Skip to content

Commit 230120d

Browse files
baloobaloo
committed
use a session ref
Signed-off-by: Arthur Gautier <baloo@superbaloo.net>
1 parent a5240ff commit 230120d

File tree

7 files changed

+88
-48
lines changed

7 files changed

+88
-48
lines changed

‎cryptoki-rustcrypto/src/ecdsa.rs‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
use cryptoki::{
55
mechanism::Mechanism,
66
object::{Attribute, AttributeType, KeyType, ObjectClass, ObjectHandle},
7-
session::Session,
87
};
98
use der::{
109
asn1::{ObjectIdentifier, OctetStringRef},
@@ -28,6 +27,8 @@ use spki::{
2827
use std::{convert::TryFrom, ops::Add};
2928
use thiserror::Error;
3029

30+
use crate::SessionLike;
31+
3132
#[derive(Error, Debug)]
3233
pub enum Error {
3334
#[error("Cryptoki error: {0}")]
@@ -50,19 +51,19 @@ impl SignAlgorithm for p256::NistP256 {
5051
}
5152
}
5253

53-
pub struct Signer<C: SignAlgorithm> {
54-
session: Session,
54+
pub struct Signer<C: SignAlgorithm, S: SessionLike> {
55+
session: S,
5556
_public_key: ObjectHandle,
5657
private_key: ObjectHandle,
5758
verifying_key: VerifyingKey<C>,
5859
}
5960

60-
impl<C: SignAlgorithm> Signer<C>
61+
impl<C: SignAlgorithm, S: SessionLike> Signer<C, S>
6162
where
6263
FieldBytesSize<C>: ModulusSize,
6364
AffinePoint<C>: FromEncodedPoint<C> + ToEncodedPoint<C>,
6465
{
65-
pub fn new(session: Session, label: &[u8]) -> Result<Self, Error> {
66+
pub fn new(session: S, label: &[u8]) -> Result<Self, Error> {
6667
// First we'll lookup a private key with that label.
6768
let template = vec![
6869
Attribute::Token(true),
@@ -126,12 +127,12 @@ where
126127
})
127128
}
128129

129-
pub fn into_session(self) -> Session {
130+
pub fn into_session(self) -> S {
130131
self.session
131132
}
132133
}
133134

134-
impl<C: SignAlgorithm> AssociatedAlgorithmIdentifier for Signer<C>
135+
impl<C: SignAlgorithm, S: SessionLike> AssociatedAlgorithmIdentifier for Signer<C, S>
135136
where
136137
C: AssociatedOid,
137138
{
@@ -141,15 +142,15 @@ where
141142
PublicKey::<C>::ALGORITHM_IDENTIFIER;
142143
}
143144

144-
impl<C: SignAlgorithm> signature::Keypair for Signer<C> {
145+
impl<C: SignAlgorithm, S: SessionLike> signature::Keypair for Signer<C, S> {
145146
type VerifyingKey = VerifyingKey<C>;
146147

147148
fn verifying_key(&self) -> Self::VerifyingKey {
148149
self.verifying_key
149150
}
150151
}
151152

152-
impl<C: SignAlgorithm> signature::Signer<Signature<C>> for Signer<C>
153+
impl<C: SignAlgorithm, S: SessionLike> signature::Signer<Signature<C>> for Signer<C, S>
153154
where
154155
<<C as ecdsa::elliptic_curve::Curve>::FieldBytesSize as Add>::Output: ArrayLength<u8>,
155156
{
@@ -171,7 +172,7 @@ where
171172
}
172173
}
173174

174-
impl<C: SignAlgorithm> SignatureAlgorithmIdentifier for Signer<C>
175+
impl<C: SignAlgorithm, S: SessionLike> SignatureAlgorithmIdentifier for Signer<C, S>
175176
where
176177
AffinePoint<C>: FromEncodedPoint<C> + ToEncodedPoint<C>,
177178
FieldBytesSize<C>: ModulusSize,

‎cryptoki-rustcrypto/src/lib.rs‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,54 @@
11
// Copyright 2023 Contributors to the Parsec project.
22
// SPDX-License-Identifier: Apache-2.0
33

4+
use cryptoki::{
5+
error::Result,
6+
mechanism::Mechanism,
7+
object::{Attribute, AttributeType, ObjectHandle},
8+
session::Session,
9+
};
10+
411
pub mod ecdsa;
512
pub mod rsa;
13+
14+
pub trait SessionLike {
15+
fn find_objects(&self, template: &[Attribute]) -> Result<Vec<ObjectHandle>>;
16+
fn get_attributes(
17+
&self,
18+
object: ObjectHandle,
19+
attributes: &[AttributeType],
20+
) -> Result<Vec<Attribute>>;
21+
fn sign(&self, mechanism: &Mechanism, key: ObjectHandle, data: &[u8]) -> Result<Vec<u8>>;
22+
}
23+
24+
impl SessionLike for Session {
25+
fn find_objects(&self, template: &[Attribute]) -> Result<Vec<ObjectHandle>> {
26+
Session::find_objects(self, template)
27+
}
28+
fn get_attributes(
29+
&self,
30+
object: ObjectHandle,
31+
attributes: &[AttributeType],
32+
) -> Result<Vec<Attribute>> {
33+
Session::get_attributes(self, object, attributes)
34+
}
35+
fn sign(&self, mechanism: &Mechanism, key: ObjectHandle, data: &[u8]) -> Result<Vec<u8>> {
36+
Session::sign(self, mechanism, key, data)
37+
}
38+
}
39+
40+
impl<'s> SessionLike for &'s Session {
41+
fn find_objects(&self, template: &[Attribute]) -> Result<Vec<ObjectHandle>> {
42+
Session::find_objects(self, template)
43+
}
44+
fn get_attributes(
45+
&self,
46+
object: ObjectHandle,
47+
attributes: &[AttributeType],
48+
) -> Result<Vec<Attribute>> {
49+
Session::get_attributes(self, object, attributes)
50+
}
51+
fn sign(&self, mechanism: &Mechanism, key: ObjectHandle, data: &[u8]) -> Result<Vec<u8>> {
52+
Session::sign(self, mechanism, key, data)
53+
}
54+
}

‎cryptoki-rustcrypto/src/rsa/pkcs1v15.rs‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,7 @@
11
// Copyright 2023 Contributors to the Parsec project.
22
// SPDX-License-Identifier: Apache-2.0
33

4-
use cryptoki::{
5-
object::{Attribute, AttributeType, KeyType, ObjectClass, ObjectHandle},
6-
session::Session,
7-
};
4+
use cryptoki::object::{Attribute, AttributeType, KeyType, ObjectClass, ObjectHandle};
85
use der::AnyRef;
96
use rsa::{
107
pkcs1,
@@ -15,16 +12,17 @@ use spki::{AlgorithmIdentifierRef, AssociatedAlgorithmIdentifier, SignatureAlgor
1512
use std::convert::TryFrom;
1613

1714
use super::{DigestSigning, Error};
15+
use crate::SessionLike;
1816

19-
pub struct Signer<D: DigestSigning> {
20-
session: Session,
17+
pub struct Signer<D: DigestSigning, S: SessionLike> {
18+
session: S,
2119
_public_key: ObjectHandle,
2220
private_key: ObjectHandle,
2321
verifying_key: VerifyingKey<D>,
2422
}
2523

26-
impl<D: DigestSigning> Signer<D> {
27-
pub fn new(session: Session, label: &[u8]) -> Result<Self, Error> {
24+
impl<D: DigestSigning, S: SessionLike> Signer<D, S> {
25+
pub fn new(session: S, label: &[u8]) -> Result<Self, Error> {
2826
// First we'll lookup a private key with that label.
2927
let template = vec![
3028
Attribute::Token(true),
@@ -83,25 +81,25 @@ impl<D: DigestSigning> Signer<D> {
8381
})
8482
}
8583

86-
pub fn into_session(self) -> Session {
84+
pub fn into_session(self) -> S {
8785
self.session
8886
}
8987
}
9088

91-
impl<D: DigestSigning> AssociatedAlgorithmIdentifier for Signer<D> {
89+
impl<D: DigestSigning, S: SessionLike> AssociatedAlgorithmIdentifier for Signer<D, S> {
9290
type Params = AnyRef<'static>;
9391
const ALGORITHM_IDENTIFIER: AlgorithmIdentifierRef<'static> = pkcs1::ALGORITHM_ID;
9492
}
9593

96-
impl<D: DigestSigning> signature::Keypair for Signer<D> {
94+
impl<D: DigestSigning, S: SessionLike> signature::Keypair for Signer<D, S> {
9795
type VerifyingKey = VerifyingKey<D>;
9896

9997
fn verifying_key(&self) -> Self::VerifyingKey {
10098
self.verifying_key.clone()
10199
}
102100
}
103101

104-
impl<D: DigestSigning> signature::Signer<Signature> for Signer<D> {
102+
impl<D: DigestSigning, S: SessionLike> signature::Signer<Signature> for Signer<D, S> {
105103
fn try_sign(&self, msg: &[u8]) -> Result<Signature, signature::Error> {
106104
let bytes = self
107105
.session
@@ -116,7 +114,7 @@ impl<D: DigestSigning> signature::Signer<Signature> for Signer<D> {
116114
}
117115
}
118116

119-
impl<D: DigestSigning> SignatureAlgorithmIdentifier for Signer<D> {
117+
impl<D: DigestSigning, S: SessionLike> SignatureAlgorithmIdentifier for Signer<D, S> {
120118
type Params = AnyRef<'static>;
121119

122120
const SIGNATURE_ALGORITHM_IDENTIFIER: AlgorithmIdentifierRef<'static> =

‎cryptoki-rustcrypto/src/rsa/pss.rs‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,7 @@
11
// Copyright 2023 Contributors to the Parsec project.
22
// SPDX-License-Identifier: Apache-2.0
33

4-
use cryptoki::{
5-
object::{Attribute, AttributeType, KeyType, ObjectClass, ObjectHandle},
6-
session::Session,
7-
};
4+
use cryptoki::object::{Attribute, AttributeType, KeyType, ObjectClass, ObjectHandle};
85
use der::{asn1::ObjectIdentifier, oid::AssociatedOid, Any, AnyRef};
96
use rsa::{
107
pkcs1::{self, RsaPssParams},
@@ -20,17 +17,18 @@ use spki::{
2017
use std::convert::TryFrom;
2118

2219
use super::{DigestSigning, Error};
20+
use crate::SessionLike;
2321

24-
pub struct Signer<D: DigestSigning> {
25-
session: Session,
22+
pub struct Signer<D: DigestSigning, S: SessionLike> {
23+
session: S,
2624
_public_key: ObjectHandle,
2725
private_key: ObjectHandle,
2826
verifying_key: VerifyingKey<D>,
2927
salt_len: usize,
3028
}
3129

32-
impl<D: DigestSigning> Signer<D> {
33-
pub fn new(session: Session, label: &[u8]) -> Result<Self, Error> {
30+
impl<D: DigestSigning, S: SessionLike> Signer<D, S> {
31+
pub fn new(session: S, label: &[u8]) -> Result<Self, Error> {
3432
// First we'll lookup a private key with that label.
3533
let template = vec![
3634
Attribute::Token(true),
@@ -91,25 +89,25 @@ impl<D: DigestSigning> Signer<D> {
9189
})
9290
}
9391

94-
pub fn into_session(self) -> Session {
92+
pub fn into_session(self) -> S {
9593
self.session
9694
}
9795
}
9896

99-
impl<D: DigestSigning> AssociatedAlgorithmIdentifier for Signer<D> {
97+
impl<D: DigestSigning, S: SessionLike> AssociatedAlgorithmIdentifier for Signer<D, S> {
10098
type Params = AnyRef<'static>;
10199
const ALGORITHM_IDENTIFIER: AlgorithmIdentifierRef<'static> = pkcs1::ALGORITHM_ID;
102100
}
103101

104-
impl<D: DigestSigning> signature::Keypair for Signer<D> {
102+
impl<D: DigestSigning, S: SessionLike> signature::Keypair for Signer<D, S> {
105103
type VerifyingKey = VerifyingKey<D>;
106104

107105
fn verifying_key(&self) -> Self::VerifyingKey {
108106
self.verifying_key.clone()
109107
}
110108
}
111109

112-
impl<D: DigestSigning> signature::Signer<Signature> for Signer<D> {
110+
impl<D: DigestSigning, S: SessionLike> signature::Signer<Signature> for Signer<D, S> {
113111
fn try_sign(&self, msg: &[u8]) -> Result<Signature, signature::Error> {
114112
let bytes = self
115113
.session
@@ -124,7 +122,7 @@ impl<D: DigestSigning> signature::Signer<Signature> for Signer<D> {
124122
}
125123
}
126124

127-
impl<D: DigestSigning> DynSignatureAlgorithmIdentifier for Signer<D> {
125+
impl<D: DigestSigning, S: SessionLike> DynSignatureAlgorithmIdentifier for Signer<D, S> {
128126
fn signature_algorithm_identifier(&self) -> pkcs8::spki::Result<AlgorithmIdentifierOwned> {
129127
get_pss_signature_algo_id::<D>(self.salt_len as u8)
130128
}

‎cryptoki-rustcrypto/tests/ecdsa.rs‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -67,15 +67,13 @@ fn sign_verify() -> TestResult {
6767
let data = [0xFF, 0x55, 0xDD];
6868

6969
let signer =
70-
ecdsa::Signer::<p256::NistP256>::new(session, label).expect("Lookup keys from HSM");
70+
ecdsa::Signer::<p256::NistP256, _>::new(&session, label).expect("Lookup keys from HSM");
7171

7272
let signature = signer.sign(&data);
7373

7474
let verifying_key = signer.verifying_key();
7575
verifying_key.verify(&data, &signature)?;
7676

77-
let session = signer.into_session();
78-
7977
// delete keys
8078
session.destroy_object(public)?;
8179
session.destroy_object(private)?;

‎cryptoki-rustcrypto/tests/rsa.rs‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -50,15 +50,13 @@ fn pkcs1v15_sign_verify() -> TestResult {
5050
let data = [0xFF, 0x55, 0xDD];
5151

5252
let signer =
53-
pkcs1v15::Signer::<sha2::Sha256>::new(session, label).expect("Lookup keys from HSM");
53+
pkcs1v15::Signer::<sha2::Sha256, _>::new(&session, label).expect("Lookup keys from HSM");
5454

5555
let signature = signer.sign(&data);
5656

5757
let verifying_key = signer.verifying_key();
5858
verifying_key.verify(&data, &signature)?;
5959

60-
let session = signer.into_session();
61-
6260
// delete keys
6361
session.destroy_object(public)?;
6462
session.destroy_object(private)?;
@@ -104,15 +102,14 @@ fn pss_sign_verify() -> TestResult {
104102
// data to sign
105103
let data = [0xFF, 0x55, 0xDD];
106104

107-
let signer = pss::Signer::<sha2::Sha256>::new(session, label).expect("Lookup keys from HSM");
105+
let signer =
106+
pss::Signer::<sha2::Sha256, _>::new(&session, label).expect("Lookup keys from HSM");
108107

109108
let signature = signer.sign(&data);
110109

111110
let verifying_key = signer.verifying_key();
112111
verifying_key.verify(&data, &signature)?;
113112

114-
let session = signer.into_session();
115-
116113
// delete keys
117114
session.destroy_object(public)?;
118115
session.destroy_object(private)?;

‎cryptoki-rustcrypto/tests/x509-ca.rs‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,8 @@ fn pss_create_ca() -> TestResult {
5555
let (public, private) =
5656
session.generate_key_pair(&mechanism, &pub_key_template, &priv_key_template)?;
5757

58-
let signer = pss::Signer::<sha2::Sha256>::new(session, label).expect("Lookup keys from HSM");
58+
let signer =
59+
pss::Signer::<sha2::Sha256, _>::new(&session, label).expect("Lookup keys from HSM");
5960

6061
let serial_number = SerialNumber::from(42u32);
6162
let validity = Validity::from_now(Duration::new(5, 0)).unwrap();
@@ -73,8 +74,6 @@ fn pss_create_ca() -> TestResult {
7374
let pem = certificate.to_pem(LineEnding::LF).expect("generate pem");
7475
println!("{}", pem);
7576

76-
let session = signer.into_session();
77-
7877
// delete keys
7978
session.destroy_object(public)?;
8079
session.destroy_object(private)?;

0 commit comments

Comments
 (0)