cose-key 0.2.0

CoseKey [RFC 8152]
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124

use crate::{CoseKey, CoseKeyError};
use ciborium::Value;
use coset::iana::EnumI64;
use coset::{Algorithm, KeyType, Label, iana};

impl CoseKey {
    pub fn from_public_key_pem<
        K: pkcs8::DecodePublicKey + TryInto<Self, Error = E>,
        E: Into<CoseKeyError>,
    >(
        s: &str,
    ) -> Result<Self, CoseKeyError> {
        K::from_public_key_pem(s)?.try_into().map_err(Into::into)
    }
}

impl pkcs8::EncodePublicKey for CoseKey {
    fn to_public_key_der(&self) -> pkcs8::spki::Result<pkcs8::Document> {
        let coset::CoseKey {
            alg: Some(alg),
            params,
            kty,
            ..
        } = &self.0
        else {
            return Err(pkcs8::spki::Error::AlgorithmParametersMissing);
        };

        let crv = |params: &[(Label, Value)], label: i64, expected: iana::EllipticCurve| {
            params
                .iter()
                .find_map(|(k, v)| (k == &Label::Int(label)).then_some(v))
                .map(|v| matches!(v, Value::Integer(crv) if crv == &expected.to_i64().into()))
                .unwrap_or_default()
        };

        match (kty, alg, params) {
            #[cfg(feature = "ed25519")]
            (
                KeyType::Assigned(iana::KeyType::OKP),
                Algorithm::Assigned(iana::Algorithm::EdDSA),
                p,
            ) if crv(
                p,
                iana::OkpKeyParameter::Crv.to_i64(),
                iana::EllipticCurve::Ed25519,
            ) =>
            {
                ed25519_dalek::VerifyingKey::try_from(self)
                    .map_err(|_| pkcs8::spki::Error::KeyMalformed)?
                    .to_public_key_der()
            }
            #[cfg(feature = "p256")]
            (
                KeyType::Assigned(iana::KeyType::EC2),
                Algorithm::Assigned(iana::Algorithm::ES256),
                p,
            ) if crv(
                p,
                iana::OkpKeyParameter::Crv.to_i64(),
                iana::EllipticCurve::P_256,
            ) =>
            {
                p256::ecdsa::VerifyingKey::try_from(self)
                    .map_err(|_| pkcs8::spki::Error::KeyMalformed)?
                    .to_public_key_der()
            }
            #[cfg(feature = "p384")]
            (
                KeyType::Assigned(iana::KeyType::EC2),
                Algorithm::Assigned(iana::Algorithm::ES384),
                p,
            ) if crv(
                p,
                iana::OkpKeyParameter::Crv.to_i64(),
                iana::EllipticCurve::P_384,
            ) =>
            {
                p384::ecdsa::VerifyingKey::try_from(self)
                    .map_err(|_| pkcs8::spki::Error::KeyMalformed)?
                    .to_public_key_der()
            }
            _ => Err(pkcs8::spki::Error::KeyMalformed),
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use pkcs8::{EncodePublicKey, LineEnding::LF};

    #[test]
    fn from_public_key_pem_should_succeed() {
        // Ed25519
        let vk = ed25519_dalek::SigningKey::generate(&mut rand::thread_rng()).verifying_key();
        let ck = CoseKey::from(&vk);

        let pem = vk.to_public_key_pem(LF).unwrap();
        let ck_pem = CoseKey::from_public_key_pem::<ed25519_dalek::VerifyingKey, _>(&pem).unwrap();
        assert_eq!(ck, ck_pem);
        assert_eq!(ck_pem.to_public_key_pem(LF).unwrap(), pem);

        // P256
        let sk = p256::ecdsa::SigningKey::random(&mut rand::thread_rng());
        let vk = sk.as_ref();
        let ck = CoseKey::try_from(vk).unwrap();

        let pem = vk.to_public_key_pem(LF).unwrap();
        let ck_pem = CoseKey::from_public_key_pem::<p256::ecdsa::VerifyingKey, _>(&pem).unwrap();
        assert_eq!(ck, ck_pem);
        assert_eq!(ck_pem.to_public_key_pem(LF).unwrap(), pem);

        // P384
        let sk = p384::ecdsa::SigningKey::random(&mut rand::thread_rng());
        let vk = sk.as_ref();
        let ck = CoseKey::try_from(vk).unwrap();

        let pem = vk.to_public_key_pem(LF).unwrap();
        let ck_pem = CoseKey::from_public_key_pem::<p384::ecdsa::VerifyingKey, _>(&pem).unwrap();
        assert_eq!(ck, ck_pem);
        assert_eq!(ck_pem.to_public_key_pem(LF).unwrap(), pem);
    }
}