jwt_simple/algorithms/
es256.rs

1use std::convert::TryFrom;
2
3use ct_codecs::{Base64UrlSafeNoPadding, Encoder};
4use p256::ecdsa::{self, signature::DigestVerifier as _, signature::RandomizedDigestSigner as _};
5use p256::pkcs8::{DecodePrivateKey, DecodePublicKey, EncodePrivateKey, EncodePublicKey};
6use p256::NonZeroScalar;
7use serde::{de::DeserializeOwned, Serialize};
8
9use crate::claims::*;
10use crate::common::*;
11#[cfg(feature = "cwt")]
12use crate::cwt_token::*;
13use crate::error::*;
14use crate::jwt_header::*;
15use crate::token::*;
16
17#[doc(hidden)]
18#[derive(Debug, Clone)]
19pub struct P256PublicKey(ecdsa::VerifyingKey);
20
21impl AsRef<ecdsa::VerifyingKey> for P256PublicKey {
22    fn as_ref(&self) -> &ecdsa::VerifyingKey {
23        &self.0
24    }
25}
26
27impl P256PublicKey {
28    pub fn from_bytes(raw: &[u8]) -> Result<Self, Error> {
29        let p256_pk =
30            ecdsa::VerifyingKey::from_sec1_bytes(raw).map_err(|_| JWTError::InvalidPublicKey)?;
31        Ok(P256PublicKey(p256_pk))
32    }
33
34    pub fn from_der(der: &[u8]) -> Result<Self, Error> {
35        let p256_pk = ecdsa::VerifyingKey::from_public_key_der(der)
36            .map_err(|_| JWTError::InvalidPublicKey)?;
37        Ok(P256PublicKey(p256_pk))
38    }
39
40    pub fn from_pem(pem: &str) -> Result<Self, Error> {
41        let p256_pk = ecdsa::VerifyingKey::from_public_key_pem(pem)
42            .map_err(|_| JWTError::InvalidPublicKey)?;
43        Ok(P256PublicKey(p256_pk))
44    }
45
46    pub fn to_bytes(&self) -> Vec<u8> {
47        self.0.to_encoded_point(true).as_bytes().to_vec()
48    }
49
50    pub fn to_bytes_uncompressed(&self) -> Vec<u8> {
51        self.0.to_encoded_point(false).as_bytes().to_vec()
52    }
53
54    pub fn to_der(&self) -> Result<Vec<u8>, Error> {
55        let p256_pk = p256::PublicKey::from(self.0);
56        Ok(p256_pk
57            .to_public_key_der()
58            .map_err(|_| JWTError::InvalidPublicKey)?
59            .as_ref()
60            .to_vec())
61    }
62
63    pub fn to_pem(&self) -> Result<String, Error> {
64        let p256_pk = p256::PublicKey::from(self.0);
65        Ok(p256_pk
66            .to_public_key_pem(Default::default())
67            .map_err(|_| JWTError::InvalidPublicKey)?)
68    }
69}
70
71#[doc(hidden)]
72pub struct P256KeyPair {
73    p256_sk: ecdsa::SigningKey,
74    metadata: Option<KeyMetadata>,
75}
76
77impl AsRef<ecdsa::SigningKey> for P256KeyPair {
78    fn as_ref(&self) -> &ecdsa::SigningKey {
79        &self.p256_sk
80    }
81}
82
83impl P256KeyPair {
84    pub fn from_bytes(raw: &[u8]) -> Result<Self, Error> {
85        let p256_sk =
86            ecdsa::SigningKey::from_bytes(raw.into()).map_err(|_| JWTError::InvalidKeyPair)?;
87        Ok(P256KeyPair {
88            p256_sk,
89            metadata: None,
90        })
91    }
92
93    pub fn from_der(der: &[u8]) -> Result<Self, Error> {
94        let p256_sk =
95            ecdsa::SigningKey::from_pkcs8_der(der).map_err(|_| JWTError::InvalidKeyPair)?;
96        Ok(P256KeyPair {
97            p256_sk,
98            metadata: None,
99        })
100    }
101
102    pub fn from_pem(pem: &str) -> Result<Self, Error> {
103        let p256_sk =
104            ecdsa::SigningKey::from_pkcs8_pem(pem).map_err(|_| JWTError::InvalidKeyPair)?;
105        Ok(P256KeyPair {
106            p256_sk,
107            metadata: None,
108        })
109    }
110
111    pub fn to_bytes(&self) -> Vec<u8> {
112        self.p256_sk.to_bytes().to_vec()
113    }
114
115    pub fn to_der(&self) -> Result<Vec<u8>, Error> {
116        let scalar = NonZeroScalar::from_repr(self.p256_sk.to_bytes());
117        if bool::from(scalar.is_none()) {
118            return Err(JWTError::InvalidKeyPair.into());
119        }
120        let p256_sk =
121            p256::SecretKey::from(NonZeroScalar::from_repr(scalar.unwrap().into()).unwrap());
122        Ok(p256_sk
123            .to_pkcs8_der()
124            .map_err(|_| JWTError::InvalidKeyPair)?
125            .as_bytes()
126            .to_vec())
127    }
128
129    pub fn to_pem(&self) -> Result<String, Error> {
130        let scalar = NonZeroScalar::from_repr(self.p256_sk.to_bytes());
131        if bool::from(scalar.is_none()) {
132            return Err(JWTError::InvalidKeyPair.into());
133        }
134        let p256_sk =
135            p256::SecretKey::from(NonZeroScalar::from_repr(scalar.unwrap().into()).unwrap());
136        Ok(p256_sk
137            .to_pkcs8_pem(Default::default())
138            .map_err(|_| JWTError::InvalidKeyPair)?
139            .to_string())
140    }
141
142    pub fn public_key(&self) -> P256PublicKey {
143        let p256_pk = self.p256_sk.verifying_key();
144        P256PublicKey(*p256_pk)
145    }
146
147    pub fn generate() -> Self {
148        let mut rng = rand::thread_rng();
149        let p256_sk = ecdsa::SigningKey::random(&mut rng);
150        P256KeyPair {
151            p256_sk,
152            metadata: None,
153        }
154    }
155}
156
157pub trait ECDSAP256KeyPairLike {
158    fn jwt_alg_name() -> &'static str;
159    fn key_pair(&self) -> &P256KeyPair;
160    fn key_id(&self) -> &Option<String>;
161    fn metadata(&self) -> &Option<KeyMetadata>;
162    fn attach_metadata(&mut self, metadata: KeyMetadata) -> Result<(), Error>;
163
164    fn sign<CustomClaims: Serialize + DeserializeOwned>(
165        &self,
166        claims: JWTClaims<CustomClaims>,
167    ) -> Result<String, Error> {
168        let jwt_header = JWTHeader::new(Self::jwt_alg_name().to_string(), self.key_id().clone())
169            .with_metadata(self.metadata());
170        Token::build(&jwt_header, claims, |authenticated| {
171            let mut digest = hmac_sha256::Hash::new();
172            digest.update(authenticated.as_bytes());
173            let mut rng = rand::thread_rng();
174            let signature: ecdsa::Signature = self
175                .key_pair()
176                .as_ref()
177                .sign_digest_with_rng(&mut rng, digest);
178            Ok(signature.to_vec())
179        })
180    }
181}
182
183pub trait ECDSAP256PublicKeyLike {
184    fn jwt_alg_name() -> &'static str;
185    fn public_key(&self) -> &P256PublicKey;
186    fn key_id(&self) -> &Option<String>;
187    fn set_key_id(&mut self, key_id: String);
188
189    fn verify_token<CustomClaims: Serialize + DeserializeOwned>(
190        &self,
191        token: &str,
192        options: Option<VerificationOptions>,
193    ) -> Result<JWTClaims<CustomClaims>, Error> {
194        Token::verify(
195            Self::jwt_alg_name(),
196            token,
197            options,
198            |authenticated, signature| {
199                let ecdsa_signature = ecdsa::Signature::try_from(signature)
200                    .map_err(|_| JWTError::InvalidSignature)?;
201                let mut digest = hmac_sha256::Hash::new();
202                digest.update(authenticated.as_bytes());
203                self.public_key()
204                    .as_ref()
205                    .verify_digest(digest, &ecdsa_signature)
206                    .map_err(|_| JWTError::InvalidSignature)?;
207                Ok(())
208            },
209        )
210    }
211
212    #[cfg(feature = "cwt")]
213    fn verify_cwt_token<CustomClaims: Serialize + DeserializeOwned>(
214        &self,
215        token: &str,
216        options: Option<VerificationOptions>,
217    ) -> Result<JWTClaims<NoCustomClaims>, Error> {
218        CWTToken::verify(
219            Self::jwt_alg_name(),
220            token,
221            options,
222            |authenticated, signature| {
223                let ecdsa_signature = ecdsa::Signature::try_from(signature)
224                    .map_err(|_| JWTError::InvalidSignature)?;
225                let mut digest = hmac_sha256::Hash::new();
226                digest.update(authenticated.as_bytes());
227                self.public_key()
228                    .as_ref()
229                    .verify_digest(digest, &ecdsa_signature)
230                    .map_err(|_| JWTError::InvalidSignature)?;
231                Ok(())
232            },
233        )
234    }
235
236    fn create_key_id(&mut self) -> &str {
237        self.set_key_id(
238            Base64UrlSafeNoPadding::encode_to_string(hmac_sha256::Hash::hash(
239                &self.public_key().to_bytes(),
240            ))
241            .unwrap(),
242        );
243        self.key_id().as_ref().map(|x| x.as_str()).unwrap()
244    }
245}
246
247pub struct ES256KeyPair {
248    key_pair: P256KeyPair,
249    key_id: Option<String>,
250}
251
252#[derive(Debug, Clone)]
253pub struct ES256PublicKey {
254    pk: P256PublicKey,
255    key_id: Option<String>,
256}
257
258impl ECDSAP256KeyPairLike for ES256KeyPair {
259    fn jwt_alg_name() -> &'static str {
260        "ES256"
261    }
262
263    fn key_pair(&self) -> &P256KeyPair {
264        &self.key_pair
265    }
266
267    fn key_id(&self) -> &Option<String> {
268        &self.key_id
269    }
270
271    fn metadata(&self) -> &Option<KeyMetadata> {
272        &self.key_pair.metadata
273    }
274
275    fn attach_metadata(&mut self, metadata: KeyMetadata) -> Result<(), Error> {
276        self.key_pair.metadata = Some(metadata);
277        Ok(())
278    }
279}
280
281impl ES256KeyPair {
282    pub fn from_bytes(raw: &[u8]) -> Result<Self, Error> {
283        Ok(ES256KeyPair {
284            key_pair: P256KeyPair::from_bytes(raw)?,
285            key_id: None,
286        })
287    }
288
289    pub fn from_der(der: &[u8]) -> Result<Self, Error> {
290        Ok(ES256KeyPair {
291            key_pair: P256KeyPair::from_der(der)?,
292            key_id: None,
293        })
294    }
295
296    pub fn from_pem(pem: &str) -> Result<Self, Error> {
297        Ok(ES256KeyPair {
298            key_pair: P256KeyPair::from_pem(pem)?,
299            key_id: None,
300        })
301    }
302
303    pub fn to_bytes(&self) -> Vec<u8> {
304        self.key_pair.to_bytes()
305    }
306
307    pub fn to_der(&self) -> Result<Vec<u8>, Error> {
308        self.key_pair.to_der()
309    }
310
311    pub fn to_pem(&self) -> Result<String, Error> {
312        self.key_pair.to_pem()
313    }
314
315    pub fn public_key(&self) -> ES256PublicKey {
316        ES256PublicKey {
317            pk: self.key_pair.public_key(),
318            key_id: self.key_id.clone(),
319        }
320    }
321
322    pub fn generate() -> Self {
323        ES256KeyPair {
324            key_pair: P256KeyPair::generate(),
325            key_id: None,
326        }
327    }
328
329    pub fn with_key_id(mut self, key_id: &str) -> Self {
330        self.key_id = Some(key_id.to_string());
331        self
332    }
333}
334
335impl ECDSAP256PublicKeyLike for ES256PublicKey {
336    fn jwt_alg_name() -> &'static str {
337        "ES256"
338    }
339
340    fn public_key(&self) -> &P256PublicKey {
341        &self.pk
342    }
343
344    fn key_id(&self) -> &Option<String> {
345        &self.key_id
346    }
347
348    fn set_key_id(&mut self, key_id: String) {
349        self.key_id = Some(key_id);
350    }
351}
352
353impl ES256PublicKey {
354    pub fn from_bytes(raw: &[u8]) -> Result<Self, Error> {
355        Ok(ES256PublicKey {
356            pk: P256PublicKey::from_bytes(raw)?,
357            key_id: None,
358        })
359    }
360
361    pub fn from_der(der: &[u8]) -> Result<Self, Error> {
362        Ok(ES256PublicKey {
363            pk: P256PublicKey::from_der(der)?,
364            key_id: None,
365        })
366    }
367
368    pub fn from_pem(pem: &str) -> Result<Self, Error> {
369        Ok(ES256PublicKey {
370            pk: P256PublicKey::from_pem(pem)?,
371            key_id: None,
372        })
373    }
374
375    pub fn to_bytes(&self) -> Vec<u8> {
376        self.pk.to_bytes()
377    }
378
379    pub fn to_der(&self) -> Result<Vec<u8>, Error> {
380        self.pk.to_der()
381    }
382
383    pub fn to_pem(&self) -> Result<String, Error> {
384        self.pk.to_pem()
385    }
386
387    pub fn with_key_id(mut self, key_id: &str) -> Self {
388        self.key_id = Some(key_id.to_string());
389        self
390    }
391}
jwt_simple/algorithms/es256.rs

jwt_simple/algorithms/
es256.rs
