xml_sec/xmldsig/
mod.rs

1//! XML Digital Signatures (XMLDSig).
2//!
3//! Implements [XML Signature Syntax and Processing](https://www.w3.org/TR/xmldsig-core1/).
4//!
5//! ## Current Status
6//!
7//! - URI dereference: same-document references (`""`, `#id`, `#xpointer(/)`, `#xpointer(id('...'))`)
8//! - ID attribute resolution with configurable attribute names
9//! - Exact element, attribute, and namespace node sets for transform processing
10//! - Enveloped, canonicalization, Base64, XPath 1.0, and XPath Filter 2.0 transforms
11//!
12//! ## Signing and verification
13//!
14//! Build an enveloped signature with a modern algorithm, then verify it with
15//! the embedded certificate. Secure defaults require SHA-224 or stronger;
16//! legacy SHA-1 methods require an explicit operation policy opt-in.
17//!
18//! ```no_run
19//! use xml_sec::c14n::{C14nAlgorithm, C14nMode};
20//! use xml_sec::xmldsig::{
21//!     DefaultKeyResolver, DigestAlgorithm, ReferenceBuilder, RsaSigningKey,
22//!     SignContext, SignatureAlgorithm, SignatureBuilder, Transform, VerifyContext,
23//!     X509CertificateKeyInfoWriter,
24//! };
25//!
26//! # fn example(private_key_pem: &str, certificate_pem: &str) -> Result<(), Box<dyn std::error::Error>> {
27//! let c14n = C14nAlgorithm::new(C14nMode::Exclusive1_0, false);
28//! let template = SignatureBuilder::new(c14n.clone(), SignatureAlgorithm::RsaSha256)
29//!     .add_reference(
30//!         ReferenceBuilder::new(DigestAlgorithm::Sha256)
31//!             .uri("#message")
32//!             .transform(Transform::Enveloped)
33//!             .transform(Transform::C14n(c14n)),
34//!     )
35//!     .key_info(true)
36//!     .build_template()?;
37//! let xml = xml_sec::xmldsig::mutation::append_signature_to_root(
38//!     "<Message ID=\"message\">hello</Message>",
39//!     &template,
40//! )?;
41//! let signing_key = RsaSigningKey::from_pkcs8_pem(private_key_pem)?;
42//! let key_info = X509CertificateKeyInfoWriter::from_pem(certificate_pem)?;
43//! let signed = SignContext::new(&signing_key)
44//!     .key_info_writer(&key_info)
45//!     .sign_template(&xml)?;
46//!
47//! let resolver = DefaultKeyResolver::default();
48//! let result = VerifyContext::new().key_resolver(&resolver).verify(&signed)?;
49//! assert!(matches!(result.status, xml_sec::xmldsig::DsigStatus::Valid));
50//! # Ok(())
51//! # }
52//! ```
53#![doc = include_str!("../../docs/xmldsig.md")]
54
55pub mod builder;
56pub mod digest;
57pub mod keys;
58mod modern;
59#[cfg(feature = "experimental-pq")]
60pub(crate) mod post_quantum;
61mod pq_algorithm;
62#[cfg(feature = "experimental-pq")]
63pub use post_quantum::PostQuantumSigningKey;
64pub use pq_algorithm::PqAlgorithm;
65pub mod mutation;
66pub mod parse;
67pub mod sign;
68pub mod signature;
69pub mod transforms;
70pub mod trust;
71pub mod types;
72pub mod uri;
73pub mod verify;
74pub(crate) mod whitespace;
75pub mod x509;
76mod xpath;
77
78pub use builder::{ReferenceBuilder, SignatureBuilder, SignatureBuilderError};
79pub use digest::{DigestAlgorithm, compute_digest, compute_digest_with_provider, constant_time_eq};
80pub use keys::{
81    DefaultKeyResolver, HmacSha1VerificationKey, HmacVerificationKey, InspectedKeyCandidateBudget,
82    KeyResolutionError, KeyResolverConfig, VerificationKey,
83};
84pub use modern::EdDsaSigningKey;
85pub use parse::{
86    KeyInfo, KeyInfoSource, KeyValueInfo, ParseError, Reference, RetrievalMethodTransforms,
87    RsaPssParameters, SignatureAlgorithm, SignatureContext, SignedInfo, X509DataInfo,
88    find_signature_node, parse_key_info, parse_reference, parse_signed_info,
89    x509_certificate_matches_selectors,
90};
91pub use sign::{
92    ComputedReferenceDigest, DerEncodedKeyValueInfoWriter, DsaSigningKey, EcdsaP256SigningKey,
93    EcdsaP384SigningKey, EcdsaP521SigningKey, HmacSigningKey, KeyInfoWriteError, KeyInfoWriter,
94    KeyValueInfoWriter, RsaSigningKey, SignContext, SignatureTemplateSelection, SigningDigestError,
95    SigningError, SigningKey, SigningKeyError, SigningPublicKeyInfo, X509CertificateKeyInfoWriter,
96    X509DigestKeyInfoWriter, compute_reference_digest_values, fill_reference_digest_values,
97    validate_signing_key,
98};
99pub use signature::{
100    SignatureVerificationError, verify_dsa_signature_spki, verify_ecdsa_signature_pem,
101    verify_ecdsa_signature_pem_with_encoding, verify_ecdsa_signature_spki,
102    verify_ecdsa_signature_spki_with_encoding, verify_rsa_signature_pem, verify_rsa_signature_spki,
103};
104pub use transforms::{
105    BASE64_TRANSFORM_URI, DEFAULT_IMPLICIT_C14N_URI, ENVELOPED_SIGNATURE_URI,
106    RELATIONSHIP_TRANSFORM_URI, RelationshipSelector, Transform, XPATH_FILTER2_TRANSFORM_URI,
107    XPATH_TRANSFORM_URI, XPathExpression, XPathFilter, XPathFilterOperation, XPathHereSemantics,
108    execute_transforms, execute_transforms_with_policy, parse_transforms,
109};
110pub use trust::{KeyTrustEvidence, ResolvedVerificationKey, TrustedPublicKey, X509TrustEvidence};
111pub use types::{NodeSet, TransformData, TransformError};
112pub use verify::{
113    CallerTrustedSignatureKey, DsigError, DsigStatus, FailureReason, KeyResolver,
114    ReferenceCoverage, ReferenceProcessingError, ReferenceResult, ReferenceSet, ReferencesResult,
115    SignatureEvidence, SignatureKeyInfoMetadata, SignatureRequirement, SignatureSelection,
116    UriTypeSet, VerificationRequest, VerifyContext, VerifyEvidence, VerifyResult, VerifyingKey,
117    has_same_document_encapsulation, inspect_pinned_verification_key_info,
118    inspect_signing_key_info, inspect_verification_key_info,
119    materialize_signing_key_info_references, materialize_verification_key_info_references,
120    process_all_references, process_reference, verify_signature_with_pem_key,
121};
122pub use x509::{X509ChainError, X509ChainOptions, verify_x509_certificate_chain};
xml_sec/xmldsig/mod.rs

xml_sec/xmldsig/
mod.rs
