diff options
| -rw-r--r-- | ext/crypto/import_key.rs | 64 |
1 files changed, 27 insertions, 37 deletions
diff --git a/ext/crypto/import_key.rs b/ext/crypto/import_key.rs index 6d6b11c52..b929f38bb 100644 --- a/ext/crypto/import_key.rs +++ b/ext/crypto/import_key.rs @@ -5,6 +5,7 @@ use elliptic_curve::pkcs8::der::Decodable as Pkcs8Decodable; use elliptic_curve::pkcs8::PrivateKeyInfo; use ring::signature::EcdsaKeyPair; use rsa::pkcs1::UIntBytes; +use rsa::pkcs8::AlgorithmIdentifier; use serde::Deserialize; use serde::Serialize; use spki::der::Encodable; @@ -191,6 +192,28 @@ fn import_key_rsa_jwk( } } +fn validate_mask_gen( + mask_gen_algorithm: &AlgorithmIdentifier, + hash_algorithm: &AlgorithmIdentifier, +) -> Result<(), deno_core::anyhow::Error> { + if mask_gen_algorithm.oid != ID_MFG1 { + return Err(not_supported_error("unsupported mask gen algorithm")); + } + + let parameters = mask_gen_algorithm + .parameters_any() + .map_err(|_| not_supported_error("unsupported parameters"))?; + let mgf1_hash_identifier = AlgorithmIdentifier::try_from(parameters) + .map_err(|_| not_supported_error("unsupported parameters"))?; + + // The hash function on which MGF1 is based. + mgf1_hash_identifier + .assert_algorithm_oid(hash_algorithm.oid) + .map_err(|_| not_supported_error("unsupported parameters"))?; + + Ok(()) +} + fn import_key_rsassa( key_data: KeyData, hash: ShaHash, @@ -359,12 +382,7 @@ fn import_key_rsapss( return Err(not_supported_error("unsupported hash algorithm")); } - // TODO(lucacasonato): - // If the parameters field of the maskGenAlgorithm field of params - // is not an instance of the HashAlgorithm ASN.1 type that is - // identical in content to the hashAlgorithm field of params, - // throw a NotSupportedError. - + validate_mask_gen(¶ms.mask_gen_algorithm, &hash_alg)?; hash } _ => return Err(data_error("unsupported algorithm")), @@ -439,16 +457,7 @@ fn import_key_rsapss( _ => return Err(data_error("unsupported hash algorithm")), }; - if params.mask_gen_algorithm.oid != ID_MFG1 { - return Err(not_supported_error("unsupported mask gen algorithm")); - } - - // TODO(lucacasonato): - // If the parameters field of the maskGenAlgorithm field of params - // is not an instance of the HashAlgorithm ASN.1 type that is - // identical in content to the hashAlgorithm field of params, - // throw a NotSupportedError. - + validate_mask_gen(¶ms.mask_gen_algorithm, &hash_alg)?; hash } _ => return Err(data_error("unsupported algorithm")), @@ -534,16 +543,7 @@ fn import_key_rsaoaep( _ => return Err(data_error("unsupported hash algorithm")), }; - if params.mask_gen_algorithm.oid != ID_MFG1 { - return Err(not_supported_error("unsupported hash algorithm")); - } - - // TODO(lucacasonato): - // If the parameters field of the maskGenAlgorithm field of params - // is not an instance of the HashAlgorithm ASN.1 type that is - // identical in content to the hashAlgorithm field of params, - // throw a NotSupportedError. - + validate_mask_gen(¶ms.mask_gen_algorithm, &hash_alg)?; hash } _ => return Err(data_error("unsupported algorithm")), @@ -617,17 +617,7 @@ fn import_key_rsaoaep( ID_SHA512_OID => Some(ShaHash::Sha512), _ => return Err(data_error("unsupported hash algorithm")), }; - - if params.mask_gen_algorithm.oid != ID_MFG1 { - return Err(not_supported_error("unsupported mask gen algorithm")); - } - - // TODO(lucacasonato): - // If the parameters field of the maskGenAlgorithm field of params - // is not an instance of the HashAlgorithm ASN.1 type that is - // identical in content to the hashAlgorithm field of params, - // throw a NotSupportedError. - + validate_mask_gen(¶ms.mask_gen_algorithm, &hash_alg)?; hash } _ => return Err(data_error("unsupported algorithm")), |