5f, 0x77, 0x8c, 0x4f, 0xe6, 0x4f, 0x58, 0x67, 0xbf, 0xde, 0x8e, 0x39, 0xa5, 0xd8,
        0x82, 0x59, 0x40, 0xf8, 0xd4, 0x46, 0xbe, 0x5b, 0xaa, 0x2b, 0x74, 0xf4, 0x29, 0x72, 0xfd,
        0x2b, 0xa0, 0xa2, 0xb4, 0x1a, 0x3d, 0x4d, 0x2f, 0xfe, 0x61, 0x55, 0x04, 0x81, 0x02, 0x81,
        0x80, 0x58, 0x92, 0xa6, 0xce, 0x08, 0x70, 0x50, 0xca, 0x7d, 0x96, 0xa9, 0x74, 0x6d, 0x83,
        0x08, 0x24, 0x60, 0xa1, 0x57, 0x8b, 0xe8, 0x44, 0xc5, 0xc8, 0x11, 0xf4, 0x6d, 0x9d, 0x58,
        0x14, 0xe8, 0x0c, 0xce, 0x0d, 0x79, 0xf0, 0xba, 0x03, 0xe0, 0x81, 0xc9, 0xe7, 0x48, 0x5b,
        0xe1, 0x31, 0x79, 0x87, 0xdc, 0x61, 0x2d, 0x97, 0x27, 0x64, 0x13, 0xc9, 0xc0, 0xa5, 0x29,
        0x69, 0x43, 0xbd, 0xd7, 0x43, 0xe6, 0x8a, 0xed, 0xd6, 0xcb, 0xcb, 0x2b, 0x51, 0x10, 0x01,
        0xeb, 0xe7, 0x93, 0x1c, 0x32, 0x16, 0x4f, 0x87, 0x5e, 0xc8, 0x5e, 0xa5, 0x15, 0x62, 0x24,
        0xbb, 0x63, 0x6f, 0xab, 0xb6, 0x6a, 0x54, 0x44, 0xcc, 0x0a, 0x47, 0x09, 0xab, 0xa7, 0x91,
        0x31, 0xfe, 0xcd, 0x22, 0x7d, 0xcb, 0x1f, 0x90, 0xcb, 0x54, 0x24, 0xd1, 0xdf, 0x19, 0xa9,
        0x06, 0x65, 0xf3, 0xed, 0xcb, 0x5e, 0xdb, 0x8a, 0xa1, 0x02, 0x81, 0x80, 0x0b, 0x53, 0x45,
        0x1f, 0x07, 0x5d, 0xfa, 0xa8, 0xce, 0xd5, 0x6c, 0x46, 0x8d, 0x47, 0x2b, 0x4c, 0x5d, 0x99,
        0xda, 0xff, 0x94, 0x58, 0x4f, 0x8e, 0xc8, 0x42, 0x54, 0x91, 0xb2, 0x2f, 0x77, 0x46, 0x50,
        0x6e, 0x65, 0xe8, 0x7a, 0x5e, 0x17, 0xda, 0x79, 0x95, 0x5a, 0xb9, 0x1f, 0xc5, 0xbd, 0x48,
        0xba, 0xa5, 0xd7, 0x1a, 0xb3, 0xc8, 0xbc, 0x52, 0xa1, 0x2f, 0x7e, 0x36, 0x01, 0x62, 0x51,
        0xa2, 0xd9, 0x9a, 0xe5, 0xb4, 0x13, 0x9b, 0xcc, 0x1d, 0x17, 0xc8, 0x05, 0x41, 0x59, 0xcb,
        0xe2, 0x36, 0x31, 0xb8, 0x65, 0x6b, 0x92, 0xc7, 0xd1, 0xfc, 0x7a, 0x7c, 0x59, 0xa2, 0x57,
        0xd3, 0xa4, 0xda, 0x90, 0xb5, 0x25, 0xd0, 0x8b, 0x4b, 0xa4, 0xf2, 0x4a, 0x09, 0xb3, 0x0d,
        0xe6, 0xd9, 0x55, 0xfe, 0x9c, 0x14, 0xdf, 0x2b, 0xed, 0x56, 0x60, 0x45, 0x05, 0x9e, 0x93,
        0x22, 0x23, 0x90, 0x4b, 0x81, 0x02, 0x81, 0x80, 0x71, 0x49, 0x07, 0xff, 0x86, 0xc5, 0xf7,
        0xe4, 0xbd, 0xa8, 0xbc, 0xa4, 0xbe, 0x1f, 0x8e, 0x73, 0xb0, 0xea, 0x71, 0x85, 0x61, 0xb1,
        0x8d, 0x30, 0xe3, 0xac, 0x67, 0xfc, 0x2c, 0x5a, 0x36, 0xcc, 0x66, 0xe7, 0x2f, 0x32, 0x97,
        0x54, 0x97, 0xe9, 0xd6, 0x5d, 0xd9, 0xe5, 0xbb, 0x1a, 0x06, 0x15, 0x95, 0x2d, 0x8e, 0xca,
        0x27, 0x8e, 0x2e, 0x39, 0xab, 0x45, 0x2d, 0x94, 0x26, 0x93, 0xd0, 0x7b, 0xda, 0x62, 0x02,
        0xba, 0xe6, 0xd9, 0x87, 0xad, 0xf7, 0x2a, 0x33, 0x1d, 0x5a, 0xd9, 0xa8, 0xf3, 0x38, 0x0e,
        0x0f, 0xd1, 0x24, 0x25, 0x69, 0x2a, 0x2c, 0x99, 0xf7, 0xea, 0x0d, 0x3b, 0x51, 0x8b, 0x2a,
        0x72, 0xb0, 0x51, 0xd3, 0x07, 0x63, 0x9e, 0x9d, 0x15, 0xe6, 0xa8, 0xf5, 0xce, 0x69, 0x74,
        0x53, 0xd3, 0xb1, 0x26, 0x77, 0xfa, 0x0e, 0x8f, 0xdd, 0x1f, 0x0e, 0x76, 0x51, 0x56, 0x85,
        0xb7,
    ];

    const TEST_RSA_N: &[u8] = &[
        0xb7, 0xe0, 0x0f, 0xc9, 0xdb, 0xfa, 0xce, 0x64, 0xa6, 0xe2, 0xb7, 0xfb, 0xa2, 0x1c, 0x09,
        0x14, 0xfb, 0xd6, 0x26, 0xe5, 0x17, 0xcc, 0xf6, 0x6b, 0xf5, 0x8e, 0xbb, 0x69, 0x07, 0x50,
        0xc0, 0xbb, 0x4c, 0xe7, 0x6e, 0xd8, 0xa4, 0x6a, 0x69, 0x29, 0xfc, 0xc9, 0x52, 0x0c, 0xdb,
        0x04, 0xec, 0xa2, 0xef, 0x27, 0x7d, 0x8f, 0xfa, 0x9d, 0xaa, 0x10, 0x59, 0x54, 0x7b, 0x42,
        0x78, 0xdb, 0xae, 0xd4, 0x24, 0x0a, 0xd4, 0x06, 0x69, 0xb0, 0xe2, 0xa5, 0x68, 0xca, 0x2d,
        0x41, 0x34, 0xb0, 0x64, 0xaf, 0x61, 0x13, 0xc9, 0x32, 0xfc, 0x93, 0x56, 0x4f, 0x82, 0x7b,
        0xea, 0xff, 0x20, 0xe5, 0x1c, 0x56, 0xb6, 0xe0, 0xf4, 0xaa, 0x6a, 0x20, 0xd2, 0x1c, 0x46,
        0x71, 0xe6, 0x05, 0x9a, 0x96, 0x99, 0xad, 0x5a, 0x6f, 0x78, 0xfd, 0xa7, 0x06, 0xf8, 0xfd,
        0x2d, 0xea, 0x91, 0xf2, 0x9e, 0xac, 0xc0, 0x43, 0x45, 0x2d, 0x79, 0xb0, 0xf2, 0x24, 0x5a,
        0x8c, 0x91, 0xe6, 0xc6, 0xc2, 0xfe, 0x50, 0x8d, 0x64, 0x82, 0x06, 0x77, 0x6e, 0xef, 0x7d,
        0x61, 0x6e, 0x80, 0xd1, 0x87, 0xfb, 0x25, 0x35, 0xc6, 0xe8, 0x3a, 0xec, 0x38, 0xce, 0x45,
        0x70, 0xf8, 0x56, 0xc7, 0x6e, 0xb7, 0x20, 0xdb, 0x72, 0x51, 0x82, 0xd0, 0xd2, 0xd2, 0xbd,
        0xc9, 0xe0, 0x3c, 0xef, 0xbb, 0x93, 0x70, 0xdd, 0xfb, 0xd4, 0xda, 0x6e, 0xf6, 0x73, 0xb3,
        0x79, 0xf7, 0xe8, 0x49, 0x72, 0x22, 0x44, 0x92, 0xd8, 0xe4, 0x3e, 0x04, 0xbc, 0x83, 0xb2,
        0x6c, 0x59, 0x4a, 0x79, 0x11, 0x1e, 0x33, 0xd6, 0x4b, 0xe6, 0x24, 0x7b, 0xdf, 0x93, 0x18,
        0x1d, 0xb3, 0x27, 0x0b, 0x73, 0xbb, 0xff, 0xa8, 0xe2, 0x13, 0xa0, 0x8f, 0x39, 0x2c, 0x21,
        0xc1, 0x5e, 0xf1, 0xa8, 0x82, 0x25, 0x28, 0x19, 0xae, 0xc9, 0x3f, 0x09, 0x2d, 0x8c, 0x81,
        0xa5,
    ];

    const TEST_RSA_E: &[u8] = &[0x01, 0x00, 0x01]; // 65537

    fn rsa_sign(message: &[u8]) -> Vec<u8> {
        use ring::rand::SystemRandom;
        use ring::rsa::KeyPair as RsaKeyPair;
        use ring::signature::RSA_PKCS1_SHA256;

        let rng = SystemRandom::new();
        let key_pair = RsaKeyPair::from_pkcs8(TEST_RSA_PKCS8_DER).expect("test setup");
        let mut sig = vec![0u8; key_pair.public().modulus_len()];
        key_pair
            .sign(&RSA_PKCS1_SHA256, &rng, message, &mut sig)
            .expect("test setup");
        sig
    }

    fn rsa_public_key_der() -> Vec<u8> {
        crate::der::rsa_components_to_der(TEST_RSA_N, TEST_RSA_E).expect("test setup")
    }

    #[test]
    fn verify_rs256_accepts_valid_signature() {
        let message = b"test message for RS256 verification";
        let sig = rsa_sign(message);
        let der = rsa_public_key_der();
        verify_rs256(&der, message, &sig).expect("valid RS256 signature should verify");
    }

    #[test]
    fn verify_rs256_rejects_tampered_signature() {
        let message = b"test message";
        let mut sig = rsa_sign(message);
        sig[10] ^= 0xFF;
        let der = rsa_public_key_der();
        let err = verify_rs256(&der, message, &sig).expect_err("expected error");
        assert!(matches!(err, WebAuthnError::SignatureVerificationFailed));
    }

    #[test]
    fn verify_rs256_rejects_wrong_message() {
        let sig = rsa_sign(b"message A");
        let der = rsa_public_key_der();
        let err = verify_rs256(&der, b"message B", &sig).expect_err("expected error");
        assert!(matches!(err, WebAuthnError::SignatureVerificationFailed));
    }

    #[test]
    fn verify_rs256_rejects_empty_public_key() {
        let err = verify_rs256(&[], b"msg", &[0u8; 256]).expect_err("expected error");
        assert!(matches!(err, WebAuthnError::SignatureVerificationFailed));
    }

    #[test]
    fn verify_rs256_rejects_garbage_signature() {
        let der = rsa_public_key_der();
        let err =
            verify_rs256(&der, b"hello", &[0xDE, 0xAD, 0xBE, 0xEF]).expect_err("expected error");
        assert!(matches!(err, WebAuthnError::SignatureVerificationFailed));
    }

    // ── helpers ──────────────────────────────────────────────────────────────

    fn hex_to_bytes(s: &str) -> Vec<u8> {
        (0..s.len())
            .step_by(2)
            .map(|i| u8::from_str_radix(&s[i..i + 2], 16).expect("test setup"))
            .collect()
    }
}