HTTP Signatures

[barzamin]

Need to implement keypair generation, wire into the publicKey field in actors, and actually do the signature stuff (probably with https://github.com/asonix/http-signatures).

[asonix]

Hey! so for information regarding my http-signatures crate, for encoding, it needs a Ring 13.5 RSAKeyPair type, and for decoding it needs a PKCS1 DER encoded Input type (from the untrusted crate, but exported by HTTP Signatures).

Unfortunately, it looks like the only crate in the ecosystem that can generate RSA Keypairs is OpenSSL, which exports to SubjectPublicKeyInfo PEM, PKCS1 PEM, SubjectPublicKeyInfo DER, and PKCS1 DER. Ring can build an RSAKeyPair from PKCS8 PEM, or PKCS1 DER.

It's likely that when using my crate, you'll need to do some translation, because I think Masto and friends use PKCS1 PEM for their plaintext representations (it might be SubjectPublicKeyInfo PEM).

For Aardwolf, I'm storing keys as PKCS1 DER byte arrays in the DB, and I'll do translation to PKCS1 PEM using the OpenSSL crate for plaintext representations.

I should really put some of this in the http-signatures docs

[barzamin]

@asonix in SignedHeader::verify, key: Input. what's the semantically expected content of key?

[asonix]

That's a PKCS1 DER encoded set of bytes. I probably should have just taken a Vec<u8> or &[u8] to make it easier for callers.

[asonix]

You can get that from an openssl::rsa::Rsa type with public_key_to_der_pkcs1

[asonix]

ACTUALLY I should have created a trait like

pub trait IntoVerifyType {
    type Error: Fail;

    fn into_verify_type(&self) -> Result<Vec<u8>, Self::Error>;
}

impl IntoVerifyType for Rsa {
    type Error = ErrorStack;

    fn into_verify_type(&self) -> Result<Vec<u8>, Self::Error> {
        self.public_key_to_der_pkcs1()
    }
}

and then it can be extended by consumers of my library, or by others in the future

[asonix]

Alright, with the openssl feature, it enables the following helpful methods

CreateKey::from_openssl_rsa(Rsa<Private>, ShaSize)

AsVerifyKey::as_verify_key(&self) // for Rsa<Public> and Rsa<Private>