Integrate OAEP and PSS into existing interface

Cargo.toml

@@ -22,7 +22,9 @@ byteorder = "1.3.1"
 thiserror = "1.0.11"
 subtle = "2.0.0"
 simple_asn1 = "0.4"
-pem = { version = "0.7", optional = true }
+pem = { version = "0.8", optional = true }
+digest = { version = "0.9.0", features = ["std"] }
+sha2 = "0.9.0"
 
 [dependencies.zeroize]
 version = "1.1.0"
@@ -36,13 +38,13 @@ default-features = false
 features = ["std", "derive"]
 
 [dev-dependencies]
-base64 = "0.11.0"
-sha-1 = "0.8.1"
-sha2 = "0.8.0"
+base64 = "0.12.0"
 hex = "0.4.0"
 serde_test = "1.0.89"
 rand_xorshift = "0.2.0"
-pem = "0.7"
+pem = "0.8"
+sha-1 = "0.9.0"
+sha3 = "0.9.0"
 
 [[bench]]
 name = "key"

README.md

@@ -9,23 +9,21 @@ A portable RSA implementation in pure Rust.
 ## Example
 
 ```rust
-extern crate rsa;
-extern crate rand;
-
 use rsa::{PublicKey, RSAPrivateKey, PaddingScheme};
 use rand::rngs::OsRng;
 
 let mut rng = OsRng;
 let bits = 2048;
-let key = RSAPrivateKey::new(&mut rng, bits).expect("failed to generate a key");
+let priv_key = RSAPrivateKey::new(&mut rng, bits).expect("failed to generate a key");
+let pub_key = RSAPublicKey::from(&private_key);
 
 // Encrypt
 let data = b"hello world";
-let enc_data = key.encrypt(&mut rng, PaddingScheme::PKCS1v15, &data[..]).expect("failed to encrypt");
+let enc_data = pub_key.encrypt(&mut rng, PaddingScheme::new_pkcs1v15(), &data[..]).expect("failed to encrypt");
 assert_ne!(&data[..], &enc_data[..]);
 
 // Decrypt
-let dec_data = key.decrypt(PaddingScheme::PKCS1v15, &enc_data).expect("failed to decrypt");
+let dec_data = priv_key.decrypt(PaddingScheme::new_pkcs1v15(), &enc_data).expect("failed to decrypt");
 assert_eq!(&data[..], &dec_data[..]);
 ```
 
@@ -41,8 +39,8 @@ There will be three phases before `1.0` :ship: can be released.
     - [x] PKCS1v1.5: Encryption & Decryption :white_check_mark:
     - [x] PKCS1v1.5: Sign & Verify :white_check_mark:
     - [ ] PKCS1v1.5 (session key): Encryption & Decryption
-    - [ ] OAEP: Encryption & Decryption
-    - [ ] PSS: Sign & Verify
+    - [x] OAEP: Encryption & Decryption
+    - [x] PSS: Sign & Verify
     - [x] Key import & export
 2. :rocket: Make it fast
     - [x] Benchmarks :white_check_mark:

benches/key.rs

@@ -6,9 +6,7 @@ use base64;
 use num_bigint::BigUint;
 use num_traits::{FromPrimitive, Num};
 use rand::{rngs::StdRng, SeedableRng};
-use rsa::hash::Hashes;
-use rsa::padding::PaddingScheme;
-use rsa::RSAPrivateKey;
+use rsa::{Hash, PaddingScheme, RSAPrivateKey};
 use sha2::{Digest, Sha256};
 use test::Bencher;
 
@@ -33,7 +31,9 @@ fn bench_rsa_2048_pkcsv1_decrypt(b: &mut Bencher) {
     let x = base64::decode(DECRYPT_VAL).unwrap();
 
     b.iter(|| {
-        let res = priv_key.decrypt(PaddingScheme::PKCS1v15, &x).unwrap();
+        let res = priv_key
+            .decrypt(PaddingScheme::new_pkcs1v15_encrypt(), &x)
+            .unwrap();
         test::black_box(res);
     });
 }
@@ -48,8 +48,7 @@ fn bench_rsa_2048_pkcsv1_sign_blinded(b: &mut Bencher) {
         let res = priv_key
             .sign_blinded(
                 &mut rng,
-                PaddingScheme::PKCS1v15,
-                Some(&Hashes::SHA2_256),
+                PaddingScheme::new_pkcs1v15_sign(Some(Hash::SHA2_256)),
                 &digest,
             )
             .unwrap();

src/algorithms.rs

@@ -1,3 +1,4 @@
+use digest::DynDigest;
 use num_bigint::traits::ModInverse;
 use num_bigint::{BigUint, RandPrime};
 use num_traits::{FromPrimitive, One, Zero};
@@ -110,3 +111,44 @@ pub fn generate_multi_prime_key<R: Rng>(
         primes,
     ))
 }
+
+/// Mask generation function.
+///
+/// Panics if out is larger than 2**32. This is in accordance with RFC 8017 - PKCS #1 B.2.1
+pub fn mgf1_xor(out: &mut [u8], digest: &mut dyn DynDigest, seed: &[u8]) {
+    let mut counter = [0u8; 4];
+    let mut i = 0;
+
+    const MAX_LEN: u64 = std::u32::MAX as u64 + 1;
+    assert!(out.len() as u64 <= MAX_LEN);
+
+    while i < out.len() {
+        let mut digest_input = vec![0u8; seed.len() + 4];
+        digest_input[0..seed.len()].copy_from_slice(seed);
+        digest_input[seed.len()..].copy_from_slice(&counter);
+
+        digest.update(digest_input.as_slice());
+        let digest_output = &*digest.finalize_reset();
+        let mut j = 0;
+        loop {
+            if j >= digest_output.len() || i >= out.len() {
+                break;
+            }
+
+            out[i] ^= digest_output[j];
+            j += 1;
+            i += 1;
+        }
+        inc_counter(&mut counter);
+    }
+}
+
+fn inc_counter(counter: &mut [u8; 4]) {
+    for i in (0..4).rev() {
+        counter[i] = counter[i].wrapping_add(1);
+        if counter[i] != 0 {
+            // No overflow
+            return;
+        }
+    }
+}

src/errors.rs

@@ -35,4 +35,6 @@ pub enum Error {
     ParseError { reason: String },
     #[error("internal error")]
     Internal,
+    #[error("label too long")]
+    LabelTooLong,
 }

src/hash.rs

@@ -1,16 +1,6 @@
-/// A generic trait that exposes the information that is needed for a hash function to be
-/// used in `sign` and `verify.`.
-pub trait Hash {
-    /// Returns the length in bytes of a digest.
-    fn size(&self) -> usize;
-
-    /// Returns the ASN1 DER prefix for the the hash function.
-    fn asn1_prefix(&self) -> Vec<u8>;
-}
-
 /// A list of provided hashes, implementing `Hash`.
 #[derive(Debug, Clone, Copy)]
-pub enum Hashes {
+pub enum Hash {
     MD5,
     SHA1,
     SHA2_224,
@@ -24,67 +14,69 @@ pub enum Hashes {
     RIPEMD160,
 }
 
-impl Hash for Hashes {
-    fn size(&self) -> usize {
+impl Hash {
+    /// Returns the length in bytes of a digest.
+    pub fn size(&self) -> usize {
         match *self {
-            Hashes::MD5 => 16,
-            Hashes::SHA1 => 20,
-            Hashes::SHA2_224 => 28,
-            Hashes::SHA2_256 => 32,
-            Hashes::SHA2_384 => 48,
-            Hashes::SHA2_512 => 64,
-            Hashes::SHA3_256 => 32,
-            Hashes::SHA3_384 => 48,
-            Hashes::SHA3_512 => 64,
-            Hashes::MD5SHA1 => 36,
-            Hashes::RIPEMD160 => 20,
+            Hash::MD5 => 16,
+            Hash::SHA1 => 20,
+            Hash::SHA2_224 => 28,
+            Hash::SHA2_256 => 32,
+            Hash::SHA2_384 => 48,
+            Hash::SHA2_512 => 64,
+            Hash::SHA3_256 => 32,
+            Hash::SHA3_384 => 48,
+            Hash::SHA3_512 => 64,
+            Hash::MD5SHA1 => 36,
+            Hash::RIPEMD160 => 20,
         }
     }
 
-    fn asn1_prefix(&self) -> Vec<u8> {
+    /// Returns the ASN1 DER prefix for the the hash function.
+    pub fn asn1_prefix(&self) -> &'static [u8] {
         match *self {
-            Hashes::MD5 => vec![
+            Hash::MD5 => &[
                 0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05,
                 0x05, 0x00, 0x04, 0x10,
             ],
-            Hashes::SHA1 => vec![
+            Hash::SHA1 => &[
                 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04,
                 0x14,
             ],
-            Hashes::SHA2_224 => vec![
+            Hash::SHA2_224 => &[
                 0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x04, 0x05, 0x00, 0x04, 0x1c,
             ],
-            Hashes::SHA2_256 => vec![
+            Hash::SHA2_256 => &[
                 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x01, 0x05, 0x00, 0x04, 0x20,
             ],
-            Hashes::SHA2_384 => vec![
+            Hash::SHA2_384 => &[
                 0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x02, 0x05, 0x00, 0x04, 0x30,
             ],
 
-            Hashes::SHA2_512 => vec![
+            Hash::SHA2_512 => &[
                 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x03, 0x05, 0x00, 0x04, 0x40,
             ],
 
             // A special TLS case which doesn't use an ASN1 prefix
-            Hashes::MD5SHA1 => Vec::new(),
-            Hashes::RIPEMD160 => vec![
+            Hash::MD5SHA1 => &[],
+            Hash::RIPEMD160 => &[
                 0x30, 0x20, 0x30, 0x08, 0x06, 0x06, 0x28, 0xcf, 0x06, 0x03, 0x00, 0x31, 0x04, 0x14,
             ],
 
-            Hashes::SHA3_256 => vec![
+            Hash::SHA3_256 => &[
                 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x08, 0x05, 0x00, 0x04, 0x20,
             ],
-            Hashes::SHA3_384 => vec![
+            Hash::SHA3_384 => &[
                 30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x08, 0x05, 0x00, 0x04, 0x20,
             ],
 
-            Hashes::SHA3_512 => vec![
+            Hash::SHA3_512 => &[
                 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x0a, 0x05, 0x00, 0x04, 0x40,
             ],