Struct cryptographic_message_syntax::SignedData

pub struct SignedData { /* private fields */ }

Represents a CMS SignedData structure.

This is the high-level type representing a CMS signature of some data. It contains a description of what was signed, the cryptographic signature of what was signed, and likely the X.509 certificate chain for the signing key.

This is a high-level data structure that ultimately gets (de)serialized from/to ASN.1. It exists to facilitate common interactions with the low-level ASN.1 without exposing the complexity of ASN.1.

Implementations

impl SignedData

pub fn parse_ber(data: &[u8]) -> Result<Self, CmsError>

Construct an instance by parsing BER data.

pub fn message_digest_with_algorithm(&self, alg: DigestAlgorithm) -> Digest

Compute the digest of the encapsulated content using a specified algorithm.

The returned value is likely used as the message-digest attribute type for use within signed attributes.

You can get the raw bytes of the digest by calling its .as_ref().

pub fn signed_content(&self) -> Option<&[u8]>

Obtain encapsulated content that was signed.

This is the defined encapContentInfo cContent value.

Examples found in repository

src/lib.rs (line 754)

    pub fn signed_content_with_signed_data(&self, signed_data: &SignedData) -> Vec<u8> {
        self.signed_content(signed_data.signed_content())
    }

    /// Obtain the raw bytes of content that were digested and signed.
    ///
    /// The returned value is the message that was signed and whose signature
    /// of which needs to be verified.
    ///
    /// The optional content argument is the `encapContentInfo eContent`
    /// field, typically the value of `SignedData.signed_content()`.
    pub fn signed_content(&self, content: Option<&[u8]>) -> Vec<u8> {
        // Per RFC 5652 Section 5.4:
        //
        //    The result of the message digest calculation process depends on
        //    whether the signedAttrs field is present.  When the field is absent,
        //    the result is just the message digest of the content as described
        //    above.  When the field is present, however, the result is the message
        //    digest of the complete DER encoding of the SignedAttrs value
        //    contained in the signedAttrs field.  Since the SignedAttrs value,
        //    when present, must contain the content-type and the message-digest
        //    attributes, those values are indirectly included in the result.  The
        //    content-type attribute MUST NOT be included in a countersignature
        //    unsigned attribute as defined in Section 11.4.  A separate encoding
        //    of the signedAttrs field is performed for message digest calculation.
        //    The IMPLICIT [0] tag in the signedAttrs is not used for the DER
        //    encoding, rather an EXPLICIT SET OF tag is used.  That is, the DER
        //    encoding of the EXPLICIT SET OF tag, rather than of the IMPLICIT [0]
        //    tag, MUST be included in the message digest calculation along with
        //    the length and content octets of the SignedAttributes value.

        if let Some(signed_attributes_data) = &self.digested_signed_attributes_data {
            signed_attributes_data.clone()
        } else if let Some(content) = content {
            content.to_vec()
        } else {
            vec![]
        }
    }

    /// Obtain the raw bytes constituting `SignerInfo.signedAttrs` as encoded for signatures.
    ///
    /// Cryptographic signatures in the `SignerInfo` ASN.1 type are made from the digest
    /// of the `EXPLICIT SET OF` DER encoding of `SignerInfo.signedAttrs`, if signed
    /// attributes are present. This function resolves the raw bytes that are used
    /// for digest computation and later signing.
    ///
    /// This should always be `Some` if the instance was constructed from an ASN.1
    /// value that had signed attributes.
    pub fn signed_attributes_data(&self) -> Option<&[u8]> {
        self.digested_signed_attributes_data
            .as_ref()
            .map(|x| x.as_ref())
    }

    /// Compute a message digest using a `SignedData` instance.
    ///
    /// This will obtain the encapsulated content blob from a `SignedData`
    /// and digest it using the algorithm configured on this instance.
    ///
    /// The resulting digest is typically stored in the `message-digest`
    /// attribute of `SignedData`.
    pub fn compute_digest_with_signed_data(&self, signed_data: &SignedData) -> Digest {
        self.compute_digest(signed_data.signed_content())
    }

pub fn certificates(
    &self
) -> Box<dyn Iterator<Item = &CapturedX509Certificate> + '_>

Examples found in repository

src/lib.rs (line 568)

    pub fn verify_signature_with_signed_data_and_content(
        &self,
        signed_data: &SignedData,
        signed_content: &[u8],
    ) -> Result<(), CmsError> {
        let verifier = self.signature_verifier(signed_data.certificates())?;
        let signature = self.signature();

        verifier
            .verify(signed_content, signature)
            .map_err(|_| CmsError::SignatureVerificationError)
    }

pub fn signers(&self) -> impl Iterator<Item = &SignerInfo>

Obtain signing information attached to this instance.

Each iterated value represents an entity that cryptographically signed the content. Use these objects to validate the signed data.

Examples found in repository

src/lib.rs (line 740)

    pub fn verify_time_stamp_token(&self) -> Result<Option<()>, CmsError> {
        let signed_data = if let Some(v) = self.time_stamp_token_signed_data()? {
            v
        } else {
            return Ok(None);
        };

        if signed_data.signers.is_empty() {
            return Ok(None);
        }

        for signer in signed_data.signers() {
            signer.verify_signature_with_signed_data(&signed_data)?;
            signer.verify_message_digest_with_signed_data(&signed_data)?;
        }

        Ok(Some(()))
    }

Trait Implementations

impl Clone for SignedData

fn clone(&self) -> SignedData

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SignedData

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl TryFrom<&SignedData> for SignedData

type Error = CmsError

The type returned in the event of a conversion error.

fn try_from(raw: &SignedData) -> Result<Self, Self::Error>

Performs the conversion.