Skip to content

Commit 0d96de4

Browse files
SrabutdotcomSrabutdotcom
committed
remove CertificateVerify and Finished
1 parent 5a40855 commit 0d96de4

File tree

3 files changed

+2
-248
lines changed

3 files changed

+2
-248
lines changed

‎deno.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@tls/enum",
3-
"version": "0.6.7",
3+
"version": "0.6.8",
44
"exports": "./src/mod.ts",
55
"publish": {
66
"exclude": ["dist/"]

‎src/signaturescheme.js‎

Lines changed: 1 addition & 146 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,8 @@
11
// deno-lint-ignore-file no-slow-types
22
// @ts-self-types="../type/signaturescheme.d.ts"
33

4-
import { Constrained, Struct, Uint16 } from "./dep.ts";
4+
import { Uint16 } from "./dep.ts";
55
import { Enum } from "./enum.js";
6-
import { sha256, sha384, sha512 } from "@noble/hashes/sha2"
7-
import { HandshakeType } from "./handshaketype.js";
86

97
/**
108
* Enumeration of signature schemes as defined in RFC 8446.
@@ -113,150 +111,7 @@ export class SignatureScheme extends Enum {
113111
}
114112
}
115113

116-
async certificateVerify(clientHelloMsg, serverHelloMsg, encryptedExtensionsMsg, certificateMsg, RSAprivateKey) {
117-
const signature = await signatureFrom(clientHelloMsg, serverHelloMsg, encryptedExtensionsMsg, certificateMsg, RSAprivateKey, this.algo)
118-
return new CertificateVerify(this, signature)
119-
}
120-
}
121-
122-
export class CertificateVerify extends Uint8Array {
123-
static fromMsg(array) {
124-
const copy = Uint8Array.from(array)
125-
const algorithm = SignatureScheme.from(copy.subarray(4));
126-
const signature = Signature.from(copy.subarray(6))
127-
return new CertificateVerify(algorithm, signature.opaque)
128-
}
129-
static from = CertificateVerify.fromMsg
130-
constructor(signatureScheme, signature) {
131-
const signatureConstrained = new Signature(signature);
132-
const struct = new Struct(
133-
signatureScheme.Uint16,
134-
signatureConstrained
135-
)
136-
super(struct);
137-
this.algorithm = signatureScheme;
138-
this.signature = signature
139-
return HandshakeType.CERTIFICATE_VERIFY.handshake(this);
140-
}
141-
}
142-
143-
export class Signature extends Constrained {
144-
static from(array) {
145-
const copy = Uint8Array.from(array);
146-
const lengthOf = Uint16.from(copy).value;
147-
return new Signature(copy.subarray(2, 2 + lengthOf))
148-
}
149-
constructor(opaque) {
150-
super(0, 2 ** 16 - 1, opaque)
151-
this.opaque = opaque
152-
}
153-
}
154-
155-
async function signatureFrom(clientHelloMsg, serverHelloMsg, encryptedExtensionsMsg, certificateMsg, RSAprivateKey, algo) {
156-
const leading = Uint8Array.of(
157-
//NOTE 64 space characters
158-
32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
159-
//NOTE 'TLS 1.3, server CertificateVerify'
160-
84, 76, 83, 32, 49, 46, 51, 44, 32, 115, 101, 114, 118, 101, 114, 32, 67, 101, 114, 116, 105, 102, 105, 99, 97, 116, 101, 86, 101, 114, 105, 102, 121,
161-
//NOTE single null char
162-
0
163-
)
164-
165-
const hash = hashFromAlgo(algo)
166-
167-
const transcriptHash = hash
168-
.update(clientHelloMsg)
169-
.update(serverHelloMsg)
170-
.update(encryptedExtensionsMsg)
171-
.update(certificateMsg)
172-
.digest();
173-
174-
const data = Struct.createFrom(
175-
leading,
176-
transcriptHash
177-
)
178-
179-
const signBuffer = await crypto.subtle.sign(
180-
algo,
181-
RSAprivateKey,
182-
data
183-
)
184-
185-
/* const verify = await crypto.subtle.verify(
186-
{
187-
name: "RSA-PSS",//'RSASSA-PKCS1-v1_5',
188-
saltLength: 256 / 8
189-
},
190-
RSAPublicKey, //rsapublickey in Certificate
191-
sign,
192-
data
193-
) */
194-
return new Uint8Array(signBuffer)
195-
}
196-
197-
function hashFromAlgo(algo) {
198-
let sha
199-
const { hash, saltLength } = algo;
200-
if (hash) { sha = parseInt(hash.split("-")[1]); }
201-
else if (saltLength) { sha = saltLength * 8 }
202-
else { sha = 256 };
203-
switch (sha) {
204-
case 384: return sha384.create();
205-
case 512: return sha512.create();
206-
case 256:
207-
default:
208-
return sha256.create();
209-
}
210114
}
211115

212-
export async function finished(finishedKey, sha = 256, ...messages) {
213-
//const finishedKey = hkdfExpandLabel(serverHS_secret, 'finished', new Uint8Array, 32);
214-
const finishedKeyCrypto = await crypto.subtle.importKey(
215-
"raw",
216-
finishedKey,
217-
{
218-
name: "HMAC",
219-
hash: { name: `SHA-${sha}` },
220-
},
221-
true,
222-
["sign", "verify"]
223-
);
224-
225-
const hash = sha == 256 ? sha256.create() :
226-
sha == 384 ? sha384.create() : sha256.create();
227-
228-
const messagesStruct = Struct.createFrom(...messages);
229-
230-
const transcriptHash = hash
231-
.update(Uint8Array.from(messagesStruct))
232-
.digest();
233-
234-
const verify_data = await crypto.subtle.sign(
235-
{ name: "HMAC" },
236-
finishedKeyCrypto,
237-
transcriptHash
238-
)
239-
240-
/* const _test_verify_data = await crypto.subtle.verify(
241-
{ name: "HMAC" },
242-
finishedKeyCrypto,
243-
verify_data,
244-
transcriptHash
245-
) */
246-
//verify_data.transcriptHash = transcriptHash;
247-
return new Finished(verify_data);
248-
}
249-
250-
export class Finished extends Uint8Array {
251-
static fromMsg(message) {
252-
const copy = Uint8Array.from(message)
253-
return new Finished(copy.subarray(4))
254-
}
255-
constructor(verify_data) {
256-
super(verify_data);
257-
this.verify_data = verify_data
258-
return HandshakeType.FINISHED.handshake(this)
259-
}
260-
}
261116

262117
// npx -p typescript tsc ./src/signaturescheme.js --declaration --allowJs --emitDeclarationOnly --lib ESNext --outDir ./dist

‎test/signaturescheme_test.js‎

Lines changed: 0 additions & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -18,108 +18,7 @@ Deno.test("SignatureAlgorithmSchema", () => {
1818
assertEquals(test, back)
1919
})
2020

21-
const clientHelloMsg = HexaDecimal.fromString(
22-
`01 00 00 c0 03 03 cb 34 ec b1 e7 81 63
23-
ba 1c 38 c6 da cb 19 6a 6d ff a2 1a 8d 99 12 ec 18 a2 ef 62 83
24-
02 4d ec e7 00 00 06 13 01 13 03 13 02 01 00 00 91 00 00 00 0b
25-
00 09 00 00 06 73 65 72 76 65 72 ff 01 00 01 00 00 0a 00 14 00
26-
12 00 1d 00 17 00 18 00 19 01 00 01 01 01 02 01 03 01 04 00 23
27-
00 00 00 33 00 26 00 24 00 1d 00 20 99 38 1d e5 60 e4 bd 43 d2
28-
3d 8e 43 5a 7d ba fe b3 c0 6e 51 c1 3c ae 4d 54 13 69 1e 52 9a
29-
af 2c 00 2b 00 03 02 03 04 00 0d 00 20 00 1e 04 03 05 03 06 03
30-
02 03 08 04 08 05 08 06 04 01 05 01 06 01 02 01 04 02 05 02 06
31-
02 02 02 00 2d 00 02 01 01 00 1c 00 02 40 01`).byte
3221

33-
const serverHelloMsg = HexaDecimal.fromString(
34-
`02 00 00 56 03 03 a6 af 06 a4 12 18 60 dc 5e
35-
6e 60 24 9c d3 4c 95 93 0c 8a c5 cb 14 34 da c1 55 77 2e d3 e2
36-
69 28 00 13 01 00 00 2e 00 33 00 24 00 1d 00 20 c9 82 88 76 11
37-
20 95 fe 66 76 2b db f7 c6 72 e1 56 d6 cc 25 3b 83 3d f1 dd 69
38-
b1 b0 4e 75 1f 0f 00 2b 00 02 03 04`).byte
39-
40-
const encryptedExtensionsMsg = HandshakeType.ENCRYPTED_EXTENSIONS.handshake(HexaDecimal.fromString(`00 22 00 0a 00 14 00
41-
12 00 1d 00 17 00 18 00 19 01 00 01 01 01 02 01 03 01 04 00 1c
42-
00 02 40 01 00 00 00 00
43-
`).byte).byte
44-
45-
const certificateMsg = HexaDecimal.fromString(
46-
`0b 00 01 b9 00 00 01 b5 00 01 b0 30 82
47-
01 ac 30 82 01 15 a0 03 02 01 02 02 01 02 30 0d 06 09 2a 86 48
48-
86 f7 0d 01 01 0b 05 00 30 0e 31 0c 30 0a 06 03 55 04 03 13 03
49-
72 73 61 30 1e 17 0d 31 36 30 37 33 30 30 31 32 33 35 39 5a 17
50-
0d 32 36 30 37 33 30 30 31 32 33 35 39 5a 30 0e 31 0c 30 0a 06
51-
03 55 04 03 13 03 72 73 61 30 81 9f 30 0d 06 09 2a 86 48 86 f7
52-
0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 b4 bb 49 8f
53-
82 79 30 3d 98 08 36 39 9b 36 c6 98 8c 0c 68 de 55 e1 bd b8 26
54-
d3 90 1a 24 61 ea fd 2d e4 9a 91 d0 15 ab bc 9a 95 13 7a ce 6c
55-
1a f1 9e aa 6a f9 8c 7c ed 43 12 09 98 e1 87 a8 0e e0 cc b0 52
56-
4b 1b 01 8c 3e 0b 63 26 4d 44 9a 6d 38 e2 2a 5f da 43 08 46 74
57-
80 30 53 0e f0 46 1c 8c a9 d9 ef bf ae 8e a6 d1 d0 3e 2b d1 93
58-
ef f0 ab 9a 80 02 c4 74 28 a6 d3 5a 8d 88 d7 9f 7f 1e 3f 02 03
59-
01 00 01 a3 1a 30 18 30 09 06 03 55 1d 13 04 02 30 00 30 0b 06
60-
03 55 1d 0f 04 04 03 02 05 a0 30 0d 06 09 2a 86 48 86 f7 0d 01
61-
01 0b 05 00 03 81 81 00 85 aa d2 a0 e5 b9 27 6b 90 8c 65 f7 3a
62-
72 67 17 06 18 a5 4c 5f 8a 7b 33 7d 2d f7 a5 94 36 54 17 f2 ea
63-
e8 f8 a5 8c 8f 81 72 f9 31 9c f3 6b 7f d6 c5 5b 80 f2 1a 03 01
64-
51 56 72 60 96 fd 33 5e 5e 67 f2 db f1 02 70 2e 60 8c ca e6 be
65-
c1 fc 63 a4 2a 99 be 5c 3e b7 10 7c 3c 54 e9 b9 eb 2b d5 20 3b
66-
1c 3b 84 e0 a8 b2 f7 59 40 9b a3 ea c9 d9 1d 40 2d cc 0c c8 f8
67-
96 12 29 ac 91 87 b4 2b 4d e1 00 00`).byte;
68-
69-
const rsaKey = await crypto.subtle.generateKey(
70-
{
71-
name: "RSA-PSS",
72-
hash: "SHA-256", // SHA-1, SHA-256, SHA-384, or SHA-512
73-
publicExponent: new Uint8Array([1, 0, 1]), // 0x03 or 0x010001
74-
modulusLength: 2048, // 1024, 2048, or 4096
75-
},
76-
true,
77-
["sign", "verify"],
78-
)
79-
80-
Deno.test("CertificateVerify", async () => {
81-
const test = await SignatureScheme.RSA_PSS_PSS_SHA256.certificateVerify(clientHelloMsg, serverHelloMsg, encryptedExtensionsMsg, certificateMsg, rsaKey.privateKey)
82-
const back = CertificateVerify.fromMsg(test)
83-
assertEquals(test.toString(), back.toString())
84-
})
85-
86-
87-
Deno.test("Finished", async () => {
88-
const test = await SignatureScheme.RSA_PSS_PSS_SHA256.certificateVerify(clientHelloMsg, serverHelloMsg, encryptedExtensionsMsg, certificateMsg, rsaKey.privateKey)
89-
//const back = CertificateVerify.from(test)
90-
const serverHS_secret_fake = crypto.getRandomValues(new Uint8Array(32));
91-
const _finished = await finished(serverHS_secret_fake, 256, test);
92-
const finishedBack = Finished.fromMsg(_finished);
93-
assertEquals(_finished.toString(), finishedBack.toString())
94-
})
95-
96-
const hash = "SHA-256";
97-
const sha = parseInt(hash.split("-")[1]);
98-
99-
const certificateVerifyMsg = HexaDecimal.fromString(`0f 00 00 84 08 04 00 80 5a 74 7c
100-
5d 88 fa 9b d2 e5 5a b0 85 a6 10 15 b7 21 1f 82 4c d4 84 14 5a
101-
b3 ff 52 f1 fd a8 47 7b 0b 7a bc 90 db 78 e2 d3 3a 5c 14 1a 07
102-
86 53 fa 6b ef 78 0c 5e a2 48 ee aa a7 85 c4 f3 94 ca b6 d3 0b
103-
be 8d 48 59 ee 51 1f 60 29 57 b1 54 11 ac 02 76 71 45 9e 46 44
104-
5c 9e a5 8c 18 1e 81 8e 95 b8 c3 fb 0b f3 27 84 09 d3 be 15 2a
105-
3d a5 04 3e 06 3d da 65 cd f5 ae a2 0d 53 df ac d4 2f 74 f3`).byte
106-
107-
const finishedMsg = HexaDecimal.fromString(
108-
`14 00 00 20 9b 9b 14 1d 90 63 37 fb d2 cb
109-
dc e7 1d f4 de da 4a b4 2c 30 95 72 cb 7f ff ee 54 54 b7 8f 07
110-
18`).byte
111-
112-
const rsaPrivateKeyJwk = JSON.parse('{"kty":"RSA","alg":"PS256","key_ops":["sign"],"ext":true,"n":"tLtJj4J5MD2YCDY5mzbGmIwMaN5V4b24JtOQGiRh6v0t5JqR0BWrvJqVE3rObBrxnqpq-Yx87UMSCZjhh6gO4MywUksbAYw-C2MmTUSabTjiKl_aQwhGdIAwUw7wRhyMqdnvv66OptHQPivRk-_wq5qAAsR0KKbTWo2I159_Hj8","e":"AQAB","d":"BN6nBdQ6bqcgndgHIRGoPIHjIqWSeLM0gGQer3wKaYW44xxE9t5i4bTCMJ9hJud7fEHpIzFLv6OIEwXcEhfxbIGc5TjpIvNpgo0OVxldjISIRgIHsvqnJrz3CLvX239nn4k0kvwqYi4IlwqsRBzk4MMIjfJa5nkjPfijvaL_mUE","p":"5DX7fMg3N3VtrOqWq39ZoswQadt96xkOF-M6UysnPzCjJ6oKqrxYzWdGavmEX63Gdf4JSvksS9Hywbwz3S4FFQ","q":"yr07wOBDhmTI1MyfmZd6lNm7_q2OQ4cKuuP364tODu6K8dm0cZumGWzyy7ru6_izSQr-np_6dKiKpR_GRWKTAw","dp":"P1c0XCf-G2h-bnYWJ7eLG4JkM912D6C-pqas85SQqhtHzaSGnWj1hN1bUCm9Mgk7glhmH-cVAl5dcKRaCNPTGQ","dq":"GD2gE2O9LyiFysvcmWS_R2TxUXY2-GQBKG9xiTxSzP5ApsI9DQhrR8b7ENj9EEHgTe9-mkDOlXxBd5ThBBLROQ","qi":"g5ypoIXkKGsskORmmXosaB8hM5qjR3gU5N7BGDMFDtUN0TzAOASKQ8WbKsxBaInAN2Zf5a-mBZafjAHfpcqWnQ"}');
113-
114-
const rsaPrivateKey = await crypto.subtle.importKey('jwk', rsaPrivateKeyJwk, { name: 'RSA-PSS', hash: 'SHA-256' }, true, ['sign'])
115-
116-
const certificateVerifyMsg_0 = await SignatureScheme.RSA_PSS_PSS_SHA256.certificateVerify(clientHelloMsg, serverHelloMsg, encryptedExtensionsMsg, certificateMsg, rsaPrivateKey)
117-
118-
const finished_key = HexaDecimal.fromString(
119-
`00 8d 3b 66 f8 16 ea 55 9f 96 b5 37 e8 85
120-
c3 1f c0 68 bf 49 2c 65 2f 01 f2 88 a1 d8 cd c1 9f c8`).byte
121-
122-
const finished_0 = await finished(finished_key, 256, clientHelloMsg, serverHelloMsg, encryptedExtensionsMsg, certificateMsg);
12322

12423

12524

0 commit comments

Comments
 (0)