Merge pull request #54 from canonical/rsa-sha256

RSAwithSHA256 - make SHA256 the default digest for RSA signatures
canonical · Dec 11, 2024 · ecf169e · ecf169e
2 parents 3bf1691 + 359e0cd
commit ecf169e
Show file tree

Hide file tree

Showing 7 changed files with 37 additions and 34 deletions.
diff --git a/src/main/java/com/canonical/openssl/provider/OpenSSLFIPSProvider.java b/src/main/java/com/canonical/openssl/provider/OpenSSLFIPSProvider.java
@@ -56,7 +56,7 @@ public OpenSSLFIPSProvider() {
         put("MessageDigest.MDSHA512", "com.canonical.openssl.md.MDSHA512");
 
         // Signatures
-        put("Signature.RSA", "com.canonical.openssl.signature.SignatureRSA");
+        put("Signature.RSAwithSHA256", "com.canonical.openssl.signature.SignatureRSAwithSHA256");
         // The openssl FIPS provider for Ubuntu Pro does not have support for ED448 and ED25519.
         // There is lack of clarity over the FIPS approval status of these algorithms.
         // put("Signature.ED448", "com.canonical.openssl.signature.SignatureED448");

diff --git a/src/main/java/com/canonical/openssl/signature/OpenSSLSignature.java b/src/main/java/com/canonical/openssl/signature/OpenSSLSignature.java
@@ -61,9 +61,9 @@ public void run() {
 
     private Params params = new Params(null, -1, Padding.NONE, null);;
 
-    enum Padding { NONE, PSS };
+    protected static enum Padding { NONE, PSS };
 
-    class Params {
+    protected static class Params {
 
         static final int NO_PADDING = 0;
         static final int PSS_PADDING = 1;
@@ -97,6 +97,10 @@ public int getPadding() {
         }
     }
 
+    protected OpenSSLSignature(Params params) {
+        this.params = params;
+    }
+
     protected abstract String getSignatureName();
 
     @Override

diff --git a/src/main/java/com/canonical/openssl/signature/SignatureED25519.java b/src/main/java/com/canonical/openssl/signature/SignatureED25519.java
@@ -17,6 +17,10 @@
 package com.canonical.openssl.signature;
 
 public final class SignatureED25519 extends OpenSSLSignature {
+    public SignatureED25519() {
+        super(null);
+    }
+
     protected String getSignatureName() {
         return "ED25519";
     }

diff --git a/src/main/java/com/canonical/openssl/signature/SignatureED448.java b/src/main/java/com/canonical/openssl/signature/SignatureED448.java
@@ -17,6 +17,10 @@
 package com.canonical.openssl.signature;
 
 public final class SignatureED448 extends OpenSSLSignature {
+    public SignatureED448() {
+        super(null);
+    }
+
     protected String getSignatureName() {
         return "ED448";
     }

diff --git a/...nical/openssl/signature/SignatureRSA.java → ...ssl/signature/SignatureRSAwithSHA256.java b/...nical/openssl/signature/SignatureRSA.java → ...ssl/signature/SignatureRSAwithSHA256.java
@@ -16,8 +16,13 @@
  */
 package com.canonical.openssl.signature;
 
-public final class SignatureRSA extends OpenSSLSignature {
+public final class SignatureRSAwithSHA256 extends OpenSSLSignature {
+
+    public SignatureRSAwithSHA256() {
+        super(new OpenSSLSignature.Params("SHA-256", -1, OpenSSLSignature.Padding.NONE, null));
+    }
+
     protected String getSignatureName() {
-        return "RSA";
+        return "RSAwithSHA256";
     }
 }
diff --git a/src/test/java/ProviderSanityTest.java b/src/test/java/ProviderSanityTest.java
@@ -108,7 +108,7 @@ public void testMessageDigests() {
 
     @Test
     public void testSignatures() {
-        test(Signature.class, "RSA", SignatureRSA.class, "sigSpi");
+        test(Signature.class, "RSAwithSHA256", SignatureRSAwithSHA256.class, "sigSpi");
         //test(Signature.class, "ED448", SignatureED448.class, "sigSpi");
         //test(Signature.class, "ED25519", SignatureED25519.class, "sigSpi");
     }

diff --git a/src/test/java/SignatureTest.java b/src/test/java/SignatureTest.java
@@ -62,15 +62,13 @@ public void testRSABasic() throws Exception {
         PublicKey publicKey = gen.pubKey;
         PrivateKey privateKey = gen.privKey;
 
-        Signature signer = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        signer.setParameter("digest", "SHA-256"); // TODO: why does this work only with SHA-256? 
+        Signature signer = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         signer.initSign(privateKey);
         byte[] bytes = message.getBytes();
         signer.update(bytes, 0, bytes.length);
         byte[] sigBytes = signer.sign();
 
-        Signature verifier = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        verifier.setParameter("digest", "SHA-256");
+        Signature verifier = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         verifier.initVerify(publicKey);
         verifier.update(bytes, 0, bytes.length);
 
@@ -82,17 +80,15 @@ public void testRSAwithMultipleUpdates() throws Exception {
         PublicKey publicKey = new RSAPublicKey("src/test/keys/rsa16384-pub.pem");
         PrivateKey privateKey = new RSAPrivateKey("src/test/keys/rsa16384-priv.pem");
 
-        Signature signer = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        signer.setParameter("digest", "SHA-256");
+        Signature signer = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         signer.initSign(privateKey);
         byte[] bytes = message.getBytes();
         signer.update(bytes, 0, bytes.length);
         signer.update(bytes, 2, bytes.length-2);
         signer.update(bytes, 3, bytes.length-3); 
         byte[] sigBytes = signer.sign();
 
-        Signature verifier = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        verifier.setParameter("digest", "SHA-256");
+        Signature verifier = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         verifier.initVerify(publicKey);
         verifier.update(bytes, 0, bytes.length);
         verifier.update(bytes, 2, bytes.length-2);
@@ -109,8 +105,7 @@ public void testRSAsingleByteUpdates() throws Exception {
         PublicKey publicKey = gen.pubKey;
         PrivateKey privateKey = gen.privKey;
 
-        Signature signer = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        signer.setParameter("digest", "SHA-256");
+        Signature signer = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         signer.initSign(privateKey);
         byte[] bytes = message.getBytes();
 
@@ -119,8 +114,7 @@ public void testRSAsingleByteUpdates() throws Exception {
         }
         byte[] sigBytes = signer.sign();
 
-        Signature verifier = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        verifier.setParameter("digest", "SHA-256");
+        Signature verifier = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         verifier.initVerify(publicKey);
         verifier.update(bytes, 0, bytes.length);
 
@@ -132,15 +126,13 @@ public void testRSAmultipleByteBufferUpdates() throws Exception {
         PublicKey publicKey = new RSAPublicKey("src/test/keys/rsa8192-pub.pem");
         PrivateKey privateKey = new RSAPrivateKey("src/test/keys/rsa8192-priv.pem");
 
-        Signature signer = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        signer.setParameter("digest", "SHA-256");
+        Signature signer = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         signer.initSign(privateKey);
         byte[] bytes = message.getBytes();
         signer.update(ByteBuffer.wrap(message.getBytes()));
         byte[] sigBytes = signer.sign();
 
-        Signature verifier = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        verifier.setParameter("digest", "SHA-256");
+        Signature verifier = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         verifier.initVerify(publicKey);
         verifier.update(bytes, 0, bytes.length);
 
@@ -153,15 +145,13 @@ public void testRSAsignNonzeroOffset() throws Exception {
         PrivateKey privateKey = new RSAPrivateKey("src/test/keys/rsa4096-priv.pem");
 
         byte[] sigBytes = new byte[612];
-        Signature signer = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        signer.setParameter("digest", "SHA-256");
+        Signature signer = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         signer.initSign(privateKey);
         byte[] bytes = message.getBytes();
         signer.update(ByteBuffer.wrap(message.getBytes()));
         signer.sign(sigBytes, 100, 512);
 
-        Signature verifier = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        verifier.setParameter("digest", "SHA-256");
+        Signature verifier = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         verifier.initVerify(publicKey);
         verifier.update(bytes, 0, bytes.length);
 
@@ -176,8 +166,7 @@ public void testRSAtamperedSignature() throws Exception {
         PublicKey publicKey = gen.pubKey;
         PrivateKey privateKey = gen.privKey;
 
-        Signature signer = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        signer.setParameter("digest", "SHA-256");
+        Signature signer = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         signer.initSign(privateKey);
         byte[] bytes = message.getBytes();
 
@@ -186,8 +175,7 @@ public void testRSAtamperedSignature() throws Exception {
         }
         byte[] sigBytes = signer.sign();
 
-        Signature verifier = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        verifier.setParameter("digest", "SHA-256");
+        Signature verifier = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         verifier.initVerify(publicKey);
         verifier.update(bytes, 0, bytes.length);
 
@@ -205,8 +193,7 @@ public void testRSAtamperedContent() throws Exception {
         PublicKey publicKey = gen.pubKey;
         PrivateKey privateKey = gen.privKey;
 
-        Signature signer = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        signer.setParameter("digest", "SHA-256");
+        Signature signer = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         signer.initSign(privateKey);
         byte[] bytes = message.getBytes();
 
@@ -217,8 +204,7 @@ public void testRSAtamperedContent() throws Exception {
 
         // tamper content
         bytes[0] += 1;
-        Signature verifier = Signature.getInstance("RSA", "OpenSSLFIPSProvider");
-        verifier.setParameter("digest", "SHA-256");
+        Signature verifier = Signature.getInstance("RSAwithSHA256", "OpenSSLFIPSProvider");
         verifier.initVerify(publicKey);
         verifier.update(bytes, 0, bytes.length);