Implement SignaturePrivateKey::parse_der

Author: plq

include/mls/crypto.h

@@ -223,6 +223,7 @@ struct SignaturePrivateKey
 {
   static SignaturePrivateKey generate(CipherSuite suite);
   static SignaturePrivateKey parse(CipherSuite suite, const bytes& data);
+  static SignaturePrivateKey parse_der(CipherSuite suite, const bytes& data);
   static SignaturePrivateKey derive(CipherSuite suite, const bytes& secret);
 
   SignaturePrivateKey() = default;

lib/hpke/include/hpke/signature.h

@@ -50,6 +50,9 @@ struct Signature
   virtual std::unique_ptr<PrivateKey> deserialize_private(
     const bytes& skm) const;
 
+  virtual std::unique_ptr<PrivateKey> deserialize_private_der(
+    const bytes& der) const;
+
   virtual bytes sign(const bytes& data, const PrivateKey& sk) const = 0;
   virtual bool verify(const bytes& data,
                       const bytes& sig,

lib/hpke/src/group.cpp

@@ -8,6 +8,7 @@
 #include "openssl/ec.h"
 #include "openssl/evp.h"
 #include "openssl/obj_mac.h"
+#include "openssl/pem.h"
 #if defined(WITH_OPENSSL3)
 #include "openssl/core_names.h"
 #include "openssl/param_build.h"
@@ -526,14 +527,27 @@ struct ECKeyGroup : public EVPGroup
 #endif
   }
 
+  std::unique_ptr<Group::PrivateKey> deserialize_private_der(
+    const bytes& der) const override
+  {
+    BIO* mem = BIO_new_mem_buf(der.data(), der.size());
+    if (!mem) {
+      throw openssl_error();
+    }
+    EVP_PKEY* pkey = d2i_PrivateKey_bio(mem, NULL);
+    BIO_free(mem);
+    if (!pkey) {
+      throw openssl_error();
+    }
+
+    return std::make_unique<EVPGroup::PrivateKey>(pkey);
+  }
+
 private:
   int curve_nid;
 
 #if !defined(WITH_OPENSSL3)
-  EC_KEY* new_ec_key() const
-  {
-    return EC_KEY_new_by_curve_name(curve_nid);
-  }
+  EC_KEY* new_ec_key() const { return EC_KEY_new_by_curve_name(curve_nid); }
 
   static EVP_PKEY* to_pkey(EC_KEY* eckey)
   {
@@ -651,6 +665,22 @@ struct RawKeyGroup : public EVPGroup
     return std::make_unique<EVPGroup::PrivateKey>(pkey);
   }
 
+  std::unique_ptr<Group::PrivateKey> deserialize_private_der(
+    const bytes& der) const override
+  {
+    BIO* mem = BIO_new_mem_buf(der.data(), der.size());
+    if (!mem) {
+      throw openssl_error();
+    }
+    EVP_PKEY* pkey = d2i_PrivateKey_bio(mem, NULL);
+    BIO_free(mem);
+    if (!pkey) {
+      throw openssl_error();
+    }
+
+    return std::make_unique<RawKeyGroup::PrivateKey>(pkey);
+  }
+
 private:
   const int evp_type;
 

lib/hpke/src/group.h

@@ -55,6 +55,8 @@ struct Group
   virtual bytes serialize_private(const PrivateKey& sk) const = 0;
   virtual std::unique_ptr<PrivateKey> deserialize_private(
     const bytes& skm) const = 0;
+  virtual std::unique_ptr<PrivateKey> deserialize_private_der(
+    const bytes& der) const = 0;
 
   virtual bytes dh(const PrivateKey& sk, const PublicKey& pk) const = 0;
 

lib/hpke/src/signature.cpp

@@ -7,6 +7,7 @@
 #include "group.h"
 #include "rsa.h"
 #include <openssl/evp.h>
+#include <openssl/pem.h>
 #include <openssl/rsa.h>
 
 namespace hpke {
@@ -89,6 +90,13 @@ struct GroupSignature : public Signature
       group.deserialize_private(skm).release());
   }
 
+  std::unique_ptr<Signature::PrivateKey> deserialize_private_der(
+    const bytes& der) const override
+  {
+    return std::make_unique<PrivateKey>(
+      group.deserialize_private_der(der).release());
+  }
+
   bytes sign(const bytes& data, const Signature::PrivateKey& sk) const override
   {
     const auto& rsk = dynamic_cast<const PrivateKey&>(sk);
@@ -188,6 +196,12 @@ Signature::deserialize_private(const bytes& /* unused */) const
   throw std::runtime_error("Not implemented");
 }
 
+std::unique_ptr<Signature::PrivateKey>
+Signature::deserialize_private_der(const bytes&) const
+{
+  throw std::runtime_error("Not implemented");
+}
+
 std::unique_ptr<Signature::PrivateKey>
 Signature::generate_rsa(size_t bits)
 {

src/crypto.cpp

@@ -402,6 +402,16 @@ SignaturePrivateKey::parse(CipherSuite suite, const bytes& data)
   return { data, pub_data };
 }
 
+SignaturePrivateKey
+SignaturePrivateKey::parse_der(CipherSuite suite, const bytes& data)
+{
+  auto priv = suite.sig().deserialize_private_der(data);
+  auto pub = priv->public_key();
+  auto pub_data = suite.sig().serialize(*pub);
+  auto priv_data = suite.sig().serialize_private(*priv);
+  return { priv_data, pub_data };
+}
+
 SignaturePrivateKey
 SignaturePrivateKey::derive(CipherSuite suite, const bytes& secret)
 {

test/credential.cpp

@@ -74,7 +74,7 @@ TEST_CASE("X509 Credential EC certificates")
 
   const std::vector<bytes> der_in{ cert };
 
-  auto key = SignaturePrivateKey::parse(
+  auto key = SignaturePrivateKey::parse_der(
     mls::CipherSuite::ID::P256_AES128GCM_SHA256_P256, keydata);
 
   auto cred = Credential::x509(der_in);