Skip to content

Commit a68557d

Browse files
baloobaloo
committed
use a session ref
Signed-off-by: Arthur Gautier <[email protected]>
1 parent 713ab62 commit a68557d

File tree

7 files changed

+88
-48
lines changed

7 files changed

+88
-48
lines changed

‎cryptoki-rustcrypto/src/ecdsa.rs

+11-10
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
use cryptoki::{
22
mechanism::Mechanism,
33
object::{Attribute, AttributeType, KeyType, ObjectClass, ObjectHandle},
4-
session::Session,
54
};
65
use der::{
76
asn1::{ObjectIdentifier, OctetStringRef},
@@ -25,6 +24,8 @@ use spki::{
2524
use std::{convert::TryFrom, ops::Add};
2625
use thiserror::Error;
2726

27+
use crate::SessionLike;
28+
2829
#[derive(Error, Debug)]
2930
pub enum Error {
3031
#[error("Cryptoki error: {0}")]
@@ -47,19 +48,19 @@ impl SignAlgorithm for p256::NistP256 {
4748
}
4849
}
4950

50-
pub struct Signer<C: SignAlgorithm> {
51-
session: Session,
51+
pub struct Signer<C: SignAlgorithm, S: SessionLike> {
52+
session: S,
5253
_public_key: ObjectHandle,
5354
private_key: ObjectHandle,
5455
verifying_key: VerifyingKey<C>,
5556
}
5657

57-
impl<C: SignAlgorithm> Signer<C>
58+
impl<C: SignAlgorithm, S: SessionLike> Signer<C, S>
5859
where
5960
FieldBytesSize<C>: ModulusSize,
6061
AffinePoint<C>: FromEncodedPoint<C> + ToEncodedPoint<C>,
6162
{
62-
pub fn new(session: Session, label: &[u8]) -> Result<Self, Error> {
63+
pub fn new(session: S, label: &[u8]) -> Result<Self, Error> {
6364
// First we'll lookup a private key with that label.
6465
let template = vec![
6566
Attribute::Token(true),
@@ -123,12 +124,12 @@ where
123124
})
124125
}
125126

126-
pub fn into_session(self) -> Session {
127+
pub fn into_session(self) -> S {
127128
self.session
128129
}
129130
}
130131

131-
impl<C: SignAlgorithm> AssociatedAlgorithmIdentifier for Signer<C>
132+
impl<C: SignAlgorithm, S: SessionLike> AssociatedAlgorithmIdentifier for Signer<C, S>
132133
where
133134
C: AssociatedOid,
134135
{
@@ -138,15 +139,15 @@ where
138139
PublicKey::<C>::ALGORITHM_IDENTIFIER;
139140
}
140141

141-
impl<C: SignAlgorithm> signature::Keypair for Signer<C> {
142+
impl<C: SignAlgorithm, S: SessionLike> signature::Keypair for Signer<C, S> {
142143
type VerifyingKey = VerifyingKey<C>;
143144

144145
fn verifying_key(&self) -> Self::VerifyingKey {
145146
self.verifying_key
146147
}
147148
}
148149

149-
impl<C: SignAlgorithm> signature::Signer<Signature<C>> for Signer<C>
150+
impl<C: SignAlgorithm, S: SessionLike> signature::Signer<Signature<C>> for Signer<C, S>
150151
where
151152
<<C as ecdsa::elliptic_curve::Curve>::FieldBytesSize as Add>::Output: ArrayLength<u8>,
152153
{
@@ -168,7 +169,7 @@ where
168169
}
169170
}
170171

171-
impl<C: SignAlgorithm> SignatureAlgorithmIdentifier for Signer<C>
172+
impl<C: SignAlgorithm, S: SessionLike> SignatureAlgorithmIdentifier for Signer<C, S>
172173
where
173174
AffinePoint<C>: FromEncodedPoint<C> + ToEncodedPoint<C>,
174175
FieldBytesSize<C>: ModulusSize,

‎cryptoki-rustcrypto/src/lib.rs

+49
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,51 @@
1+
use cryptoki::{
2+
error::Result,
3+
mechanism::Mechanism,
4+
object::{Attribute, AttributeType, ObjectHandle},
5+
session::Session,
6+
};
7+
18
pub mod ecdsa;
29
pub mod rsa;
10+
11+
pub trait SessionLike {
12+
fn find_objects(&self, template: &[Attribute]) -> Result<Vec<ObjectHandle>>;
13+
fn get_attributes(
14+
&self,
15+
object: ObjectHandle,
16+
attributes: &[AttributeType],
17+
) -> Result<Vec<Attribute>>;
18+
fn sign(&self, mechanism: &Mechanism, key: ObjectHandle, data: &[u8]) -> Result<Vec<u8>>;
19+
}
20+
21+
impl SessionLike for Session {
22+
fn find_objects(&self, template: &[Attribute]) -> Result<Vec<ObjectHandle>> {
23+
Session::find_objects(self, template)
24+
}
25+
fn get_attributes(
26+
&self,
27+
object: ObjectHandle,
28+
attributes: &[AttributeType],
29+
) -> Result<Vec<Attribute>> {
30+
Session::get_attributes(self, object, attributes)
31+
}
32+
fn sign(&self, mechanism: &Mechanism, key: ObjectHandle, data: &[u8]) -> Result<Vec<u8>> {
33+
Session::sign(self, mechanism, key, data)
34+
}
35+
}
36+
37+
impl<'s> SessionLike for &'s Session {
38+
fn find_objects(&self, template: &[Attribute]) -> Result<Vec<ObjectHandle>> {
39+
Session::find_objects(self, template)
40+
}
41+
fn get_attributes(
42+
&self,
43+
object: ObjectHandle,
44+
attributes: &[AttributeType],
45+
) -> Result<Vec<Attribute>> {
46+
Session::get_attributes(self, object, attributes)
47+
}
48+
fn sign(&self, mechanism: &Mechanism, key: ObjectHandle, data: &[u8]) -> Result<Vec<u8>> {
49+
Session::sign(self, mechanism, key, data)
50+
}
51+
}

‎cryptoki-rustcrypto/src/rsa/pkcs1v15.rs

+11-13
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,4 @@
1-
use cryptoki::{
2-
object::{Attribute, AttributeType, KeyType, ObjectClass, ObjectHandle},
3-
session::Session,
4-
};
1+
use cryptoki::object::{Attribute, AttributeType, KeyType, ObjectClass, ObjectHandle};
52
use der::AnyRef;
63
use rsa::{
74
pkcs1,
@@ -12,16 +9,17 @@ use spki::{AlgorithmIdentifierRef, AssociatedAlgorithmIdentifier, SignatureAlgor
129
use std::convert::TryFrom;
1310

1411
use super::{DigestSigning, Error};
12+
use crate::SessionLike;
1513

16-
pub struct Signer<D: DigestSigning> {
17-
session: Session,
14+
pub struct Signer<D: DigestSigning, S: SessionLike> {
15+
session: S,
1816
_public_key: ObjectHandle,
1917
private_key: ObjectHandle,
2018
verifying_key: VerifyingKey<D>,
2119
}
2220

23-
impl<D: DigestSigning> Signer<D> {
24-
pub fn new(session: Session, label: &[u8]) -> Result<Self, Error> {
21+
impl<D: DigestSigning, S: SessionLike> Signer<D, S> {
22+
pub fn new(session: S, label: &[u8]) -> Result<Self, Error> {
2523
// First we'll lookup a private key with that label.
2624
let template = vec![
2725
Attribute::Token(true),
@@ -80,25 +78,25 @@ impl<D: DigestSigning> Signer<D> {
8078
})
8179
}
8280

83-
pub fn into_session(self) -> Session {
81+
pub fn into_session(self) -> S {
8482
self.session
8583
}
8684
}
8785

88-
impl<D: DigestSigning> AssociatedAlgorithmIdentifier for Signer<D> {
86+
impl<D: DigestSigning, S: SessionLike> AssociatedAlgorithmIdentifier for Signer<D, S> {
8987
type Params = AnyRef<'static>;
9088
const ALGORITHM_IDENTIFIER: AlgorithmIdentifierRef<'static> = pkcs1::ALGORITHM_ID;
9189
}
9290

93-
impl<D: DigestSigning> signature::Keypair for Signer<D> {
91+
impl<D: DigestSigning, S: SessionLike> signature::Keypair for Signer<D, S> {
9492
type VerifyingKey = VerifyingKey<D>;
9593

9694
fn verifying_key(&self) -> Self::VerifyingKey {
9795
self.verifying_key.clone()
9896
}
9997
}
10098

101-
impl<D: DigestSigning> signature::Signer<Signature> for Signer<D> {
99+
impl<D: DigestSigning, S: SessionLike> signature::Signer<Signature> for Signer<D, S> {
102100
fn try_sign(&self, msg: &[u8]) -> Result<Signature, signature::Error> {
103101
let bytes = self
104102
.session
@@ -113,7 +111,7 @@ impl<D: DigestSigning> signature::Signer<Signature> for Signer<D> {
113111
}
114112
}
115113

116-
impl<D: DigestSigning> SignatureAlgorithmIdentifier for Signer<D> {
114+
impl<D: DigestSigning, S: SessionLike> SignatureAlgorithmIdentifier for Signer<D, S> {
117115
type Params = AnyRef<'static>;
118116

119117
const SIGNATURE_ALGORITHM_IDENTIFIER: AlgorithmIdentifierRef<'static> =

‎cryptoki-rustcrypto/src/rsa/pss.rs

+11-13
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,4 @@
1-
use cryptoki::{
2-
object::{Attribute, AttributeType, KeyType, ObjectClass, ObjectHandle},
3-
session::Session,
4-
};
1+
use cryptoki::object::{Attribute, AttributeType, KeyType, ObjectClass, ObjectHandle};
52
use der::{asn1::ObjectIdentifier, oid::AssociatedOid, Any, AnyRef};
63
use rsa::{
74
pkcs1::{self, RsaPssParams},
@@ -17,17 +14,18 @@ use spki::{
1714
use std::convert::TryFrom;
1815

1916
use super::{DigestSigning, Error};
17+
use crate::SessionLike;
2018

21-
pub struct Signer<D: DigestSigning> {
22-
session: Session,
19+
pub struct Signer<D: DigestSigning, S: SessionLike> {
20+
session: S,
2321
_public_key: ObjectHandle,
2422
private_key: ObjectHandle,
2523
verifying_key: VerifyingKey<D>,
2624
salt_len: usize,
2725
}
2826

29-
impl<D: DigestSigning> Signer<D> {
30-
pub fn new(session: Session, label: &[u8]) -> Result<Self, Error> {
27+
impl<D: DigestSigning, S: SessionLike> Signer<D, S> {
28+
pub fn new(session: S, label: &[u8]) -> Result<Self, Error> {
3129
// First we'll lookup a private key with that label.
3230
let template = vec![
3331
Attribute::Token(true),
@@ -88,25 +86,25 @@ impl<D: DigestSigning> Signer<D> {
8886
})
8987
}
9088

91-
pub fn into_session(self) -> Session {
89+
pub fn into_session(self) -> S {
9290
self.session
9391
}
9492
}
9593

96-
impl<D: DigestSigning> AssociatedAlgorithmIdentifier for Signer<D> {
94+
impl<D: DigestSigning, S: SessionLike> AssociatedAlgorithmIdentifier for Signer<D, S> {
9795
type Params = AnyRef<'static>;
9896
const ALGORITHM_IDENTIFIER: AlgorithmIdentifierRef<'static> = pkcs1::ALGORITHM_ID;
9997
}
10098

101-
impl<D: DigestSigning> signature::Keypair for Signer<D> {
99+
impl<D: DigestSigning, S: SessionLike> signature::Keypair for Signer<D, S> {
102100
type VerifyingKey = VerifyingKey<D>;
103101

104102
fn verifying_key(&self) -> Self::VerifyingKey {
105103
self.verifying_key.clone()
106104
}
107105
}
108106

109-
impl<D: DigestSigning> signature::Signer<Signature> for Signer<D> {
107+
impl<D: DigestSigning, S: SessionLike> signature::Signer<Signature> for Signer<D, S> {
110108
fn try_sign(&self, msg: &[u8]) -> Result<Signature, signature::Error> {
111109
let bytes = self
112110
.session
@@ -121,7 +119,7 @@ impl<D: DigestSigning> signature::Signer<Signature> for Signer<D> {
121119
}
122120
}
123121

124-
impl<D: DigestSigning> DynSignatureAlgorithmIdentifier for Signer<D> {
122+
impl<D: DigestSigning, S: SessionLike> DynSignatureAlgorithmIdentifier for Signer<D, S> {
125123
fn signature_algorithm_identifier(&self) -> pkcs8::spki::Result<AlgorithmIdentifierOwned> {
126124
get_pss_signature_algo_id::<D>(self.salt_len as u8)
127125
}

‎cryptoki-rustcrypto/tests/ecdsa.rs

+1-3
Original file line numberDiff line numberDiff line change
@@ -66,15 +66,13 @@ fn sign_verify() -> TestResult {
6666
let data = [0xFF, 0x55, 0xDD];
6767

6868
let signer =
69-
ecdsa::Signer::<p256::NistP256>::new(session, label).expect("Lookup keys from HSM");
69+
ecdsa::Signer::<p256::NistP256, _>::new(&session, label).expect("Lookup keys from HSM");
7070

7171
let signature = signer.sign(&data);
7272

7373
let verifying_key = signer.verifying_key();
7474
verifying_key.verify(&data, &signature)?;
7575

76-
let session = signer.into_session();
77-
7876
// delete keys
7977
session.destroy_object(public)?;
8078
session.destroy_object(private)?;

‎cryptoki-rustcrypto/tests/rsa.rs

+3-6
Original file line numberDiff line numberDiff line change
@@ -49,15 +49,13 @@ fn pkcs1v15_sign_verify() -> TestResult {
4949
let data = [0xFF, 0x55, 0xDD];
5050

5151
let signer =
52-
pkcs1v15::Signer::<sha2::Sha256>::new(session, label).expect("Lookup keys from HSM");
52+
pkcs1v15::Signer::<sha2::Sha256, _>::new(&session, label).expect("Lookup keys from HSM");
5353

5454
let signature = signer.sign(&data);
5555

5656
let verifying_key = signer.verifying_key();
5757
verifying_key.verify(&data, &signature)?;
5858

59-
let session = signer.into_session();
60-
6159
// delete keys
6260
session.destroy_object(public)?;
6361
session.destroy_object(private)?;
@@ -103,15 +101,14 @@ fn pss_sign_verify() -> TestResult {
103101
// data to sign
104102
let data = [0xFF, 0x55, 0xDD];
105103

106-
let signer = pss::Signer::<sha2::Sha256>::new(session, label).expect("Lookup keys from HSM");
104+
let signer =
105+
pss::Signer::<sha2::Sha256, _>::new(&session, label).expect("Lookup keys from HSM");
107106

108107
let signature = signer.sign(&data);
109108

110109
let verifying_key = signer.verifying_key();
111110
verifying_key.verify(&data, &signature)?;
112111

113-
let session = signer.into_session();
114-
115112
// delete keys
116113
session.destroy_object(public)?;
117114
session.destroy_object(private)?;

‎cryptoki-rustcrypto/tests/x509-ca.rs

+2-3
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,8 @@ fn pss_create_ca() -> TestResult {
5454
let (public, private) =
5555
session.generate_key_pair(&mechanism, &pub_key_template, &priv_key_template)?;
5656

57-
let signer = pss::Signer::<sha2::Sha256>::new(session, label).expect("Lookup keys from HSM");
57+
let signer =
58+
pss::Signer::<sha2::Sha256, _>::new(&session, label).expect("Lookup keys from HSM");
5859

5960
let serial_number = SerialNumber::from(42u32);
6061
let validity = Validity::from_now(Duration::new(5, 0)).unwrap();
@@ -72,8 +73,6 @@ fn pss_create_ca() -> TestResult {
7273
let pem = certificate.to_pem(LineEnding::LF).expect("generate pem");
7374
println!("{}", pem);
7475

75-
let session = signer.into_session();
76-
7776
// delete keys
7877
session.destroy_object(public)?;
7978
session.destroy_object(private)?;

0 commit comments

Comments
 (0)