feat: rename pivsign

src/cmd_pivrsasign.rs

@@ -0,0 +1,89 @@
+use std::collections::BTreeMap;
+
+use clap::{App, Arg, ArgMatches, SubCommand};
+use rust_util::util_clap::{Command, CommandError};
+use rust_util::util_msg::MessageType;
+use rust_util::{util_msg, XResult};
+use yubikey::piv::{AlgorithmId, SlotId};
+use yubikey::{piv, YubiKey};
+
+pub struct CommandImpl;
+
+impl Command for CommandImpl {
+    fn name(&self) -> &str { "piv-sign" }
+
+    fn subcommand<'a>(&self) -> App<'a, 'a> {
+        SubCommand::with_name(self.name()).about("PIV Sign subcommand")
+            .arg(Arg::with_name("pin").short("p").long("pin").takes_value(true).default_value("123456").help("OpenPGP card user pin"))
+            .arg(Arg::with_name("sha256").short("2").long("sha256").takes_value(true).help("Digest SHA256 HEX"))
+            .arg(Arg::with_name("json").long("json").help("JSON output"))
+    }
+
+    fn run(&self, _arg_matches: &ArgMatches, sub_arg_matches: &ArgMatches) -> CommandError {
+        let json_output = sub_arg_matches.is_present("json");
+        if json_output { util_msg::set_logger_std_out(false); }
+
+        let pin_opt = sub_arg_matches.value_of("pin");
+        let pin = opt_value_result!(pin_opt, "User pin must be assigned");
+
+        let sha256_hex_opt = sub_arg_matches.value_of("sha256").map(|s| s.to_string());
+
+        let mut yk = opt_result!(YubiKey::open(), "YubiKey not found: {}");
+        opt_result!(yk.verify_pin(pin.as_bytes()), "YubiKey verify pin failed: {}");
+
+        // https://www.ibm.com/docs/en/zos/2.2.0?topic=cryptography-pkcs-1-formats
+        // MD5  X’3020300C 06082A86 4886F70D 02050500 0410’ || 16-byte hash value
+        // SHA-1  X'30213009 06052B0E 03021A05 000414’ || 20-byte hash value
+        // SHA-224  X’302D300D 06096086 48016503 04020405 00041C’ || 28-byte hash value
+        // SHA-256  X’3031300D 06096086 48016503 04020105 000420’ || 32-byte hash value
+        // SHA-384  X’3041300D 06096086 48016503 04020205 000430’ || 48-byte hash value
+        // SHA-512  X’3051300D 06096086 48016503 04020305 000440’ || 64-byte hash value
+        let sha256_der_prefix = hex::decode("3031300d060960864801650304020105000420").unwrap();
+
+        if let Some(sha256_hex) = sha256_hex_opt {
+            let hash = opt_result!(hex::decode(sha256_hex), "Decode sha256 failed: {}");
+
+            let mut hash_with_oid = Vec::with_capacity(128);
+            hash_with_oid.extend_from_slice(&sha256_der_prefix);
+            hash_with_oid.extend_from_slice(&hash);
+            let hash_padding = pkcs1_padding_for_sign(&hash_with_oid, 2048).unwrap();
+            rust_util::util_msg::when(MessageType::DEBUG, || {
+                debugging!("Hash: {}", hex::encode(&hash));
+                debugging!("Hash with OID: {}", hex::encode(&hash_with_oid));
+                debugging!("PKCS1 padding: {}", hex::encode(&hash_padding));
+            });
+            let raw_in = crate::digest::copy_rsa2048(&hash_padding).unwrap();
+            let sign_result = piv::sign_data(&mut yk, &raw_in, AlgorithmId::Rsa2048, SlotId::Signature);
+            let sign = opt_result!(sign_result, "Sign data failed: {}");
+            let sign_bytes = sign.as_slice();
+
+            if json_output {
+                let mut json = BTreeMap::<&'_ str, String>::new();
+                json.insert("hash_hex", hex::encode(&hash));
+                json.insert("sign_hex", hex::encode(&sign_bytes));
+                json.insert("sign_base64", base64::encode(&sign_bytes));
+                println!("{}", serde_json::to_string_pretty(&json).unwrap());
+            } else {
+                success!("Signature HEX: {}", hex::encode(sign_bytes));
+                success!("Signature base64: {}", base64::encode(sign_bytes));
+            }
+        }
+        Ok(None)
+    }
+}
+
+fn pkcs1_padding_for_sign(bs: &[u8], bit_len: usize) -> XResult<Vec<u8>> {
+    let byte_len = bit_len / 8;
+    let max_len = byte_len - (1 + 1 + 8 + 2);
+    if bs.len() > max_len {
+        return simple_error!("Length is too large: {} > {}", bs.len(), max_len);
+    }
+    let mut output = Vec::<u8>::with_capacity(byte_len);
+    output.push(0x00);
+    output.push(0x01);
+    let ps_len = byte_len - bs.len() - (1 + 1 + 1);
+    output.extend_from_slice(&vec![0xff_u8; ps_len]);
+    output.push(0x00);
+    output.extend_from_slice(bs);
+    Ok(output)
+}