RSA certificate verification (#69)

cryspen · Nov 15, 2023 · 7949a38 · 7949a38
1 parent 0366520
commit 7949a38
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 15 deletions.
diff --git a/simple_https_client/src/lib.rs b/simple_https_client/src/lib.rs
@@ -126,18 +126,18 @@ const SHA384_Aes256Gcm_EcdsaSecp256r1Sha256_P256: Algorithms = Algorithms(
 
 pub fn ciphersuites() -> Vec<Algorithms> {
     vec![
-        // SHA256_Chacha20Poly1305_RsaPssRsaSha256_X25519,
+        SHA256_Chacha20Poly1305_RsaPssRsaSha256_X25519,
         SHA256_Chacha20Poly1305_EcdsaSecp256r1Sha256_X25519,
         SHA256_Chacha20Poly1305_EcdsaSecp256r1Sha256_P256,
-        // SHA256_Chacha20Poly1305_RsaPssRsaSha256_P256,
-        // SHA256_Aes128Gcm_EcdsaSecp256r1Sha256_P256,
-        // SHA256_Aes128Gcm_EcdsaSecp256r1Sha256_X25519,
-        // SHA256_Aes128Gcm_RsaPssRsaSha256_P256,
-        // SHA256_Aes128Gcm_RsaPssRsaSha256_X25519,
-        // SHA384_Aes256Gcm_EcdsaSecp256r1Sha256_P256,
-        // SHA384_Aes256Gcm_EcdsaSecp256r1Sha256_X25519,
-        // SHA384_Aes256Gcm_RsaPssRsaSha256_P256,
-        // SHA384_Aes256Gcm_RsaPssRsaSha256_X25519,
+        SHA256_Chacha20Poly1305_RsaPssRsaSha256_P256,
+        SHA256_Aes128Gcm_EcdsaSecp256r1Sha256_P256,
+        SHA256_Aes128Gcm_EcdsaSecp256r1Sha256_X25519,
+        SHA256_Aes128Gcm_RsaPssRsaSha256_P256,
+        SHA256_Aes128Gcm_RsaPssRsaSha256_X25519,
+        SHA384_Aes256Gcm_EcdsaSecp256r1Sha256_P256,
+        SHA384_Aes256Gcm_EcdsaSecp256r1Sha256_X25519,
+        SHA384_Aes256Gcm_RsaPssRsaSha256_P256,
+        SHA384_Aes256Gcm_RsaPssRsaSha256_X25519,
     ]
 }
 

diff --git a/simple_https_client/src/tls13client.rs b/simple_https_client/src/tls13client.rs
@@ -34,9 +34,8 @@ fn main() -> anyhow::Result<()> {
 
     // FIXME: #51 This is going to go away as soon as Bertie supports multiple
     //        ciphersuites.
-    let mut ciphersuites = ciphersuites();
     let mut response_prefix = Vec::new();
-    for algorithms in ciphersuites.drain(..) {
+    for algorithms in ciphersuites() {
         // Initiate HTTPS connection to host:port.
         let stream = TcpStream::connect((host.clone(), port))?;
         stream.set_nodelay(true).expect("set_nodelay call failed");
@@ -49,9 +48,8 @@ fn main() -> anyhow::Result<()> {
             Ok((_, _, response_prefix)) => response_prefix,
             Err(e) => {
                 // We ignore all errors here for now and keep trying.
-                eprintln!("tls13connet failed with {}", e);
-                break; // TODO FIX
-                       //continue;
+                eprintln!("tls13connect failed with {}", e);
+                continue;
             }
         };
         break;

diff --git a/src/tls13crypto.rs b/src/tls13crypto.rs
@@ -1,5 +1,6 @@
 use libcrux::{
     kem::{Ct, PrivateKey, PublicKey},
+    signature::rsa_pss::{RsaPssKeySize, RsaPssPublicKey},
     *,
 };
 
@@ -290,6 +291,34 @@ pub fn verify(
                 Err(_) => tlserr(INVALID_SIGNATURE),
             }
         }
+        (SignatureScheme::RsaPssRsaSha256, PublicVerificationKey::Rsa((n, e))) => {
+            let e = e.declassify();
+            if !(e.len() == 3 && e[0] == 0x1 && e[1] == 0x0 && e[2] == 0x1) {
+                // libcrux only supports `e = 3`
+                tlserr(UNSUPPORTED_ALGORITHM)
+            } else {
+                let key_size = match n.len() {
+                    // The format includes an extra 0-byte in front to disambiguate from negative numbers
+                    257 => RsaPssKeySize::N2048,
+                    385 => RsaPssKeySize::N3072,
+                    513 => RsaPssKeySize::N4096,
+                    769 => RsaPssKeySize::N6144,
+                    1025 => RsaPssKeySize::N8192,
+                    _ => return tlserr(UNSUPPORTED_ALGORITHM),
+                };
+                let pk = RsaPssPublicKey::new(key_size, &n.declassify()[1..]).unwrap();
+                let res = pk.verify(
+                    signature::DigestAlgorithm::Sha256,
+                    &sig.declassify().into(),
+                    &input.declassify(),
+                    32, // salt must be same length as digest ouput length
+                );
+                match res {
+                    Ok(res) => Ok(res),
+                    Err(_) => tlserr(CRYPTO_ERROR),
+                }
+            }
+        }
         _ => tlserr(UNSUPPORTED_ALGORITHM),
     }
 }