Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

support for pure-rust make credentials #563

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

support for pure-rust make credentials #563

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2f14766
bump rustcrypto dependencies to pre-release
baloo Jan 28, 2025
406f62f
Create credentials
baloo Jan 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,28 @@
[workspace]
resolver = "2"
members = ["tss-esapi", "tss-esapi-sys"]

[patch.crates-io]
p192 = { git = "https://github.com/RustCrypto/elliptic-curves.git" }
p224 = { git = "https://github.com/RustCrypto/elliptic-curves.git" }
sm2 = { git = "https://github.com/RustCrypto/elliptic-curves.git" }

# https://github.com/RustCrypto/KDFs/pull/108
concat-kdf = { git = "https://github.com/RustCrypto/KDFs.git" }

cfb-mode = { git = "https://github.com/RustCrypto/block-modes.git" }

# https://github.com/RustCrypto/RSA/pull/467
rsa = { git = "https://github.com/RustCrypto/RSA.git" }

# https://github.com/RustCrypto/traits/issues/1738
# https://github.com/RustCrypto/traits/pull/1742
# Pending release of crypto-common 0.2.0-rc.2
# Pending release of digest 0.11.0-rc.0
crypto-common = { git = "https://github.com/RustCrypto/traits.git" }
digest = { git = "https://github.com/RustCrypto/traits.git" }

# https://github.com/RustCrypto/block-ciphers/pull/465
aes = { git = "https://github.com/RustCrypto/block-ciphers.git" }
# Not actually in the graph, but a consumer should use the weak key detection there.
# des = { git = "https://github.com/RustCrypto/block-ciphers.git" }
52 changes: 31 additions & 21 deletions tss-esapi/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,40 +34,50 @@ hostname-validator = "1.1.0"
regex = "1.3.9"
zeroize = { version = "1.5.7", features = ["zeroize_derive"] }
tss-esapi-sys = { path = "../tss-esapi-sys", version = "0.5.0" }
x509-cert = { version = "0.2.0", optional = true }
ecdsa = { version = "0.16.9", features = ["der", "hazmat", "arithmetic", "verifying"], optional = true }
elliptic-curve = { version = "0.13.8", optional = true, features = ["alloc", "pkcs8"] }
p192 = { version = "0.13.0", optional = true }
p224 = { version = "0.13.2", optional = true }
p256 = { version = "0.13.2", optional = true }
p384 = { version = "0.13.0", optional = true }
p521 = { version = "0.13.3", optional = true }
pkcs8 = { version = "0.10.2", optional = true }
rsa = { version = "0.9", optional = true }
sha1 = { version = "0.10.6", optional = true }
sha2 = { version = "0.10.8", optional = true }
sha3 = { version = "0.10.8", optional = true }
sm2 = { version = "0.13.3", optional = true }
sm3 = { version = "0.4.2", optional = true }
digest = { version = "0.10.7", optional = true }
signature = { version = "2.2.0", features = ["std"], optional = true}
x509-cert = { version = "0.3.0-pre.0", optional = true }
aes = { version = "0.9.0-pre.2", optional = true }
cfb-mode = { version = "0.9.0-pre", optional = true }
ecdsa = { version = "0.17.0-pre.9", features = ["der", "hazmat", "arithmetic", "verifying"], optional = true }
elliptic-curve = { version = "0.14.0-rc.1", optional = true, features = ["alloc", "pkcs8"] }
hmac = { version = "0.13.0-pre.4", optional = true }
p192 = { version = "0.14.0-pre", optional = true }
p224 = { version = "0.14.0-pre", optional = true }
p256 = { version = "0.14.0-pre.2", optional = true }
p384 = { version = "0.14.0-pre.2", optional = true }
p521 = { version = "0.14.0-pre.2", optional = true }
pkcs8 = { version = "0.11.0-rc.1", optional = true }
rsa = { version = "0.10.0-pre.3", optional = true }
sha1 = { version = "0.11.0-pre.4", optional = true }
sha2 = { version = "0.11.0-pre.4", optional = true }
sha3 = { version = "0.11.0-pre.4", optional = true }
sm2 = { version = "0.14.0-pre", optional = true }
sm3 = { version = "0.5.0-pre.4", optional = true }
digest = { version = "0.11.0-pre.9", optional = true }
kbkdf = { version = "0.0.1", optional = true }
concat-kdf = { version = "0.2.0-pre", optional = true }
signature = { version = "2.3.0-pre.4", features = ["std"], optional = true}
cfg-if = "1.0.0"
strum = { version = "0.26.3", optional = true }
strum_macros = { version = "0.26.4", optional = true }
paste = "1.0.14"
getrandom = "0.2.11"
rand = "0.8"

[dev-dependencies]
aes = "0.9.0-pre.2"
env_logger = "0.11.5"
hex-literal = "0.4.1"
rsa = { version = "0.10.0-pre.3" }
serde_json = "^1.0.108"
sha2 = { version = "0.10.8", features = ["oid"] }
sha2 = { version = "0.11.0-pre.4", features = ["oid"] }
tss-esapi = { path = ".", features = [
"integration-tests",
"serde",
"abstraction",
"rustcrypto-full",
] }
x509-cert = { version = "0.2.0", features = ["builder"] }
p256 = { version = "0.14.0-pre.2", features = ["ecdh"] }
x509-cert = { version = "0.3.0-pre.0", features = ["builder"] }

[build-dependencies]
semver = "1.0.7"
Expand All @@ -78,5 +88,5 @@ generate-bindings = ["tss-esapi-sys/generate-bindings"]
abstraction = ["rustcrypto"]
integration-tests = ["strum", "strum_macros"]

rustcrypto = ["digest", "ecdsa", "elliptic-curve", "pkcs8", "signature", "x509-cert"]
rustcrypto-full = ["rustcrypto", "p192", "p224", "p256", "p384", "p521", "rsa", "sha1", "sha2", "sha3", "sm2", "sm3"]
rustcrypto = ["cfb-mode", "concat-kdf", "digest", "ecdsa", "elliptic-curve", "pkcs8", "signature", "x509-cert"]
rustcrypto-full = ["rustcrypto", "aes", "p192", "p224", "p256", "p384", "p521", "rsa", "sha1", "sha2", "sha3", "sm2", "sm3"]
44 changes: 24 additions & 20 deletions tss-esapi/src/abstraction/public.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ use crate::{Error, WrapperErrorKind};

use core::convert::TryFrom;
use elliptic_curve::{
generic_array::typenum::Unsigned,
array::typenum::Unsigned,
sec1::{EncodedPoint, FromEncodedPoint, ModulusSize, ToEncodedPoint},
AffinePoint, CurveArithmetic, FieldBytesSize, PublicKey,
};
Expand All @@ -18,7 +18,7 @@ use x509_cert::spki::SubjectPublicKeyInfoOwned;
#[cfg(feature = "rsa")]
use {
crate::structures::RsaExponent,
rsa::{BigUint, RsaPublicKey},
rsa::{BoxedUint, RsaPublicKey},
};

#[cfg(any(
Expand Down Expand Up @@ -57,15 +57,13 @@ where
let x = unique.x().as_bytes();
let y = unique.y().as_bytes();

if x.len() != FieldBytesSize::<C>::USIZE {
return Err(Error::local_error(WrapperErrorKind::InvalidParam));
}
if y.len() != FieldBytesSize::<C>::USIZE {
return Err(Error::local_error(WrapperErrorKind::InvalidParam));
}

let encoded_point =
EncodedPoint::<C>::from_affine_coordinates(x.into(), y.into(), false);
let encoded_point = EncodedPoint::<C>::from_affine_coordinates(
x.try_into()
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?,
y.try_into()
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?,
false,
);
let public_key = PublicKey::<C>::try_from(&encoded_point)
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?;

Expand All @@ -86,10 +84,11 @@ impl TryFrom<&Public> for RsaPublicKey {
unique, parameters, ..
} => {
let exponent = match parameters.exponent() {
RsaExponent::ZERO_EXPONENT => BigUint::from(RSA_DEFAULT_EXP),
_ => BigUint::from(parameters.exponent().value()),
RsaExponent::ZERO_EXPONENT => BoxedUint::from(RSA_DEFAULT_EXP),
_ => BoxedUint::from(parameters.exponent().value()),
};
let modulus = BigUint::from_bytes_be(unique.as_bytes());
let modulus = BoxedUint::from_be_slice(unique.as_bytes(), 8192)
.map_err(|_| Error::local_error(WrapperErrorKind::WrongParamSize))?;

let public_key = RsaPublicKey::new(modulus, exponent)
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?;
Expand Down Expand Up @@ -173,17 +172,21 @@ where
let x = x.as_slice();
let y = y.as_slice();

// TODO: When elliptic_curve bumps to 0.14, we can use the TryFrom implementation instead
// of checking lengths manually
if x.len() != FieldBytesSize::<C>::USIZE {
return Err(Error::local_error(WrapperErrorKind::InvalidParam));
}
if y.len() != FieldBytesSize::<C>::USIZE {
return Err(Error::local_error(WrapperErrorKind::InvalidParam));
}

let encoded_point =
EncodedPoint::<C>::from_affine_coordinates(x.into(), y.into(), false);
let encoded_point = EncodedPoint::<C>::from_affine_coordinates(
x.try_into()
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?,
y.try_into()
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?,
false,
);

let public_key = PublicKey::<C>::try_from(&encoded_point)
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?;

Expand All @@ -201,8 +204,9 @@ impl TryFrom<&TpmPublicKey> for RsaPublicKey {
fn try_from(value: &TpmPublicKey) -> Result<Self, Self::Error> {
match value {
TpmPublicKey::Rsa(modulus) => {
let exponent = BigUint::from(RSA_DEFAULT_EXP);
let modulus = BigUint::from_bytes_be(modulus.as_slice());
let exponent = BoxedUint::from(RSA_DEFAULT_EXP);
let modulus = BoxedUint::from_be_slice(modulus.as_slice(), 8192)
.map_err(|_| Error::local_error(WrapperErrorKind::WrongParamSize))?;

let public_key = RsaPublicKey::new(modulus, exponent)
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?;
Expand Down
16 changes: 10 additions & 6 deletions tss-esapi/src/abstraction/signatures.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ use crate::{structures::EccSignature, Error, Result, WrapperErrorKind};

use std::convert::TryFrom;

use ecdsa::SignatureSize;
use ecdsa::{EcdsaCurve, SignatureSize};
use elliptic_curve::{
generic_array::{typenum::Unsigned, ArrayLength},
array::{typenum::Unsigned, ArraySize},
FieldBytes, FieldBytesSize, PrimeCurve,
};

Expand All @@ -16,8 +16,8 @@ use crate::structures::Signature;

impl<C> TryFrom<EccSignature> for ecdsa::Signature<C>
where
C: PrimeCurve,
SignatureSize<C>: ArrayLength<u8>,
C: PrimeCurve + EcdsaCurve,
SignatureSize<C>: ArraySize,
{
type Error = Error;

Expand All @@ -33,8 +33,12 @@ where
}

let signature = ecdsa::Signature::from_scalars(
FieldBytes::<C>::from_slice(r).clone(),
FieldBytes::<C>::from_slice(s).clone(),
FieldBytes::<C>::try_from(r)
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?
.clone(),
FieldBytes::<C>::try_from(s)
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?
.clone(),
)
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?;
Ok(signature)
Expand Down
Loading
Loading