rpgpie 0.9.0

Experimental high level API for rPGP
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135

// SPDX-FileCopyrightText: Heiko Schaefer <heiko@schaefer.name>
// SPDX-License-Identifier: MIT OR Apache-2.0

use pgp::{
    composed::SignedPublicKey,
    crypto::ecc_curve::ECCCurve,
    packet::{PublicKey, Signature},
    types::{EcdsaPublicParams, EddsaLegacyPublicParams, PublicParams},
};

use crate::{
    certificate::Certificate,
    model::info::{print::print_cert_info, transform::cert_to_info},
    signature::{merge_unhashed, signature_bytes_eq},
};

/// Pick the signature with the newer creation time, if creation time differs
pub(crate) fn newer<'a>(a: &'a Signature, b: &'a Signature) -> &'a Signature {
    if a.created() > b.created() { a } else { b }
}

/// Produce a human-readable name for the public key algorithm in a PublicParams
pub(crate) fn algo_name(pp: &PublicParams) -> String {
    match pp {
        PublicParams::RSA(key) => {
            use rsa::traits::PublicKeyParts;
            format!("RSA({})", key.key.n().to_bytes_be().len() * 8)
        }
        PublicParams::DSA(key) => {
            format!("DSA({})", key.key.y().to_bytes_be().len() * 8)
        }
        PublicParams::Elgamal(_) => "Elgamal".to_string(),

        PublicParams::ECDH(params) => {
            format!("ECDH/{}", params.curve().name())
        }

        PublicParams::ECDSA(params) => {
            let curve = match params {
                EcdsaPublicParams::P256 { .. } => ECCCurve::P256,
                EcdsaPublicParams::P384 { .. } => ECCCurve::P384,
                EcdsaPublicParams::P521 { .. } => ECCCurve::P521,
                EcdsaPublicParams::Secp256k1 { .. } => ECCCurve::Secp256k1,
                EcdsaPublicParams::Unsupported { curve, .. } => curve.clone(),
            };

            format!("ECDSA/{}", curve.name())
        }

        PublicParams::EdDSALegacy(EddsaLegacyPublicParams::Ed25519 { .. }) => {
            "EdDSA/Curve25519".to_string()
        }

        PublicParams::Ed25519(_) => "Ed25519".to_string(),
        PublicParams::X25519(_) => "X25519".to_string(),
        PublicParams::Ed448(_) => "Ed448".to_string(),
        PublicParams::X448(_) => "X448".to_string(),

        #[cfg(feature = "draft-pqc")]
        PublicParams::MlKem768X25519(_) => "ML-KEM-768+X25519".to_string(),
        #[cfg(feature = "draft-pqc")]
        PublicParams::MlKem1024X448(_) => "ML-KEM-1024+X448".to_string(),
        #[cfg(feature = "draft-pqc")]
        PublicParams::MlDsa65Ed25519(_) => "ML-DSA-65+Ed25519".to_string(),
        #[cfg(feature = "draft-pqc")]
        PublicParams::MlDsa87Ed448(_) => "ML-DSA-87+Ed448".to_string(),
        #[cfg(feature = "draft-pqc")]
        PublicParams::SlhDsaShake128s(_) => "SLH-DSA-SHAKE-128s".to_string(),
        #[cfg(feature = "draft-pqc")]
        PublicParams::SlhDsaShake128f(_) => "SLH-DSA-SHAKE-128f".to_string(),
        #[cfg(feature = "draft-pqc")]
        PublicParams::SlhDsaShake256s(_) => "SLH-DSA-SHAKE-256s".to_string(),

        _ => format!("{pp:?}"),
    }
}

/// Print human-readable information about a Certificate
///
/// FIXME: This will probably not remain in the public API in this form.
pub fn print_cert(cert: &Certificate, verbose: bool, ordered: bool) {
    let ci = cert_to_info(cert, ordered);
    print_cert_info(&ci, verbose, ordered);
}

/// Check if `sig` is a valid direct/revocation signature over `public`
pub(crate) fn verify_signature(sig: &Signature, public: &PublicKey) -> bool {
    sig.verify_key(public).is_ok()
}

/// Flatten duplicates in a set of signatures:
/// Remove duplicate instances of the same signature, but merge
/// unhashed subpackets into the unified signature.
fn dedup(sigs: &mut Vec<Signature>) {
    /// Returns the pos of a signature that can be removed as a duplicate.
    /// None, if no duplicate is found.
    fn dedup_inner(sigs: &mut [Signature]) -> Option<usize> {
        for pos in 0..sigs.len() {
            for check in pos + 1..sigs.len() {
                if signature_bytes_eq(&sigs[pos], &sigs[check]) {
                    // merge unhashed packets from check into pos
                    let chk = sigs[check].clone();
                    merge_unhashed(&mut sigs[pos], &chk);

                    return Some(check);
                }
            }
        }
        None
    }

    while let Some(pos) = dedup_inner(sigs) {
        sigs.remove(pos);
    }
}

/// Drop/unify duplicate signatures
pub fn canonicalize(spk: &mut SignedPublicKey) {
    // - drop duplicate signatures
    dedup(&mut spk.details.revocation_signatures);
    dedup(&mut spk.details.direct_signatures);
    for sk in &mut spk.public_subkeys {
        dedup(&mut sk.signatures);
    }
    for user in &mut spk.details.users {
        dedup(&mut user.signatures);
    }
    for ua in &mut spk.details.user_attributes {
        dedup(&mut ua.signatures);
    }

    // TODO?
    // - check that non-revocation signatures satisfy our policy?
    // - verify self-signatures?
}