1
1
pub use ring;
2
- pub use serde;
3
2
use std:: convert:: TryInto ;
3
+ use tracing:: warn;
4
4
5
5
pub mod sign_ed25519 {
6
6
use super :: deserialize_slice;
@@ -11,6 +11,7 @@ pub mod sign_ed25519 {
11
11
pub use ring:: signature:: { ED25519 , ED25519_PUBLIC_KEY_LEN } ;
12
12
use serde:: { Deserialize , Serialize } ;
13
13
use std:: convert:: TryInto ;
14
+ use tracing:: warn;
14
15
15
16
pub type PublicKeyBase = <SecretKey as KeyPair >:: PublicKey ;
16
17
@@ -29,6 +30,12 @@ pub mod sign_ed25519 {
29
30
[ u8 ; ED25519_SIGNATURE_LEN ] ,
30
31
) ;
31
32
33
+ impl Default for Signature {
34
+ fn default ( ) -> Self {
35
+ Self ( [ 0 ; ED25519_SIGNATURE_LEN ] )
36
+ }
37
+ }
38
+
32
39
impl Signature {
33
40
pub fn from_slice ( slice : & [ u8 ] ) -> Option < Self > {
34
41
Some ( Self ( slice. try_into ( ) . ok ( ) ?) )
@@ -50,6 +57,12 @@ pub mod sign_ed25519 {
50
57
[ u8 ; ED25519_PUBLIC_KEY_LEN ] ,
51
58
) ;
52
59
60
+ impl Default for PublicKey {
61
+ fn default ( ) -> Self {
62
+ Self ( [ 0 ; ED25519_PUBLIC_KEY_LEN ] )
63
+ }
64
+ }
65
+
53
66
impl PublicKey {
54
67
pub fn from_slice ( slice : & [ u8 ] ) -> Option < Self > {
55
68
Some ( Self ( slice. try_into ( ) . ok ( ) ?) )
@@ -86,14 +99,34 @@ pub mod sign_ed25519 {
86
99
}
87
100
88
101
pub fn sign_detached ( msg : & [ u8 ] , sk : & SecretKey ) -> Signature {
89
- let secret = SecretKeyBase :: from_pkcs8 ( sk. as_ref ( ) ) . unwrap ( ) ;
90
- Signature ( secret. sign ( msg) . as_ref ( ) . try_into ( ) . unwrap ( ) )
102
+ let secret = match SecretKeyBase :: from_pkcs8 ( sk. as_ref ( ) ) {
103
+ Ok ( secret) => secret,
104
+ Err ( _) => {
105
+ warn ! ( "Invalid secret key" ) ;
106
+ return Signature ( [ 0 ; ED25519_SIGNATURE_LEN ] ) ;
107
+ }
108
+ } ;
109
+
110
+ let signature = match secret. sign ( msg) . as_ref ( ) . try_into ( ) {
111
+ Ok ( signature) => signature,
112
+ Err ( _) => {
113
+ warn ! ( "Invalid signature" ) ;
114
+ return Signature ( [ 0 ; ED25519_SIGNATURE_LEN ] ) ;
115
+ }
116
+ } ;
117
+ Signature ( signature)
91
118
}
92
119
93
120
pub fn verify_append ( sm : & [ u8 ] , pk : & PublicKey ) -> bool {
94
121
if sm. len ( ) > ED25519_SIGNATURE_LEN {
95
122
let start = sm. len ( ) - ED25519_SIGNATURE_LEN ;
96
- let sig = Signature ( sm[ start..] . try_into ( ) . unwrap ( ) ) ;
123
+ let sig = Signature ( match sm[ start..] . try_into ( ) {
124
+ Ok ( sig) => sig,
125
+ Err ( _) => {
126
+ warn ! ( "Invalid signature" ) ;
127
+ return false ;
128
+ }
129
+ } ) ;
97
130
let msg = & sm[ ..start] ;
98
131
verify_detached ( & sig, msg, pk)
99
132
} else {
@@ -110,10 +143,38 @@ pub mod sign_ed25519 {
110
143
111
144
pub fn gen_keypair ( ) -> ( PublicKey , SecretKey ) {
112
145
let rand = ring:: rand:: SystemRandom :: new ( ) ;
113
- let pkcs8 = SecretKeyBase :: generate_pkcs8 ( & rand) . unwrap ( ) ;
114
- let secret = SecretKeyBase :: from_pkcs8 ( pkcs8. as_ref ( ) ) . unwrap ( ) ;
115
- let public = PublicKey ( secret. public_key ( ) . as_ref ( ) . try_into ( ) . unwrap ( ) ) ;
116
- let secret = SecretKey :: from_slice ( pkcs8. as_ref ( ) ) . unwrap ( ) ;
146
+ let pkcs8 = match SecretKeyBase :: generate_pkcs8 ( & rand) {
147
+ Ok ( pkcs8) => pkcs8,
148
+ Err ( _) => {
149
+ warn ! ( "Failed to generate secret key base for pkcs8" ) ;
150
+ return ( PublicKey ( [ 0 ; ED25519_PUBLIC_KEY_LEN ] ) , SecretKey ( vec ! [ ] ) ) ;
151
+ }
152
+ } ;
153
+
154
+ let secret = match SecretKeyBase :: from_pkcs8 ( pkcs8. as_ref ( ) ) {
155
+ Ok ( secret) => secret,
156
+ Err ( _) => {
157
+ warn ! ( "Invalid secret key base" ) ;
158
+ return ( PublicKey ( [ 0 ; ED25519_PUBLIC_KEY_LEN ] ) , SecretKey ( vec ! [ ] ) ) ;
159
+ }
160
+ } ;
161
+
162
+ let pub_key_gen = match secret. public_key ( ) . as_ref ( ) . try_into ( ) {
163
+ Ok ( pub_key_gen) => pub_key_gen,
164
+ Err ( _) => {
165
+ warn ! ( "Invalid public key generation" ) ;
166
+ return ( PublicKey ( [ 0 ; ED25519_PUBLIC_KEY_LEN ] ) , SecretKey ( vec ! [ ] ) ) ;
167
+ }
168
+ } ;
169
+ let public = PublicKey ( pub_key_gen) ;
170
+ let secret = match SecretKey :: from_slice ( pkcs8. as_ref ( ) ) {
171
+ Some ( secret) => secret,
172
+ None => {
173
+ warn ! ( "Invalid secret key" ) ;
174
+ return ( PublicKey ( [ 0 ; ED25519_PUBLIC_KEY_LEN ] ) , SecretKey ( vec ! [ ] ) ) ;
175
+ }
176
+ } ;
177
+
117
178
( public, secret)
118
179
}
119
180
}
@@ -218,6 +279,7 @@ pub mod pbkdf2 {
218
279
use serde:: { Deserialize , Serialize } ;
219
280
use std:: convert:: TryInto ;
220
281
use std:: num:: NonZeroU32 ;
282
+ use tracing:: warn;
221
283
222
284
pub const SALT_LEN : usize = 256 / 8 ;
223
285
pub const OPSLIMIT_INTERACTIVE : u32 = 100_000 ;
@@ -242,7 +304,13 @@ pub mod pbkdf2 {
242
304
}
243
305
244
306
pub fn derive_key ( key : & mut [ u8 ] , passwd : & [ u8 ] , salt : & Salt , iterations : u32 ) {
245
- let iterations = NonZeroU32 :: new ( iterations) . unwrap ( ) ;
307
+ let iterations = match NonZeroU32 :: new ( iterations) {
308
+ Some ( iterations) => iterations,
309
+ None => {
310
+ warn ! ( "Invalid iterations in key derivation" ) ;
311
+ return ;
312
+ }
313
+ } ;
246
314
derive ( PBKDF2_HMAC_SHA256 , iterations, salt. as_ref ( ) , passwd, key) ;
247
315
}
248
316
@@ -251,6 +319,22 @@ pub mod pbkdf2 {
251
319
}
252
320
}
253
321
322
+ pub mod sha3_256 {
323
+ pub use sha3:: digest:: Output ;
324
+ pub use sha3:: Digest ;
325
+ pub use sha3:: Sha3_256 ;
326
+
327
+ pub fn digest ( data : & [ u8 ] ) -> Output < Sha3_256 > {
328
+ Sha3_256 :: digest ( data)
329
+ }
330
+
331
+ pub fn digest_all < ' a > ( data : impl Iterator < Item = & ' a [ u8 ] > ) -> Output < Sha3_256 > {
332
+ let mut hasher = Sha3_256 :: new ( ) ;
333
+ data. for_each ( |v| hasher. update ( v) ) ;
334
+ hasher. finalize ( )
335
+ }
336
+ }
337
+
254
338
fn deserialize_slice < ' de , D : serde:: Deserializer < ' de > , const N : usize > (
255
339
deserializer : D ,
256
340
) -> Result < [ u8 ; N ] , D :: Error > {
@@ -265,7 +349,10 @@ pub fn generate_random<const N: usize>() -> [u8; N] {
265
349
266
350
use ring:: rand:: SecureRandom ;
267
351
let rand = ring:: rand:: SystemRandom :: new ( ) ;
268
- rand. fill ( & mut value) . unwrap ( ) ;
352
+ match rand. fill ( & mut value) {
353
+ Ok ( _) => ( ) ,
354
+ Err ( _) => warn ! ( "Failed to generate random bytes" ) ,
355
+ } ;
269
356
270
357
value
271
358
}
0 commit comments