x509 1.6.4 → 1.6.5
raw patch · 7 files changed
+59/−23 lines, 7 files
Files
- Data/X509.hs +1/−0
- Data/X509/AlgorithmIdentifier.hs +25/−5
- Data/X509/Ext.hs +0/−1
- Data/X509/PublicKey.hs +3/−3
- Data/X509/Signed.hs +27/−13
- Tests/Tests.hs +2/−0
- x509.cabal +1/−1
Data/X509.hs view
@@ -43,6 +43,7 @@ , getSigned , getSignedData , objectToSignedExact+ , objectToSignedExactF , encodeSignedObject , decodeSignedObject
Data/X509/AlgorithmIdentifier.hs view
@@ -28,6 +28,7 @@ -- | Public Key Algorithm data PubKeyALG = PubKeyALG_RSA -- ^ RSA Public Key algorithm+ | PubKeyALG_RSAPSS -- ^ RSA PSS Key algorithm (RFC 3447) | PubKeyALG_DSA -- ^ DSA Public Key algorithm | PubKeyALG_EC -- ^ ECDSA & ECDH Public Key algorithm | PubKeyALG_DH -- ^ Diffie Hellman Public Key algorithm@@ -42,10 +43,11 @@ deriving (Show,Eq) instance OIDable PubKeyALG where- getObjectID PubKeyALG_RSA = [1,2,840,113549,1,1,1]- getObjectID PubKeyALG_DSA = [1,2,840,10040,4,1]- getObjectID PubKeyALG_EC = [1,2,840,10045,2,1]- getObjectID PubKeyALG_DH = [1,2,840,10046,2,1]+ getObjectID PubKeyALG_RSA = [1,2,840,113549,1,1,1]+ getObjectID PubKeyALG_RSAPSS = [1,2,840,113549,1,1,10]+ getObjectID PubKeyALG_DSA = [1,2,840,10040,4,1]+ getObjectID PubKeyALG_EC = [1,2,840,10045,2,1]+ getObjectID PubKeyALG_DH = [1,2,840,10046,2,1] getObjectID (PubKeyALG_Unknown oid) = oid sig_table :: [ (OID, SignatureALG) ]@@ -63,6 +65,12 @@ , ([1,2,840,10045,4,3,2], SignatureALG HashSHA256 PubKeyALG_EC) , ([1,2,840,10045,4,3,3], SignatureALG HashSHA384 PubKeyALG_EC) , ([1,2,840,10045,4,3,4], SignatureALG HashSHA512 PubKeyALG_EC)+ , ([2,16,840,1,101,3,4,2,1], SignatureALG HashSHA256 PubKeyALG_RSAPSS)+ , ([2,16,840,1,101,3,4,2,2], SignatureALG HashSHA384 PubKeyALG_RSAPSS)+ , ([2,16,840,1,101,3,4,2,3], SignatureALG HashSHA512 PubKeyALG_RSAPSS)+ , ([2,16,840,1,101,3,4,2,4], SignatureALG HashSHA224 PubKeyALG_RSAPSS)+ , ([2,16,840,1,101,3,4,3,1], SignatureALG HashSHA224 PubKeyALG_DSA)+ , ([2,16,840,1,101,3,4,3,2], SignatureALG HashSHA256 PubKeyALG_DSA) ] oidSig :: OID -> SignatureALG@@ -72,11 +80,23 @@ sigOID (SignatureALG_Unknown oid) = oid sigOID sig = maybe (error ("unknown OID for " ++ show sig)) fst $ find ((==) sig . snd) sig_table +-- | PSS salt length. Always assume ``-sigopt rsa_pss_saltlen:-1``+saltLen :: HashALG -> Integer+saltLen HashSHA256 = 32+saltLen HashSHA384 = 48+saltLen HashSHA512 = 64+saltLen HashSHA224 = 28+saltLen _ = error "toASN1: X509.SignatureAlg.HashAlg: Unknown hash"+ instance ASN1Object SignatureALG where fromASN1 (Start Sequence:OID oid:Null:End Sequence:xs) = Right (oidSig oid, xs) fromASN1 (Start Sequence:OID oid:End Sequence:xs) = Right (oidSig oid, xs)+ fromASN1 (Start Sequence:OID [1,2,840,113549,1,1,10]:Start Sequence:Start _:Start Sequence:OID hash1:End Sequence:End _:Start _:Start Sequence:OID [1,2,840,113549,1,1,8]:Start Sequence:OID _hash2:End Sequence:End Sequence:End _:Start _: IntVal _iv: End _: End Sequence : End Sequence:xs) =+ Right (oidSig hash1, xs) fromASN1 _ = Left "fromASN1: X509.SignatureALG: unknown format"- toASN1 signatureAlg = \xs -> Start Sequence:OID (sigOID signatureAlg):Null:End Sequence:xs+ toASN1 signatureAlg@(SignatureALG hashAlg PubKeyALG_RSAPSS) = \xs -> Start Sequence:OID [1,2,840,113549,1,1,10]:Start Sequence:Start (Container Context 0):Start Sequence:OID (sigOID signatureAlg):End Sequence:End (Container Context 0):Start (Container Context 1): Start Sequence:OID [1,2,840,113549,1,1,8]:Start Sequence:OID (sigOID signatureAlg):End Sequence:End Sequence:End (Container Context 1):Start (Container Context 2):IntVal (saltLen hashAlg):End (Container Context 2):End Sequence:End Sequence:xs+ toASN1 signatureAlg@(SignatureALG _ _) = \xs -> Start Sequence:OID (sigOID signatureAlg):Null:End Sequence:xs+ toASN1 (SignatureALG_Unknown oid) = \xs -> Start Sequence:OID oid:Null:End Sequence:xs
Data/X509/Ext.hs view
@@ -39,7 +39,6 @@ import Data.List (find) import Data.X509.ExtensionRaw import Data.X509.DistinguishedName-import Data.X509.Internal import Control.Applicative -- | key usage flag that is found in the key usage extension field.
Data/X509/PublicKey.hs view
@@ -175,9 +175,9 @@ encodeInner (PubKeyEC (PubKeyEC_Named curveName (SerializedPoint bits))) = asn1Container Sequence [pkalg,OID eOid] ++ [BitString $ toBitArray bits 0] where- eOid = case curveName of- ECC.SEC_p384r1 -> [1,3,132,0,34]- _ -> error ("undefined curve OID: " ++ show curveName)+ eOid = case lookupOID curvesOIDTable curveName of+ Just oid -> oid+ _ -> error ("undefined curve OID: " ++ show curveName) encodeInner (PubKeyEC (PubKeyEC_Prime {})) = error "encodeInner: unimplemented public key EC_Prime" encodeInner (PubKeyDH _) = error "encodeInner: unimplemented public key DH"
Data/X509/Signed.hs view
@@ -35,6 +35,7 @@ , decodeSignedObject -- * Object to Signed and SignedExact , objectToSignedExact+ , objectToSignedExactF , objectToSigned , signedToExact ) where@@ -93,21 +94,34 @@ => (ByteString -> (ByteString, SignatureALG, r)) -- ^ signature function -> a -- ^ object to sign -> (SignedExact a, r)-objectToSignedExact signatureFunction object = (SignedExact signed objRaw signedRaw, r)- where signed = Signed { signedObject = object- , signedAlg = sigAlg- , signedSignature = sigBits- }- signedRaw = encodeASN1' DER signedASN1- signedASN1 = Start Sequence- : objASN1- (toASN1 sigAlg- (BitString (toBitArray sigBits 0)- : End Sequence- : []))+objectToSignedExact signatureFunction object = (signedExact, val)+ where+ (val, signedExact) = objectToSignedExactF (wrap . signatureFunction) object+ wrap (b, s, r) = (r, (b, s))++-- | A generalization of 'objectToSignedExact' where the signature function+-- runs in an arbitrary functor. This allows for example to sign using an+-- algorithm needing random values.+objectToSignedExactF :: (Functor f, Show a, Eq a, ASN1Object a)+ => (ByteString -> f (ByteString, SignatureALG)) -- ^ signature function+ -> a -- ^ object to sign+ -> f (SignedExact a)+objectToSignedExactF signatureFunction object = fmap buildSignedExact (signatureFunction objRaw)+ where buildSignedExact (sigBits,sigAlg) =+ let signed = Signed { signedObject = object+ , signedAlg = sigAlg+ , signedSignature = sigBits+ }+ signedRaw = encodeASN1' DER signedASN1+ signedASN1 = Start Sequence+ : objASN1+ (toASN1 sigAlg+ (BitString (toBitArray sigBits 0)+ : End Sequence+ : []))+ in SignedExact signed objRaw signedRaw objASN1 = \xs -> Start Sequence : toASN1 object (End Sequence : xs) objRaw = encodeASN1' DER (objASN1 [])- (sigBits,sigAlg,r) = signatureFunction objRaw -- | Transform an object into a 'Signed' object. --
Tests/Tests.hs view
@@ -59,6 +59,8 @@ , SignatureALG HashSHA512 PubKeyALG_RSA , SignatureALG HashSHA224 PubKeyALG_RSA , SignatureALG HashSHA1 PubKeyALG_DSA+ , SignatureALG HashSHA224 PubKeyALG_DSA+ , SignatureALG HashSHA256 PubKeyALG_DSA , SignatureALG HashSHA224 PubKeyALG_EC , SignatureALG HashSHA256 PubKeyALG_EC , SignatureALG HashSHA384 PubKeyALG_EC
x509.cabal view
@@ -1,5 +1,5 @@ Name: x509-Version: 1.6.4+Version: 1.6.5 Description: X509 reader and writer License: BSD3 License-file: LICENSE