Golang rsa.VerifyPSS函数代码示例

func (alg *RsaPssUsingSha) Verify(securedInput, signature []byte, key interface{}) error {
	if pubKey, ok := key.(*rsa.PublicKey); ok {
		return rsa.VerifyPSS(pubKey, hashFunc(alg.keySizeBits), sha(alg.keySizeBits, securedInput), signature, &rsa.PSSOptions{SaltLength: alg.saltSizeBytes})
	}

	return errors.New("RsaPssUsingSha.Verify(): expects key to be '*rsa.PublicKey'")
}

// Implements the Verify method from SigningMethod
// For this verify method, key must be an rsa.PublicKey struct
func (m *SigningMethodRSAPSS) Verify(signingString, signature string, key interface{}) error {
	var err error

	// Decode the signature
	var sig []byte
	if sig, err = DecodeSegment(signature); err != nil {
		return err
	}

	var rsaKey *rsa.PublicKey
	switch k := key.(type) {
	case *rsa.PublicKey:
		rsaKey = k
	default:
		return ErrInvalidKey
	}

	// Create hasher
	if !m.Hash.Available() {
		return ErrHashUnavailable
	}
	hasher := m.Hash.New()
	hasher.Write([]byte(signingString))

	return rsa.VerifyPSS(rsaKey, m.Hash, hasher.Sum(nil), sig, m.Options)
}

//VerifySignature verifies the signature of a message
func (rsaKey *RsaKey) VerifySignature(message string, signature string) (err error) {
	hashAlgorithm := crypto.SHA256
	if rsaKey.privateKey == nil {
		err = errors.New("privateKey is nil")
		return
	}
	messageBytes := bytes.NewBufferString(message)

	//hash
	pssh := hashAlgorithm.New()
	pssh.Write(messageBytes.Bytes())
	messageHash := pssh.Sum(nil)

	var signatureBytes []byte
	signatureBytes, err = base64.StdEncoding.DecodeString(signature)
	if err != nil {
		return
	}

	//Verify signature
	var opts rsa.PSSOptions
	opts.SaltLength = rsa.PSSSaltLengthAuto
	err = rsa.VerifyPSS(&rsaKey.privateKey.PublicKey, hashAlgorithm, messageHash, signatureBytes, &opts)

	return
}

func verify(pub *rsa.PublicKey, msg string, signature string) (err error) {
	sig, _ := decodeBase64(signature)
	h := sha256.New()
	h.Write([]byte(msg))
	d := h.Sum(nil)
	return rsa.VerifyPSS(pub, crypto.SHA256, d, sig, nil)
}

// Verify the given payload
func (ctx rsaEncrypterVerifier) verifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error {
	var hash crypto.Hash

	switch alg {
	case RS256, PS256:
		hash = crypto.SHA256
	case RS384, PS384:
		hash = crypto.SHA384
	case RS512, PS512:
		hash = crypto.SHA512
	default:
		return ErrUnsupportedAlgorithm
	}

	hasher := hash.New()

	// According to documentation, Write() on hash never fails
	_, _ = hasher.Write(payload)
	hashed := hasher.Sum(nil)

	switch alg {
	case RS256, RS384, RS512:
		return rsa.VerifyPKCS1v15(ctx.publicKey, hash, hashed, signature)
	case PS256, PS384, PS512:
		return rsa.VerifyPSS(ctx.publicKey, hash, hashed, signature, nil)
	}

	return ErrUnsupportedAlgorithm
}

// Verify implements the Verify method from SigningMethod.
// For this verify method, key must be an *rsa.PublicKey.
func (m *SigningMethodRSAPSS) Verify(raw []byte, signature Signature, key interface{}) error {
	rsaKey, ok := key.(*rsa.PublicKey)
	if !ok {
		return ErrInvalidKey
	}
	return rsa.VerifyPSS(rsaKey, m.Hash, m.sum(raw), signature, m.Options)
}

func ValidateSignatureForMessage(msg string, sig []byte, pub *rsa.PublicKey) (err error) {
	hashFunction := sha256.New()
	io.WriteString(hashFunction, msg)
	hashSum := hashFunction.Sum(nil)

	err = rsa.VerifyPSS(pub, crypto.SHA256, hashSum, sig, nil)
	return
}

func BenchmarkRsaVerify(b *testing.B) {
	key, _ := rsa.GenerateKey(rand.Reader, 2048)
	val := sha256.Sum256(make([]byte, 32, 32))
	sig, _ := rsa.SignPSS(rand.Reader, key, crypto.SHA256, val[:], nil)

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		rsa.VerifyPSS(&key.PublicKey, crypto.SHA256, val[:], sig, nil)
	}
}

func (r *rsaPSSSigner) verifyMessage(key crypto.PublicKey, msg, sig []byte) error {
	rsaKey, ok := key.(*rsa.PublicKey)
	if !ok {
		return errors.New("invalid key type for RSA-PSS")
	}

	h := r.hash.New()
	h.Write(msg)
	return rsa.VerifyPSS(rsaKey, r.hash, h.Sum(nil), sig, &pssOptions)
}

func VerifyMessage(pmsg PeerMessage) error {
	if pmsg.Body.Action != "NewPeer" {
		newhash := crypto.SHA1
		peer_pbkey := myPeerKeys.m[pmsg.Addr]
		err := rsa.VerifyPSS(&peer_pbkey, newhash, pmsg.Hashed, pmsg.Sig, nil)
		return err
	} else {
		return nil
	}
}

func VerifySenderMessage(senderPublicKey *rsa.PublicKey, plainText, signature []byte) error {
	pssh := newhash.New()
	_, err := pssh.Write(plainText)
	if err != nil {
		return err
	}

	hashed := pssh.Sum(nil)

	return rsa.VerifyPSS(senderPublicKey, newhash, hashed, signature, opts)
}

func verifyPSS(key interface{}, digest, sig []byte) error {
	rsaPub, ok := key.(*rsa.PublicKey)
	if !ok {
		logrus.Infof("value was not an RSA public key")
		return ErrInvalid
	}

	opts := rsa.PSSOptions{SaltLength: sha256.Size, Hash: crypto.SHA256}
	if err := rsa.VerifyPSS(rsaPub, crypto.SHA256, digest[:], sig, &opts); err != nil {
		logrus.Infof("failed RSAPSS verification: %s", err)
		return ErrInvalid
	}
	return nil
}

func main() {
	priv, err := rsa.GenerateKey(rand.Reader, 2048)
	checkFatal(err)

	message := []byte("Binding contractual agreement...")

	h := sha256.New()
	h.Write(message)
	digest := h.Sum(nil)
	sig, err := rsa.SignPSS(rand.Reader, priv, crypto.SHA256, digest, nil)
	checkFatal(err)

	fmt.Printf("Signature: %x\n", sig)
	err = rsa.VerifyPSS(&priv.PublicKey, crypto.SHA256, digest, sig, nil)
	fmt.Printf("Signature OK: %v\n", err == nil)
}

// VerifySignature validates the signature string
func VerifySignature(key *rsa.PublicKey, signed []byte, signature string) error {
	dec, err := base64.URLEncoding.DecodeString(signature)
	if err != nil {
		return errors.New("Could not decode signature string")
	}

	h := sha256.New()
	h.Write(signed)
	d := h.Sum(nil)

	err = rsa.VerifyPSS(key, crypto.SHA256, d, dec, nil)

	if err != nil {
		return err
	}

	return nil
}

func (v RsaVerify) PayloadVerify(payload, signature []byte) error {
	pubkey := v.pubkey
	hfunc := v.hash
	h := hfunc.New()
	h.Write(payload)

	var err error
	switch v.alg {
	case jwa.RS256, jwa.RS384, jwa.RS512:
		err = rsa.VerifyPKCS1v15(pubkey, hfunc, h.Sum(nil), signature)
	case jwa.PS256, jwa.PS384, jwa.PS512:
		err = rsa.VerifyPSS(pubkey, hfunc, h.Sum(nil), signature, nil)
	}

	if err != nil {
		return err
	}
	return nil
}