|
|
@ -1,20 +1,19 @@ |
|
|
|
|
|
|
|
use crate::res::{IFError, IFResult}; |
|
|
|
|
|
|
|
use alloc::string::String; |
|
|
|
|
|
|
|
use alloc::vec; |
|
|
|
/// This module has wrappers for cryptography with RSA algorithms.
|
|
|
|
/// This module has wrappers for cryptography with RSA algorithms.
|
|
|
|
/// Its main structs - `PublicKey` and `Keys` implement all functions for key generation, signatures and asymmetric encryption
|
|
|
|
/// Its main structs - `PublicKey` and `Keys` implement all functions for key generation, signatures and asymmetric encryption
|
|
|
|
use alloc::vec::Vec; |
|
|
|
use alloc::vec::Vec; |
|
|
|
use alloc::string::String; |
|
|
|
|
|
|
|
use serde::{Deserialize, Serialize}; |
|
|
|
|
|
|
|
use rsa::{RsaPublicKey, RsaPrivateKey, PaddingScheme, PublicKey as RPK, PublicKeyParts, BigUint}; |
|
|
|
|
|
|
|
use rsa::errors::Result as RsaRes; |
|
|
|
|
|
|
|
use rand::rngs::OsRng; |
|
|
|
use rand::rngs::OsRng; |
|
|
|
|
|
|
|
use rsa::errors::Result as RsaRes; |
|
|
|
|
|
|
|
use rsa::{BigUint, PaddingScheme, PublicKey as RPK, PublicKeyParts, RsaPrivateKey, RsaPublicKey}; |
|
|
|
|
|
|
|
use serde::{Deserialize, Serialize}; |
|
|
|
use sha2::{Digest, Sha224}; |
|
|
|
use sha2::{Digest, Sha224}; |
|
|
|
use alloc::vec; |
|
|
|
|
|
|
|
use crate::res::{IFError, IFResult}; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static KEY_LENGTH: usize = 2048; |
|
|
|
static KEY_LENGTH: usize = 2048; |
|
|
|
static ENCRYPTION_CHUNK_SIZE: usize = 240; |
|
|
|
static ENCRYPTION_CHUNK_SIZE: usize = 240; |
|
|
|
static ENCRYPTION_OUTPUT_CHUNK_SIZE: usize = 256; |
|
|
|
static ENCRYPTION_OUTPUT_CHUNK_SIZE: usize = 256; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/// Public key of a node
|
|
|
|
/// Public key of a node
|
|
|
|
#[derive(Debug, PartialEq, Serialize, Deserialize, Clone)] |
|
|
|
#[derive(Debug, PartialEq, Serialize, Deserialize, Clone)] |
|
|
|
pub struct PublicKey { |
|
|
|
pub struct PublicKey { |
|
|
@ -24,15 +23,26 @@ pub struct PublicKey { |
|
|
|
impl PublicKey { |
|
|
|
impl PublicKey { |
|
|
|
/// Check if the sign is valid for given data and key
|
|
|
|
/// Check if the sign is valid for given data and key
|
|
|
|
pub fn verify_sign(&self, data: &[u8], sign: &[u8]) -> bool { |
|
|
|
pub fn verify_sign(&self, data: &[u8], sign: &[u8]) -> bool { |
|
|
|
self.key.verify(PaddingScheme::PKCS1v15Sign { hash: None }, &Sha224::new().chain(data).result().to_vec(), sign).is_ok() |
|
|
|
self.key |
|
|
|
|
|
|
|
.verify( |
|
|
|
|
|
|
|
PaddingScheme::PKCS1v15Sign { hash: None }, |
|
|
|
|
|
|
|
&Sha224::new().chain(data).result().to_vec(), |
|
|
|
|
|
|
|
sign, |
|
|
|
|
|
|
|
) |
|
|
|
|
|
|
|
.is_ok() |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
/// Encrypt some data for a user with this public key
|
|
|
|
/// Encrypt some data for a user with this public key
|
|
|
|
pub fn encrypt_data(&self, data: &[u8]) -> RsaRes<Vec<u8>> { |
|
|
|
pub fn encrypt_data(&self, data: &[u8]) -> RsaRes<Vec<u8>> { |
|
|
|
if data.len() <= ENCRYPTION_CHUNK_SIZE { |
|
|
|
if data.len() <= ENCRYPTION_CHUNK_SIZE { |
|
|
|
self.key.encrypt(&mut OsRng {}, PaddingScheme::PKCS1v15Encrypt, data) |
|
|
|
self.key |
|
|
|
|
|
|
|
.encrypt(&mut OsRng {}, PaddingScheme::PKCS1v15Encrypt, data) |
|
|
|
} else { |
|
|
|
} else { |
|
|
|
let mut res = self.key.encrypt(&mut OsRng {}, PaddingScheme::PKCS1v15Encrypt, &data[..ENCRYPTION_CHUNK_SIZE])?; |
|
|
|
let mut res = self.key.encrypt( |
|
|
|
|
|
|
|
&mut OsRng {}, |
|
|
|
|
|
|
|
PaddingScheme::PKCS1v15Encrypt, |
|
|
|
|
|
|
|
&data[..ENCRYPTION_CHUNK_SIZE], |
|
|
|
|
|
|
|
)?; |
|
|
|
res.extend(self.encrypt_data(&data[ENCRYPTION_CHUNK_SIZE..])?); |
|
|
|
res.extend(self.encrypt_data(&data[ENCRYPTION_CHUNK_SIZE..])?); |
|
|
|
Ok(res) |
|
|
|
Ok(res) |
|
|
|
} |
|
|
|
} |
|
|
@ -42,8 +52,10 @@ impl PublicKey { |
|
|
|
let n_bytes = self.key.n().to_bytes_be(); |
|
|
|
let n_bytes = self.key.n().to_bytes_be(); |
|
|
|
let e_bytes = self.key.e().to_bytes_be(); |
|
|
|
let e_bytes = self.key.e().to_bytes_be(); |
|
|
|
let mut res = vec![ |
|
|
|
let mut res = vec![ |
|
|
|
(n_bytes.len() / 256) as u8, (n_bytes.len() % 256) as u8, |
|
|
|
(n_bytes.len() / 256) as u8, |
|
|
|
(e_bytes.len() / 256) as u8, (e_bytes.len() % 256) as u8, |
|
|
|
(n_bytes.len() % 256) as u8, |
|
|
|
|
|
|
|
(e_bytes.len() / 256) as u8, |
|
|
|
|
|
|
|
(e_bytes.len() % 256) as u8, |
|
|
|
]; |
|
|
|
]; |
|
|
|
res.extend(n_bytes); |
|
|
|
res.extend(n_bytes); |
|
|
|
res.extend(e_bytes); |
|
|
|
res.extend(e_bytes); |
|
|
@ -52,16 +64,38 @@ impl PublicKey { |
|
|
|
|
|
|
|
|
|
|
|
pub fn from_vec(data: Vec<u8>) -> IFResult<Self> { |
|
|
|
pub fn from_vec(data: Vec<u8>) -> IFResult<Self> { |
|
|
|
if data.len() < 4 { |
|
|
|
if data.len() < 4 { |
|
|
|
return Err(IFError::SerializationError(String::from("Not enough bytes in serialized PublicKey"))) |
|
|
|
return Err(IFError::SerializationError(String::from( |
|
|
|
|
|
|
|
"Not enough bytes in serialized PublicKey", |
|
|
|
|
|
|
|
))); |
|
|
|
} |
|
|
|
} |
|
|
|
let n_len = data[0] as usize * 256 + data[1] as usize; |
|
|
|
let n_len = data[0] as usize * 256 + data[1] as usize; |
|
|
|
let e_len = data[2] as usize * 256 + data[3] as usize; |
|
|
|
let e_len = data[2] as usize * 256 + data[3] as usize; |
|
|
|
if data.len() != e_len + n_len + 4 { |
|
|
|
if data.len() != e_len + n_len + 4 { |
|
|
|
return Err(IFError::SerializationError(String::from("Not enough bytes in serialized PublicKey"))) |
|
|
|
return Err(IFError::SerializationError(String::from( |
|
|
|
|
|
|
|
"Not enough bytes in serialized PublicKey", |
|
|
|
|
|
|
|
))); |
|
|
|
} |
|
|
|
} |
|
|
|
let n_bytes = &data[4..n_len + 4]; |
|
|
|
let n_bytes = &data[4..n_len + 4]; |
|
|
|
let e_bytes = &data[4 + n_len..e_len + n_len + 4]; |
|
|
|
let e_bytes = &data[4 + n_len..e_len + n_len + 4]; |
|
|
|
Ok(Self { key: RsaPublicKey::new(BigUint::from_bytes_be(n_bytes), BigUint::from_bytes_be(e_bytes))? }) |
|
|
|
Ok(Self { |
|
|
|
|
|
|
|
key: RsaPublicKey::new( |
|
|
|
|
|
|
|
BigUint::from_bytes_be(n_bytes), |
|
|
|
|
|
|
|
BigUint::from_bytes_be(e_bytes), |
|
|
|
|
|
|
|
)?, |
|
|
|
|
|
|
|
}) |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/// Get a short string that's kind of a hash
|
|
|
|
|
|
|
|
pub fn get_short_id(&self) -> String { |
|
|
|
|
|
|
|
alloc::string::String::from_utf8( |
|
|
|
|
|
|
|
self.to_vec() |
|
|
|
|
|
|
|
.iter() |
|
|
|
|
|
|
|
.skip(90) |
|
|
|
|
|
|
|
.take(5) |
|
|
|
|
|
|
|
.map(|c| c % 26 + 97) |
|
|
|
|
|
|
|
.collect::<Vec<u8>>(), |
|
|
|
|
|
|
|
) |
|
|
|
|
|
|
|
.unwrap() |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
@ -82,7 +116,8 @@ impl Keys { |
|
|
|
/// Generate new random key
|
|
|
|
/// Generate new random key
|
|
|
|
pub fn generate() -> Self { |
|
|
|
pub fn generate() -> Self { |
|
|
|
let mut rng = OsRng; |
|
|
|
let mut rng = OsRng; |
|
|
|
let private_key = RsaPrivateKey::new(&mut rng, KEY_LENGTH).expect("failed to generate a key"); |
|
|
|
let private_key = |
|
|
|
|
|
|
|
RsaPrivateKey::new(&mut rng, KEY_LENGTH).expect("failed to generate a key"); |
|
|
|
let public_key = RsaPublicKey::from(&private_key); |
|
|
|
let public_key = RsaPublicKey::from(&private_key); |
|
|
|
Self { |
|
|
|
Self { |
|
|
|
private_key, |
|
|
|
private_key, |
|
|
@ -94,15 +129,22 @@ impl Keys { |
|
|
|
impl Keys { |
|
|
|
impl Keys { |
|
|
|
/// Sign content using these keys
|
|
|
|
/// Sign content using these keys
|
|
|
|
pub fn sign(&self, content: &[u8]) -> RsaRes<Vec<u8>> { |
|
|
|
pub fn sign(&self, content: &[u8]) -> RsaRes<Vec<u8>> { |
|
|
|
self.private_key.sign(PaddingScheme::PKCS1v15Sign { hash: None }, &Sha224::new().chain(content).result().to_vec()) |
|
|
|
self.private_key.sign( |
|
|
|
|
|
|
|
PaddingScheme::PKCS1v15Sign { hash: None }, |
|
|
|
|
|
|
|
&Sha224::new().chain(content).result().to_vec(), |
|
|
|
|
|
|
|
) |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
/// Decrypt data
|
|
|
|
/// Decrypt data
|
|
|
|
pub fn decrypt_data(&self, data_encrypted: &[u8]) -> RsaRes<Vec<u8>> { |
|
|
|
pub fn decrypt_data(&self, data_encrypted: &[u8]) -> RsaRes<Vec<u8>> { |
|
|
|
if data_encrypted.len() <= ENCRYPTION_OUTPUT_CHUNK_SIZE { |
|
|
|
if data_encrypted.len() <= ENCRYPTION_OUTPUT_CHUNK_SIZE { |
|
|
|
self.private_key.decrypt(PaddingScheme::PKCS1v15Encrypt, data_encrypted) |
|
|
|
self.private_key |
|
|
|
|
|
|
|
.decrypt(PaddingScheme::PKCS1v15Encrypt, data_encrypted) |
|
|
|
} else { |
|
|
|
} else { |
|
|
|
let mut res = self.private_key.decrypt(PaddingScheme::PKCS1v15Encrypt, &data_encrypted[..ENCRYPTION_OUTPUT_CHUNK_SIZE])?; |
|
|
|
let mut res = self.private_key.decrypt( |
|
|
|
|
|
|
|
PaddingScheme::PKCS1v15Encrypt, |
|
|
|
|
|
|
|
&data_encrypted[..ENCRYPTION_OUTPUT_CHUNK_SIZE], |
|
|
|
|
|
|
|
)?; |
|
|
|
res.extend(self.decrypt_data(&data_encrypted[ENCRYPTION_OUTPUT_CHUNK_SIZE..])?); |
|
|
|
res.extend(self.decrypt_data(&data_encrypted[ENCRYPTION_OUTPUT_CHUNK_SIZE..])?); |
|
|
|
Ok(res) |
|
|
|
Ok(res) |
|
|
|
} |
|
|
|
} |
|
|
@ -110,7 +152,9 @@ impl Keys { |
|
|
|
|
|
|
|
|
|
|
|
/// Get public key
|
|
|
|
/// Get public key
|
|
|
|
pub fn get_public(&self) -> PublicKey { |
|
|
|
pub fn get_public(&self) -> PublicKey { |
|
|
|
PublicKey { key: self.public_key.clone() } |
|
|
|
PublicKey { |
|
|
|
|
|
|
|
key: self.public_key.clone(), |
|
|
|
|
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
@ -119,12 +163,10 @@ fn test_encrypt() { |
|
|
|
let data = vec![0, 5, 8, 135, 67, 45, 32, 5]; |
|
|
|
let data = vec![0, 5, 8, 135, 67, 45, 32, 5]; |
|
|
|
let keys = Keys::generate(); |
|
|
|
let keys = Keys::generate(); |
|
|
|
let data_encrypted = keys.get_public().encrypt_data(&data).unwrap(); |
|
|
|
let data_encrypted = keys.get_public().encrypt_data(&data).unwrap(); |
|
|
|
|
|
|
|
assert_eq!(keys.decrypt_data(&data_encrypted).unwrap(), data); |
|
|
|
assert_eq!( |
|
|
|
assert_eq!( |
|
|
|
keys.decrypt_data(&data_encrypted).unwrap(), |
|
|
|
keys.decrypt_data(&keys.get_public().encrypt_data(&data.repeat(300)).unwrap()) |
|
|
|
data |
|
|
|
.unwrap(), |
|
|
|
); |
|
|
|
|
|
|
|
assert_eq!( |
|
|
|
|
|
|
|
keys.decrypt_data(&keys.get_public().encrypt_data(&data.repeat(300)).unwrap()).unwrap(), |
|
|
|
|
|
|
|
data.repeat(300) |
|
|
|
data.repeat(300) |
|
|
|
); |
|
|
|
); |
|
|
|
} |
|
|
|
} |
|
|
@ -134,15 +176,21 @@ fn test_invalid_encrypt() { |
|
|
|
let data = vec![0, 5, 8, 135, 67]; |
|
|
|
let data = vec![0, 5, 8, 135, 67]; |
|
|
|
let keys_1 = Keys::generate(); |
|
|
|
let keys_1 = Keys::generate(); |
|
|
|
let keys_2 = Keys::generate(); |
|
|
|
let keys_2 = Keys::generate(); |
|
|
|
assert!(keys_2.decrypt_data(&keys_1.get_public().encrypt_data(&data).unwrap()).is_err()); |
|
|
|
assert!(keys_2 |
|
|
|
|
|
|
|
.decrypt_data(&keys_1.get_public().encrypt_data(&data).unwrap()) |
|
|
|
|
|
|
|
.is_err()); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
#[test] |
|
|
|
#[test] |
|
|
|
fn test_signing() { |
|
|
|
fn test_signing() { |
|
|
|
let data = vec![0, 5, 8, 135, 67]; |
|
|
|
let data = vec![0, 5, 8, 135, 67]; |
|
|
|
let keys = Keys::generate(); |
|
|
|
let keys = Keys::generate(); |
|
|
|
assert!(keys.get_public().verify_sign(&data, &keys.sign(&data).unwrap())); |
|
|
|
assert!(keys |
|
|
|
assert!(keys.get_public().verify_sign(&data.repeat(340), &keys.sign(&data.repeat(340)).unwrap())); |
|
|
|
.get_public() |
|
|
|
|
|
|
|
.verify_sign(&data, &keys.sign(&data).unwrap())); |
|
|
|
|
|
|
|
assert!(keys |
|
|
|
|
|
|
|
.get_public() |
|
|
|
|
|
|
|
.verify_sign(&data.repeat(340), &keys.sign(&data.repeat(340)).unwrap())); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
#[test] |
|
|
|
#[test] |
|
|
@ -150,10 +198,15 @@ fn test_invalid_signing() { |
|
|
|
let data = vec![0, 5, 8, 135, 67]; |
|
|
|
let data = vec![0, 5, 8, 135, 67]; |
|
|
|
let keys_1 = Keys::generate(); |
|
|
|
let keys_1 = Keys::generate(); |
|
|
|
let keys_2 = Keys::generate(); |
|
|
|
let keys_2 = Keys::generate(); |
|
|
|
assert!(!keys_2.get_public().verify_sign(&data, &keys_1.sign(&data).unwrap())); |
|
|
|
assert!(!keys_2 |
|
|
|
|
|
|
|
.get_public() |
|
|
|
|
|
|
|
.verify_sign(&data, &keys_1.sign(&data).unwrap())); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
#[test] |
|
|
|
#[test] |
|
|
|
fn test_pkey_caching() { |
|
|
|
fn test_pkey_caching() { |
|
|
|
assert_ne!(Keys::generate().get_public().hash(), Keys::generate().get_public().hash()) |
|
|
|
assert_ne!( |
|
|
|
|
|
|
|
Keys::generate().get_public().hash(), |
|
|
|
|
|
|
|
Keys::generate().get_public().hash() |
|
|
|
|
|
|
|
) |
|
|
|
} |
|
|
|
} |
|
|
|