feature: pkcs#1 v2.2 emsa_pss_encode + emsa_pss_verify

Author: NegaScout

src/padding/pkcs_1_v2_2.jl

@@ -66,3 +66,46 @@ function MGF1(mgfSeed::Vector{UInt8}, maskLen:: Integer; hash = SHA.sha1)
     end
     return T[1:maskLen]
 end
+
+function emsa_pss_encode(M::Vector{UInt8}, emBits::Integer; MGF=ToyPublicKeys.MGF1, hash=SHA.sha1, sLen=0)
+    hLen = hash(UInt8[]) |> length
+    (emBits >= 8*hLen + 8 * sLen + 9) || error("emBits !>= 8hLen + 8 * sLen + 9") |> throw
+    emLen = ceil(emBits/8) |> Integer
+    emLen < hLen + sLen + 2 && error("encoding error") |> throw
+    length(M) > (big"2" << 60) && error("message too long") |> throw
+    salt = UInt8[]
+    if sLen > 0
+        salt = rand(UInt8, sLen)
+    end
+    mHash = hash(M)
+    MPrime = vcat(zeros(UInt8, 8), mHash, salt)
+    H = hash(MPrime)
+    PS = zeros(UInt8, emLen - sLen - hLen - 2)
+    DB = vcat(PS, ones(UInt8, 1), salt)
+    dbMask = MGF(H, emLen - hLen - 1)
+    maskedDB = DB .⊻ dbMask
+    maskedDB[1] &= 0xFF >> (8 * emLen - emBits)
+    EM = vcat(maskedDB, H, UInt8[0xbc])
+    return EM
+end
+
+function emsa_pss_verify(M::Vector{UInt8}, EM::Vector{UInt8}, emBits::Integer; MGF=ToyPublicKeys.MGF1, hash=SHA.sha1, sLen=0)
+    length(M) > (big"2" << 60) && error("inconsistent") |> throw
+    mHash = hash(M)
+    hLen = mHash |> length
+    emLen = ceil(emBits/8) |> Integer
+    emLen < hLen + sLen + 2 && error("inconsistent") |> throw
+    EM[end] != 0xbc && error("inconsistent") |> throw
+    maskedDB = EM[1:emLen - hLen - 1]
+    H = EM[emLen - hLen:emLen - 1]
+    (maskedDB[1] & ~(0xFF >> (8 * emLen - emBits))) != 0 && error("inconsistent") |> throw
+    dbMask = MGF(H, emLen - hLen - 1)
+    DB = maskedDB .⊻ dbMask
+    DB[1] &= 0xFF >> (8 * emLen - emBits)
+    (DB[1:emLen - hLen - sLen - 2] .!= 0) |> any && error("inconsistent") |> throw
+    DB[emLen - hLen - sLen - 1] != 1 && error("inconsistent") |> throw
+    salt = DB[end - sLen + 1 : end]
+    MPrime = MPrime = vcat(zeros(UInt8, 8), mHash, salt)
+    HPrime = hash(MPrime)
+    return H == HPrime
+end

test/padding.jl

@@ -1,3 +1,4 @@
+using SHA
 @testset "padding/pkcs_1_v1_5" begin
     test_vector = Vector{UInt8}([1,2,3])
     Random.seed!(42)
@@ -35,3 +36,51 @@ end
                                     public_key)
     @test unpadded == test_vector
 end
+
+@testset "emsa_pss_encode" begin
+    Random.seed!(42)
+    M = Vector{UInt8}([3,2,1])
+    sLen = 0
+    hLen = SHA.sha1(UInt8[]) |> length
+    emBits = 8 * hLen + 8 * sLen + 9
+    padded = ToyPublicKeys.emsa_pss_encode(M,
+                                           emBits;
+                                           sLen=sLen,
+                                           hash=SHA.sha1)
+    @test padded == UInt8[0x00, 0x39, 0xa1, 0xb4, 0x56, 0x60, 0x17, 0xd8, 0x5f, 0xa1, 0x6e, 0xa9, 0xe8, 0xd1, 0xe6, 0x30, 0x5a, 0xbd, 0xa2, 0x75, 0xb9, 0xbc]
+end
+
+@testset "emsa_pss_verify" begin
+    Random.seed!(42)
+    M = Vector{UInt8}([3,2,1])
+    hLen = SHA.sha1(UInt8[]) |> length
+    sLen = 0
+    emBits = 8 * hLen + 8 * sLen + 9
+    emLen = ceil(emBits/8) |> Integer
+    EM = UInt8[0x00, 0x39, 0xa1, 0xb4, 0x56, 0x60, 0x17, 0xd8, 0x5f, 0xa1, 0x6e, 0xa9, 0xe8, 0xd1, 0xe6, 0x30, 0x5a, 0xbd, 0xa2, 0x75, 0xb9, 0xbc]
+    consistent = ToyPublicKeys.emsa_pss_verify(M,
+                                               EM,
+                                               emBits;
+                                               sLen=sLen,
+                                               hash=SHA.sha1)
+    @test consistent == true
+end
+
+@testset "emsa_pss_verify(emsa_pss_encode)" begin
+    Random.seed!(42)
+    M = Vector{UInt8}([3,2,1])
+    hLen = SHA.sha1(UInt8[]) |> length
+    sLen = 0
+    emBits = 8 * hLen + 8 * sLen + 9
+    emLen = ceil(emBits/8) |> Integer
+    EM = ToyPublicKeys.emsa_pss_encode(M,
+                                       emBits;
+                                       sLen = sLen,
+                                       hash=SHA.sha1)
+    consistent = ToyPublicKeys.emsa_pss_verify(M,
+                                               EM,
+                                               emBits;
+                                               sLen=sLen,
+                                               hash=SHA.sha1)
+    @test consistent == true
+end