feat: support rsassa-pkcs-v1.5-sha256 and rsassa-pss-sha512, braking api changes

Author: junkurihara

Cargo.toml

@@ -4,7 +4,7 @@ resolver = "2"
 
 [workspace.package]
 edition = "2021"
-version = "0.0.21"
+version = "0.0.22"
 authors = ["Jun Kurihara"]
 homepage = "https://github.com/junkurihara/httpsig-rs"
 repository = "https://github.com/junkurihara/httpsig-rs"

httpsig-hyper/Cargo.toml

@@ -18,7 +18,7 @@ blocking = ["futures/executor"]
 
 
 [dependencies]
-httpsig = { path = "../httpsig", version = "0.0.21" }
+httpsig = { path = "../httpsig", version = "0.0.22" }
 
 thiserror = { version = "2.0.18" }
 tracing = { version = "0.1.44" }

httpsig-hyper/README.md

@@ -27,7 +27,8 @@ If you need to verify the body of a given message when `content-digest` is cover
 
 ```rust
 // first verifies the signature according to `signature-input` header
-let public_key = PublicKey::from_pem(EDDSA_PUBLIC_KEY).unwrap();
+let alg = AlgorithmName::Ed25519;
+let public_key = PublicKey::from_pem(&alg, EDDSA_PUBLIC_KEY).unwrap();
 let signature_verification = req.verify_message_signature(&public_key, None).await;
 assert!(verification_res.is_ok());
 

httpsig-hyper/examples/hyper-request.rs

@@ -43,7 +43,7 @@ async fn sender_ed25519(req: &mut Request<BoxBody>) {
   let mut signature_params = HttpSignatureParams::try_new(&covered_components).unwrap();
 
   // set signing/verifying key information, alg and keyid with ed25519
-  let secret_key = SecretKey::from_pem(EDDSA_SECRET_KEY).unwrap();
+  let secret_key = SecretKey::from_pem(&AlgorithmName::Ed25519, EDDSA_SECRET_KEY).unwrap();
   signature_params.set_key_info(&secret_key);
 
   // set signature with custom signature name
@@ -65,7 +65,7 @@ async fn sender_hs256(req: &mut Request<BoxBody>) {
   let mut signature_params = HttpSignatureParams::try_new(&covered_components).unwrap();
 
   // set signing/verifying key information, alg and keyid and random noce with hmac-sha256
-  let shared_key = SharedKey::from_base64(HMACSHA256_SECRET_KEY).unwrap();
+  let shared_key = SharedKey::from_base64(&AlgorithmName::HmacSha256, HMACSHA256_SECRET_KEY).unwrap();
   signature_params.set_key_info(&shared_key);
   signature_params.set_random_nonce();
 
@@ -81,7 +81,7 @@ where
   B: http_body::Body + Send + Sync,
 {
   println!("Verifying ED25519 signature");
-  let public_key = PublicKey::from_pem(EDDSA_PUBLIC_KEY).unwrap();
+  let public_key = PublicKey::from_pem(&AlgorithmName::Ed25519, EDDSA_PUBLIC_KEY).unwrap();
   let key_id = public_key.key_id();
 
   // verify signature with checking key_id
@@ -94,7 +94,7 @@ where
   B: http_body::Body + Send + Sync,
 {
   println!("Verifying HMAC-SHA256 signature");
-  let shared_key = SharedKey::from_base64(HMACSHA256_SECRET_KEY).unwrap();
+  let shared_key = SharedKey::from_base64(&AlgorithmName::HmacSha256, HMACSHA256_SECRET_KEY).unwrap();
   let key_id = VerifyingKey::key_id(&shared_key);
 
   // verify signature with checking key_id

httpsig-hyper/examples/hyper-response.rs

@@ -55,7 +55,7 @@ async fn sender_ed25519(res: &mut Response<BoxBody>, received_req: &Request<BoxB
   let mut signature_params = HttpSignatureParams::try_new(&covered_components).unwrap();
 
   // set signing/verifying key information, alg and keyid with ed25519
-  let secret_key = SecretKey::from_pem(EDDSA_SECRET_KEY).unwrap();
+  let secret_key = SecretKey::from_pem(&AlgorithmName::Ed25519, EDDSA_SECRET_KEY).unwrap();
   signature_params.set_key_info(&secret_key);
 
   // set signature with custom signature name
@@ -77,7 +77,7 @@ async fn sender_hs256(res: &mut Response<BoxBody>, received_req: &Request<BoxBod
   let mut signature_params = HttpSignatureParams::try_new(&covered_components).unwrap();
 
   // set signing/verifying key information, alg and keyid and random noce with hmac-sha256
-  let shared_key = SharedKey::from_base64(HMACSHA256_SECRET_KEY).unwrap();
+  let shared_key = SharedKey::from_base64(&AlgorithmName::HmacSha256, HMACSHA256_SECRET_KEY).unwrap();
   signature_params.set_key_info(&shared_key);
   signature_params.set_random_nonce();
 
@@ -93,7 +93,7 @@ where
   B: http_body::Body + Send + Sync,
 {
   println!("Verifying ED25519 signature");
-  let public_key = PublicKey::from_pem(EDDSA_PUBLIC_KEY).unwrap();
+  let public_key = PublicKey::from_pem(&AlgorithmName::Ed25519, EDDSA_PUBLIC_KEY).unwrap();
   let key_id = public_key.key_id();
 
   // verify signature with checking key_id
@@ -106,7 +106,7 @@ where
   B: http_body::Body + Send + Sync,
 {
   println!("Verifying HMAC-SHA256 signature");
-  let shared_key = SharedKey::from_base64(HMACSHA256_SECRET_KEY).unwrap();
+  let shared_key = SharedKey::from_base64(&AlgorithmName::HmacSha256, HMACSHA256_SECRET_KEY).unwrap();
   let key_id = VerifyingKey::key_id(&shared_key);
 
   // verify signature with checking key_id

httpsig-hyper/src/hyper_http.rs

@@ -5,10 +5,10 @@ use httpsig::prelude::{
   message_component::{
     DerivedComponentName, HttpMessageComponent, HttpMessageComponentId, HttpMessageComponentName, HttpMessageComponentParam,
   },
-  HttpSignatureBase, HttpSignatureHeaders, HttpSignatureHeadersMap, HttpSignatureParams, SigningKey, VerifyingKey,
+  AlgorithmName, HttpSignatureBase, HttpSignatureHeaders, HttpSignatureHeadersMap, HttpSignatureParams, SigningKey, VerifyingKey,
 };
 use indexmap::{IndexMap, IndexSet};
-use std::future::Future;
+use std::{future::Future, str::FromStr};
 
 /// A type alias for the signature name
 type SignatureName = String;
@@ -24,7 +24,7 @@ pub trait MessageSignature {
   fn has_message_signature(&self) -> bool;
 
   /// Extract all key ids for signature bases contained in the request headers
-  fn get_key_ids(&self) -> Result<IndexMap<SignatureName, KeyId>, Self::Error>;
+  fn get_alg_key_ids(&self) -> Result<IndexMap<SignatureName, (AlgorithmName, KeyId)>, Self::Error>;
 
   /// Extract all signature params used to generate signature bases contained in the request headers
   fn get_signature_params(&self) -> Result<IndexMap<SignatureName, HttpSignatureParams>, Self::Error>;
@@ -243,9 +243,9 @@ where
   }
 
   /// Extract all signature bases contained in the request headers
-  fn get_key_ids(&self) -> HyperSigResult<IndexMap<SignatureName, KeyId>> {
+  fn get_alg_key_ids(&self) -> HyperSigResult<IndexMap<SignatureName, (AlgorithmName, KeyId)>> {
     let req_or_res = RequestOrResponse::Request(self);
-    get_key_ids_inner(&req_or_res)
+    get_alg_key_ids_inner(&req_or_res)
   }
 
   /// Extract all signature params used to generate signature bases contained in the request headers
@@ -358,9 +358,9 @@ where
   }
 
   /// Extract all key ids for signature bases contained in the response headers
-  fn get_key_ids(&self) -> Result<IndexMap<SignatureName, KeyId>, Self::Error> {
+  fn get_alg_key_ids(&self) -> Result<IndexMap<SignatureName, (AlgorithmName, KeyId)>, Self::Error> {
     let req_or_res = RequestOrResponse::Response(self);
-    get_key_ids_inner(&req_or_res)
+    get_alg_key_ids_inner(&req_or_res)
   }
 
   /// Extract all signature params used to generate signature bases contained in the response headers
@@ -594,11 +594,28 @@ fn has_message_signature_inner(headers: &HeaderMap) -> bool {
 }
 
 /// get key ids inner function
-fn get_key_ids_inner<B>(req_or_res: &RequestOrResponse<B>) -> HyperSigResult<IndexMap<SignatureName, KeyId>> {
+fn get_alg_key_ids_inner<B>(
+  req_or_res: &RequestOrResponse<B>,
+) -> HyperSigResult<IndexMap<SignatureName, (AlgorithmName, KeyId)>> {
   let signature_headers_map = extract_signature_headers_with_name(req_or_res)?;
   let res = signature_headers_map
     .iter()
-    .filter_map(|(name, headers)| headers.signature_params().keyid.clone().map(|key_id| (name.clone(), key_id)))
+    .filter_map(|(name, headers)| {
+      let alg = headers
+        .signature_params()
+        .alg
+        .clone()
+        .map(|a| AlgorithmName::from_str(&a))
+        .transpose()
+        .ok()
+        .flatten();
+      let key_id = headers.signature_params().keyid.clone();
+      if let (Some(alg), Some(key_id)) = (alg, key_id) {
+        Some((name.clone(), (alg, key_id)))
+      } else {
+        None
+      }
+    })
     .collect();
   Ok(res)
 }
@@ -904,7 +921,7 @@ mod tests {
     *,
   };
   use http_body_util::Full;
-  use httpsig::prelude::{PublicKey, SecretKey, SharedKey};
+  use httpsig::prelude::{AlgorithmName, PublicKey, SecretKey, SharedKey};
 
   type BoxBody = http_body_util::combinators::BoxBody<bytes::Bytes, HyperDigestError>;
 
@@ -1053,7 +1070,7 @@ MCowBQYDK2VwAyEA1ixMQcxO46PLlgQfYS46ivFd+n0CcDHSKUnuhm3i1O0=
   #[tokio::test]
   async fn test_set_verify_message_signature_req() {
     let mut req = build_request().await;
-    let secret_key = SecretKey::from_pem(EDDSA_SECRET_KEY).unwrap();
+    let secret_key = SecretKey::from_pem(&AlgorithmName::Ed25519, EDDSA_SECRET_KEY).unwrap();
     let mut signature_params = HttpSignatureParams::try_new(&build_covered_components_req()).unwrap();
     signature_params.set_key_info(&secret_key);
 
@@ -1062,7 +1079,7 @@ MCowBQYDK2VwAyEA1ixMQcxO46PLlgQfYS46ivFd+n0CcDHSKUnuhm3i1O0=
     assert!(signature_input.starts_with(r##"sig=("@method" "date" "content-type" "content-digest")"##));
     // let signature = req.headers().get("signature").unwrap().to_str().unwrap();
 
-    let public_key = PublicKey::from_pem(EDDSA_PUBLIC_KEY).unwrap();
+    let public_key = PublicKey::from_pem(&AlgorithmName::Ed25519, EDDSA_PUBLIC_KEY).unwrap();
     let verification_res = req.verify_message_signature(&public_key, None).await;
     assert!(verification_res.is_ok());
   }
@@ -1072,7 +1089,7 @@ MCowBQYDK2VwAyEA1ixMQcxO46PLlgQfYS46ivFd+n0CcDHSKUnuhm3i1O0=
     let req = build_request().await;
     let mut res = build_response().await;
 
-    let secret_key = SecretKey::from_pem(EDDSA_SECRET_KEY).unwrap();
+    let secret_key = SecretKey::from_pem(&AlgorithmName::Ed25519, EDDSA_SECRET_KEY).unwrap();
 
     let mut signature_params = HttpSignatureParams::try_new(&build_covered_components_res()).unwrap();
     signature_params.set_key_info(&secret_key);
@@ -1090,15 +1107,15 @@ MCowBQYDK2VwAyEA1ixMQcxO46PLlgQfYS46ivFd+n0CcDHSKUnuhm3i1O0=
     assert!(signature_input.starts_with(r##"sig=("@status" "@method";req "date" "content-type" "content-digest";req)"##));
     // let signature = req.headers().get("signature").unwrap().to_str().unwrap();
 
-    let public_key = PublicKey::from_pem(EDDSA_PUBLIC_KEY).unwrap();
+    let public_key = PublicKey::from_pem(&AlgorithmName::Ed25519, EDDSA_PUBLIC_KEY).unwrap();
     let verification_res = res.verify_message_signature(&public_key, None, Some(&req)).await;
     assert!(verification_res.is_ok());
   }
 
   #[tokio::test]
   async fn test_expired_signature() {
     let mut req = build_request().await;
-    let secret_key = SecretKey::from_pem(EDDSA_SECRET_KEY).unwrap();
+    let secret_key = SecretKey::from_pem(&AlgorithmName::Ed25519, EDDSA_SECRET_KEY).unwrap();
     let mut signature_params = HttpSignatureParams::try_new(&build_covered_components_req()).unwrap();
     signature_params.set_key_info(&secret_key);
     let created = signature_params.created.unwrap();
@@ -1107,15 +1124,15 @@ MCowBQYDK2VwAyEA1ixMQcxO46PLlgQfYS46ivFd+n0CcDHSKUnuhm3i1O0=
 
     req.set_message_signature(&signature_params, &secret_key, None).await.unwrap();
 
-    let public_key = PublicKey::from_pem(EDDSA_PUBLIC_KEY).unwrap();
+    let public_key = PublicKey::from_pem(&AlgorithmName::Ed25519, EDDSA_PUBLIC_KEY).unwrap();
     let verification_res = req.verify_message_signature(&public_key, None).await;
     assert!(verification_res.is_err());
   }
 
   #[tokio::test]
   async fn test_set_verify_with_signature_name() {
     let mut req = build_request().await;
-    let secret_key = SecretKey::from_pem(EDDSA_SECRET_KEY).unwrap();
+    let secret_key = SecretKey::from_pem(&AlgorithmName::Ed25519, EDDSA_SECRET_KEY).unwrap();
     let mut signature_params = HttpSignatureParams::try_new(&build_covered_components_req()).unwrap();
     signature_params.set_key_info(&secret_key);
 
@@ -1129,21 +1146,21 @@ MCowBQYDK2VwAyEA1ixMQcxO46PLlgQfYS46ivFd+n0CcDHSKUnuhm3i1O0=
     assert_eq!(signature_headers_map.len(), 1);
     assert_eq!(signature_headers_map[0].signature_name(), "custom_sig_name");
 
-    let public_key = PublicKey::from_pem(EDDSA_PUBLIC_KEY).unwrap();
+    let public_key = PublicKey::from_pem(&AlgorithmName::Ed25519, EDDSA_PUBLIC_KEY).unwrap();
     let verification_res = req.verify_message_signature(&public_key, None).await;
     assert!(verification_res.is_ok());
   }
 
   #[tokio::test]
   async fn test_set_verify_with_key_id() {
     let mut req = build_request().await;
-    let secret_key = SecretKey::from_pem(EDDSA_SECRET_KEY).unwrap();
+    let secret_key = SecretKey::from_pem(&AlgorithmName::Ed25519, EDDSA_SECRET_KEY).unwrap();
     let mut signature_params = HttpSignatureParams::try_new(&build_covered_components_req()).unwrap();
     signature_params.set_key_info(&secret_key);
 
     req.set_message_signature(&signature_params, &secret_key, None).await.unwrap();
 
-    let public_key = PublicKey::from_pem(EDDSA_PUBLIC_KEY).unwrap();
+    let public_key = PublicKey::from_pem(&AlgorithmName::Ed25519, EDDSA_PUBLIC_KEY).unwrap();
     let key_id = public_key.key_id();
     let verification_res = req.verify_message_signature(&public_key, Some(&key_id)).await;
     assert!(verification_res.is_ok());
@@ -1158,33 +1175,37 @@ MCowBQYDK2VwAyEA1ixMQcxO46PLlgQfYS46ivFd+n0CcDHSKUnuhm3i1O0=
   #[tokio::test]
   async fn test_set_verify_with_key_id_hmac_sha256() {
     let mut req = build_request().await;
-    let secret_key = SharedKey::from_base64(HMACSHA256_SECRET_KEY).unwrap();
+    let secret_key = SharedKey::from_base64(&AlgorithmName::HmacSha256, HMACSHA256_SECRET_KEY).unwrap();
     let mut signature_params = HttpSignatureParams::try_new(&build_covered_components_req()).unwrap();
     signature_params.set_key_info(&secret_key);
     // Random nonce is highly recommended for HMAC
     signature_params.set_random_nonce();
 
     req.set_message_signature(&signature_params, &secret_key, None).await.unwrap();
 
-    let key_id = VerifyingKey::key_id(&secret_key);
-    let verification_res = req.verify_message_signature(&secret_key, Some(&key_id)).await;
+    let org_key_id = VerifyingKey::key_id(&secret_key);
+    let (alg, key_id) = req.get_alg_key_ids().unwrap().into_iter().next().unwrap().1;
+    assert_eq!(org_key_id, *key_id);
+    let verification_key = SharedKey::from_base64(&alg, HMACSHA256_SECRET_KEY).unwrap();
+    let verification_res = req.verify_message_signature(&verification_key, Some(&key_id)).await;
     assert!(verification_res.is_ok());
 
-    let verification_res = req.verify_message_signature(&secret_key, Some("NotFoundKeyId")).await;
+    let verification_res = req.verify_message_signature(&verification_key, Some("NotFoundKeyId")).await;
     assert!(verification_res.is_err());
   }
 
   #[tokio::test]
-  async fn test_get_key_ids() {
+  async fn test_get_alg_key_ids() {
     let mut req = build_request().await;
-    let secret_key = SecretKey::from_pem(EDDSA_SECRET_KEY).unwrap();
+    let secret_key = SecretKey::from_pem(&AlgorithmName::Ed25519, EDDSA_SECRET_KEY).unwrap();
     let mut signature_params = HttpSignatureParams::try_new(&build_covered_components_req()).unwrap();
     signature_params.set_key_info(&secret_key);
 
     req.set_message_signature(&signature_params, &secret_key, None).await.unwrap();
-    let key_ids = req.get_key_ids().unwrap();
+    let key_ids = req.get_alg_key_ids().unwrap();
     assert_eq!(key_ids.len(), 1);
-    assert_eq!(key_ids[0], "gjrE7ACMxgzYfFHgabgf4kLTg1eKIdsJ94AiFTFj1is=");
+    assert_eq!(key_ids[0].0, AlgorithmName::Ed25519);
+    assert_eq!(key_ids[0].1, "gjrE7ACMxgzYfFHgabgf4kLTg1eKIdsJ94AiFTFj1is=");
   }
 
   const P256_SECERT_KEY: &str = r##"-----BEGIN PRIVATE KEY-----
@@ -1202,11 +1223,11 @@ ii+31DW+YulmysZKQKDvuk96TARuWMO/vDbhk777a2QF3bgNoIj8UPMwnw==
   async fn test_set_verify_multiple_signatures() {
     let mut req = build_request().await;
 
-    let secret_key_eddsa = SecretKey::from_pem(EDDSA_SECRET_KEY).unwrap();
+    let secret_key_eddsa = SecretKey::from_pem(&AlgorithmName::Ed25519, EDDSA_SECRET_KEY).unwrap();
     let mut signature_params_eddsa = HttpSignatureParams::try_new(&build_covered_components_req()).unwrap();
     signature_params_eddsa.set_key_info(&secret_key_eddsa);
 
-    let secret_key_p256 = SecretKey::from_pem(P256_SECERT_KEY).unwrap();
+    let secret_key_p256 = SecretKey::from_pem(&AlgorithmName::EcdsaP256Sha256, P256_SECERT_KEY).unwrap();
     let mut signature_params_hmac = HttpSignatureParams::try_new(&build_covered_components_req()).unwrap();
     signature_params_hmac.set_key_info(&secret_key_p256);
 
@@ -1217,8 +1238,8 @@ ii+31DW+YulmysZKQKDvuk96TARuWMO/vDbhk777a2QF3bgNoIj8UPMwnw==
 
     req.set_message_signatures(params_key_name).await.unwrap();
 
-    let public_key_eddsa = PublicKey::from_pem(EDDSA_PUBLIC_KEY).unwrap();
-    let public_key_p256 = PublicKey::from_pem(P256_PUBLIC_KEY).unwrap();
+    let public_key_eddsa = PublicKey::from_pem(&AlgorithmName::Ed25519, EDDSA_PUBLIC_KEY).unwrap();
+    let public_key_p256 = PublicKey::from_pem(&AlgorithmName::EcdsaP256Sha256, P256_PUBLIC_KEY).unwrap();
     let key_id_eddsa = public_key_eddsa.key_id();
     let key_id_p256 = public_key_p256.key_id();
 
@@ -1239,13 +1260,13 @@ ii+31DW+YulmysZKQKDvuk96TARuWMO/vDbhk777a2QF3bgNoIj8UPMwnw==
   #[test]
   fn test_blocking_set_verify_message_signature_req() {
     let mut req = futures::executor::block_on(build_request());
-    let secret_key = SecretKey::from_pem(EDDSA_SECRET_KEY).unwrap();
+    let secret_key = SecretKey::from_pem(&AlgorithmName::Ed25519, EDDSA_SECRET_KEY).unwrap();
     let mut signature_params = HttpSignatureParams::try_new(&build_covered_components_req()).unwrap();
     signature_params.set_key_info(&secret_key);
 
     req.set_message_signature_sync(&signature_params, &secret_key, None).unwrap();
 
-    let public_key = PublicKey::from_pem(EDDSA_PUBLIC_KEY).unwrap();
+    let public_key = PublicKey::from_pem(&AlgorithmName::Ed25519, EDDSA_PUBLIC_KEY).unwrap();
     let verification_res = req.verify_message_signature_sync(&public_key, None);
     assert!(verification_res.is_ok());
   }
@@ -1255,14 +1276,14 @@ ii+31DW+YulmysZKQKDvuk96TARuWMO/vDbhk777a2QF3bgNoIj8UPMwnw==
   fn test_blocking_set_verify_message_signature_res() {
     let req = futures::executor::block_on(build_request());
     let mut res = futures::executor::block_on(build_response());
-    let secret_key = SecretKey::from_pem(EDDSA_SECRET_KEY).unwrap();
+    let secret_key = SecretKey::from_pem(&AlgorithmName::Ed25519, EDDSA_SECRET_KEY).unwrap();
     let mut signature_params = HttpSignatureParams::try_new(&build_covered_components_res()).unwrap();
     signature_params.set_key_info(&secret_key);
     res
       .set_message_signature_sync(&signature_params, &secret_key, None, Some(&req))
       .unwrap();
 
-    let public_key = PublicKey::from_pem(EDDSA_PUBLIC_KEY).unwrap();
+    let public_key = PublicKey::from_pem(&AlgorithmName::Ed25519, EDDSA_PUBLIC_KEY).unwrap();
     let verification_res = res.verify_message_signature_sync(&public_key, None, Some(&req));
     assert!(verification_res.is_ok());
   }