security-rs 0.2.4

Safe Rust bindings for Apple's Security framework — keychain, identity, certificates, trust, authorization, CMS, SecureTransport, and cryptographic primitives on macOS
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

mod common;

use security::{
    Certificate, EncryptionAlgorithm, KeyType, PrivateKey, PublicKey, SignatureAlgorithm,
};

#[test]
fn signs_verifies_encrypts_and_exports_private_keys() -> security::Result<()> {
    let imported = PrivateKey::import_item(
        &common::fixture("test-key.pem"),
        Some(".pem"),
        security::ExternalFormat::Unknown,
        security::ExternalItemType::PrivateKey,
    )?;
    assert!(imported.attributes()?.is_object());

    let raw_key = PrivateKey::from_data(
        &common::fixture("test-key-rsa.pkcs1.der"),
        KeyType::Rsa,
        2048,
    )?;
    assert_eq!(PrivateKey::type_id(), PublicKey::type_id());
    assert!(raw_key.attributes()?.is_object());
    assert_eq!(raw_key.block_size(), 256);
    assert!(!raw_key.external_representation()?.is_empty());

    let derived_public_key = raw_key.public_key()?;
    assert_eq!(derived_public_key.block_size(), 256);
    assert!(!derived_public_key.external_representation()?.is_empty());

    let ciphertext =
        derived_public_key.encrypt(EncryptionAlgorithm::RsaEncryptionOaepSha256, b"security-rs")?;
    let plaintext = raw_key.decrypt(EncryptionAlgorithm::RsaEncryptionOaepSha256, &ciphertext)?;
    assert_eq!(plaintext, b"security-rs");

    let signature = raw_key.sign(
        SignatureAlgorithm::RsaSignatureMessagePkcs1v15Sha256,
        b"security-rs",
    )?;

    let certificate = Certificate::from_pem(&common::fixture("test-cert.pem"))?;
    let public_key = certificate.public_key()?;
    assert_eq!(public_key.block_size(), 256);
    assert!(!public_key.external_representation()?.is_empty());
    assert!(public_key.verify_signature(
        SignatureAlgorithm::RsaSignatureMessagePkcs1v15Sha256,
        b"security-rs",
        &signature,
    )?);
    assert!(!public_key.verify_signature(
        SignatureAlgorithm::RsaSignatureMessagePkcs1v15Sha256,
        b"tampered",
        &signature,
    )?);
    Ok(())
}