xml-sec 0.1.20

Pure Rust XML Security: XMLDSig, XMLEnc, C14N. Drop-in replacement for libxmlsec1.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119

//! XML Digital Signatures (XMLDSig).
//!
//! Implements [XML Signature Syntax and Processing](https://www.w3.org/TR/xmldsig-core1/).
//!
//! ## Current Status
//!
//! - URI dereference: same-document references (`""`, `#id`, `#xpointer(/)`, `#xpointer(id('...'))`)
//! - ID attribute resolution with configurable attribute names
//! - Exact element, attribute, and namespace node sets for transform processing
//! - Enveloped, canonicalization, Base64, XPath 1.0, and XPath Filter 2.0 transforms
//!
//! ## Signing and verification
//!
//! Build an enveloped signature with a modern algorithm, then verify it with
//! the embedded certificate. Secure defaults require SHA-224 or stronger;
//! legacy SHA-1 methods require an explicit operation policy opt-in.
//!
//! ```no_run
//! use xml_sec::c14n::{C14nAlgorithm, C14nMode};
//! use xml_sec::xmldsig::{
//!     DefaultKeyResolver, DigestAlgorithm, ReferenceBuilder, RsaSigningKey,
//!     SignContext, SignatureAlgorithm, SignatureBuilder, Transform, VerifyContext,
//!     X509CertificateKeyInfoWriter,
//! };
//!
//! # fn example(private_key_pem: &str, certificate_pem: &str) -> Result<(), Box<dyn std::error::Error>> {
//! let c14n = C14nAlgorithm::new(C14nMode::Exclusive1_0, false);
//! let template = SignatureBuilder::new(c14n.clone(), SignatureAlgorithm::RsaSha256)
//!     .add_reference(
//!         ReferenceBuilder::new(DigestAlgorithm::Sha256)
//!             .uri("#message")
//!             .transform(Transform::Enveloped)
//!             .transform(Transform::C14n(c14n)),
//!     )
//!     .key_info(true)
//!     .build_template()?;
//! let xml = xml_sec::xmldsig::mutation::append_signature_to_root(
//!     "<Message ID=\"message\">hello</Message>",
//!     &template,
//! )?;
//! let signing_key = RsaSigningKey::from_pkcs8_pem(private_key_pem)?;
//! let key_info = X509CertificateKeyInfoWriter::from_pem(certificate_pem)?;
//! let signed = SignContext::new(&signing_key)
//!     .key_info_writer(&key_info)
//!     .sign_template(&xml)?;
//!
//! let resolver = DefaultKeyResolver::default();
//! let result = VerifyContext::new().key_resolver(&resolver).verify(&signed)?;
//! assert!(matches!(result.status, xml_sec::xmldsig::DsigStatus::Valid));
//! # Ok(())
//! # }
//! ```
#![doc = include_str!("../../docs/xmldsig.md")]

pub mod builder;
pub mod digest;
pub mod keys;
mod modern;
#[cfg(feature = "experimental-pq")]
pub(crate) mod post_quantum;
mod pq_algorithm;
#[cfg(feature = "experimental-pq")]
pub use post_quantum::PostQuantumSigningKey;
pub use pq_algorithm::PqAlgorithm;
pub mod mutation;
pub mod parse;
pub mod sign;
pub mod signature;
pub mod transforms;
pub mod trust;
pub mod types;
pub mod uri;
pub mod verify;
pub(crate) mod whitespace;
pub mod x509;
mod xpath;

pub use builder::{ReferenceBuilder, SignatureBuilder, SignatureBuilderError};
pub use digest::{DigestAlgorithm, compute_digest, compute_digest_with_provider, constant_time_eq};
pub use keys::{
    DefaultKeyResolver, HmacSha1VerificationKey, HmacVerificationKey, InspectedKeyCandidateBudget,
    KeyResolutionError, KeyResolverConfig, VerificationKey,
};
pub use modern::EdDsaSigningKey;
pub use parse::{
    KeyInfo, KeyInfoSource, KeyValueInfo, ParseError, Reference, RetrievalMethodTransforms,
    RsaPssParameters, SignatureAlgorithm, SignatureContext, SignedInfo, X509DataInfo,
    find_signature_node, parse_key_info, parse_reference, parse_signed_info,
    x509_certificate_matches_selectors,
};
pub use sign::{
    ComputedReferenceDigest, DerEncodedKeyValueInfoWriter, DsaSigningKey, EcdsaP256SigningKey,
    EcdsaP384SigningKey, EcdsaP521SigningKey, HmacSigningKey, KeyInfoWriteError, KeyInfoWriter,
    KeyValueInfoWriter, RsaSigningKey, SignContext, SignatureTemplateSelection, SigningDigestError,
    SigningError, SigningKey, SigningKeyError, SigningPublicKeyInfo, X509CertificateKeyInfoWriter,
    X509DigestKeyInfoWriter, compute_reference_digest_values, fill_reference_digest_values,
    validate_signing_key,
};
pub use signature::{
    SignatureVerificationError, verify_dsa_signature_spki, verify_ecdsa_signature_pem,
    verify_ecdsa_signature_pem_with_encoding, verify_ecdsa_signature_spki,
    verify_ecdsa_signature_spki_with_encoding, verify_rsa_signature_pem, verify_rsa_signature_spki,
};
pub use transforms::{
    BASE64_TRANSFORM_URI, DEFAULT_IMPLICIT_C14N_URI, ENVELOPED_SIGNATURE_URI, Transform,
    XPATH_FILTER2_TRANSFORM_URI, XPATH_TRANSFORM_URI, XPathExpression, XPathFilter,
    XPathFilterOperation, XPathHereSemantics, execute_transforms, parse_transforms,
};
pub use trust::{KeyTrustEvidence, ResolvedVerificationKey, TrustedPublicKey, X509TrustEvidence};
pub use types::{NodeSet, TransformData, TransformError};
pub use verify::{
    CallerTrustedSignatureKey, DsigError, DsigStatus, FailureReason, KeyResolver,
    ReferenceCoverage, ReferenceProcessingError, ReferenceResult, ReferenceSet, ReferencesResult,
    SignatureEvidence, SignatureRequirement, SignatureSelection, UriTypeSet, VerificationRequest,
    VerifyContext, VerifyEvidence, VerifyResult, VerifyingKey,
    materialize_signing_key_info_references, materialize_verification_key_info_references,
    process_all_references, process_reference, verify_signature_with_pem_key,
};
pub use x509::{X509ChainError, X509ChainOptions, verify_x509_certificate_chain};