File Coverage

blib/lib/Net/DNS/SEC/EdDSA.pm

Criterion	Covered	Total	%
statement	16	16	100.0
branch			n/a
condition			n/a
subroutine	6	6	100.0
pod			n/a
total	22	22	100.0

package Net::DNS::SEC::EdDSA;

use strict;
use warnings;

our $VERSION = (qw$Id: EdDSA.pm 1853 2021-10-11 10:40:59Z willem $)[2];


=head1 NAME

Net::DNS::SEC::EdDSA - DNSSEC EdDSA digital signature algorithm


=head1 SYNOPSIS

    require Net::DNS::SEC::EdDSA;

    $signature = Net::DNS::SEC::EdDSA->sign( $sigdata, $private );

    $validated = Net::DNS::SEC::EdDSA->verify( $sigdata, $keyrr, $sigbin );


=head1 DESCRIPTION

Implementation of EdDSA Edwards curve digital signature
generation and verification procedures.

=head2 sign

    $signature = Net::DNS::SEC::EdDSA->sign( $sigdata, $private );

Generates the wire-format signature from the sigdata octet string
and the appropriate private key object.

=head2 verify

    $validated = Net::DNS::SEC::EdDSA->verify( $sigdata, $keyrr, $signature );

Verifies the signature over the sigdata octet string using the specified
public key resource record.

=cut

use integer;
use MIME::Base64;

use constant EdDSA_configured => Net::DNS::SEC::libcrypto->can('EVP_PKEY_new_raw_public_key');

BEGIN { die 'EdDSA disabled or application has no "use Net::DNS::SEC"' unless EdDSA_configured }


my %parameters = (
	15 => [1087, 32, 64],
	16 => [1088, 57, 114],
	);

sub _index { return keys %parameters }


sub sign {
	my ( $class, $sigdata, $private ) = @_;

	my $algorithm = $private->algorithm;
	my ( $nid, $keylen ) = @{$parameters{$algorithm} || []};
	die 'private key not EdDSA' unless $nid;

	my $rawkey = pack "a$keylen", decode_base64( $private->PrivateKey );
	my $evpkey = Net::DNS::SEC::libcrypto::EVP_PKEY_new_raw_private_key( $nid, $rawkey );

	return Net::DNS::SEC::libcrypto::EVP_sign( $sigdata, $evpkey );
}


sub verify {
	my ( $class, $sigdata, $keyrr, $signature ) = @_;

	my $algorithm = $keyrr->algorithm;
	my ( $nid, $keylen, $siglen ) = @{$parameters{$algorithm} || []};
	die 'public key not EdDSA' unless $nid;

	return unless $signature;

	my $rawkey = pack "a$keylen", $keyrr->keybin;
	my $evpkey = Net::DNS::SEC::libcrypto::EVP_PKEY_new_raw_public_key( $nid, $rawkey );

	my $sigbin = pack "a$siglen", $signature;
	return Net::DNS::SEC::libcrypto::EVP_verify( $sigdata, $sigbin, $evpkey );
}


1;

__END__