92 lines
4.2 KiB
Rust
92 lines
4.2 KiB
Rust
use std::collections::BTreeMap;
|
||
|
||
use clap::{App, Arg, ArgMatches, SubCommand};
|
||
use rust_util::{util_msg, XResult};
|
||
use rust_util::util_clap::{Command, CommandError};
|
||
use rust_util::util_msg::MessageType;
|
||
use yubikey::{piv, YubiKey};
|
||
use yubikey::piv::{AlgorithmId, SlotId};
|
||
|
||
use crate::util::base64_encode;
|
||
|
||
pub struct CommandImpl;
|
||
|
||
impl Command for CommandImpl {
|
||
fn name(&self) -> &str { "piv-sign" }
|
||
|
||
fn subcommand<'a>(&self) -> App<'a, 'a> {
|
||
SubCommand::with_name(self.name()).about("PIV RSA Sign(with SHA256) subcommand")
|
||
.arg(Arg::with_name("pin").short("p").long("pin").takes_value(true).default_value("123456").help("OpenPGP card user pin"))
|
||
.arg(Arg::with_name("sha256").short("2").long("sha256").takes_value(true).help("Digest SHA256 HEX"))
|
||
.arg(Arg::with_name("json").long("json").help("JSON output"))
|
||
}
|
||
|
||
fn run(&self, _arg_matches: &ArgMatches, sub_arg_matches: &ArgMatches) -> CommandError {
|
||
let json_output = sub_arg_matches.is_present("json");
|
||
if json_output { util_msg::set_logger_std_out(false); }
|
||
|
||
let pin_opt = sub_arg_matches.value_of("pin");
|
||
let pin = opt_value_result!(pin_opt, "User pin must be assigned");
|
||
|
||
let sha256_hex_opt = sub_arg_matches.value_of("sha256").map(|s| s.to_string());
|
||
|
||
let mut yk = opt_result!(YubiKey::open(), "YubiKey not found: {}");
|
||
opt_result!(yk.verify_pin(pin.as_bytes()), "YubiKey verify pin failed: {}");
|
||
|
||
// https://www.ibm.com/docs/en/zos/2.2.0?topic=cryptography-pkcs-1-formats
|
||
// MD5 X’3020300C 06082A86 4886F70D 02050500 0410’ || 16-byte hash value
|
||
// SHA-1 X'30213009 06052B0E 03021A05 000414’ || 20-byte hash value
|
||
// SHA-224 X’302D300D 06096086 48016503 04020405 00041C’ || 28-byte hash value
|
||
// SHA-256 X’3031300D 06096086 48016503 04020105 000420’ || 32-byte hash value
|
||
// SHA-384 X’3041300D 06096086 48016503 04020205 000430’ || 48-byte hash value
|
||
// SHA-512 X’3051300D 06096086 48016503 04020305 000440’ || 64-byte hash value
|
||
let sha256_der_prefix = hex::decode("3031300d060960864801650304020105000420").unwrap();
|
||
|
||
if let Some(sha256_hex) = sha256_hex_opt {
|
||
let hash = opt_result!(hex::decode(sha256_hex), "Decode sha256 failed: {}");
|
||
|
||
let mut hash_with_oid = Vec::with_capacity(128);
|
||
hash_with_oid.extend_from_slice(&sha256_der_prefix);
|
||
hash_with_oid.extend_from_slice(&hash);
|
||
let hash_padding = pkcs1_padding_for_sign(&hash_with_oid, 2048).unwrap();
|
||
util_msg::when(MessageType::DEBUG, || {
|
||
debugging!("Hash: {}", hex::encode(&hash));
|
||
debugging!("Hash with OID: {}", hex::encode(&hash_with_oid));
|
||
debugging!("PKCS1 padding: {}", hex::encode(&hash_padding));
|
||
});
|
||
let raw_in = crate::digest::copy_rsa2048(&hash_padding).unwrap();
|
||
let sign_result = piv::sign_data(&mut yk, &raw_in, AlgorithmId::Rsa2048, SlotId::Signature);
|
||
let sign = opt_result!(sign_result, "Sign data failed: {}");
|
||
let sign_bytes = sign.as_slice();
|
||
|
||
if json_output {
|
||
let mut json = BTreeMap::<&'_ str, String>::new();
|
||
json.insert("hash_hex", hex::encode(&hash));
|
||
json.insert("sign_hex", hex::encode(sign_bytes));
|
||
json.insert("sign_base64", base64_encode(sign_bytes));
|
||
println!("{}", serde_json::to_string_pretty(&json).unwrap());
|
||
} else {
|
||
success!("Signature HEX: {}", hex::encode(sign_bytes));
|
||
success!("Signature base64: {}", base64_encode(sign_bytes));
|
||
}
|
||
}
|
||
Ok(None)
|
||
}
|
||
}
|
||
|
||
fn pkcs1_padding_for_sign(bs: &[u8], bit_len: usize) -> XResult<Vec<u8>> {
|
||
let byte_len = bit_len / 8;
|
||
let max_len = byte_len - (1 + 1 + 8 + 2);
|
||
if bs.len() > max_len {
|
||
return simple_error!("Length is too large: {} > {}", bs.len(), max_len);
|
||
}
|
||
let mut output = Vec::<u8>::with_capacity(byte_len);
|
||
output.push(0x00);
|
||
output.push(0x01);
|
||
let ps_len = byte_len - bs.len() - (1 + 1 + 1);
|
||
output.extend_from_slice(&vec![0xff_u8; ps_len]);
|
||
output.push(0x00);
|
||
output.extend_from_slice(bs);
|
||
Ok(output)
|
||
}
|