x509_validator/crypto/
ring.rs

1//! ring backed crypto backend.
2
3use ::ring as ring_krate;
4
5backend! {
6    krate: ring_krate,
7    backend: Ring,
8    ecdsa_p256: {
9        256 => ECDSA_P256_SHA256_ASN1,
10        384 => ECDSA_P256_SHA384_ASN1,
11    },
12    ecdsa_p384: {
13        256 => ECDSA_P384_SHA256_ASN1,
14        384 => ECDSA_P384_SHA384_ASN1,
15    },
16}
17
18#[cfg(test)]
19mod tests {
20    use x509_validator_testkit::rcgen::KeyPair;
21    use x509_validator_testkit::self_signed;
22
23    use super::*;
24    use crate::{Certificate, CertificateExt, oid_registry};
25
26    #[test]
27    fn ecdsa_p256_round_trip_verifies() {
28        let key_pair = KeyPair::generate().expect("generate key pair");
29        let der: &'static [u8] = Box::leak(self_signed(&key_pair).into_boxed_slice());
30        let cert = Certificate::parse(der).expect("parse certificate");
31
32        let result = Ring.verify_signature(
33            &cert.signature_algorithm,
34            cert.public_key(),
35            cert.tbs_certificate.as_ref(),
36            cert.signature_value.as_ref(),
37        );
38        assert!(
39            result.is_ok(),
40            "expected valid signature to verify, got {result:?}"
41        );
42    }
43
44    #[test]
45    fn ecdsa_p256_tampered_message_fails() {
46        let key_pair = KeyPair::generate().expect("generate key pair");
47        let der: &'static [u8] = Box::leak(self_signed(&key_pair).into_boxed_slice());
48        let cert = Certificate::parse(der).expect("parse certificate");
49
50        let result = Ring.verify_signature(
51            &cert.signature_algorithm,
52            cert.public_key(),
53            b"tampered message",
54            cert.signature_value.as_ref(),
55        );
56        assert!(matches!(result, Err(CryptoError::VerificationFailed)));
57    }
58
59    #[test]
60    fn unsupported_algorithm_is_rejected() {
61        let algorithm = AlgorithmIdentifier {
62            algorithm: oid_registry::OID_SIG_ED448,
63            parameters: None,
64        };
65        let key_pair = KeyPair::generate().expect("generate key pair");
66        let der: &'static [u8] = Box::leak(self_signed(&key_pair).into_boxed_slice());
67        let cert = Certificate::parse(der).expect("parse certificate");
68
69        let result = Ring.verify_signature(&algorithm, cert.public_key(), b"message", b"signature");
70        assert!(matches!(result, Err(CryptoError::InvalidKey(_))));
71    }
72
73    #[test]
74    fn ecdsa_sha512_is_unsupported() {
75        let algorithm = AlgorithmIdentifier {
76            algorithm: oid_registry::OID_SIG_ECDSA_WITH_SHA512,
77            parameters: None,
78        };
79        let key_pair = KeyPair::generate().expect("generate key pair");
80        let der: &'static [u8] = Box::leak(self_signed(&key_pair).into_boxed_slice());
81        let cert = Certificate::parse(der).expect("parse certificate");
82
83        let result = Ring.verify_signature(&algorithm, cert.public_key(), b"message", b"signature");
84        assert!(matches!(result, Err(CryptoError::InvalidKey(_))));
85    }
86}
x509_validator/crypto/ring.rs

x509_validator/crypto/
ring.rs
