Struct cryptographic_message_syntax::SignerInfo

pub struct SignerInfo { /* fields omitted */ }

Represents a CMS SignerInfo structure.

This is a high-level interface to the SignerInfo ASN.1 type. It supports performing common operations against that type.

Instances of this type are logically equivalent to a single signed assertion within a SignedData payload. There can be multiple signers per SignedData, which is why this type exists on its own.

Implementations

impl SignerInfo

pub fn certificate_issuer_and_serial(&self) -> Option<(&Name, &Integer)>

Obtain the signing X.509 certificate’s issuer name and its serial number.

The returned value can be used to locate the certificate so verification can be performed.

pub fn digest_algorithm(&self) -> DigestAlgorithm

Obtain the message digest algorithm used by this signer.

pub fn signature_algorithm(&self) -> SignatureAlgorithm

Obtain the cryptographic signing algorithm used by this signer.

pub fn signature(&self) -> &[u8]

Obtain the raw bytes constituting the cryptographic signature.

This is the signature that should be verified.

pub fn signed_attributes(&self) -> Option<&SignedAttributes>

Obtain the SignedAttributes attached to this instance.

pub fn unsigned_attributes(&self) -> Option<&UnsignedAttributes>

Obtain the UnsignedAttributes attached to this instance.

pub fn verify_signature_with_signed_data(
    &self,
    signed_data: &SignedData
) -> Result<(), CmsError>

Verifies the signature defined by this signer given a SignedData instance.

This function will perform cryptographic verification that the signature contained within this SignerInfo instance is valid for the content that was signed. The content that was signed is the encapsulated content from the SignedData instance (its .signed_data() value) combined with the SignedAttributes attached to this instance.

IMPORTANT SECURITY LIMITATIONS

This method only performs signature verification. It:

• DOES NOT verify the digest hash embedded within SignedAttributes (if present).
• DOES NOT validate the signing certificate in any way.
• DOES NOT validate that the cryptography used is appropriate.

See the crate’s documentation for more on the security implications.

pub fn verify_message_digest_with_signed_data(
    &self,
    signed_data: &SignedData
) -> Result<(), CmsError>

Verifies the digest stored in signed attributes matches that of content in a SignedData.

If signed attributes are present on this instance, they must contain a message-digest attribute defining the digest of data that was signed. The specification says this digested data should come from the encapsulated content within SignedData (SignedData.signed_content()).

Note that some utilities of CMS will not store a computed digest in message-digest that came from SignedData or is using the digest algorithm indicated by this SignerInfo. This is strictly in violation of the specification but it does occur.

IMPORTANT SECURITY LIMITATIONS

This method only performs message digest verification. It:

• DOES NOT verify the signature over the signed data or anything about the signer.
• DOES NOT validate that the digest algorithm is strong/appropriate.
• DOES NOT compare the digests in a manner that is immune to timing side-channels.

See the crate’s documentation for more on the security implications.

pub fn signature_verifier<'a, C>(
    &self,
    certs: C
) -> Result<UnparsedPublicKey<Vec<u8>>, CmsError> where
    C: Iterator<Item = &'a Certificate>, 

Obtain an entity for validating the signature described by this instance.

See signature_verifier_with_algorithm() for documentation.

This version calls into that with the signature algorithm used by this signer.

pub fn signature_verifier_with_algorithm<'a, C>(
    &self,
    certs: C,
    algorithm: &'static dyn VerificationAlgorithm
) -> Result<UnparsedPublicKey<Vec<u8>>, CmsError> where
    C: Iterator<Item = &'a Certificate>, 

Obtain an entity for validating the signature described by this instance.

This will attempt to locate the certificate used by this signing info structure in the passed iterable of certificates and then construct a signature verifier that can be used to verify content integrity.

The verification algorithm is controllable by the caller.

If the certificate referenced by this signing info could not be found, an error occurs.

pub fn signed_content_with_signed_data(
    &self,
    signed_data: &SignedData
) -> Vec<u8>

Obtain the raw bytes of content that was signed given a SignedData.

This joins the encapsulated content from SignedData with SignedAttributes on this instance to produce a new blob. This new blob is the message that is signed and whose signature is embedded in SignerInfo instances.

pub fn signed_content(&self, content: Option<&[u8]>) -> Vec<u8>

Obtain the raw bytes of content that were digested and signed.

The returned value is the message that was signed and whose signature of needs to be verified.

The optional content argument is the encapContentInfo eContent field, typically the value of SignedData.signed_content().

pub fn compute_digest_with_signed_data(
    &self,
    signed_data: &SignedData
) -> Digest

Compute a message digest using a SignedData instance.

This will obtain the encapsulated content blob from a SignedData and digest it using the algorithm configured on this instance.

The resulting digest is typically stored in the message-digest attribute of SignedData.

pub fn compute_digest(&self, content: Option<&[u8]>) -> Digest

Compute a message digest using the configured algorithm.

This method calls into compute_digest_with_algorithm() using the digest algorithm stored in this instance.

pub fn compute_digest_with_algorithm(
    &self,
    content: Option<&[u8]>,
    alg: DigestAlgorithm
) -> Digest

Compute a message digest using an explicit digest algorithm.

This will compute the hash/digest of the passed in content.

Trait Implementations

impl Clone for SignerInfo

fn clone(&self) -> SignerInfo

Returns a copy of the value.

pub fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SignerInfo

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl TryFrom<&'_ SignerInfo> for SignerInfo

type Error = CmsError

The type returned in the event of a conversion error.

fn try_from(signer_info: &SignerInfo) -> Result<Self, Self::Error>

Performs the conversion.