Skip to content

Commit f788e02

Browse files
lulflulf
authored
Merge pull request #139 from MathiasKoch/fix/additional-signature-algos
Add three additional signature algorithms, offered by atleast AWS
2 parents d7c9b93 + 9b3c9d7 commit f788e02

14 files changed

+95
-49
lines changed

‎src/config.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ where
124124
pub struct TlsConfig<'a> {
125125
pub(crate) server_name: Option<&'a str>,
126126
pub(crate) psk: Option<(&'a [u8], Vec<&'a [u8], 4>)>,
127-
pub(crate) signature_schemes: Vec<SignatureScheme, 16>,
127+
pub(crate) signature_schemes: Vec<SignatureScheme, 19>,
128128
pub(crate) named_groups: Vec<NamedGroup, 16>,
129129
pub(crate) max_fragment_length: Option<MaxFragmentLength>,
130130
pub(crate) ca: Option<Certificate<'a>>,

‎src/extensions/extension_data/signature_algorithms.rs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ pub enum SignatureScheme {
3333
RsaPssPssSha384 = 0x080a,
3434
RsaPssPssSha512 = 0x080b,
3535

36+
Sha224Ecdsa = 0x0303,
37+
Sha224Rsa = 0x0301,
38+
Sha224Dsa = 0x0302,
39+
3640
/* Legacy algorithms */
3741
RsaPkcs1Sha1 = 0x0201,
3842
EcdsaSha1 = 0x0203,
@@ -63,6 +67,10 @@ impl SignatureScheme {
6367
0x080a => Ok(Self::RsaPssPssSha384),
6468
0x080b => Ok(Self::RsaPssPssSha512),
6569

70+
0x0303 => Ok(Self::Sha224Ecdsa),
71+
0x0301 => Ok(Self::Sha224Rsa),
72+
0x0302 => Ok(Self::Sha224Dsa),
73+
6674
0x0201 => Ok(Self::RsaPkcs1Sha1),
6775
0x0203 => Ok(Self::EcdsaSha1),
6876
_ => Err(ParseError::InvalidData),

‎src/extensions/messages.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,12 @@ extension_group! {
1919
pub enum ClientHelloExtension<'a> {
2020
ServerName(ServerNameList<'a, 1>),
2121
SupportedVersions(SupportedVersionsClientHello<16>),
22-
SignatureAlgorithms(SignatureAlgorithms<16>),
22+
SignatureAlgorithms(SignatureAlgorithms<19>),
2323
SupportedGroups(SupportedGroups<16>),
2424
KeyShare(KeyShareClientHello<'a, 1>),
2525
PreSharedKey(PreSharedKeyClientHello<'a, 4>),
2626
PskKeyExchangeModes(PskKeyExchangeModes<4>),
27-
SignatureAlgorithmsCert(SignatureAlgorithmsCert<16>),
27+
SignatureAlgorithmsCert(SignatureAlgorithmsCert<19>),
2828
MaxFragmentLength(MaxFragmentLength),
2929
StatusRequest(Unimplemented<'a>),
3030
UseSrtp(Unimplemented<'a>),
@@ -71,7 +71,7 @@ extension_group! {
7171
extension_group! {
7272
pub enum CertificateRequestExtension<'a> {
7373
StatusRequest(Unimplemented<'a>),
74-
SignatureAlgorithms(SignatureAlgorithms<16>),
74+
SignatureAlgorithms(SignatureAlgorithms<19>),
7575
SignedCertificateTimestamp(Unimplemented<'a>),
7676
CertificateAuthorities(Unimplemented<'a>),
7777
OidFilters(Unimplemented<'a>),

‎src/handshake/certificate_request.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ impl<'a> CertificateRequestRef<'a> {
3434
#[cfg_attr(feature = "defmt", derive(defmt::Format))]
3535
pub struct CertificateRequest {
3636
pub(crate) request_context: Vec<u8, 256>,
37-
pub(crate) signature_algorithms: Option<SignatureAlgorithms<16>>,
37+
pub(crate) signature_algorithms: Option<SignatureAlgorithms<19>>,
3838
}
3939

4040
impl<'a> TryFrom<CertificateRequestRef<'a>> for CertificateRequest {

‎src/webpki.rs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,10 @@ impl TryInto<&'static webpki::SignatureAlgorithm> for SignatureScheme {
3434
SignatureScheme::Ed25519 => Ok(&webpki::ED25519),
3535
SignatureScheme::Ed448 => Err(TlsError::InvalidSignatureScheme),
3636

37+
SignatureScheme::Sha224Ecdsa => Err(TlsError::InvalidSignatureScheme),
38+
SignatureScheme::Sha224Rsa => Err(TlsError::InvalidSignatureScheme),
39+
SignatureScheme::Sha224Dsa => Err(TlsError::InvalidSignatureScheme),
40+
3741
/* RSASSA-PSS algorithms with public key OID RSASSA-PSS */
3842
SignatureScheme::RsaPssPssSha256 => Err(TlsError::InvalidSignatureScheme),
3943
SignatureScheme::RsaPssPssSha384 => Err(TlsError::InvalidSignatureScheme),
@@ -69,6 +73,10 @@ impl TryInto<&'static webpki::SignatureAlgorithm> for SignatureScheme {
6973
SignatureScheme::Ed25519 => Ok(&webpki::ED25519),
7074
SignatureScheme::Ed448 => Err(TlsError::InvalidSignatureScheme),
7175

76+
SignatureScheme::Sha224Ecdsa => Err(TlsError::InvalidSignatureScheme),
77+
SignatureScheme::Sha224Rsa => Err(TlsError::InvalidSignatureScheme),
78+
SignatureScheme::Sha224Dsa => Err(TlsError::InvalidSignatureScheme),
79+
7280
/* RSASSA-PSS algorithms with public key OID RSASSA-PSS */
7381
SignatureScheme::RsaPssPssSha256 => Err(TlsError::InvalidSignatureScheme),
7482
SignatureScheme::RsaPssPssSha384 => Err(TlsError::InvalidSignatureScheme),

‎tests/data/ca-cert.pem

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIB2TCCAX+gAwIBAgIUZ+9dtzTSadaW+FC4m8dOGL40eBMwCgYIKoZIzj0EAwIw
3-
QjELMAkGA1UEBhMCWFgxFTATBgNVBAcMDERlZmF1bHQgQ2l0eTEcMBoGA1UECgwT
4-
RGVmYXVsdCBDb21wYW55IEx0ZDAeFw0yMTEwMTMwODIwNDJaFw0zMTEwMTEwODIw
5-
NDJaMEIxCzAJBgNVBAYTAlhYMRUwEwYDVQQHDAxEZWZhdWx0IENpdHkxHDAaBgNV
6-
BAoME0RlZmF1bHQgQ29tcGFueSBMdGQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC
7-
AARwQ/jWAMuCH4qbcYVntGyq4RCYKiWiN9cVXKOnnDbSfIXS8IGnF7PFrCOck9yx
8-
4A7Pfo/00rTf0x1/NKNOV5nio1MwUTAdBgNVHQ4EFgQU7HQ64pisg1MasN9wSLE/
9-
LC6PcjowHwYDVR0jBBgwFoAU7HQ64pisg1MasN9wSLE/LC6PcjowDwYDVR0TAQH/
10-
BAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiBMip1366r3oWgJFzkkmh3Sf2te54G5
11-
KWs0PcVLaoNiuAIhAIx5dhXti2FEQ4mkZUKaqxfH5GdboZa6JEv2yYTd6ZvK
2+
MIIB4TCCAYegAwIBAgIUQg+MEmSRVTK2bmxap0ML1hrSlWYwCgYIKoZIzj0EAwIw
3+
RTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGElu
4+
dGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAgFw0yNDAzMTUxMDA0MTRaGA8yMDUxMDgw
5+
MTEwMDQxNFowRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAf
6+
BgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDBZMBMGByqGSM49AgEGCCqG
7+
SM49AwEHA0IABB2pswE2gtPH89n4Wt0G4s8DomZAB7nkUgUOt5cs6vEJLoPTiPo8
8+
3KXH3neFwooXK1OX+pCtwyun+EMDxbzZAyujUzBRMB0GA1UdDgQWBBTCzl8UW2Kl
9+
0hJcSAmVz0/TKyCdXDAfBgNVHSMEGDAWgBTCzl8UW2Kl0hJcSAmVz0/TKyCdXDAP
10+
BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0gAMEUCIECp2SXHt3BkjkxCovuE
11+
5v8TmyuZqgyte95t9B28kDExAiEAqSM8ngckj9JqgKUijOMRYIE+frU9RtlawtUi
12+
7n2KQV0=
1213
-----END CERTIFICATE-----

‎tests/data/ca-key.pem

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
-----BEGIN PRIVATE KEY-----
2-
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgb2Ff7kE1XJA3FKLl
3-
sNqHvI6ALhbh3pZjzeWTa+BrfvKhRANCAARwQ/jWAMuCH4qbcYVntGyq4RCYKiWi
4-
N9cVXKOnnDbSfIXS8IGnF7PFrCOck9yx4A7Pfo/00rTf0x1/NKNOV5ni
5-
-----END PRIVATE KEY-----
1+
-----BEGIN EC PRIVATE KEY-----
2+
MHcCAQEEINFi5sVVW/2beOSKPlg8ef4Daez9wW2md3vBQ/XGzxKmoAoGCCqGSM49
3+
AwEHoUQDQgAEHamzATaC08fz2fha3QbizwOiZkAHueRSBQ63lyzq8Qkug9OI+jzc
4+
pcfed4XCihcrU5f6kK3DK6f4QwPFvNkDKw==
5+
-----END EC PRIVATE KEY-----

‎tests/data/client-cert.pem

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIBzDCCAXGgAwIBAgIUVB+wKMT9vfrrgAOVt5qON8J8onMwCgYIKoZIzj0EAwIw
3-
QjELMAkGA1UEBhMCWFgxFTATBgNVBAcMDERlZmF1bHQgQ2l0eTEcMBoGA1UECgwT
4-
RGVmYXVsdCBDb21wYW55IEx0ZDAeFw0yNDAyMDkwOTI3NDlaFw0yNDAzMTAwOTI3
5-
NDlaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQK
6-
DBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggqhkjOPQMB
7-
BwNCAAQzXKrX05qlw3NP1k6+kSiTnmI6Mo3ffT6VY71oPQIcqYiD1+hY7tIkk9kV
8-
ke11ZNdGZR0r/o+4TzYJcxcgkNhLo0IwQDAdBgNVHQ4EFgQUBH7ViSdnDzmkYtsO
9-
/f+BpHjeJHcwHwYDVR0jBBgwFoAU7HQ64pisg1MasN9wSLE/LC6PcjowCgYIKoZI
10-
zj0EAwIDSQAwRgIhAONbHGkd+/wpgELOk/az5ELfrB7YO2o4a6Uix5KQOnARAiEA
11-
tDGyTnCEmHjB/GGsLwLa8DRplNXFESDH2erfhutw8ME=
2+
MIIBzTCCAXSgAwIBAgIUGQYrxI6lMa1yflVNpTO7VPPEwSgwCgYIKoZIzj0EAwIw
3+
RTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGElu
4+
dGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNDAzMTUxMDA0MTVaFw0yNjEyMTAx
5+
MDA0MTVaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYD
6+
VQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggqhkjO
7+
PQMBBwNCAATBRnKMD+6BTcFuurE4Qt4pMgjUaWLOP/kTdGzyaZkVlPfp0fIKTRKv
8+
EgHJlmTjsZfHkIm7nVD078BrfRoP6DqIo0IwQDAdBgNVHQ4EFgQUghgnu06bRUBN
9+
bZHPn38zSTpb70UwHwYDVR0jBBgwFoAUws5fFFtipdISXEgJlc9P0ysgnVwwCgYI
10+
KoZIzj0EAwIDRwAwRAIgOu6eFOYVbuWpIyDs2WrLXqHybAYlv4y4qqD6LZtITawC
11+
IHNgKyB1PNV0CN7VOexBVJQv4edB8etbVxAF+WqztDT+
1212
-----END CERTIFICATE-----

‎tests/data/client-key.pem

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
-----BEGIN EC PRIVATE KEY-----
2-
MHcCAQEEIIMoxSnX9BbbgLSGk2rVi0o+NLwzisbbfce/pLGkHwvooAoGCCqGSM49
3-
AwEHoUQDQgAEM1yq19OapcNzT9ZOvpEok55iOjKN330+lWO9aD0CHKmIg9foWO7S
4-
JJPZFZHtdWTXRmUdK/6PuE82CXMXIJDYSw==
2+
MHcCAQEEIFllWPnIPExTk23tY4nSbss9UJ3EgDG91qZqajC/FBrkoAoGCCqGSM49
3+
AwEHoUQDQgAEwUZyjA/ugU3BbrqxOELeKTII1Glizj/5E3Rs8mmZFZT36dHyCk0S
4+
rxIByZZk47GXx5CJu51Q9O/Aa30aD+g6iA==
55
-----END EC PRIVATE KEY-----

‎tests/data/client.csr

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
-----BEGIN CERTIFICATE REQUEST-----
2+
MIH/MIGnAgEAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
3+
HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggq
4+
hkjOPQMBBwNCAATBRnKMD+6BTcFuurE4Qt4pMgjUaWLOP/kTdGzyaZkVlPfp0fIK
5+
TRKvEgHJlmTjsZfHkIm7nVD078BrfRoP6DqIoAAwCgYIKoZIzj0EAwIDRwAwRAIg
6+
Lz4amy52zltB01+MsIbEs0prvo3IscABIjJ5fmDbfKwCIBIHDrmrMLpSQmC6IhtD
7+
dbx7onV8yn6akJxA8tYjW6em
8+
-----END CERTIFICATE REQUEST-----

‎tests/data/gen_certs_and_keys.sh

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Create CA private key and certificate
2+
openssl ecparam -name prime256v1 -genkey -noout -out ca-key.pem
3+
openssl req -new -x509 -sha256 -key ca-key.pem -days 10000 -out ca-cert.pem
4+
5+
6+
# Create private key, certificate signing request (CSR) and certificate for client
7+
openssl ecparam -name prime256v1 -genkey -noout -out client-key.pem
8+
openssl req -new -sha256 -key client-key.pem -out client.csr
9+
openssl x509 -req -in client.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 1000 -sha256
10+
11+
# Create private key, certificate signing request (CSR) and certificate for server
12+
openssl ecparam -name prime256v1 -genkey -noout -out server-key.pem
13+
openssl req -new -sha256 -key server-key.pem -out server.csr
14+
openssl x509 -req -in server.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 10000 -sha256

‎tests/data/server-cert.pem

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
-----BEGIN CERTIFICATE-----
2-
MIICBjCCAa2gAwIBAgIULDyCYYteka2S6hEC2890o7k+0Z0wCgYIKoZIzj0EAwIw
3-
QjELMAkGA1UEBhMCWFgxFTATBgNVBAcMDERlZmF1bHQgQ2l0eTEcMBoGA1UECgwT
4-
RGVmYXVsdCBDb21wYW55IEx0ZDAeFw0yMTEwMTMwODIwNDJaFw0zMTEwMTEwODIw
5-
NDJaMHIxCzAJBgNVBAYTAk5PMQ4wDAYDVQQIDAVIYW1hcjEOMAwGA1UEBwwFSGFt
6-
YXIxGDAWBgNVBAoMD0dsb2JhbCBTZWN1cml0eTEVMBMGA1UECwwMSG9sc2V0YmFr
7-
a2VuMRIwEAYDVQQDDAlsb2NhbGhvc3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC
8-
AATEmfbzqqHiZwCKXgEfjAWjk6zPlK9Fs3bXfjo2gt1NuqA4yCdOULKa6aIFHyAv
9-
fM3zHNiL5vk5pbBtzja6vaIjo1EwTzAfBgNVHSMEGDAWgBTsdDrimKyDUxqw33BI
10-
sT8sLo9yOjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIE8DAUBgNVHREEDTALgglsb2Nh
11-
bGhvc3QwCgYIKoZIzj0EAwIDRwAwRAIgbzQX/FohpbrME+QE6bo0UrYdXI1hSaSs
12-
8yjdM7dr4HoCIEM+dbqDGm+QG+tkhH7jB35czbBWmC/Y5ObMM29i/u2h
2+
MIIBzzCCAXagAwIBAgIUGQYrxI6lMa1yflVNpTO7VPPEwSkwCgYIKoZIzj0EAwIw
3+
RTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGElu
4+
dGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAgFw0yNDAzMTUxMDA0MTdaGA8yMDUxMDgw
5+
MTEwMDQxN1owRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAf
6+
BgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDBZMBMGByqGSM49AgEGCCqG
7+
SM49AwEHA0IABETSCUisGGdCnccDgjSkSnk7W9AwUJVV4fLeP7c0G1QH1KBjQFib
8+
fOiWiVi28vSFmqjsTDIMx9kdWLeUnBi9zwGjQjBAMB0GA1UdDgQWBBQDKzwiywv5
9+
9mVBb18zMizxhf9YgzAfBgNVHSMEGDAWgBTCzl8UW2Kl0hJcSAmVz0/TKyCdXDAK
10+
BggqhkjOPQQDAgNHADBEAiBRY8JvchuVF8+3ZKKHK5479LHIKGrLunjAiUct6x9J
11+
nQIgXzQlpSfpbSiZJc1vyfePkiyiDq02t3TQg7vhpmZeonU=
1312
-----END CERTIFICATE-----

‎tests/data/server-key.pem

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
-----BEGIN PRIVATE KEY-----
2-
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgKoaBrAdXxdzKFph6
3-
tXe2+WYYMV0HUz9KWdnz81f38YKhRANCAATEmfbzqqHiZwCKXgEfjAWjk6zPlK9F
4-
s3bXfjo2gt1NuqA4yCdOULKa6aIFHyAvfM3zHNiL5vk5pbBtzja6vaIj
5-
-----END PRIVATE KEY-----
1+
-----BEGIN EC PRIVATE KEY-----
2+
MHcCAQEEINr4rPfkzpj7lJtJSoAwhLlTw5EQbHq+prwpWL5NlUlHoAoGCCqGSM49
3+
AwEHoUQDQgAERNIJSKwYZ0KdxwOCNKRKeTtb0DBQlVXh8t4/tzQbVAfUoGNAWJt8
4+
6JaJWLby9IWaqOxMMgzH2R1Yt5ScGL3PAQ==
5+
-----END EC PRIVATE KEY-----

‎tests/data/server.csr

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
-----BEGIN CERTIFICATE REQUEST-----
2+
MIH/MIGnAgEAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
3+
HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggq
4+
hkjOPQMBBwNCAARE0glIrBhnQp3HA4I0pEp5O1vQMFCVVeHy3j+3NBtUB9SgY0BY
5+
m3zololYtvL0hZqo7EwyDMfZHVi3lJwYvc8BoAAwCgYIKoZIzj0EAwIDRwAwRAIg
6+
PrWAWWiMXPKHsx6zzEkzzonesjnUJc3YsbGfmGn8xXACIHLTD3XYL/X1Naoi1CMq
7+
nNcthxjBCwiHfVB2cqaf8N19
8+
-----END CERTIFICATE REQUEST-----

0 commit comments

Comments
 (0)