xml-sec 0.2.0

Pure Rust XML Security: XMLDSig, XMLEnc, C14N. Drop-in replacement for libxmlsec1.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135

//! XML Digital Signatures (XMLDSig).
//!
//! Implements [XML Signature Syntax and Processing](https://www.w3.org/TR/xmldsig-core1/).
//!
//! ## Current Status
//!
//! - URI dereference: same-document references (`""`, `#id`, `#xpointer(/)`, `#xpointer(id('...'))`)
//! - ID attribute resolution with configurable attribute names
//! - Exact element, attribute, and namespace node sets for transform processing
//! - Enveloped, canonicalization, Base64, XPath 1.0, and XPath Filter 2.0 transforms
//!
//! ## Signing and verification
//!
//! Build an enveloped signature with a modern algorithm, then verify it with
//! the embedded certificate. Secure defaults require SHA-224 or stronger;
//! legacy SHA-1 methods require an explicit operation policy opt-in.
//!
//! ```no_run
//! use xml_sec::c14n::{C14nAlgorithm, C14nMode};
//! use xml_sec::xmldsig::{
//!     DefaultKeyResolver, DigestAlgorithm, ReferenceBuilder, RsaSigningKey,
//!     SignContext, SignatureAlgorithm, SignatureBuilder, Transform, VerifyContext,
//!     X509CertificateKeyInfoWriter,
//! };
//!
//! # fn example(private_key_pem: &str, certificate_pem: &str) -> Result<(), Box<dyn std::error::Error>> {
//! let c14n = C14nAlgorithm::new(C14nMode::Exclusive1_0, false);
//! let template = SignatureBuilder::new(c14n.clone(), SignatureAlgorithm::RsaSha256)
//!     .add_reference(
//!         ReferenceBuilder::new(DigestAlgorithm::Sha256)
//!             .uri("#message")
//!             .transform(Transform::Enveloped)
//!             .transform(Transform::C14n(c14n)),
//!     )
//!     .key_info(true)
//!     .build_template()?;
//! let xml = xml_sec::xmldsig::mutation::append_signature_to_root(
//!     "<Message ID=\"message\">hello</Message>",
//!     &template,
//! )?;
//! let signing_key = RsaSigningKey::from_pkcs8_pem(private_key_pem)?;
//! let key_info = X509CertificateKeyInfoWriter::from_pem(certificate_pem)?;
//! let signed = SignContext::new(&signing_key)
//!     .key_info_writer(&key_info)
//!     .sign_template(&xml)?;
//!
//! let resolver = DefaultKeyResolver::default();
//! let result = VerifyContext::new().key_resolver(&resolver).verify(&signed)?;
//! assert!(matches!(result.status, xml_sec::xmldsig::DsigStatus::Valid));
//! # Ok(())
//! # }
//! ```
#![doc = include_str!("../../docs/xmldsig.md")]

pub mod builder;
pub mod digest;
pub mod extension;
pub mod keys;
mod modern;
#[cfg(feature = "experimental-pq")]
pub(crate) mod post_quantum;
mod pq_algorithm;
#[cfg(feature = "experimental-pq")]
pub use post_quantum::PostQuantumSigningKey;
pub use pq_algorithm::PqAlgorithm;
pub mod mutation;
pub mod parse;
pub(crate) mod pkix;
pub mod sign;
pub mod signature;
pub mod transforms;
pub mod trust;
pub mod types;
pub mod uri;
pub mod verify;
pub(crate) mod whitespace;
pub mod x509;
mod xpath;

pub use builder::{ReferenceBuilder, SignatureBuilder, SignatureBuilderError};
pub use digest::{DigestAlgorithm, compute_digest, compute_digest_with_provider, constant_time_eq};
pub use keys::{
    DefaultKeyResolver, HmacSha1VerificationKey, HmacVerificationKey, InspectedKeyCandidateBudget,
    KeyResolutionError, KeyResolverConfig, VerificationKey,
};
pub use modern::EdDsaSigningKey;
pub use parse::{
    KeyInfo, KeyInfoSource, KeyValueInfo, ParseError, Reference, RetrievalMethodTransforms,
    RsaPssParameters, SignatureAlgorithm, SignatureContext, SignedInfo, X509DataInfo,
    find_signature_node, parse_key_info, parse_reference, parse_signed_info,
    x509_certificate_matches_selectors,
};
pub use pkix::CertificatePathVerifier;
pub use sign::{
    ComputedReferenceDigest, DerEncodedKeyValueInfoWriter, DsaSigningKey, EcdsaP256SigningKey,
    EcdsaP384SigningKey, EcdsaP521SigningKey, HmacSigningKey, KeyInfoWriteError, KeyInfoWriter,
    KeyValueInfoWriter, RsaSigningKey, SignContext, SignatureTemplateSelection, SigningDigestError,
    SigningError, SigningKey, SigningKeyError, SigningPublicKeyInfo, X509CertificateKeyInfoWriter,
    X509DigestKeyInfoWriter, compute_reference_digest_values, fill_reference_digest_values,
    validate_signing_key,
};
pub use signature::{
    SignatureVerificationError, verify_dsa_signature_spki, verify_ecdsa_signature_pem,
    verify_ecdsa_signature_pem_with_encoding, verify_ecdsa_signature_spki,
    verify_ecdsa_signature_spki_with_encoding, verify_rsa_signature_pem, verify_rsa_signature_spki,
};
#[cfg(feature = "xslt")]
pub use transforms::XsltStylesheet;
pub use transforms::{
    BASE64_TRANSFORM_URI, DEFAULT_IMPLICIT_C14N_URI, ENVELOPED_SIGNATURE_URI,
    RELATIONSHIP_TRANSFORM_URI, RelationshipSelector, Transform, XPATH_FILTER2_TRANSFORM_URI,
    XPATH_TRANSFORM_URI, XPathExpression, XPathFilter, XPathFilterOperation, XPathHereSemantics,
    XSLT_TRANSFORM_URI, execute_transforms, execute_transforms_with_policy, parse_transforms,
};
pub use trust::{KeyTrustEvidence, ResolvedVerificationKey, TrustedPublicKey, X509TrustEvidence};
pub use types::{NodeSet, TransformData, TransformError};
pub use verify::{
    AuthenticatedReference, BareNameTarget, CallerTrustedSignatureKey, CatalogueCompleteness,
    CatalogueError, DigestMethodResolution, DsigError, DsigStatus, ExternalResourceUnavailable,
    FailureReason, HashUseAlgorithm, HashUseCompleteness, HashUseRole, HashUseState, KeyResolver,
    LexicalSource, ReferenceCoverage, ReferenceLocation, ReferenceParent, ReferenceProcessingError,
    ReferenceResolution, ReferenceResult, ReferenceSet, ReferencesResult, ReplayError, ReplayMode,
    ReplayOutcome, SelectedKeyReceipt, SelectedSignature, SelectedSignatureMethod, SessionDigest,
    SignatureEvidence, SignatureHashUse, SignatureKeyInfoMetadata, SignatureRequirement,
    SignatureSelection, UriTypeSet, VerificationRequest, VerifiedSession, VerifyContext,
    VerifyEvidence, VerifyResult, VerifyingKey, has_same_document_encapsulation,
    inspect_pinned_verification_key_info, inspect_signing_key_info, inspect_verification_key_info,
    materialize_signing_key_info_references, materialize_verification_key_info_references,
    process_all_references, process_reference, verify_signature_with_pem_key,
    with_verified_request,
};
pub use x509::{
    X509ChainError, X509ChainOptions, verify_x509_certificate_chain,
    verify_x509_certificate_chain_with_resources,
};