synta-certificate 0.2.6

//! Signature verification and certificate signing backed by OpenSSL.

use synta::{Decoder, Encoding};

use crate::crypto::{CertificateSigner, SignatureVerifier};
use crate::oids;
use crate::pkcs1_types::RsassaPssParams;

use crate::crypto::utils::split_alg_id;

use native_ossl::digest::DigestAlg;
use native_ossl::params::ParamBuilder;
#[cfg(all(ossl320, feature = "pqc", ossl_mldsa))]
use native_ossl::pkey::{MessageSigner, MessageVerifier, SigAlg};
use native_ossl::pkey::{Pkey, Private, Public, SignInit, Signer, Verifier};

// ML-DSA signature sizes (FIPS 204, fixed and deterministic).
#[cfg(all(feature = "pqc", ossl_mldsa))]
const ML_DSA_44_SIG_LEN: usize = 2420;
#[cfg(all(feature = "pqc", ossl_mldsa))]
const ML_DSA_65_SIG_LEN: usize = 3309;
#[cfg(all(feature = "pqc", ossl_mldsa))]
const ML_DSA_87_SIG_LEN: usize = 4627;

/// Error type for [`OpensslSignatureVerifier`].
#[derive(Debug)]
pub struct OpensslVerifierError(pub(crate) String);

impl std::fmt::Display for OpensslVerifierError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(&self.0)
    }
}

impl std::error::Error for OpensslVerifierError {}

impl From<native_ossl::error::ErrorStack> for OpensslVerifierError {
    fn from(e: native_ossl::error::ErrorStack) -> Self {
        OpensslVerifierError(e.to_string())
    }
}

/// OpenSSL-backed certificate signature verifier.
///
/// Implements [`SignatureVerifier`] for use with the `synta-x509-verification`
/// path validator.  Supports RSA PKCS#1 v1.5, RSA-PSS, ECDSA, Ed25519, and
/// Ed448.
///
/// # Example
///
/// ```rust,ignore
/// use synta_certificate::OpensslSignatureVerifier;
/// use synta_x509_verification::policy::PolicyDefinition;
///
/// let policy = PolicyDefinition::new_server(
///     OpensslSignatureVerifier,
///     Some(subject),
///     validation_time,
/// );
/// ```
pub struct OpensslSignatureVerifier;

/// Map a signature algorithm OID to its pre-hash `DigestAlg`.
///
/// Returns `None` for EdDSA and RSA-PSS (handled separately) and for
/// unknown OIDs.
fn sig_alg_to_digest(oid: &[u32]) -> Option<DigestAlg> {
    if oid == oids::SHA256_WITH_RSA || oid == oids::ECDSA_WITH_SHA256 {
        super::alg_cache::sha256()
    } else if oid == oids::SHA384_WITH_RSA || oid == oids::ECDSA_WITH_SHA384 {
        super::alg_cache::sha384()
    } else if oid == oids::SHA512_WITH_RSA || oid == oids::ECDSA_WITH_SHA512 {
        super::alg_cache::sha512()
    } else if oid == oids::SHA1_WITH_RSA || oid == oids::ECDSA_WITH_SHA1 {
        super::alg_cache::sha1()
    } else {
        None
    }
}

/// Map a hash algorithm OID to its OpenSSL EVP canonical name.
fn hash_oid_to_digest_name(oid: &[u32]) -> Option<&'static std::ffi::CStr> {
    if oid == oids::ID_SHA1 {
        Some(c"SHA1")
    } else if oid == oids::ID_SHA256 {
        Some(c"SHA2-256")
    } else if oid == oids::ID_SHA384 {
        Some(c"SHA2-384")
    } else if oid == oids::ID_SHA512 {
        Some(c"SHA2-512")
    } else {
        None
    }
}

/// Map a hash algorithm OID (as used in PSS/OAEP parameters) to its digest.
pub(super) fn hash_alg_to_digest(oid: &[u32]) -> Option<DigestAlg> {
    hash_oid_to_digest_name(oid).and_then(super::alg_cache::digest_by_name)
}

/// Verify an RSA-PSS signature, parsing hash algorithm and salt length from
/// the `RSASSA-PSS-params` SEQUENCE in `params_der`.
fn verify_rsa_pss_sig(
    pkey: &Pkey<Public>,
    params_der: &[u8],
    tbs_der: &[u8],
    signature: &[u8],
) -> Result<(), OpensslVerifierError> {
    // RFC 8017 defaults: SHA-256, salt = 32 bytes.
    let (hash_digest, hash_name, salt_len) = if !params_der.is_empty() {
        let mut dec = Decoder::new(params_der, Encoding::Der);
        match dec.decode::<RsassaPssParams>() {
            Ok(pss) => {
                let hash_oid = pss
                    .hash_algorithm
                    .as_ref()
                    .map(|h| h.algorithm.components().to_vec())
                    .unwrap_or_else(|| oids::ID_SHA1.to_vec());
                let salt = pss
                    .salt_length
                    .as_ref()
                    .and_then(|i| i.as_i64().ok())
                    .unwrap_or(20) as i32;
                let name = hash_oid_to_digest_name(&hash_oid).ok_or_else(|| {
                    OpensslVerifierError(format!("unsupported RSA-PSS hash OID: {:?}", hash_oid))
                })?;
                let d = super::alg_cache::digest_by_name(name).ok_or_else(|| {
                    OpensslVerifierError(format!("unsupported RSA-PSS hash: {name:?}"))
                })?;
                (d, name, salt)
            }
            Err(e) => {
                return Err(OpensslVerifierError(format!(
                    "failed to decode RSA-PSS parameters: {e:?}"
                )))
            }
        }
    } else {
        let d = super::alg_cache::sha256()
            .ok_or_else(|| OpensslVerifierError("SHA2-256 not available".to_string()))?;
        (d, c"SHA2-256", 32i32)
    };

    let pss_params = ParamBuilder::new()?
        .push_utf8_string(c"pad-mode", c"pss")?
        .push_utf8_string(c"mgf1-digest", hash_name)?
        .push_int(c"saltlen", salt_len)?
        .build()?;

    let init = SignInit {
        digest: Some(&hash_digest),
        params: Some(&pss_params),
    };
    let mut ver = Verifier::new(pkey, &init)?;
    ver.update(tbs_der)?;
    if ver.verify(signature)? {
        Ok(())
    } else {
        Err(OpensslVerifierError(
            "RSA-PSS signature invalid".to_string(),
        ))
    }
}

/// Core verification logic — operates on an already-parsed `EVP_PKEY`.
///
/// Extracted so that callers holding a cached [`Pkey<Public>`] (e.g. from
/// [`crate::crypto::BackendPublicKey`]) can skip the `d2i_PUBKEY` DER parse
/// that [`do_verify_signature`] would otherwise perform on every call.
pub(crate) fn verify_with_cached_pkey(
    pkey: &Pkey<Public>,
    tbs_der: &[u8],
    sig_alg_der: &[u8],
    signature_bits: &[u8],
) -> Result<(), OpensslVerifierError> {
    let (oid, _, params_der) = split_alg_id(sig_alg_der, |e| OpensslVerifierError(e.to_string()))?;
    let oid_comps = oid.components();

    // EdDSA: no pre-hash.  OpenSSL 3.x requires the one-shot verify API for
    // Ed25519 and Ed448; calling EVP_DigestVerifyUpdate is not supported.
    if oid_comps == oids::ED25519 || oid_comps == oids::ED448 {
        let mut ver = Verifier::new(pkey, &SignInit::default())?;
        return if ver.verify_oneshot(tbs_der, signature_bits)? {
            Ok(())
        } else {
            Err(OpensslVerifierError("EdDSA signature invalid".to_string()))
        };
    }

    // ML-DSA: pure lattice signature (FIPS 204); no pre-hash, one-shot.
    #[cfg(feature = "pqc")]
    {
        #[cfg(all(ossl_mldsa, ossl320))]
        {
            let alg_name: Option<&std::ffi::CStr> =
                if oid_comps == oids::ML_DSA_44 && pkey.is_a(c"ML-DSA-44") {
                    Some(c"ML-DSA-44")
                } else if oid_comps == oids::ML_DSA_65 && pkey.is_a(c"ML-DSA-65") {
                    Some(c"ML-DSA-65")
                } else if oid_comps == oids::ML_DSA_87 && pkey.is_a(c"ML-DSA-87") {
                    Some(c"ML-DSA-87")
                } else {
                    None
                };
            if let Some(name) = alg_name {
                let mut alg = SigAlg::fetch(name, None)?;
                let mut ver = MessageVerifier::new(pkey, &mut alg, None)?;
                return if ver.verify(tbs_der, signature_bits)? {
                    Ok(())
                } else {
                    Err(OpensslVerifierError("ML-DSA signature invalid".to_string()))
                };
            }
        }
    }

    // RSA-PSS: hash and salt from AlgorithmIdentifier parameters.
    if oid_comps == oids::RSASSA_PSS {
        return verify_rsa_pss_sig(pkey, params_der, tbs_der, signature_bits);
    }

    let digest = sig_alg_to_digest(oid_comps).ok_or_else(|| {
        OpensslVerifierError(format!(
            "unsupported signature algorithm OID: {:?}",
            oid_comps
        ))
    })?;

    let init = SignInit {
        digest: Some(&digest),
        params: None,
    };
    let mut ver = Verifier::new(pkey, &init)?;
    ver.update(tbs_der)?;
    if ver.verify(signature_bits)? {
        Ok(())
    } else {
        Err(OpensslVerifierError("signature invalid".to_string()))
    }
}

fn do_verify_signature(
    tbs_der: &[u8],
    sig_alg_der: &[u8],
    signature_bits: &[u8],
    issuer_spki_der: &[u8],
) -> Result<(), OpensslVerifierError> {
    // Detect composite ML-DSA OIDs before attempting to parse the composite SPKI,
    // because OpenSSL's EVP_PKEY cannot represent composite public keys.
    {
        let (sig_oid, _, _) = split_alg_id(sig_alg_der, |e| OpensslVerifierError(e.to_string()))?;
        let comps = sig_oid.components();
        if comps.starts_with(crate::oids::COMPOSITE_MLDSA_ARC) && comps.len() == 9 {
            let sub_arc = comps[8];
            return super::composite::verify_composite_mldsa_signature(
                tbs_der,
                sub_arc,
                signature_bits,
                issuer_spki_der,
            );
        }
    }
    let pkey = Pkey::<Public>::from_der(issuer_spki_der)?;
    verify_with_cached_pkey(&pkey, tbs_der, sig_alg_der, signature_bits)
}

impl SignatureVerifier for OpensslSignatureVerifier {
    type Error = OpensslVerifierError;

    fn verify_certificate_signature(
        &self,
        tbs_der: &[u8],
        sig_alg_der: &[u8],
        signature_bits: &[u8],
        issuer_spki_der: &[u8],
    ) -> Result<(), OpensslVerifierError> {
        do_verify_signature(tbs_der, sig_alg_der, signature_bits, issuer_spki_der)
    }
}

// ── OpensslCertificateSigner ──────────────────────────────────────────────────

/// Error type for [`OpensslCertificateSigner`].
#[derive(Debug)]
pub struct OpensslCertificateSignerError(pub(super) String);

impl std::fmt::Display for OpensslCertificateSignerError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(&self.0)
    }
}

impl std::error::Error for OpensslCertificateSignerError {}

impl From<native_ossl::error::ErrorStack> for OpensslCertificateSignerError {
    fn from(e: native_ossl::error::ErrorStack) -> Self {
        OpensslCertificateSignerError(e.to_string())
    }
}

/// OpenSSL-backed [`CertificateSigner`] for use with [`crate::CertificateBuilder`].
///
/// Supports RSA (PKCS#1 v1.5), ECDSA, Ed25519, Ed448, and ML-DSA private keys.
/// For RSA and ECDSA the `algorithm` string selects the hash:
/// `"sha1"`, `"sha256"`, `"sha384"`, or `"sha512"`.
/// For Ed25519, Ed448, and ML-DSA the `algorithm` argument is ignored (no pre-hash).
///
/// ## ML-DSA signing paths
///
/// When the key is an ML-DSA key, `sign_tbs` chooses between two paths:
///
/// - **Fast path** (no context string): a single `EVP_DigestSign` call via
///   [`Signer::sign_into`](native_ossl::pkey::Signer) into a pre-allocated
///   FIPS 204 fixed-size buffer.
/// - **Context-string path** (when [`with_context`](Self::with_context) is set):
///   `EVP_PKEY_sign_message_init` + `sign_oneshot` via
///   [`MessageSigner`].  Slightly slower but
///   required when FIPS 204 §5.2 domain separation is needed.
///
/// Note: `EVP_PKEY_sign_init` (`RawSigner`) is **not** supported for ML-DSA in
/// OpenSSL 3.x; only `sign_message_init` works.
///
/// # Example
///
/// ```rust,ignore
/// use synta_certificate::{CertificateBuilder, OpensslCertificateSigner};
///
/// let cert_der = CertificateBuilder::new()
///     .issuer_name(&issuer_der)
///     /* … other fields … */
///     .sign(&OpensslCertificateSigner::new(&ca_key, "sha256"))?;
/// ```
pub struct OpensslCertificateSigner<'a> {
    pub(super) key: &'a Pkey<Private>,
    pub(super) algorithm: &'a str,
    /// Optional ML-DSA context string (FIPS 204 §5.2 domain separation).
    /// Ignored for non-ML-DSA keys.
    pub(super) context_string: Option<&'a [u8]>,
}

impl<'a> OpensslCertificateSigner<'a> {
    /// Create a new signer from a native-ossl private key and a hash algorithm name.
    ///
    /// `algorithm` is one of `"sha1"`, `"sha256"`, `"sha384"`, `"sha512"` for
    /// RSA and ECDSA keys.  For Ed25519 / Ed448 keys the value is not used
    /// but must still be provided (use `""` or any string).  For ML-DSA keys
    /// the value is ignored; use [`with_context`](Self::with_context) to supply
    /// a FIPS 204 context string.
    pub fn new(key: &'a Pkey<Private>, algorithm: &'a str) -> Self {
        Self {
            key,
            algorithm,
            context_string: None,
        }
    }

    /// Attach an ML-DSA context string (FIPS 204 §5.2 domain separation).
    ///
    /// The context string is passed as `OSSL_SIGNATURE_PARAM_CONTEXT_STRING`
    /// to `EVP_PKEY_sign_message_init`.  Maximum length is 255 bytes.
    /// Has no effect for non-ML-DSA keys.
    #[must_use]
    pub fn with_context(mut self, ctx: &'a [u8]) -> Self {
        self.context_string = Some(ctx);
        self
    }
}

impl<'a> CertificateSigner for OpensslCertificateSigner<'a> {
    type Error = OpensslCertificateSignerError;

    fn signature_algorithm_der(&self) -> Result<Vec<u8>, OpensslCertificateSignerError> {
        use crate::{oids, AlgorithmIdentifier};
        use synta::{Element, Null, ObjectIdentifier};

        // ML-DSA: detect variant by key type; AlgorithmIdentifier has only the OID (no params).
        #[cfg(feature = "pqc")]
        {
            #[cfg(ossl_mldsa)]
            {
                let ml_oid: Option<&[u32]> = if self.key.is_a(c"ML-DSA-44") {
                    Some(oids::ML_DSA_44)
                } else if self.key.is_a(c"ML-DSA-65") {
                    Some(oids::ML_DSA_65)
                } else if self.key.is_a(c"ML-DSA-87") {
                    Some(oids::ML_DSA_87)
                } else {
                    None
                };
                if let Some(oid_comps) = ml_oid {
                    let sig_oid = ObjectIdentifier::new(oid_comps)
                        .map_err(|e| OpensslCertificateSignerError(e.to_string()))?;
                    let sig_alg = AlgorithmIdentifier {
                        algorithm: sig_oid,
                        parameters: None,
                    };
                    return sig_alg
                        .to_der()
                        .map_err(|e| OpensslCertificateSignerError(e.to_string()));
                }
            }
        }

        let (sig_oid_comps, null_params): (&[u32], bool) = if self.key.is_a(c"RSA") {
            let comps = match self.algorithm {
                "sha1" => oids::SHA1_WITH_RSA,
                "sha256" => oids::SHA256_WITH_RSA,
                "sha384" => oids::SHA384_WITH_RSA,
                "sha512" => oids::SHA512_WITH_RSA,
                other => {
                    return Err(OpensslCertificateSignerError(format!(
                        "unsupported hash for RSA signing: {other}; \
                         expected sha1, sha256, sha384, or sha512"
                    )))
                }
            };
            (comps, true)
        } else if self.key.is_a(c"EC") {
            let comps = match self.algorithm {
                "sha1" => oids::ECDSA_WITH_SHA1,
                "sha256" => oids::ECDSA_WITH_SHA256,
                "sha384" => oids::ECDSA_WITH_SHA384,
                "sha512" => oids::ECDSA_WITH_SHA512,
                other => {
                    return Err(OpensslCertificateSignerError(format!(
                        "unsupported hash for EC signing: {other}; \
                         expected sha1, sha256, sha384, or sha512"
                    )))
                }
            };
            (comps, false)
        } else if self.key.is_a(c"ED25519") {
            (oids::ED25519, false)
        } else if self.key.is_a(c"ED448") {
            (oids::ED448, false)
        } else {
            return Err(OpensslCertificateSignerError(
                "unsupported key type; expected RSA, EC, Ed25519, Ed448, or ML-DSA".to_string(),
            ));
        };

        let sig_oid = ObjectIdentifier::new(sig_oid_comps)
            .map_err(|e| OpensslCertificateSignerError(e.to_string()))?;
        let sig_alg = AlgorithmIdentifier {
            algorithm: sig_oid,
            parameters: if null_params {
                Some(Element::Null(Null))
            } else {
                None
            },
        };

        sig_alg
            .to_der()
            .map_err(|e| OpensslCertificateSignerError(e.to_string()))
    }

    fn sign_tbs(&self, tbs_der: &[u8]) -> Result<Vec<u8>, OpensslCertificateSignerError> {
        // ML-DSA: pure lattice signature (FIPS 204, no pre-hash).
        // Fast path (no context string): single EVP_DigestSign call via
        // Signer::sign_into into a FIPS 204 fixed-size pre-allocated buffer.
        // Context-string path: EVP_PKEY_sign_message_init + sign_oneshot via
        // MessageSigner (EVP_PKEY_sign_init is not supported for ML-DSA).
        #[cfg(feature = "pqc")]
        {
            #[cfg(ossl_mldsa)]
            {
                let ml_dsa_sig_len: Option<usize> = if self.key.is_a(c"ML-DSA-44") {
                    Some(ML_DSA_44_SIG_LEN)
                } else if self.key.is_a(c"ML-DSA-65") {
                    Some(ML_DSA_65_SIG_LEN)
                } else if self.key.is_a(c"ML-DSA-87") {
                    Some(ML_DSA_87_SIG_LEN)
                } else {
                    None
                };
                if let Some(sig_len) = ml_dsa_sig_len {
                    #[cfg(ossl320)]
                    if let Some(ctx) = self.context_string {
                        let alg_name = if self.key.is_a(c"ML-DSA-44") {
                            c"ML-DSA-44"
                        } else if self.key.is_a(c"ML-DSA-65") {
                            c"ML-DSA-65"
                        } else {
                            c"ML-DSA-87"
                        };
                        let ctx_params = ParamBuilder::new()?
                            .push_octet_slice(c"context-string", ctx)?
                            .build()?;
                        let mut alg = SigAlg::fetch(alg_name, None)?;
                        let signer = MessageSigner::new(self.key, &mut alg, Some(&ctx_params))?;
                        let mut sig = vec![0u8; sig_len];
                        let written = signer.sign_oneshot(tbs_der, &mut sig)?;
                        sig.truncate(written);
                        return Ok(sig);
                    }
                    let mut signer = Signer::new(self.key, &SignInit::default())?;
                    let mut sig = vec![0u8; sig_len];
                    let written = signer.sign_into(tbs_der, &mut sig)?;
                    sig.truncate(written);
                    return Ok(sig);
                }
            }
        }

        // Ed25519 and Ed448: one-shot (no pre-hash).
        if self.key.is_a(c"ED25519") || self.key.is_a(c"ED448") {
            let mut signer = Signer::new(self.key, &SignInit::default())?;
            return Ok(signer.sign_oneshot(tbs_der)?);
        }

        // RSA / ECDSA: hash then sign.
        let md = super::alg_cache::digest_by_str(self.algorithm).ok_or_else(|| {
            OpensslCertificateSignerError(format!("unsupported hash algorithm: {}", self.algorithm))
        })?;
        let init = SignInit {
            digest: Some(&md),
            params: None,
        };
        let mut signer = Signer::new(self.key, &init)?;
        signer.update(tbs_der)?;
        Ok(signer.finish()?)
    }
}