File Coverage

blib/lib/Net/DNS/SEC/RSA.pm

Criterion	Covered	Total	%
statement	36	36	100.0
branch	8	8	100.0
condition			n/a
subroutine	10	10	100.0
pod	2	2	100.0
total	56	56	100.0

package Net::DNS::SEC::RSA;

use strict;
use warnings;

our $VERSION = (qw$Id: RSA.pm 2042 2025-12-24 10:23:11Z willem $)[2];


=head1 NAME

Net::DNS::SEC::RSA - DNSSEC RSA digital signature algorithm


=head1 SYNOPSIS

	require Net::DNS::SEC::RSA;

	$signature = Net::DNS::SEC::RSA->sign( $sigdata, $private );

	$validated = Net::DNS::SEC::RSA->verify( $sigdata, $keyrr, $sigbin );


=head1 DESCRIPTION

Implementation of RSA digital signature
generation and verification procedures.

=head2 sign

	$signature = Net::DNS::SEC::RSA->sign( $sigdata, $private );

Generates the wire-format signature from the sigdata octet string
and the appropriate private key object.

=head2 verify

	$validated = Net::DNS::SEC::RSA->verify( $sigdata, $keyrr, $sigbin );

Verifies the signature over the sigdata octet string using the specified
public key resource record.

=cut

use integer;
use MIME::Base64;

use constant RSA_configured => Net::DNS::SEC::libcrypto->can('EVP_PKEY_new_RSA');

BEGIN { die 'RSA disabled or application has no "use Net::DNS::SEC"' unless RSA_configured }


my %parameters = (
	1  => scalar eval { Net::DNS::SEC::libcrypto::EVP_md5() },	## deprecate DNSSEC entirely
	5  => scalar eval { Net::DNS::SEC::libcrypto::EVP_sha1() },	## MUST NOT DNSSEC sign
	7  => scalar eval { Net::DNS::SEC::libcrypto::EVP_sha1() },	## MUST NOT DNSSEC sign
	8  => scalar eval { Net::DNS::SEC::libcrypto::EVP_sha256() },
	10 => scalar eval { Net::DNS::SEC::libcrypto::EVP_sha512() },
	);

sub _index { return keys %parameters }

sub _deprecate { return ( 1, -5, -7 ) }


sub sign {
	my ( $class, $sigdata, $private ) = @_;

	my $evpmd = $parameters{$private->algorithm};
	die 'unsupported RSA algorithm ', $private->algorithm unless $evpmd;

	my @key = qw(Modulus PublicExponent PrivateExponent Prime1 Prime2 Exponent1 Exponent2 Coefficient);
	my ( $n, $e, $d, $p1, $p2, $e1, $e2, $c ) = map { decode_base64( $private->$_ ) } @key;
	my $evpkey = Net::DNS::SEC::libcrypto::EVP_PKEY_new_RSA( $n, $e, $d, $p1, $p2, $e1, $e2, $c );

	return Net::DNS::SEC::libcrypto::EVP_sign( $sigdata, $evpkey, $evpmd );
}


sub verify {
	my ( $class, $sigdata, $keyrr, $sigbin ) = @_;

	my $evpmd = $parameters{$keyrr->algorithm};
	die 'unsupported RSA algorithm ', $keyrr->algorithm unless $evpmd;

	return unless $sigbin;

	my $keybin = $keyrr->keybin;				# public key
	my ( $short, $long ) = unpack( 'Cn', $keybin );		# RFC3110, section 2
	my $keyfmt = $short ? "x a$short a*" : "x3 a$long a*";
	my ( $exponent, $modulus ) = unpack( $keyfmt, $keybin );

	my $evpkey = Net::DNS::SEC::libcrypto::EVP_PKEY_new_RSA( $modulus, $exponent );

	return Net::DNS::SEC::libcrypto::EVP_verify( $sigdata, $sigbin, $evpkey, $evpmd );
}


1;

__END__