#[repr(u8)]pub enum SigAlg {
Ed25519 = 1,
RsaPssSha256 = 2,
}Expand description
Signature algorithm.
Variants§
Ed25519 = 1
Author signature. The only one this build executes.
RsaPssSha256 = 2
Editing-device signature, format version 3: RSA-PSS-SHA256, MGF1-SHA256, 32-byte salt, exponent 65537.
Chosen for its failure mode, not taste: ECDSA consumes an ephemeral k for
every signature, and signing two different messages with the same k reveals
the private key by arithmetic, exactly what virtual-machine snapshot
rollback causes. With PSS, repeated salt yields one extra valid signature and
nothing more. See docs/format.md, “VERSION 3 OPENED”, item 7.
Verifier: rsa::verify_pss_sha256, in pure Rust: oc-format
verifies the signature and must build for
wasm32-unknown-unknown.
Used only by mutable-region tag 6. This number is invalid in suite.sig_alg:
that field specifies the AUTHOR signature, frozen in version 1 as
Ed25519. Header parsing checks placement: ensure_supported
answers “can we execute it”, not “does it belong here”.
Implementations§
Source§impl SigAlg
impl SigAlg
Sourcepub fn ensure_supported(self) -> Result<(), CryptoError>
pub fn ensure_supported(self) -> Result<(), CryptoError>
Whether the build can execute the declared algorithm.
A second boundary, like aead::ensure_supported and
merkle::ensure_supported. Without it, an identifier in a signed
header controls nothing: a file declaring RSA-PSS would still
be verified as Ed25519 and accepted. This is the same defect class
that produced alg: none in JWS.
The match deliberately has no _: adding a member must break the build here,
beside verification, rather than pass silently.
Sourcepub fn from_u8(v: u8) -> Result<Self, CryptoError>
pub fn from_u8(v: u8) -> Result<Self, CryptoError>
Parse an identifier from a file.
As with AeadAlg::from_u8, parsing immediately passes through
Self::ensure_supported: a header using an unimplemented algorithm must
be rejected AT PARSING, not after key agreement and CEK unwrapping.