diff --git a/rcgen/src/crl.rs b/rcgen/src/crl.rs index e4220d1e..0f9c2d25 100644 --- a/rcgen/src/crl.rs +++ b/rcgen/src/crl.rs @@ -32,7 +32,7 @@ use crate::{ /// #[cfg(not(feature = "crypto"))] /// impl PublicKeyData for MyKeyPair { /// fn der_bytes(&self) -> &[u8] { &self.public_key } -/// fn algorithm(&self) -> &'static SignatureAlgorithm { &PKCS_ED25519 } +/// fn algorithm(&self) -> &'static SignatureAlgorithm { &ED25519 } /// } /// # fn main () { /// // Generate a CRL issuer. diff --git a/rcgen/src/key_pair.rs b/rcgen/src/key_pair.rs index a88ea05f..7e6a2853 100644 --- a/rcgen/src/key_pair.rs +++ b/rcgen/src/key_pair.rs @@ -71,15 +71,15 @@ pub struct KeyPair { #[cfg(feature = "crypto")] impl KeyPair { - /// Generate a new random [`PKCS_ECDSA_P256_SHA256`] key pair + /// Generate a new random [`ECDSA_P256_SHA256`] key pair #[cfg(feature = "crypto")] pub fn generate() -> Result<(Self, PrivateKeyDer<'static>), Error> { - Self::generate_for(&PKCS_ECDSA_P256_SHA256) + Self::generate_for(&ECDSA_P256_SHA256) } /// Generate a new random key pair for the specified signature algorithm /// - /// If you're not sure which algorithm to use, [`PKCS_ECDSA_P256_SHA256`] is a good choice. + /// If you're not sure which algorithm to use, [`ECDSA_P256_SHA256`] is a good choice. /// If passed an RSA signature algorithm, it depends on the backend whether we return /// a generated key or an error for key generation being unavailable. /// Currently, only `aws-lc-rs` supports RSA key generation. @@ -238,44 +238,44 @@ impl KeyPair { let rng = &SystemRandom::new(); let serialized_der = pkcs8.secret_pkcs8_der().to_vec(); - let kind = if alg == &PKCS_ED25519 { + let kind = if alg == &ED25519 { KeyPairKind::Ed(Ed25519KeyPair::from_pkcs8_maybe_unchecked(&serialized_der)._err()?) - } else if alg == &PKCS_ECDSA_P256_SHA256 { + } else if alg == &ECDSA_P256_SHA256 { KeyPairKind::Ec(ecdsa_from_pkcs8( &signature::ECDSA_P256_SHA256_ASN1_SIGNING, &serialized_der, rng, )?) - } else if alg == &PKCS_ECDSA_P384_SHA384 { + } else if alg == &ECDSA_P384_SHA384 { KeyPairKind::Ec(ecdsa_from_pkcs8( &signature::ECDSA_P384_SHA384_ASN1_SIGNING, &serialized_der, rng, )?) - } else if alg == &PKCS_RSA_SHA256 { + } else if alg == &RSA_PKCS1_SHA256 { let rsakp = RsaKeyPair::from_pkcs8(&serialized_der)._err()?; KeyPairKind::Rsa(rsakp, &signature::RSA_PKCS1_SHA256) - } else if alg == &PKCS_RSA_SHA384 { + } else if alg == &RSA_PKCS1_SHA384 { let rsakp = RsaKeyPair::from_pkcs8(&serialized_der)._err()?; KeyPairKind::Rsa(rsakp, &signature::RSA_PKCS1_SHA384) - } else if alg == &PKCS_RSA_SHA512 { + } else if alg == &RSA_PKCS1_SHA512 { let rsakp = RsaKeyPair::from_pkcs8(&serialized_der)._err()?; KeyPairKind::Rsa(rsakp, &signature::RSA_PKCS1_SHA512) } else { #[cfg(feature = "aws_lc_rs")] - if alg == &PKCS_ECDSA_P521_SHA256 { + if alg == &ECDSA_P521_SHA256 { KeyPairKind::Ec(ecdsa_from_pkcs8( &signature::ECDSA_P521_SHA256_ASN1_SIGNING, &serialized_der, rng, )?) - } else if alg == &PKCS_ECDSA_P521_SHA384 { + } else if alg == &ECDSA_P521_SHA384 { KeyPairKind::Ec(ecdsa_from_pkcs8( &signature::ECDSA_P521_SHA384_ASN1_SIGNING, &serialized_der, rng, )?) - } else if alg == &PKCS_ECDSA_P521_SHA512 { + } else if alg == &ECDSA_P521_SHA512 { KeyPairKind::Ec(ecdsa_from_pkcs8( &signature::ECDSA_P521_SHA512_ASN1_SIGNING, &serialized_der, @@ -355,30 +355,30 @@ impl KeyPair { let serialized_der = key.secret_der().to_vec(); - let kind = if alg == &PKCS_ED25519 { + let kind = if alg == &ED25519 { KeyPairKind::Ed(Ed25519KeyPair::from_pkcs8_maybe_unchecked(&serialized_der)._err()?) - } else if alg == &PKCS_ECDSA_P256_SHA256 { + } else if alg == &ECDSA_P256_SHA256 { KeyPairKind::Ec(ecdsa_from_private_key_der( &signature::ECDSA_P256_SHA256_ASN1_SIGNING, &serialized_der, )?) - } else if alg == &PKCS_ECDSA_P384_SHA384 { + } else if alg == &ECDSA_P384_SHA384 { KeyPairKind::Ec(ecdsa_from_private_key_der( &signature::ECDSA_P384_SHA384_ASN1_SIGNING, &serialized_der, )?) - } else if alg == &PKCS_ECDSA_P521_SHA512 { + } else if alg == &ECDSA_P521_SHA512 { KeyPairKind::Ec(ecdsa_from_private_key_der( &signature::ECDSA_P521_SHA512_ASN1_SIGNING, &serialized_der, )?) - } else if alg == &PKCS_RSA_SHA256 { + } else if alg == &RSA_PKCS1_SHA256 { let rsakp = rsa_key_pair_from(&serialized_der)._err()?; KeyPairKind::Rsa(rsakp, &signature::RSA_PKCS1_SHA256) - } else if alg == &PKCS_RSA_SHA384 { + } else if alg == &RSA_PKCS1_SHA384 { let rsakp = rsa_key_pair_from(&serialized_der)._err()?; KeyPairKind::Rsa(rsakp, &signature::RSA_PKCS1_SHA384) - } else if alg == &PKCS_RSA_SHA512 { + } else if alg == &RSA_PKCS1_SHA512 { let rsakp = rsa_key_pair_from(&serialized_der)._err()?; KeyPairKind::Rsa(rsakp, &signature::RSA_PKCS1_SHA512) } else { @@ -511,19 +511,19 @@ impl TryFrom<&PrivateKeyDer<'_>> for KeyPair { let pkcs8 = pkcs8.secret_pkcs8_der(); let rng = SystemRandom::new(); let (kind, alg) = if let Ok(edkp) = Ed25519KeyPair::from_pkcs8_maybe_unchecked(pkcs8) { - (KeyPairKind::Ed(edkp), &PKCS_ED25519) + (KeyPairKind::Ed(edkp), &ED25519) } else if let Ok(eckp) = ecdsa_from_pkcs8(&signature::ECDSA_P256_SHA256_ASN1_SIGNING, pkcs8, &rng) { - (KeyPairKind::Ec(eckp), &PKCS_ECDSA_P256_SHA256) + (KeyPairKind::Ec(eckp), &ECDSA_P256_SHA256) } else if let Ok(eckp) = ecdsa_from_pkcs8(&signature::ECDSA_P384_SHA384_ASN1_SIGNING, pkcs8, &rng) { - (KeyPairKind::Ec(eckp), &PKCS_ECDSA_P384_SHA384) + (KeyPairKind::Ec(eckp), &ECDSA_P384_SHA384) } else if let Ok(rsakp) = RsaKeyPair::from_pkcs8(pkcs8) { ( KeyPairKind::Rsa(rsakp, &signature::RSA_PKCS1_SHA256), - &PKCS_RSA_SHA256, + &RSA_PKCS1_SHA256, ) } else { return Err(Error::CouldNotParseKeyPair); @@ -544,23 +544,23 @@ impl TryFrom<&PrivateKeyDer<'_>> for KeyPair { }; let (kind, alg) = if let Ok(edkp) = Ed25519KeyPair::from_pkcs8_maybe_unchecked(key) { - (KeyPairKind::Ed(edkp), &PKCS_ED25519) + (KeyPairKind::Ed(edkp), &ED25519) } else if let Ok(eckp) = ecdsa_from_private_key_der(&signature::ECDSA_P256_SHA256_ASN1_SIGNING, key) { - (KeyPairKind::Ec(eckp), &PKCS_ECDSA_P256_SHA256) + (KeyPairKind::Ec(eckp), &ECDSA_P256_SHA256) } else if let Ok(eckp) = ecdsa_from_private_key_der(&signature::ECDSA_P384_SHA384_ASN1_SIGNING, key) { - (KeyPairKind::Ec(eckp), &PKCS_ECDSA_P384_SHA384) + (KeyPairKind::Ec(eckp), &ECDSA_P384_SHA384) } else if let Ok(eckp) = ecdsa_from_private_key_der(&signature::ECDSA_P521_SHA512_ASN1_SIGNING, key) { - (KeyPairKind::Ec(eckp), &PKCS_ECDSA_P521_SHA512) + (KeyPairKind::Ec(eckp), &ECDSA_P521_SHA512) } else if let Ok(rsakp) = rsa_key_pair_from(key) { ( KeyPairKind::Rsa(rsakp, &signature::RSA_PKCS1_SHA256), - &PKCS_RSA_SHA256, + &RSA_PKCS1_SHA256, ) } else { return Err(Error::CouldNotParseKeyPair); @@ -759,13 +759,13 @@ mod test { #[test] fn test_subject_public_key_parsing() { for alg in [ - &PKCS_ED25519, - &PKCS_ECDSA_P256_SHA256, - &PKCS_ECDSA_P384_SHA384, + &ED25519, + &ECDSA_P256_SHA256, + &ECDSA_P384_SHA384, #[cfg(feature = "aws_lc_rs")] - &PKCS_ECDSA_P521_SHA512, + &ECDSA_P521_SHA512, #[cfg(feature = "aws_lc_rs")] - &PKCS_RSA_SHA256, + &RSA_PKCS1_SHA256, ] { let (kp, _) = KeyPair::generate_for(alg).expect("keygen"); let pem = kp.public_key_pem(); @@ -786,6 +786,6 @@ mod test { let der = pkcs8.as_ref().to_vec(); let key_pair = KeyPair::try_from(der).unwrap(); - assert_eq!(key_pair.algorithm(), &PKCS_ECDSA_P256_SHA256); + assert_eq!(key_pair.algorithm(), &ECDSA_P256_SHA256); } } diff --git a/rcgen/src/sign_algo.rs b/rcgen/src/sign_algo.rs index a7fe1c7c..afd1b701 100644 --- a/rcgen/src/sign_algo.rs +++ b/rcgen/src/sign_algo.rs @@ -33,6 +33,7 @@ pub(crate) enum SignatureAlgorithmParams { /// Signature algorithm type #[derive(Clone)] pub struct SignatureAlgorithm { + name: &'static str, oids_sign_alg: &'static [&'static [u64]], #[cfg(feature = "crypto")] pub(crate) sign_alg: SignAlgo, @@ -42,35 +43,7 @@ pub struct SignatureAlgorithm { impl fmt::Debug for SignatureAlgorithm { fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { - use algo::*; - if self == &PKCS_RSA_SHA256 { - write!(f, "PKCS_RSA_SHA256") - } else if self == &PKCS_RSA_SHA384 { - write!(f, "PKCS_RSA_SHA384") - } else if self == &PKCS_RSA_SHA512 { - write!(f, "PKCS_RSA_SHA512") - } else if self == &PKCS_ECDSA_P256_SHA256 { - write!(f, "PKCS_ECDSA_P256_SHA256") - } else if self == &PKCS_ECDSA_P384_SHA384 { - write!(f, "PKCS_ECDSA_P384_SHA384") - } else if self == &PKCS_ED25519 { - write!(f, "PKCS_ED25519") - } else { - #[cfg(feature = "aws_lc_rs")] - if self == &PKCS_ECDSA_P521_SHA256 { - return write!(f, "PKCS_ECDSA_P521_SHA256"); - } - #[cfg(feature = "aws_lc_rs")] - if self == &PKCS_ECDSA_P521_SHA384 { - return write!(f, "PKCS_ECDSA_P521_SHA384"); - } - #[cfg(feature = "aws_lc_rs")] - if self == &PKCS_ECDSA_P521_SHA512 { - return write!(f, "PKCS_ECDSA_P521_SHA512"); - } - - write!(f, "Unknown") - } + write!(f, "{}", self.name) } } @@ -93,18 +66,24 @@ impl SignatureAlgorithm { pub(crate) fn iter() -> std::slice::Iter<'static, &'static SignatureAlgorithm> { use algo::*; static ALGORITHMS: &[&SignatureAlgorithm] = &[ - &PKCS_RSA_SHA256, - &PKCS_RSA_SHA384, - &PKCS_RSA_SHA512, - &PKCS_ECDSA_P256_SHA256, - &PKCS_ECDSA_P384_SHA384, + &RSA_PKCS1_SHA256, + &RSA_PKCS1_SHA384, + &RSA_PKCS1_SHA512, + &ECDSA_P256_SHA256, + &ECDSA_P384_SHA384, + #[cfg(feature = "aws_lc_rs")] + &ECDSA_P521_SHA256, + #[cfg(feature = "aws_lc_rs")] + &ECDSA_P521_SHA384, + #[cfg(feature = "aws_lc_rs")] + &ECDSA_P521_SHA512, + &ED25519, #[cfg(feature = "aws_lc_rs")] - &PKCS_ECDSA_P521_SHA256, + &ML_DSA_44, #[cfg(feature = "aws_lc_rs")] - &PKCS_ECDSA_P521_SHA384, + &ML_DSA_65, #[cfg(feature = "aws_lc_rs")] - &PKCS_ECDSA_P521_SHA512, - &PKCS_ED25519, + &ML_DSA_87, ]; ALGORITHMS.iter() } @@ -126,7 +105,8 @@ pub(crate) mod algo { use crate::oid::*; /// RSA signing with PKCS#1 1.5 padding and SHA-256 hashing as per [RFC 4055](https://tools.ietf.org/html/rfc4055) - pub static PKCS_RSA_SHA256: SignatureAlgorithm = SignatureAlgorithm { + pub static RSA_PKCS1_SHA256: SignatureAlgorithm = SignatureAlgorithm { + name: "RSA_PKCS1_SHA256", oids_sign_alg: &[RSA_ENCRYPTION], #[cfg(feature = "crypto")] sign_alg: SignAlgo::Rsa(&signature::RSA_PKCS1_SHA256), @@ -136,7 +116,8 @@ pub(crate) mod algo { }; /// RSA signing with PKCS#1 1.5 padding and SHA-384 hashing as per [RFC 4055](https://tools.ietf.org/html/rfc4055) - pub static PKCS_RSA_SHA384: SignatureAlgorithm = SignatureAlgorithm { + pub static RSA_PKCS1_SHA384: SignatureAlgorithm = SignatureAlgorithm { + name: "RSA_PKCS1_SHA384", oids_sign_alg: &[RSA_ENCRYPTION], #[cfg(feature = "crypto")] sign_alg: SignAlgo::Rsa(&signature::RSA_PKCS1_SHA384), @@ -146,7 +127,8 @@ pub(crate) mod algo { }; /// RSA signing with PKCS#1 1.5 padding and SHA-512 hashing as per [RFC 4055](https://tools.ietf.org/html/rfc4055) - pub static PKCS_RSA_SHA512: SignatureAlgorithm = SignatureAlgorithm { + pub static RSA_PKCS1_SHA512: SignatureAlgorithm = SignatureAlgorithm { + name: "RSA_PKCS1_SHA512", oids_sign_alg: &[RSA_ENCRYPTION], #[cfg(feature = "crypto")] sign_alg: SignAlgo::Rsa(&signature::RSA_PKCS1_SHA512), @@ -156,7 +138,8 @@ pub(crate) mod algo { }; /// ECDSA signing using the P-256 curves and SHA-256 hashing as per [RFC 5758](https://tools.ietf.org/html/rfc5758#section-3.2) - pub static PKCS_ECDSA_P256_SHA256: SignatureAlgorithm = SignatureAlgorithm { + pub static ECDSA_P256_SHA256: SignatureAlgorithm = SignatureAlgorithm { + name: "ECDSA_P256_SHA256", oids_sign_alg: &[EC_PUBLIC_KEY, EC_SECP_256_R1], #[cfg(feature = "crypto")] sign_alg: SignAlgo::EcDsa(&signature::ECDSA_P256_SHA256_ASN1_SIGNING), @@ -166,7 +149,8 @@ pub(crate) mod algo { }; /// ECDSA signing using the P-384 curves and SHA-384 hashing as per [RFC 5758](https://tools.ietf.org/html/rfc5758#section-3.2) - pub static PKCS_ECDSA_P384_SHA384: SignatureAlgorithm = SignatureAlgorithm { + pub static ECDSA_P384_SHA384: SignatureAlgorithm = SignatureAlgorithm { + name: "ECDSA_P384_SHA384", oids_sign_alg: &[EC_PUBLIC_KEY, EC_SECP_384_R1], #[cfg(feature = "crypto")] sign_alg: SignAlgo::EcDsa(&signature::ECDSA_P384_SHA384_ASN1_SIGNING), @@ -181,7 +165,8 @@ pub(crate) mod algo { /// /// Only supported with the `aws_lc_rs` backend. #[cfg(feature = "aws_lc_rs")] - pub static PKCS_ECDSA_P521_SHA256: SignatureAlgorithm = SignatureAlgorithm { + pub static ECDSA_P521_SHA256: SignatureAlgorithm = SignatureAlgorithm { + name: "ECDSA_P521_SHA256", oids_sign_alg: &[EC_PUBLIC_KEY, EC_SECP_521_R1], #[cfg(feature = "crypto")] sign_alg: SignAlgo::EcDsa(&signature::ECDSA_P521_SHA256_ASN1_SIGNING), @@ -196,7 +181,8 @@ pub(crate) mod algo { /// /// Only supported with the `aws_lc_rs` backend. #[cfg(feature = "aws_lc_rs")] - pub static PKCS_ECDSA_P521_SHA384: SignatureAlgorithm = SignatureAlgorithm { + pub static ECDSA_P521_SHA384: SignatureAlgorithm = SignatureAlgorithm { + name: "ECDSA_P521_SHA384", oids_sign_alg: &[EC_PUBLIC_KEY, EC_SECP_521_R1], #[cfg(feature = "crypto")] sign_alg: SignAlgo::EcDsa(&signature::ECDSA_P521_SHA384_ASN1_SIGNING), @@ -209,7 +195,8 @@ pub(crate) mod algo { /// /// Only supported with the `aws_lc_rs` backend. #[cfg(feature = "aws_lc_rs")] - pub static PKCS_ECDSA_P521_SHA512: SignatureAlgorithm = SignatureAlgorithm { + pub static ECDSA_P521_SHA512: SignatureAlgorithm = SignatureAlgorithm { + name: "ECDSA_P521_SHA512", oids_sign_alg: &[EC_PUBLIC_KEY, EC_SECP_521_R1], #[cfg(feature = "crypto")] sign_alg: SignAlgo::EcDsa(&signature::ECDSA_P521_SHA512_ASN1_SIGNING), @@ -219,7 +206,8 @@ pub(crate) mod algo { }; /// ED25519 curve signing as per [RFC 8410](https://tools.ietf.org/html/rfc8410) - pub static PKCS_ED25519: SignatureAlgorithm = SignatureAlgorithm { + pub static ED25519: SignatureAlgorithm = SignatureAlgorithm { + name: "ED25519", // id-Ed25519 in RFC 8410 oids_sign_alg: &[&[1, 3, 101, 112]], #[cfg(feature = "crypto")] @@ -231,31 +219,34 @@ pub(crate) mod algo { /// ML-DSA-44 signing as per . #[cfg(feature = "aws_lc_rs")] - pub static PKCS_ML_DSA_44: SignatureAlgorithm = SignatureAlgorithm { - oids_sign_alg: &[ML_DSA_44], + pub static ML_DSA_44: SignatureAlgorithm = SignatureAlgorithm { + name: "ML_DSA_44", + oids_sign_alg: &[crate::oid::ML_DSA_44], #[cfg(feature = "crypto")] sign_alg: SignAlgo::PqDsa(&ML_DSA_44_SIGNING), - oid_components: ML_DSA_44, + oid_components: crate::oid::ML_DSA_44, params: SignatureAlgorithmParams::None, }; /// ML-DSA-65 signing as per . #[cfg(feature = "aws_lc_rs")] - pub static PKCS_ML_DSA_65: SignatureAlgorithm = SignatureAlgorithm { - oids_sign_alg: &[ML_DSA_65], + pub static ML_DSA_65: SignatureAlgorithm = SignatureAlgorithm { + name: "ML_DSA_65", + oids_sign_alg: &[crate::oid::ML_DSA_65], #[cfg(feature = "crypto")] sign_alg: SignAlgo::PqDsa(&ML_DSA_65_SIGNING), - oid_components: ML_DSA_65, + oid_components: crate::oid::ML_DSA_65, params: SignatureAlgorithmParams::None, }; /// ML-DSA-87 signing as per . #[cfg(feature = "aws_lc_rs")] - pub static PKCS_ML_DSA_87: SignatureAlgorithm = SignatureAlgorithm { - oids_sign_alg: &[ML_DSA_87], + pub static ML_DSA_87: SignatureAlgorithm = SignatureAlgorithm { + name: "ML_DSA_87", + oids_sign_alg: &[crate::oid::ML_DSA_87], #[cfg(feature = "crypto")] sign_alg: SignAlgo::PqDsa(&ML_DSA_87_SIGNING), - oid_components: ML_DSA_87, + oid_components: crate::oid::ML_DSA_87, params: SignatureAlgorithmParams::None, }; } diff --git a/rustls-cert-gen/src/cert.rs b/rustls-cert-gen/src/cert.rs index c2e6c659..60b92a53 100644 --- a/rustls-cert-gen/src/cert.rs +++ b/rustls-cert-gen/src/cert.rs @@ -213,18 +213,18 @@ pub enum KeyPairAlgorithm { impl From for &'static SignatureAlgorithm { fn from(alg: KeyPairAlgorithm) -> Self { match alg { - KeyPairAlgorithm::Rsa => &rcgen::PKCS_RSA_SHA256, - KeyPairAlgorithm::Ed25519 => &rcgen::PKCS_ED25519, - KeyPairAlgorithm::EcdsaP256 => &rcgen::PKCS_ECDSA_P256_SHA256, - KeyPairAlgorithm::EcdsaP384 => &rcgen::PKCS_ECDSA_P384_SHA384, + KeyPairAlgorithm::Rsa => &rcgen::RSA_PKCS1_SHA256, + KeyPairAlgorithm::Ed25519 => &rcgen::ED25519, + KeyPairAlgorithm::EcdsaP256 => &rcgen::ECDSA_P256_SHA256, + KeyPairAlgorithm::EcdsaP384 => &rcgen::ECDSA_P384_SHA384, #[cfg(feature = "aws_lc_rs")] - KeyPairAlgorithm::EcdsaP521 => &rcgen::PKCS_ECDSA_P521_SHA512, + KeyPairAlgorithm::EcdsaP521 => &rcgen::ECDSA_P521_SHA512, #[cfg(feature = "aws_lc_rs")] - KeyPairAlgorithm::MlDsa44 => &rcgen::PKCS_ML_DSA_44, + KeyPairAlgorithm::MlDsa44 => &rcgen::ML_DSA_44, #[cfg(feature = "aws_lc_rs")] - KeyPairAlgorithm::MlDsa65 => &rcgen::PKCS_ML_DSA_65, + KeyPairAlgorithm::MlDsa65 => &rcgen::ML_DSA_65, #[cfg(feature = "aws_lc_rs")] - KeyPairAlgorithm::MlDsa87 => &rcgen::PKCS_ML_DSA_87, + KeyPairAlgorithm::MlDsa87 => &rcgen::ML_DSA_87, } } } @@ -481,27 +481,18 @@ mod tests { #[test] fn key_pair_algorithm_to_keypair() -> anyhow::Result<()> { let (keypair, _) = KeyPair::generate_for(KeyPairAlgorithm::Ed25519.into())?; - assert_eq!(format!("{:?}", keypair.algorithm()), "PKCS_ED25519"); + assert_eq!(format!("{:?}", keypair.algorithm()), "ED25519"); let (keypair, _) = KeyPair::generate_for(KeyPairAlgorithm::EcdsaP256.into())?; - assert_eq!( - format!("{:?}", keypair.algorithm()), - "PKCS_ECDSA_P256_SHA256" - ); + assert_eq!(format!("{:?}", keypair.algorithm()), "ECDSA_P256_SHA256"); let (keypair, _) = KeyPair::generate_for(KeyPairAlgorithm::EcdsaP384.into())?; - assert_eq!( - format!("{:?}", keypair.algorithm()), - "PKCS_ECDSA_P384_SHA384" - ); + assert_eq!(format!("{:?}", keypair.algorithm()), "ECDSA_P384_SHA384"); #[cfg(feature = "aws_lc_rs")] { let (keypair, _) = KeyPair::generate_for(KeyPairAlgorithm::EcdsaP521.into())?; - assert_eq!( - format!("{:?}", keypair.algorithm()), - "PKCS_ECDSA_P521_SHA512" - ); + assert_eq!(format!("{:?}", keypair.algorithm()), "ECDSA_P521_SHA512"); } Ok(()) diff --git a/verify-tests/tests/botan.rs b/verify-tests/tests/botan.rs index 4d2181ab..56aa1d85 100644 --- a/verify-tests/tests/botan.rs +++ b/verify-tests/tests/botan.rs @@ -57,7 +57,7 @@ fn test_botan() { #[test] fn test_botan_256() { let (params, _) = default_params(); - let (key_pair, _) = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap(); + let (key_pair, _) = KeyPair::generate_for(&rcgen::ECDSA_P256_SHA256).unwrap(); let cert = params.self_signed(&key_pair).unwrap(); // Now verify the certificate. @@ -67,7 +67,7 @@ fn test_botan_256() { #[test] fn test_botan_384() { let (params, _) = default_params(); - let (key_pair, _) = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P384_SHA384).unwrap(); + let (key_pair, _) = KeyPair::generate_for(&rcgen::ECDSA_P384_SHA384).unwrap(); let cert = params.self_signed(&key_pair).unwrap(); // Now verify the certificate. @@ -78,7 +78,7 @@ fn test_botan_384() { #[cfg(feature = "aws_lc_rs")] fn test_botan_521() { let (params, _) = default_params(); - let (key_pair, _) = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P521_SHA512).unwrap(); + let (key_pair, _) = KeyPair::generate_for(&rcgen::ECDSA_P521_SHA512).unwrap(); let cert = params.self_signed(&key_pair).unwrap(); // Now verify the certificate. @@ -88,7 +88,7 @@ fn test_botan_521() { #[test] fn test_botan_25519() { let (params, _) = default_params(); - let (key_pair, _) = KeyPair::generate_for(&rcgen::PKCS_ED25519).unwrap(); + let (key_pair, _) = KeyPair::generate_for(&rcgen::ED25519).unwrap(); let cert = params.self_signed(&key_pair).unwrap(); // Now verify the certificate. @@ -201,7 +201,7 @@ fn test_botan_imported_ca_with_printable_string() { #[test] fn test_botan_crl_parse() { // Create an issuer CA. - let alg = &rcgen::PKCS_ECDSA_P256_SHA256; + let alg = &rcgen::ECDSA_P256_SHA256; let (mut issuer, _, _) = util::default_params(); issuer.is_ca = IsCa::Ca(BasicConstraints::Unconstrained); issuer.key_usages = vec![ diff --git a/verify-tests/tests/generic.rs b/verify-tests/tests/generic.rs index 69a969ac..e4ae1fc9 100644 --- a/verify-tests/tests/generic.rs +++ b/verify-tests/tests/generic.rs @@ -12,16 +12,16 @@ mod test_key_params_mismatch { #[test] fn test_key_params_mismatch() { let available_key_params = [ - &rcgen::PKCS_RSA_SHA256, - &rcgen::PKCS_ECDSA_P256_SHA256, - &rcgen::PKCS_ECDSA_P384_SHA384, + &rcgen::RSA_PKCS1_SHA256, + &rcgen::ECDSA_P256_SHA256, + &rcgen::ECDSA_P384_SHA384, #[cfg(feature = "aws_lc_rs")] - &rcgen::PKCS_ECDSA_P521_SHA256, + &rcgen::ECDSA_P521_SHA256, #[cfg(feature = "aws_lc_rs")] - &rcgen::PKCS_ECDSA_P521_SHA384, + &rcgen::ECDSA_P521_SHA384, #[cfg(feature = "aws_lc_rs")] - &rcgen::PKCS_ECDSA_P521_SHA512, - &rcgen::PKCS_ED25519, + &rcgen::ECDSA_P521_SHA512, + &rcgen::ED25519, ]; for (i, kalg_1) in available_key_params.iter().enumerate() { for (j, kalg_2) in available_key_params.iter().enumerate() { @@ -33,7 +33,7 @@ mod test_key_params_mismatch { assert_ne!(*kalg_1, *kalg_2); let names = [format!("{kalg_1:?}"), format!("{kalg_2:?}")]; - if names.into_iter().all(|n| n.starts_with("PKCS_ECDSA_P521")) { + if names.into_iter().all(|n| n.starts_with("ECDSA_P521")) { continue; } diff --git a/verify-tests/tests/openssl.rs b/verify-tests/tests/openssl.rs index d8b022cc..03aa6719 100644 --- a/verify-tests/tests/openssl.rs +++ b/verify-tests/tests/openssl.rs @@ -190,7 +190,7 @@ fn test_request() { #[test] fn test_openssl_256() { let (params, _, _) = util::default_params(); - let (key_pair, key_der) = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap(); + let (key_pair, key_der) = KeyPair::generate_for(&rcgen::ECDSA_P256_SHA256).unwrap(); let cert = params.self_signed(&key_pair).unwrap(); // Now verify the certificate. @@ -201,7 +201,7 @@ fn test_openssl_256() { #[test] fn test_openssl_384() { let (params, _, _) = util::default_params(); - let (key_pair, key_der) = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P384_SHA384).unwrap(); + let (key_pair, key_der) = KeyPair::generate_for(&rcgen::ECDSA_P384_SHA384).unwrap(); let cert = params.self_signed(&key_pair).unwrap(); // Now verify the certificate. @@ -213,7 +213,7 @@ fn test_openssl_384() { #[cfg(feature = "aws_lc_rs")] fn test_openssl_521() { let (params, _, _) = util::default_params(); - let (key_pair, key_der) = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P521_SHA512).unwrap(); + let (key_pair, key_der) = KeyPair::generate_for(&rcgen::ECDSA_P521_SHA512).unwrap(); let cert = params.self_signed(&key_pair).unwrap(); // Now verify the certificate. @@ -224,7 +224,7 @@ fn test_openssl_521() { #[test] fn test_openssl_25519() { let (params, _, _) = util::default_params(); - let (key_pair, _) = KeyPair::generate_for(&rcgen::PKCS_ED25519).unwrap(); + let (key_pair, _) = KeyPair::generate_for(&rcgen::ED25519).unwrap(); let cert = params.self_signed(&key_pair).unwrap(); // Now verify the certificate. @@ -284,9 +284,9 @@ fn test_openssl_rsa_given() { #[test] fn test_openssl_rsa_combinations_given() { let alg_list = [ - &rcgen::PKCS_RSA_SHA256, - &rcgen::PKCS_RSA_SHA384, - &rcgen::PKCS_RSA_SHA512, + &rcgen::RSA_PKCS1_SHA256, + &rcgen::RSA_PKCS1_SHA384, + &rcgen::RSA_PKCS1_SHA512, ]; for (i, alg) in alg_list.iter().enumerate() { let (params, _, _) = util::default_params(); @@ -357,7 +357,7 @@ fn test_openssl_separate_ca_with_printable_string() { fn test_openssl_separate_ca_with_other_signing_alg() { let (mut ca_params, _, _) = util::default_params(); ca_params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained); - let (ca_key, _) = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap(); + let (ca_key, _) = KeyPair::generate_for(&rcgen::ECDSA_P256_SHA256).unwrap(); let ca_cert = ca_params.self_signed(&ca_key).unwrap(); let ca = Issuer::new(ca_params, ca_key); @@ -368,7 +368,7 @@ fn test_openssl_separate_ca_with_other_signing_alg() { params .distinguished_name .push(DnType::CommonName, "Dev domain"); - let (cert_key, cert_key_der) = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P384_SHA384).unwrap(); + let (cert_key, cert_key_der) = KeyPair::generate_for(&rcgen::ECDSA_P384_SHA384).unwrap(); let cert = params.signed_by(&cert_key, &ca).unwrap(); verify_cert_ca(&cert.pem(), &cert_key_der, &ca_cert.pem()); diff --git a/verify-tests/tests/webpki.rs b/verify-tests/tests/webpki.rs index c8dc918b..fff05529 100644 --- a/verify-tests/tests/webpki.rs +++ b/verify-tests/tests/webpki.rs @@ -150,7 +150,7 @@ fn test_webpki() { #[test] fn test_webpki_256() { let (params, _, _) = util::default_params(); - let (key_pair, key_der) = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap(); + let (key_pair, key_der) = KeyPair::generate_for(&rcgen::ECDSA_P256_SHA256).unwrap(); let cert = params.self_signed(&key_pair).unwrap(); // Now verify the certificate. @@ -167,7 +167,7 @@ fn test_webpki_256() { #[test] fn test_webpki_384() { let (params, _, _) = util::default_params(); - let (key_pair, key_der) = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P384_SHA384).unwrap(); + let (key_pair, key_der) = KeyPair::generate_for(&rcgen::ECDSA_P384_SHA384).unwrap(); let cert = params.self_signed(&key_pair).unwrap(); // Now verify the certificate. @@ -184,7 +184,7 @@ fn test_webpki_384() { #[test] fn test_webpki_25519() { let (params, _, _) = util::default_params(); - let (key_pair, key_der) = KeyPair::generate_for(&rcgen::PKCS_ED25519).unwrap(); + let (key_pair, key_der) = KeyPair::generate_for(&rcgen::ED25519).unwrap(); let cert = params.self_signed(&key_pair).unwrap(); // Now verify the certificate. @@ -274,17 +274,17 @@ const ML_DSA_ALGS: &[( &PqdsaSigningAlgorithm, )] = &[ ( - &rcgen::PKCS_ML_DSA_44, + &rcgen::ML_DSA_44, webpki::aws_lc_rs::ML_DSA_44, &ML_DSA_44_SIGNING, ), ( - &rcgen::PKCS_ML_DSA_65, + &rcgen::ML_DSA_65, webpki::aws_lc_rs::ML_DSA_65, &ML_DSA_65_SIGNING, ), ( - &rcgen::PKCS_ML_DSA_87, + &rcgen::ML_DSA_87, webpki::aws_lc_rs::ML_DSA_87, &ML_DSA_87_SIGNING, ), @@ -295,17 +295,17 @@ const ML_DSA_ALGS: &[( fn test_webpki_rsa_combinations_given() { let configs: &[(_, _, &'static dyn signature::RsaEncoding)] = &[ ( - &rcgen::PKCS_RSA_SHA256, + &rcgen::RSA_PKCS1_SHA256, webpki::ring::RSA_PKCS1_2048_8192_SHA256, &signature::RSA_PKCS1_SHA256, ), ( - &rcgen::PKCS_RSA_SHA384, + &rcgen::RSA_PKCS1_SHA384, webpki::ring::RSA_PKCS1_2048_8192_SHA384, &signature::RSA_PKCS1_SHA384, ), ( - &rcgen::PKCS_RSA_SHA512, + &rcgen::RSA_PKCS1_SHA512, webpki::ring::RSA_PKCS1_2048_8192_SHA512, &signature::RSA_PKCS1_SHA512, ), @@ -357,7 +357,7 @@ fn test_webpki_separate_ca() { fn test_webpki_separate_ca_with_other_signing_alg() { let (mut ca_params, _, _) = util::default_params(); ca_params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained); - let (ca_key, _) = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap(); + let (ca_key, _) = KeyPair::generate_for(&rcgen::ECDSA_P256_SHA256).unwrap(); let ca_cert = ca_params.self_signed(&ca_key).unwrap(); let mut params = CertificateParams::new(vec!["crabs.crabs".to_string()]).unwrap(); @@ -368,7 +368,7 @@ fn test_webpki_separate_ca_with_other_signing_alg() { .distinguished_name .push(DnType::CommonName, "Dev domain"); - let (key_pair, key_der) = KeyPair::generate_for(&rcgen::PKCS_ED25519).unwrap(); + let (key_pair, key_der) = KeyPair::generate_for(&rcgen::ED25519).unwrap(); let ca = Issuer::new(ca_params, ca_key); let cert = params.signed_by(&key_pair, &ca).unwrap(); check_cert_ca( @@ -401,12 +401,12 @@ fn from_remote() { } fn algorithm(&self) -> &'static rcgen::SignatureAlgorithm { - &rcgen::PKCS_ECDSA_P256_SHA256 + &rcgen::ECDSA_P256_SHA256 } } let rng = ring::rand::SystemRandom::new(); - let (_, key_der) = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap(); + let (_, key_der) = KeyPair::generate_for(&rcgen::ECDSA_P256_SHA256).unwrap(); let remote = EcdsaKeyPair::from_pkcs8( &signature::ECDSA_P256_SHA256_ASN1_SIGNING, key_der.secret_der(), @@ -669,7 +669,7 @@ fn test_webpki_crl_parse() { #[test] fn test_webpki_crl_revoke() { // Create an issuer CA. - let alg = &rcgen::PKCS_ECDSA_P256_SHA256; + let alg = &rcgen::ECDSA_P256_SHA256; let (mut issuer, _, _) = util::default_params(); issuer.is_ca = IsCa::Ca(BasicConstraints::Unconstrained); issuer.key_usages = vec![