Struct cryptographic_message_syntax::SignerInfo [−][src]
pub struct SignerInfo { /* fields omitted */ }
Represents a CMS SignerInfo structure.
This is a high-level interface to the SignerInfo ASN.1 type. It supports performing common operations against that type.
Instances of this type are logically equivalent to a single
signed assertion within a SignedData
payload. There can be multiple
signers per SignedData
, which is why this type exists on its own.
Implementations
impl SignerInfo
[src]
impl SignerInfo
[src]pub fn certificate_issuer_and_serial(&self) -> Option<(&Name, &Integer)>
[src]
pub fn certificate_issuer_and_serial(&self) -> Option<(&Name, &Integer)>
[src]Obtain the signing X.509 certificate’s issuer name and its serial number.
The returned value can be used to locate the certificate so verification can be performed.
pub fn digest_algorithm(&self) -> DigestAlgorithm
[src]
pub fn digest_algorithm(&self) -> DigestAlgorithm
[src]Obtain the message digest algorithm used by this signer.
pub fn signature_algorithm(&self) -> SignatureAlgorithm
[src]
pub fn signature_algorithm(&self) -> SignatureAlgorithm
[src]Obtain the cryptographic signing algorithm used by this signer.
pub fn signature(&self) -> &[u8]ⓘ
[src]
pub fn signature(&self) -> &[u8]ⓘ
[src]Obtain the raw bytes constituting the cryptographic signature.
This is the signature that should be verified.
pub fn signed_attributes(&self) -> Option<&SignedAttributes>
[src]
pub fn signed_attributes(&self) -> Option<&SignedAttributes>
[src]Obtain the SignedAttributes
attached to this instance.
pub fn unsigned_attributes(&self) -> Option<&UnsignedAttributes>
[src]
pub fn unsigned_attributes(&self) -> Option<&UnsignedAttributes>
[src]Obtain the UnsignedAttributes
attached to this instance.
pub fn verify_signature_with_signed_data(
&self,
signed_data: &SignedData
) -> Result<(), CmsError>
[src]
pub fn verify_signature_with_signed_data(
&self,
signed_data: &SignedData
) -> Result<(), CmsError>
[src]Verifies the signature defined by this signer given a SignedData
instance.
This function will perform cryptographic verification that the signature
contained within this SignerInfo
instance is valid for the content that
was signed. The content that was signed is the encapsulated content from
the SignedData
instance (its .signed_data()
value) combined with
the SignedAttributes
attached to this instance.
IMPORTANT SECURITY LIMITATIONS
This method only performs signature verification. It:
- DOES NOT verify the digest hash embedded within
SignedAttributes
(if present). - DOES NOT validate the signing certificate in any way.
- DOES NOT validate that the cryptography used is appropriate.
- DOES NOT verify the time stamp token, if present.
See the crate’s documentation for more on the security implications.
pub fn verify_message_digest_with_signed_data(
&self,
signed_data: &SignedData
) -> Result<(), CmsError>
[src]
pub fn verify_message_digest_with_signed_data(
&self,
signed_data: &SignedData
) -> Result<(), CmsError>
[src]Verifies the digest stored in signed attributes matches that of content in a SignedData
.
If signed attributes are present on this instance, they must contain
a message-digest
attribute defining the digest of data that was
signed. The specification says this digested data should come from
the encapsulated content within SignedData
(SignedData.signed_content()
).
Note that some utilities of CMS will not store a computed digest
in message-digest
that came from SignedData
or is using
the digest algorithm indicated by this SignerInfo
. This is strictly
in violation of the specification but it does occur.
IMPORTANT SECURITY LIMITATIONS
This method only performs message digest verification. It:
- DOES NOT verify the signature over the signed data or anything about the signer.
- DOES NOT validate that the digest algorithm is strong/appropriate.
- DOES NOT compare the digests in a manner that is immune to timing side-channels.
See the crate’s documentation for more on the security implications.
pub fn verify_message_digest_with_content(
&self,
data: &[u8]
) -> Result<(), CmsError>
[src]
pub fn verify_message_digest_with_content(
&self,
data: &[u8]
) -> Result<(), CmsError>
[src]Verifies the migest digest stored in signed attributes using explicit encapsulated content.
Typically, the digest is computed over content stored in the SignedData instance. However, it is possible for the signed content to be external. This function allows you to define the source of that external content.
Behavior is very similar to SignerInfo::verify_message_digest_with_signed_data except the original content that was digested is explicitly passed in. This content is appended with the signed attributes data on this SignerInfo.
The security limitations from SignerInfo::verify_message_digest_with_signed_data apply to this function as well.
pub fn signature_verifier<'a, C>(
&self,
certs: C
) -> Result<UnparsedPublicKey<Vec<u8>>, CmsError> where
C: Iterator<Item = &'a CapturedX509Certificate>,
[src]
pub fn signature_verifier<'a, C>(
&self,
certs: C
) -> Result<UnparsedPublicKey<Vec<u8>>, CmsError> where
C: Iterator<Item = &'a CapturedX509Certificate>,
[src]Obtain an entity for validating the signature described by this instance.
This will attempt to locate the certificate used by this signing info structure in the passed iterable of certificates and then construct a signature verifier that can be used to verify content integrity.
If the certificate referenced by this signing info could not be found, an error occurs.
If the signing key’s algorithm or signature algorithm aren’t supported, an error occurs.
pub fn time_stamp_token_signed_data(
&self
) -> Result<Option<SignedData>, CmsError>
[src]
pub fn time_stamp_token_signed_data(
&self
) -> Result<Option<SignedData>, CmsError>
[src]Resolve the time-stamp token SignedData for this signer.
The time-stamp token is a SignedData ASN.1 structure embedded as an unsigned attribute. This is a convenience method to extract it and turn it into a SignedData.
Returns Ok(Some)
on success, Ok(None)
if there is no time-stamp token,
and Err
if there is a parsing error.
pub fn verify_time_stamp_token(&self) -> Result<Option<()>, CmsError>
[src]
pub fn verify_time_stamp_token(&self) -> Result<Option<()>, CmsError>
[src]Verify the time-stamp token in this instance.
The time-stamp token is a SignedData ASN.1 structure embedded as an unsigned attribute. So this method reconstructs that data structure and effectively calls SignerInfo::verify_signature_with_signed_data and SignerInfo::verify_message_digest_with_signed_data.
Returns Ok(None)
if there is no time-stamp token and Ok(Some(()))
if
there is and the token validates. Err
occurs on any parse or verification
error.
pub fn signed_content_with_signed_data(
&self,
signed_data: &SignedData
) -> Vec<u8>ⓘ
[src]
pub fn signed_content_with_signed_data(
&self,
signed_data: &SignedData
) -> Vec<u8>ⓘ
[src]Obtain the raw bytes of content that was signed given a SignedData
.
This joins the encapsulated content from SignedData
with SignedAttributes
on this instance to produce a new blob. This new blob is the message
that is signed and whose signature is embedded in SignerInfo
instances.
pub fn signed_content(&self, content: Option<&[u8]>) -> Vec<u8>ⓘ
[src]
pub fn signed_content(&self, content: Option<&[u8]>) -> Vec<u8>ⓘ
[src]Obtain the raw bytes of content that were digested and signed.
The returned value is the message that was signed and whose signature of which needs to be verified.
The optional content argument is the encapContentInfo eContent
field, typically the value of SignedData.signed_content()
.
pub fn signed_attributes_data(&self) -> Option<&[u8]>
[src]
pub fn signed_attributes_data(&self) -> Option<&[u8]>
[src]Obtain the raw bytes constituting SignerInfo.signedAttrs
as encoded for signatures.
Cryptographic signatures in the SignerInfo
ASN.1 type are made from the digest
of the EXPLICIT SET OF
DER encoding of SignerInfo.signedAttrs
, if signed
attributes are present. This function resolves the raw bytes that are used
for digest computation and later signing.
This should always be Some
if the instance was constructed from an ASN.1
value that had signed attributes.
pub fn compute_digest_with_signed_data(
&self,
signed_data: &SignedData
) -> Digest
[src]
pub fn compute_digest_with_signed_data(
&self,
signed_data: &SignedData
) -> Digest
[src]Compute a message digest using a SignedData
instance.
This will obtain the encapsulated content blob from a SignedData
and digest it using the algorithm configured on this instance.
The resulting digest is typically stored in the message-digest
attribute of SignedData
.
pub fn compute_digest(&self, content: Option<&[u8]>) -> Digest
[src]
pub fn compute_digest(&self, content: Option<&[u8]>) -> Digest
[src]Compute a message digest using the configured algorithm.
This method calls into compute_digest_with_algorithm()
using the
digest algorithm stored in this instance.
pub fn compute_digest_with_algorithm(
&self,
content: Option<&[u8]>,
alg: DigestAlgorithm
) -> Digest
[src]
pub fn compute_digest_with_algorithm(
&self,
content: Option<&[u8]>,
alg: DigestAlgorithm
) -> Digest
[src]Compute a message digest using an explicit digest algorithm.
This will compute the hash/digest of the passed in content.
Trait Implementations
impl Clone for SignerInfo
[src]
impl Clone for SignerInfo
[src]fn clone(&self) -> SignerInfo
[src]
fn clone(&self) -> SignerInfo
[src]Returns a copy of the value. Read more
fn clone_from(&mut self, source: &Self)
1.0.0[src]
fn clone_from(&mut self, source: &Self)
1.0.0[src]Performs copy-assignment from source
. Read more
impl Debug for SignerInfo
[src]
impl Debug for SignerInfo
[src]impl TryFrom<&'_ SignerInfo> for SignerInfo
[src]
impl TryFrom<&'_ SignerInfo> for SignerInfo
[src]Auto Trait Implementations
impl RefUnwindSafe for SignerInfo
impl Send for SignerInfo
impl Sync for SignerInfo
impl Unpin for SignerInfo
impl UnwindSafe for SignerInfo
Blanket Implementations
impl<T> BorrowMut<T> for T where
T: ?Sized,
[src]
impl<T> BorrowMut<T> for T where
T: ?Sized,
[src]pub fn borrow_mut(&mut self) -> &mut T
[src]
pub fn borrow_mut(&mut self) -> &mut T
[src]Mutably borrows from an owned value. Read more
impl<T> Instrument for T
[src]
impl<T> Instrument for T
[src]fn instrument(self, span: Span) -> Instrumented<Self>
[src]
fn instrument(self, span: Span) -> Instrumented<Self>
[src]Instruments this type with the provided Span
, returning an
Instrumented
wrapper. Read more
fn in_current_span(self) -> Instrumented<Self>
[src]
fn in_current_span(self) -> Instrumented<Self>
[src]impl<T> ToOwned for T where
T: Clone,
[src]
impl<T> ToOwned for T where
T: Clone,
[src]type Owned = T
type Owned = T
The resulting type after obtaining ownership.
pub fn to_owned(&self) -> T
[src]
pub fn to_owned(&self) -> T
[src]Creates owned data from borrowed data, usually by cloning. Read more
pub fn clone_into(&self, target: &mut T)
[src]
pub fn clone_into(&self, target: &mut T)
[src]🔬 This is a nightly-only experimental API. (toowned_clone_into
)
recently added
Uses borrowed data to replace owned data, usually by cloning. Read more