crypto.go

package httpsign

import (
	"crypto"
	"crypto/ecdsa"
	"crypto/ed25519"
	"crypto/elliptic"
	"crypto/hmac"
	"crypto/rand"
	"crypto/rsa"
	"crypto/sha256"
	"crypto/sha512"
	"crypto/subtle"
	"fmt"

	"github.com/lestrrat-go/jwx/v4/jwa"
	"github.com/lestrrat-go/jwx/v4/jwk"
	"github.com/lestrrat-go/jwx/v4/jws"
)

// Signer includes a cryptographic key (typically a private key) and configuration of what needs to be signed.
type Signer struct {
	key           interface{}
	alg           string
	config        *SignConfig
	fields        Fields
	foreignSigner interface{}
}

// NewHMACSHA256Signer returns a new Signer structure. Key must be at least 64 bytes long.
// Config may be nil for a default configuration.
func NewHMACSHA256Signer(key []byte, config *SignConfig, fields Fields) (*Signer, error) {
	if len(key) < 64 {
		return nil, fmt.Errorf("key must be at least 64 bytes long")
	}
	if config == nil {
		config = NewSignConfig()
	}
	return &Signer{
		key:    key,
		alg:    "hmac-sha256",
		config: config,
		fields: fields,
	}, nil
}

// NewRSASigner returns a new Signer structure. Key is an RSA private key.
// Config may be nil for a default configuration.
func NewRSASigner(key rsa.PrivateKey, config *SignConfig, fields Fields) (*Signer, error) {
	if config == nil {
		config = NewSignConfig()
	}
	return &Signer{
		key:    key,
		alg:    "rsa-v1_5-sha256",
		config: config,
		fields: fields,
	}, nil
}

// NewRSAPSSSigner returns a new Signer structure. Key is an RSA private key.
// Config may be nil for a default configuration.
func NewRSAPSSSigner(key rsa.PrivateKey, config *SignConfig, fields Fields) (*Signer, error) {
	if config == nil {
		config = NewSignConfig()
	}
	return &Signer{
		key:    key,
		alg:    "rsa-pss-sha512",
		config: config,
		fields: fields,
	}, nil
}

// NewP256Signer returns a new Signer structure. Key is an elliptic curve P-256 private key.
// Config may be nil for a default configuration.
func NewP256Signer(key ecdsa.PrivateKey, config *SignConfig, fields Fields) (*Signer, error) {
	return newECCSigner(key, config, fields, elliptic.P256(), "P-256", "ecdsa-p256-sha256")
}

// NewP384Signer returns a new Signer structure. Key is an elliptic curve P-384 private key.
// Config may be nil for a default configuration.
func NewP384Signer(key ecdsa.PrivateKey, config *SignConfig, fields Fields) (*Signer, error) {
	return newECCSigner(key, config, fields, elliptic.P384(), "P-384", "ecdsa-p384-sha384")
}

func newECCSigner(key ecdsa.PrivateKey, config *SignConfig, fields Fields, curve elliptic.Curve, curveName, alg string) (*Signer, error) {
	if key.Curve != curve {
		return nil, fmt.Errorf("key curve must be %s", curveName)
	}
	if config == nil {
		config = NewSignConfig()
	}
	return &Signer{
		key:    key,
		alg:    alg,
		config: config,
		fields: fields,
	}, nil
}

// NewEd25519Signer returns a new Signer structure. Key is an EdDSA Curve 25519 private key.
// Config may be nil for a default configuration.
func NewEd25519Signer(key ed25519.PrivateKey, config *SignConfig, fields Fields) (*Signer, error) {
	if key == nil {
		return nil, fmt.Errorf("key must not be nil")
	}
	if config == nil {
		config = NewSignConfig()
	}
	return &Signer{
		key:    key,
		alg:    "ed25519",
		config: config,
		fields: fields,
	}, nil
}

// NewEd25519SignerFromSeed returns a new Signer structure. Key is an EdDSA Curve 25519 private key,
// a 32 byte buffer according to RFC 8032.
// Config may be nil for a default configuration.
func NewEd25519SignerFromSeed(seed []byte, config *SignConfig, fields Fields) (*Signer, error) {
	if seed == nil || len(seed) != ed25519.SeedSize {
		return nil, fmt.Errorf("seed must not be nil, and must have length %d", ed25519.SeedSize)
	}
	key := ed25519.NewKeyFromSeed(seed)
	return NewEd25519Signer(key, config, fields)
}

// NewJWSSigner creates a generic signer for JWS algorithms via github.com/lestrrat-go/jwx/v4.
// The particular key type for each algorithm is documented in that package (including
// crypto/mldsa keys for ML-DSA on Go 1.27+). HMAC keys must be []byte (not string).
// Classical RSA/ECDSA/Ed25519 and ML-DSA also accept an opaque crypto.Signer (HSM/KMS) whose
// Public() matches the algorithm. Default jwx ML-DSA signing still needs *mldsa.PrivateKey;
// opaque ML-DSA Signers require a custom jws.RegisterSigner (see README).
// Do not pass jwk.Key here — use NewJWSSignerFromJWK so alg can be taken from the JWK.
// Config may be nil (defaults with SignAlg(false)). A non-nil config that would emit
// HTTP Signature-Input "alg" is rejected — foreign JWS has no RFC 9421 algorithm id.
func NewJWSSigner(alg jwa.SignatureAlgorithm, key any, config *SignConfig, fields Fields) (*Signer, error) {
	if key == nil {
		return nil, fmt.Errorf("key must not be nil")
	}
	if err := rejectJWKKeyForSigner(key); err != nil {
		return nil, err
	}
	alg, err := resolveRegisteredJWSAlg(alg)
	if err != nil {
		return nil, err
	}
	if err := validateJWSKeyAlg(alg, key, true); err != nil {
		return nil, err
	}
	if config == nil {
		config = NewSignConfig().SignAlg(false)
	} else if config.signAlg {
		return nil, fmt.Errorf("NewJWSSigner requires SignAlg(false): foreign JWS has no HTTP Message Signatures algorithm identifier")
	}
	jwsSigner, err := jws.SignerFor(alg)
	if err != nil {
		return nil, err
	}
	return &Signer{
		key:           key,
		alg:           "",
		config:        config,
		fields:        fields,
		foreignSigner: jwsSigner,
	}, nil
}

// NewJWSSignerFromJWK creates a foreign-JWS signer by inferring the algorithm from a private jwk.Key
// (JWK alg and/or unambiguous crv), then exporting raw private key material. Preferred when keys
// are stored as JWKs (e.g. WIMSE WIT cnf.jwk). Public-only JWKs are rejected.
// Config may be nil (defaults with SignAlg(false)); SignAlg(true) is rejected as for NewJWSSigner.
func NewJWSSignerFromJWK(key jwk.Key, config *SignConfig, fields Fields) (*Signer, error) {
	alg, raw, err := inferJWSSignerKeyFromJWK(key)
	if err != nil {
		return nil, err
	}
	return NewJWSSigner(alg, raw, config, fields)
}

func (s Signer) sign(buff []byte) ([]byte, error) {
	if s.foreignSigner != nil {
		signer, ok := s.foreignSigner.(jws.Signer)
		if !ok {
			return nil, fmt.Errorf("expected jws.Signer, got %T", s.foreignSigner)
		}
		return signer.Sign(s.key, buff)
	}
	switch s.alg {
	case "hmac-sha256":
		key, ok := s.key.([]byte)
		if !ok {
			return nil, fmt.Errorf("malformed key")
		}
		mac := hmac.New(sha256.New, key)
		mac.Write(buff)
		return mac.Sum(nil), nil
	case "rsa-v1_5-sha256":
		hashed := sha256.Sum256(buff)
		key, ok := s.key.(rsa.PrivateKey)
		if !ok {
			return nil, fmt.Errorf("malformed key")
		}
		sig, err := rsa.SignPKCS1v15(nil, &key, crypto.SHA256, hashed[:])
		if err != nil {
			return nil, fmt.Errorf("RSA signature failed")
		}
		return sig, nil
	case "rsa-pss-sha512":
		hashed := sha512.Sum512(buff)
		key, ok := s.key.(rsa.PrivateKey)
		if !ok {
			return nil, fmt.Errorf("malformed key")
		}
		// RFC 9421 Section 3.3.1 requires salt length = hash output length (64 bytes for SHA-512)
		// to match TLS 1.3 and ensure interoperability with WebCrypto and other implementations
		opts := &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash}
		sig, err := rsa.SignPSS(rand.Reader, &key, crypto.SHA512, hashed[:], opts)
		if err != nil {
			return nil, fmt.Errorf("RSA-PSS signature failed")
		}
		return sig, nil
	case "ecdsa-p256-sha256":
		hashed := sha256.Sum256(buff)
		key, ok := s.key.(ecdsa.PrivateKey)
		if !ok {
			return nil, fmt.Errorf("malformed key")
		}
		return ecdsaSignRaw(rand.Reader, &key, hashed[:])
	case "ecdsa-p384-sha384":
		hashed := sha512.Sum384(buff)
		key, ok := s.key.(ecdsa.PrivateKey)
		if !ok {
			return nil, fmt.Errorf("malformed key")
		}
		return ecdsaSignRaw(rand.Reader, &key, hashed[:])
	case "ed25519":
		key, ok := s.key.(ed25519.PrivateKey)
		if !ok {
			return nil, fmt.Errorf("malformed key")
		}
		if len(key) != ed25519.PrivateKeySize {
			return nil, fmt.Errorf("key must be %d bytes long", ed25519.PrivateKeySize)
		}
		return ed25519.Sign(key, buff), nil
	default:
		return nil, fmt.Errorf("sign: unknown algorithm \"%s\"", s.alg)
	}
}

// Verifier includes a cryptographic key (typically a public key) and configuration of what needs to be verified.
type Verifier struct {
	key             interface{}
	alg             string
	config          *VerifyConfig
	fields          Fields
	foreignVerifier interface{}
}

// NewHMACSHA256Verifier generates a new Verifier for HMAC-SHA256 signatures. Set config to nil for a default configuration.
// Fields is the list of required headers and fields, which may be empty (but this is typically insecure).
func NewHMACSHA256Verifier(key []byte, config *VerifyConfig, fields Fields) (*Verifier, error) {
	if key == nil {
		return nil, fmt.Errorf("key must not be nil")
	}
	if len(key) < 64 {
		return nil, fmt.Errorf("key must be at least 64 bytes long")
	}
	if config == nil {
		config = NewVerifyConfig()
	}
	return &Verifier{
		key:    key,
		alg:    "hmac-sha256",
		config: config,
		fields: fields,
	}, nil
}

// NewRSAVerifier generates a new Verifier for RSA signatures. Set config to nil for a default configuration.
// Fields is the list of required headers and fields, which may be empty (but this is typically insecure).
func NewRSAVerifier(key rsa.PublicKey, config *VerifyConfig, fields Fields) (*Verifier, error) {
	if config == nil {
		config = NewVerifyConfig()
	}
	return &Verifier{
		key:    key,
		alg:    "rsa-v1_5-sha256",
		config: config,
		fields: fields,
	}, nil
}

// NewRSAPSSVerifier generates a new Verifier for RSA-PSS signatures. Set config to nil for a default configuration.
// Fields is the list of required headers and fields, which may be empty (but this is typically insecure).
func NewRSAPSSVerifier(key rsa.PublicKey, config *VerifyConfig, fields Fields) (*Verifier, error) {
	if config == nil {
		config = NewVerifyConfig()
	}
	return &Verifier{
		key:    key,
		alg:    "rsa-pss-sha512",
		config: config,
		fields: fields,
	}, nil
}

// NewP256Verifier generates a new Verifier for ECDSA (P-256) signatures. Set config to nil for a default configuration.
// Fields is the list of required headers and fields, which may be empty (but this is typically insecure).
func NewP256Verifier(key ecdsa.PublicKey, config *VerifyConfig, fields Fields) (*Verifier, error) {
	return newECCVerifier(key, config, fields, elliptic.P256(), "P-256", "ecdsa-p256-sha256")
}

// NewP384Verifier generates a new Verifier for ECDSA (P-384) signatures. Set config to nil for a default configuration.
// Fields is the list of required headers and fields, which may be empty (but this is typically insecure).
func NewP384Verifier(key ecdsa.PublicKey, config *VerifyConfig, fields Fields) (*Verifier, error) {
	return newECCVerifier(key, config, fields, elliptic.P384(), "P-384", "ecdsa-p384-sha384")
}

func newECCVerifier(key ecdsa.PublicKey, config *VerifyConfig, fields Fields, curve elliptic.Curve, curveName, alg string) (*Verifier, error) {
	if config == nil {
		config = NewVerifyConfig()
	}
	if key.Curve != curve {
		return nil, fmt.Errorf("key curve must be %s", curveName)
	}
	return &Verifier{
		key:    key,
		alg:    alg,
		config: config,
		fields: fields,
	}, nil
}

// NewEd25519Verifier generates a new Verifier for EdDSA Curve 25519 signatures. Set config to nil for a default configuration.
// Fields is the list of required headers and fields, which may be empty (but this is typically insecure).
func NewEd25519Verifier(key ed25519.PublicKey, config *VerifyConfig, fields Fields) (*Verifier, error) {
	if key == nil {
		return nil, fmt.Errorf("key must not be nil")
	}
	if config == nil {
		config = NewVerifyConfig()
	}
	return &Verifier{
		key:    key,
		alg:    "ed25519",
		config: config,
		fields: fields,
	}, nil
}

// NewJWSVerifier creates a foreign-JWS verifier by inferring the JWS algorithm from key.
// Preferred over NewJWSVerifierWithAlg when the key type uniquely determines the alg.
//
// Allowed key types:
//   - jwk.Key with alg, or EC/OKP with unambiguous crv (P-256→ES256, …, Ed25519→EdDSAEd25519; legacy JWK alg "EdDSA" also accepted)
//   - *ecdsa.PublicKey (curve → ES256/384/512)
//   - *mldsa.PublicKey (Parameters → ML-DSA-44/65/87)
//
// Raw RSA/HMAC keys cannot be inferred — use NewJWSVerifierWithAlg.
// allowed may be nil to skip alg policy; prefer a non-nil allowlist when keyid can select keys.
func NewJWSVerifier(allowed *JWSAlgAllowlist, key any, config *VerifyConfig, fields Fields) (*Verifier, error) {
	alg, raw, err := inferJWSVerifierKey(key)
	if err != nil {
		return nil, err
	}
	return NewJWSVerifierWithAlg(allowed, alg, raw, config, fields)
}

// NewJWSVerifierWithAlg creates a foreign-JWS verifier for an explicit JWS algorithm.
// Use when the algorithm cannot be inferred (raw RSA/HMAC) or the store already chose alg.
// Classical RSA/ECDSA/Ed25519 and ML-DSA accept raw public keys or an opaque crypto.Signer (local verify
// via Public()). Do not pass jwk.Key here — use NewJWSVerifier so alg can be taken from the JWK.
// allowed may be nil to skip alg policy.
func NewJWSVerifierWithAlg(allowed *JWSAlgAllowlist, alg jwa.SignatureAlgorithm, key any, config *VerifyConfig, fields Fields) (*Verifier, error) {
	if key == nil {
		return nil, fmt.Errorf("key must not be nil")
	}
	if err := rejectJWKKey(key); err != nil {
		return nil, err
	}
	alg, err := resolveRegisteredJWSAlg(alg)
	if err != nil {
		return nil, err
	}
	if err := checkJWSAlgAllowed(allowed, alg); err != nil {
		return nil, err
	}
	if err := validateJWSKeyAlg(alg, key, false); err != nil {
		return nil, err
	}
	if config == nil {
		config = NewVerifyConfig()
	}
	verifier, err := jws.VerifierFor(alg)
	if err != nil {
		return nil, err
	}
	return &Verifier{
		key:             key,
		alg:             "",
		config:          config,
		fields:          fields,
		foreignVerifier: verifier,
	}, nil
}

func (v Verifier) verify(buff []byte, sig []byte) (bool, error) {
	if v.foreignVerifier != nil {
		verifier, ok := v.foreignVerifier.(jws.Verifier)
		if !ok {
			return false, fmt.Errorf("expected jws.Verifier, got %T", v.foreignVerifier)
		}
		err := verifier.Verify(v.key, buff, sig)
		if err != nil {
			// Return opaque error; underlying err discarded for consistency
			return false, fmt.Errorf("signature verification failed")
		}
		return true, nil
	}

	switch v.alg {
	case "hmac-sha256":
		key, ok := v.key.([]byte)
		if !ok {
			return false, fmt.Errorf("malformed key")
		}
		mac := hmac.New(sha256.New, key)
		mac.Write(buff)
		return subtle.ConstantTimeCompare(mac.Sum(nil), sig) == 1, nil
	case "rsa-v1_5-sha256":
		hashed := sha256.Sum256(buff)
		key, ok := v.key.(rsa.PublicKey)
		if !ok {
			return false, fmt.Errorf("malformed key")
		}
		err := rsa.VerifyPKCS1v15(&key, crypto.SHA256, hashed[:], sig)
		if err != nil {
			// Return opaque error; underlying crypto err discarded to avoid leaking internals
			return false, fmt.Errorf("signature verification failed")
		}
		return true, nil
	case "rsa-pss-sha512":
		hashed := sha512.Sum512(buff)
		key, ok := v.key.(rsa.PublicKey)
		if !ok {
			return false, fmt.Errorf("malformed key")
		}
		// nil opts: accept any valid salt length for backward compatibility with pre-RFC-9421 signers
		err := rsa.VerifyPSS(&key, crypto.SHA512, hashed[:], sig, nil)
		if err != nil {
			// Return opaque error; underlying crypto err discarded to avoid leaking internals
			return false, fmt.Errorf("signature verification failed")
		}
		return true, nil
	case "ecdsa-p256-sha256":
		hashed := sha256.Sum256(buff)
		key, ok := v.key.(ecdsa.PublicKey)
		if !ok {
			return false, fmt.Errorf("malformed key")
		}
		return ecdsaVerifyRaw(&key, hashed[:], sig)
	case "ecdsa-p384-sha384":
		hashed := sha512.Sum384(buff)
		key, ok := v.key.(ecdsa.PublicKey)
		if !ok {
			return false, fmt.Errorf("malformed key")
		}
		return ecdsaVerifyRaw(&key, hashed[:], sig)
	case "ed25519":
		key, ok := v.key.(ed25519.PublicKey)
		if !ok {
			return false, fmt.Errorf("malformed key")
		}
		verified := ed25519.Verify(key, buff, sig)
		if !verified {
			return false, fmt.Errorf("signature verification failed")
		}
		return true, nil
	default:
		return false, fmt.Errorf("verify: unknown algorithm \"%s\"", v.alg)
	}
}