Implement PSS

Cargo.toml

@@ -21,6 +21,7 @@ rand = "0.6.5"
 byteorder = "1.3.1"
 failure = "0.1.5"
 subtle = "2.0.0"
+digest = "0.8"
 
 [dependencies.zeroize]
 version = "0.6"
@@ -34,10 +35,9 @@ features = ["std", "derive"]
 
 [dev-dependencies]
 base64 = "0.10.1"
-sha-1 = "0.8.1"
-sha2 = "0.8.0"
 hex = "0.3.2"
 serde_test = "1.0.89"
+sha-1 = "0.8.1"
 
 
 [[bench]]

src/algorithms.rs

@@ -110,3 +110,13 @@ pub fn generate_multi_prime_key<R: Rng>(
         primes,
     ))
 }
+
+#[inline]
+pub fn copy_with_left_pad(dest: &mut [u8], src: &[u8]) {
+    // left pad with zeros
+    let padding_bytes = dest.len() - src.len();
+    for el in dest.iter_mut().take(padding_bytes) {
+        *el = 0;
+    }
+    dest[padding_bytes..].copy_from_slice(src);
+}

src/hash.rs

@@ -5,7 +5,7 @@ pub trait Hash {
     fn size(&self) -> usize;
 
     /// Returns the ASN1 DER prefix for the the hash function.
-    fn asn1_prefix(&self) -> Vec<u8>;
+    fn asn1_prefix(&self) -> &'static [u8];
 }
 
 /// A list of provided hashes, implementing `Hash`.
@@ -41,50 +41,50 @@ impl Hash for Hashes {
         }
     }
 
-    fn asn1_prefix(&self) -> Vec<u8> {
+    fn asn1_prefix(&self) -> &'static [u8] {
         match *self {
-            Hashes::MD5 => vec![
+            Hashes::MD5 => &[
                 0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05,
                 0x05, 0x00, 0x04, 0x10,
             ],
-            Hashes::SHA1 => vec![
+            Hashes::SHA1 => &[
                 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04,
                 0x14,
             ],
-            Hashes::SHA2_224 => vec![
+            Hashes::SHA2_224 => &[
                 0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x04, 0x05, 0x00, 0x04, 0x1c,
             ],
-            Hashes::SHA2_256 => vec![
+            Hashes::SHA2_256 => &[
                 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x01, 0x05, 0x00, 0x04, 0x20,
             ],
-            Hashes::SHA2_384 => vec![
+            Hashes::SHA2_384 => &[
                 0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x02, 0x05, 0x00, 0x04, 0x30,
             ],
 
-            Hashes::SHA2_512 => vec![
+            Hashes::SHA2_512 => &[
                 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x03, 0x05, 0x00, 0x04, 0x40,
             ],
 
             // A special TLS case which doesn't use an ASN1 prefix
-            Hashes::MD5SHA1 => Vec::new(),
-            Hashes::RIPEMD160 => vec![
+            Hashes::MD5SHA1 => &[],
+            Hashes::RIPEMD160 => &[
                 0x30, 0x20, 0x30, 0x08, 0x06, 0x06, 0x28, 0xcf, 0x06, 0x03, 0x00, 0x31, 0x04, 0x14,
             ],
 
-            Hashes::SHA3_256 => vec![
+            Hashes::SHA3_256 => &[
                 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x08, 0x05, 0x00, 0x04, 0x20,
             ],
-            Hashes::SHA3_384 => vec![
+            Hashes::SHA3_384 => &[
                 30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x08, 0x05, 0x00, 0x04, 0x20,
             ],
 
-            Hashes::SHA3_512 => vec![
+            Hashes::SHA3_512 => &[
                 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
                 0x0a, 0x05, 0x00, 0x04, 0x40,
             ],

src/internals.rs

@@ -5,11 +5,11 @@ use std::borrow::Cow;
 use zeroize::Zeroize;
 
 use crate::errors::{Error, Result};
-use crate::key::{PublicKey, RSAPrivateKey};
+use crate::key::{RSAPublicKey, RSAPrivateKey};
 
 /// Raw RSA encryption of m with the public key. No padding is performed.
 #[inline]
-pub fn encrypt<K: PublicKey>(key: &K, m: &BigUint) -> BigUint {
+pub fn encrypt(key: &RSAPublicKey, m: &BigUint) -> BigUint {
     m.modpow(key.e(), key.n())
 }
 
@@ -125,7 +125,7 @@ pub fn decrypt_and_check<R: Rng>(
 }
 
 /// Returns the blinded c, along with the unblinding factor.
-pub fn blind<R: Rng, K: PublicKey>(rng: &mut R, key: &K, c: &BigUint) -> (BigUint, BigUint) {
+pub fn blind<R: Rng>(rng: &mut R, key: &RSAPublicKey, c: &BigUint) -> (BigUint, BigUint) {
     // Blinding involves multiplying c by r^e.
     // Then the decryption operation performs (m^e * r^e)^d mod n
     // which equals mr mod n. The factor of r can then be removed
@@ -162,7 +162,7 @@ pub fn blind<R: Rng, K: PublicKey>(rng: &mut R, key: &K, c: &BigUint) -> (BigUin
 }
 
 /// Given an m and and unblinding factor, unblind the m.
-pub fn unblind(key: impl PublicKey, m: &BigUint, unblinder: &BigUint) -> BigUint {
+pub fn unblind(key: &RSAPublicKey, m: &BigUint, unblinder: &BigUint) -> BigUint {
     (m * unblinder) % key.n()
 }