File Coverage

blib/lib/Net/DNS/SEC/RSA.pm

Criterion	Covered	Total	%
statement	34	34	100.0
branch	8	8	100.0
condition			n/a
subroutine	9	9	100.0
pod	2	2	100.0
total	53	53	100.0

package Net::DNS::SEC::RSA;

use strict;
use warnings;

our $VERSION = (qw$Id: RSA.pm 1863 2022-03-14 14:59:21Z willem $)[2];


=head1 NAME

Net::DNS::SEC::RSA - DNSSEC RSA digital signature algorithm


=head1 SYNOPSIS

    require Net::DNS::SEC::RSA;

    $signature = Net::DNS::SEC::RSA->sign( $sigdata, $private );

    $validated = Net::DNS::SEC::RSA->verify( $sigdata, $keyrr, $sigbin );


=head1 DESCRIPTION

Implementation of RSA digital signature
generation and verification procedures.

=head2 sign

    $signature = Net::DNS::SEC::RSA->sign( $sigdata, $private );

Generates the wire-format signature from the sigdata octet string
and the appropriate private key object.

=head2 verify

    $validated = Net::DNS::SEC::RSA->verify( $sigdata, $keyrr, $sigbin );

Verifies the signature over the sigdata octet string using the specified
public key resource record.

=cut

use integer;
use MIME::Base64;

use constant RSA_configured => Net::DNS::SEC::libcrypto->can('EVP_PKEY_new_RSA');

BEGIN { die 'RSA disabled or application has no "use Net::DNS::SEC"' unless RSA_configured }


my %parameters = (
	1  => scalar eval { Net::DNS::SEC::libcrypto::EVP_md5() },
	5  => scalar eval { Net::DNS::SEC::libcrypto::EVP_sha1() },
	7  => scalar eval { Net::DNS::SEC::libcrypto::EVP_sha1() },
	8  => scalar eval { Net::DNS::SEC::libcrypto::EVP_sha256() },
	10 => scalar eval { Net::DNS::SEC::libcrypto::EVP_sha512() },
	);

sub _index { return keys %parameters }


sub sign {
	my ( $class, $sigdata, $private ) = @_;

	my $evpmd = $parameters{$private->algorithm};
	die 'private key not RSA' unless $evpmd;

	my ( $n, $e, $d, $p, $q ) =
			map { decode_base64( $private->$_ ) } qw(Modulus PublicExponent PrivateExponent Prime1 Prime2);

	my $evpkey = Net::DNS::SEC::libcrypto::EVP_PKEY_new_RSA( $n, $e, $d, $p, $q );

	return Net::DNS::SEC::libcrypto::EVP_sign( $sigdata, $evpkey, $evpmd );
}


sub verify {
	my ( $class, $sigdata, $keyrr, $sigbin ) = @_;

	my $evpmd = $parameters{$keyrr->algorithm};
	die 'public key not RSA' unless $evpmd;

	return unless $sigbin;

	my $keybin = $keyrr->keybin;				# public key
	my ( $short, $long ) = unpack( 'Cn', $keybin );		# RFC3110, section 2
	my $keyfmt = $short ? "x a$short a*" : "x3 a$long a*";
	my ( $exponent, $modulus ) = unpack( $keyfmt, $keybin );

	my $evpkey = Net::DNS::SEC::libcrypto::EVP_PKEY_new_RSA( $modulus, $exponent, '', '', '' );

	return Net::DNS::SEC::libcrypto::EVP_verify( $sigdata, $sigbin, $evpkey, $evpmd );
}


1;

__END__