diff --git a/Cargo.lock b/Cargo.lock index 6aa1137..19d7a96 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -905,9 +905,9 @@ dependencies = [ [[package]] name = "pkcs8" -version = "0.11.0-rc.11" +version = "0.11.0-rc.12" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "12922b6296c06eb741b02d7b5161e3aaa22864af38dfa025a1a3ba3f68c84577" +checksum = "9d71d6da5a0e652b5c694049095a52f5e564012b8ee5001cf10d84a4ca9a7f9d" dependencies = [ "der", "spki", diff --git a/dsa/Cargo.toml b/dsa/Cargo.toml index ea58e5b..6b9855e 100644 --- a/dsa/Cargo.toml +++ b/dsa/Cargo.toml @@ -26,7 +26,7 @@ signature = { version = "3.0.0-rc.10", default-features = false, features = ["al zeroize = { version = "1", default-features = false, features = ["alloc"] } # optional dependencies -pkcs8 = { version = "0.11.0-rc.11", optional = true, default-features = false, features = ["alloc"] } +pkcs8 = { version = "0.11.0-rc.12", optional = true, default-features = false, features = ["alloc"] } [dev-dependencies] chacha20 = { version = "0.10", features = ["rng"] } @@ -34,7 +34,7 @@ der = { version = "0.8", features = ["derive"] } hex = "0.4" hex-literal = "1" getrandom = { version = "0.4", features = ["sys_rng"] } -pkcs8 = { version = "0.11.0-rc.11", default-features = false, features = ["pem"] } +pkcs8 = { version = "0.11.0-rc.12", default-features = false, features = ["pem"] } proptest = "1" rand_core = "0.10" sha1 = "0.11" diff --git a/dsa/src/signing_key.rs b/dsa/src/signing_key.rs index 4bf0897..14a7103 100644 --- a/dsa/src/signing_key.rs +++ b/dsa/src/signing_key.rs @@ -271,26 +271,27 @@ impl<'a> TryFrom> for SigningKey { let x = UintRef::from_der(value.private_key.into())?; let x = BoxedUint::from_be_slice(x.as_bytes(), precision) - .map_err(|_| pkcs8::Error::KeyMalformed)?; + .map_err(|_| pkcs8::KeyError::Invalid)?; let x = NonZero::new(x) .into_option() - .ok_or(pkcs8::Error::KeyMalformed)?; + .ok_or(pkcs8::KeyError::Invalid)?; let y = if let Some(y_bytes) = value.public_key.as_ref().and_then(|bs| bs.as_bytes()) { let y = UintRef::from_der(y_bytes)?; BoxedUint::from_be_slice(y.as_bytes(), precision) - .map_err(|_| pkcs8::Error::KeyMalformed)? + .map_err(|_| pkcs8::KeyError::Invalid)? } else { crate::generate::public_component(&components, &x) .into_option() - .ok_or(pkcs8::Error::KeyMalformed)? + .ok_or(pkcs8::KeyError::Invalid)? .get() }; let verifying_key = - VerifyingKey::from_components(components, y).map_err(|_| pkcs8::Error::KeyMalformed)?; + VerifyingKey::from_components(components, y).map_err(|_| pkcs8::KeyError::Invalid)?; - SigningKey::from_components(verifying_key, x.get()).map_err(|_| pkcs8::Error::KeyMalformed) + Ok(SigningKey::from_components(verifying_key, x.get()) + .map_err(|_| pkcs8::KeyError::Invalid)?) } } diff --git a/ed25519/Cargo.toml b/ed25519/Cargo.toml index bd5c78d..96cc647 100644 --- a/ed25519/Cargo.toml +++ b/ed25519/Cargo.toml @@ -21,7 +21,7 @@ rust-version = "1.85" signature = { version = "3.0.0-rc.10", default-features = false } # optional dependencies -pkcs8 = { version = "0.11.0-rc.11", optional = true } +pkcs8 = { version = "0.11.0-rc.12", optional = true } serde = { version = "1", optional = true, default-features = false } serde_bytes = { version = "0.11", optional = true, default-features = false } zeroize = { version = "1", optional = true, default-features = false } diff --git a/ed25519/src/pkcs8.rs b/ed25519/src/pkcs8.rs index 2fc25d4..0ef257a 100644 --- a/ed25519/src/pkcs8.rs +++ b/ed25519/src/pkcs8.rs @@ -15,7 +15,8 @@ //! breaking changes when using this module. pub use pkcs8::{ - DecodePrivateKey, DecodePublicKey, Error, ObjectIdentifier, PrivateKeyInfoRef, Result, spki, + DecodePrivateKey, DecodePublicKey, Error, KeyError, ObjectIdentifier, PrivateKeyInfoRef, + Result, spki, }; #[cfg(feature = "alloc")] @@ -169,14 +170,14 @@ impl TryFrom> for KeypairBytes { // - 0x04: OCTET STRING tag // - 0x20: 32-byte length let secret_key = match private_key.private_key.as_bytes() { - [0x04, 0x20, rest @ ..] => rest.try_into().map_err(|_| Error::KeyMalformed), - _ => Err(Error::KeyMalformed), + [0x04, 0x20, rest @ ..] => rest.try_into().map_err(|_| KeyError::Invalid), + _ => Err(KeyError::Invalid), }?; let public_key = private_key .public_key .and_then(|bs| bs.as_bytes()) - .map(|bytes| bytes.try_into().map_err(|_| Error::KeyMalformed)) + .map(|bytes| bytes.try_into().map_err(|_| KeyError::Invalid)) .transpose()? .map(PublicKeyBytes); diff --git a/ed448/Cargo.toml b/ed448/Cargo.toml index fbece95..d1e8b13 100644 --- a/ed448/Cargo.toml +++ b/ed448/Cargo.toml @@ -21,7 +21,7 @@ rust-version = "1.85" signature = { version = "3.0.0-rc.10", default-features = false } # optional dependencies -pkcs8 = { version = "0.11.0-rc.11", optional = true } +pkcs8 = { version = "0.11.0-rc.12", optional = true } serde = { version = "1", optional = true, default-features = false } serde_bytes = { version = "0.11", optional = true, default-features = false } zeroize = { version = "1", optional = true, default-features = false } diff --git a/ed448/src/pkcs8.rs b/ed448/src/pkcs8.rs index 3310570..6254fa9 100644 --- a/ed448/src/pkcs8.rs +++ b/ed448/src/pkcs8.rs @@ -15,7 +15,8 @@ //! breaking changes when using this module. pub use pkcs8::{ - DecodePrivateKey, DecodePublicKey, Error, ObjectIdentifier, PrivateKeyInfoRef, Result, spki, + DecodePrivateKey, DecodePublicKey, Error, KeyError, ObjectIdentifier, PrivateKeyInfoRef, + Result, spki, }; #[cfg(feature = "alloc")] @@ -162,14 +163,14 @@ impl TryFrom> for KeypairBytes { // - 0x04: OCTET STRING tag // - 0x39: 57-byte length let secret_key = match private_key.private_key.as_bytes() { - [0x04, 0x39, rest @ ..] => rest.try_into().map_err(|_| Error::KeyMalformed), - _ => Err(Error::KeyMalformed), + [0x04, 0x39, rest @ ..] => rest.try_into().map_err(|_| KeyError::Invalid), + _ => Err(KeyError::Invalid), }?; let public_key = private_key .public_key .and_then(|bs| bs.as_bytes()) - .map(|bytes| bytes.try_into().map_err(|_| Error::KeyMalformed)) + .map(|bytes| bytes.try_into().map_err(|_| KeyError::Invalid)) .transpose()? .map(PublicKeyBytes); diff --git a/ml-dsa/Cargo.toml b/ml-dsa/Cargo.toml index b2d755a..53ca61c 100644 --- a/ml-dsa/Cargo.toml +++ b/ml-dsa/Cargo.toml @@ -40,7 +40,7 @@ signature = { version = "3.0.0-rc.10", default-features = false, features = ["di # optional dependencies const-oid = { version = "0.10", features = ["db"], optional = true } -pkcs8 = { version = "0.11.0-rc.11", default-features = false, optional = true } +pkcs8 = { version = "0.11.0-rc.12", default-features = false, optional = true } rand_core = { version = "0.10", optional = true } zeroize = { version = "1.8.1", optional = true, default-features = false } @@ -49,7 +49,7 @@ criterion = "0.7" getrandom = { version = "0.4", features = ["sys_rng"] } hex = { version = "0.4", features = ["serde"] } hex-literal = "1" -pkcs8 = { version = "0.11.0-rc.11", features = ["pem"] } +pkcs8 = { version = "0.11.0-rc.12", features = ["pem"] } proptest = "1" serde = { version = "1.0.215", features = ["derive"] } serde_json = "1.0.132" diff --git a/ml-dsa/src/pkcs8.rs b/ml-dsa/src/pkcs8.rs index 604f22e..dca9ab5 100644 --- a/ml-dsa/src/pkcs8.rs +++ b/ml-dsa/src/pkcs8.rs @@ -100,12 +100,12 @@ where let mut reader = der::SliceReader::new(private_key_info.private_key.as_bytes())?; let seed_string = SeedString::decode_implicit(&mut reader, SEED_TAG_NUMBER)? - .ok_or(pkcs8::Error::KeyMalformed)?; + .ok_or(pkcs8::KeyError::Invalid)?; let seed = seed_string .value .as_bytes() .try_into() - .map_err(|_| pkcs8::Error::KeyMalformed)?; + .map_err(|_| pkcs8::KeyError::Invalid)?; reader.finish()?; Ok(P::from_seed(&seed)) @@ -203,7 +203,7 @@ where .as_bytes() .ok_or_else(|| der::Tag::BitString.value_error().to_error())?, ) - .map_err(|_| ::pkcs8::Error::KeyMalformed)?, + .map_err(|_| spki::Error::KeyMalformed)?, )) } } diff --git a/slh-dsa/Cargo.toml b/slh-dsa/Cargo.toml index b9104db..26b6977 100644 --- a/slh-dsa/Cargo.toml +++ b/slh-dsa/Cargo.toml @@ -20,7 +20,7 @@ const-oid = { version = "0.10", features = ["db"] } digest = "0.11" hmac = "0.13" hybrid-array = { version = "0.4", features = ["extra-sizes"] } -pkcs8 = { version = "0.11.0-rc.11", default-features = false } +pkcs8 = { version = "0.11.0-rc.12", default-features = false } rand_core = "0.10" sha2 = { version = "0.11", default-features = false } sha3 = { version = "0.11", default-features = false } @@ -40,7 +40,7 @@ hex = { version = "0.4.1", features = ["serde"] } hex-literal = "1" num-bigint = "0.4.4" paste = "1.0.15" -pkcs8 = { version = "0.11.0-rc.11", features = ["pem"] } +pkcs8 = { version = "0.11.0-rc.12", features = ["pem"] } proptest = "1.11.0" rand = "0.10" serde_json = "1.0.124" diff --git a/slh-dsa/src/signing_key.rs b/slh-dsa/src/signing_key.rs index 3fdd3ff..6e015be 100644 --- a/slh-dsa/src/signing_key.rs +++ b/slh-dsa/src/signing_key.rs @@ -298,7 +298,7 @@ where .assert_algorithm_oid(P::ALGORITHM_OID)?; Self::try_from(private_key_info.private_key.as_bytes()) - .map_err(|_| pkcs8::Error::KeyMalformed) + .map_err(|_| pkcs8::KeyError::Invalid.into()) } } diff --git a/slh-dsa/src/verifying_key.rs b/slh-dsa/src/verifying_key.rs index db1860b..8bfbc7c 100644 --- a/slh-dsa/src/verifying_key.rs +++ b/slh-dsa/src/verifying_key.rs @@ -212,12 +212,12 @@ impl TryFrom> for VerifyingK fn try_from(spki: pkcs8::SubjectPublicKeyInfoRef<'_>) -> spki::Result { spki.algorithm.assert_algorithm_oid(P::ALGORITHM_OID)?; - Ok(Self::try_from( + Self::try_from( spki.subject_public_key .as_bytes() .ok_or_else(|| der::Tag::BitString.value_error().to_error())?, ) - .map_err(|_| pkcs8::Error::KeyMalformed)?) + .map_err(|_| spki::Error::KeyMalformed) } } diff --git a/xmss/Cargo.toml b/xmss/Cargo.toml index 9742d4d..443f02c 100644 --- a/xmss/Cargo.toml +++ b/xmss/Cargo.toml @@ -24,7 +24,7 @@ const-oid = { version = "0.10", optional = true } der = { version = "0.8", optional = true, default-features = false, features = ["alloc"] } digest = "0.11" hybrid-array = { version = "0.4", features = ["zeroize"] } -pkcs8 = { version = "0.11.0-rc.11", optional = true, default-features = false, features = ["alloc"] } +pkcs8 = { version = "0.11.0-rc.12", optional = true, default-features = false, features = ["alloc"] } rand = "0.10" sha2 = "0.11" sha3 = "0.11" diff --git a/xmss/src/error.rs b/xmss/src/error.rs index 675ee62..20fb90c 100644 --- a/xmss/src/error.rs +++ b/xmss/src/error.rs @@ -63,3 +63,10 @@ impl From for Error { Self::Pkcs8(err) } } + +#[cfg(feature = "pkcs8")] +impl From for Error { + fn from(err: pkcs8::KeyError) -> Self { + Self::Pkcs8(err.into()) + } +} diff --git a/xmss/src/pkcs8.rs b/xmss/src/pkcs8.rs index 81e282e..ee9beb6 100644 --- a/xmss/src/pkcs8.rs +++ b/xmss/src/pkcs8.rs @@ -94,7 +94,7 @@ impl KeyPair

{ let signing_key = SigningKey::

::try_from(pk_info.private_key.as_ref())?; let verifying_key = if let Some(pk) = pk_info.public_key { - let pk_bytes = pk.as_bytes().ok_or(pkcs8::Error::KeyMalformed)?; + let pk_bytes = pk.as_bytes().ok_or(pkcs8::KeyError::Invalid)?; // TODO(tarcieri): verify key matches expected value? VerifyingKey::

::try_from(pk_bytes)?