web_eid/
sign.rs

1use esteid_cryptoki::IdCard;
2use tokenkey::{EcCurve, Hash, KeyAlgorithm, SignScheme};
3
4use crate::error::Result;
5
6/// Sign `data` with the card's signing key (PIN2) for a qualified electronic
7/// signature.
8///
9/// `data` is the raw data to be signed and is hashed with `hash` before signing.
10/// The returned ECDSA signature is the raw `r || s` concatenation as produced by the card.
11pub fn sign(card: &IdCard, hash: Hash, data: &[u8], pin2: &str) -> Result<Vec<u8>> {
12    let key = card.open_signing(pin2)?;
13    Ok(key.sign(SignScheme::Ecdsa(hash), data)?)
14}
15
16/// The hash matching the signing key's curve strength.
17pub fn recommended_hash(card: &IdCard) -> Result<Hash> {
18    let KeyAlgorithm::Ec(curve) = card.sign.algorithm()?;
19    Ok(match curve {
20        EcCurve::P256 => Hash::Sha256,
21        EcCurve::P384 => Hash::Sha384,
22        EcCurve::P521 => Hash::Sha512,
23    })
24}
web_eid/sign.rs

web_eid/
sign.rs
