x509_validator/crypto/
aws_lc.rs

1//! aws-lc-rs backed crypto backend.
2
3backend! {
4    krate: aws_lc_rs,
5    backend: AwsLc,
6    ecdsa_p256: {
7        256 => ECDSA_P256_SHA256_ASN1,
8        384 => ECDSA_P256_SHA384_ASN1,
9        512 => ECDSA_P256_SHA512_ASN1,
10    },
11    ecdsa_p384: {
12        256 => ECDSA_P384_SHA256_ASN1,
13        384 => ECDSA_P384_SHA384_ASN1,
14        512 => ECDSA_P384_SHA512_ASN1,
15    },
16}
17
18#[cfg(test)]
19mod tests {
20    use x509_validator_testkit::rcgen::KeyPair;
21    use x509_validator_testkit::self_signed;
22
23    use super::*;
24    use crate::{Certificate, CertificateExt, oid_registry};
25
26    #[test]
27    fn ecdsa_p256_round_trip_verifies() {
28        let key_pair = KeyPair::generate().expect("generate key pair");
29        let der: &'static [u8] = Box::leak(self_signed(&key_pair).into_boxed_slice());
30        let cert = Certificate::parse(der).expect("parse certificate");
31
32        let result = AwsLc.verify_signature(
33            &cert.signature_algorithm,
34            cert.public_key(),
35            cert.tbs_certificate.as_ref(),
36            cert.signature_value.as_ref(),
37        );
38        assert!(
39            result.is_ok(),
40            "expected valid signature to verify, got {result:?}"
41        );
42    }
43
44    #[test]
45    fn ecdsa_p256_tampered_message_fails() {
46        let key_pair = KeyPair::generate().expect("generate key pair");
47        let der: &'static [u8] = Box::leak(self_signed(&key_pair).into_boxed_slice());
48        let cert = Certificate::parse(der).expect("parse certificate");
49
50        let result = AwsLc.verify_signature(
51            &cert.signature_algorithm,
52            cert.public_key(),
53            b"tampered message",
54            cert.signature_value.as_ref(),
55        );
56        assert!(matches!(result, Err(CryptoError::VerificationFailed)));
57    }
58
59    #[test]
60    fn unsupported_algorithm_is_rejected() {
61        let algorithm = AlgorithmIdentifier {
62            algorithm: oid_registry::OID_SIG_ED448,
63            parameters: None,
64        };
65        let key_pair = KeyPair::generate().expect("generate key pair");
66        let der: &'static [u8] = Box::leak(self_signed(&key_pair).into_boxed_slice());
67        let cert = Certificate::parse(der).expect("parse certificate");
68
69        let result =
70            AwsLc.verify_signature(&algorithm, cert.public_key(), b"message", b"signature");
71        assert!(matches!(result, Err(CryptoError::InvalidKey(_))));
72    }
73}
x509_validator/crypto/aws_lc.rs

x509_validator/crypto/
aws_lc.rs
