signstar_crypto/key/base/
nethsm.rs

1//! NetHSM specific integration for cryptographic keys.
2
3use nethsm_sdk_rs::models::{
4    KeyMechanism as NetHsmRsKeyMechanism,
5    KeyType as NetHsmSdkRsKeyType,
6    SignMode,
7};
8
9use crate::key::{
10    Error,
11    base::{DecryptMode, EncryptMode, KeyMechanism, KeyType, SignatureType},
12};
13
14impl TryFrom<KeyType> for NetHsmSdkRsKeyType {
15    type Error = crate::Error;
16
17    fn try_from(value: KeyType) -> Result<Self, Self::Error> {
18        Ok(match value {
19            KeyType::Curve25519 => Self::Curve25519,
20            KeyType::EcBp256 => Self::BrainpoolP256,
21            KeyType::EcBp384 => Self::BrainpoolP384,
22            KeyType::EcBp512 => Self::BrainpoolP512,
23            KeyType::EcK256 => Self::EcP256K1,
24            KeyType::EcP224 => return Err(Error::UnsupportedKeyType(value).into()),
25            KeyType::EcP256 => Self::EcP256,
26            KeyType::EcP384 => Self::EcP384,
27            KeyType::EcP521 => Self::EcP521,
28            KeyType::Generic => Self::Generic,
29            KeyType::Rsa => Self::Rsa,
30        })
31    }
32}
33
34impl TryFrom<NetHsmSdkRsKeyType> for KeyType {
35    type Error = crate::Error;
36
37    /// Creates a [`KeyType`] from a [`nethsm_sdk_rs::models::KeyType`].
38    ///
39    /// # Errors
40    ///
41    /// Returns an error, if an unsupported [`nethsm_sdk_rs::models::KeyType`] is used.
42    fn try_from(value: NetHsmSdkRsKeyType) -> Result<Self, Self::Error> {
43        Ok(match value {
44            NetHsmSdkRsKeyType::BrainpoolP256 => Self::EcBp256,
45            NetHsmSdkRsKeyType::BrainpoolP384 => Self::EcBp384,
46            NetHsmSdkRsKeyType::BrainpoolP512 => Self::EcBp512,
47            NetHsmSdkRsKeyType::Curve25519 => Self::Curve25519,
48            NetHsmSdkRsKeyType::EcP256 => Self::EcP256,
49            NetHsmSdkRsKeyType::EcP256K1 => Self::EcK256,
50            NetHsmSdkRsKeyType::EcP384 => Self::EcP384,
51            NetHsmSdkRsKeyType::EcP521 => Self::EcP521,
52            NetHsmSdkRsKeyType::Generic => Self::Generic,
53            NetHsmSdkRsKeyType::Rsa => Self::Rsa,
54            // NOTE: Upstream has marked all of their models non-exhaustive.
55            // Thus, comment the below on every update to nethsm-sdk-rs to check if there are new
56            // variants that should be supported... :(
57            key_type => return Err(Error::UnsupportedNetHsmSdkRsKeyType { key_type }.into()),
58        })
59    }
60}
61
62impl TryFrom<NetHsmRsKeyMechanism> for KeyMechanism {
63    type Error = crate::Error;
64    fn try_from(value: NetHsmRsKeyMechanism) -> Result<Self, Self::Error> {
65        Ok(match value {
66            NetHsmRsKeyMechanism::AesDecryptionCbc => Self::AesDecryptionCbc,
67            NetHsmRsKeyMechanism::AesEncryptionCbc => Self::AesEncryptionCbc,
68            NetHsmRsKeyMechanism::EcdsaSignature => Self::EcdsaSignature,
69            NetHsmRsKeyMechanism::EdDsaSignature => Self::EdDsaSignature,
70            NetHsmRsKeyMechanism::RsaDecryptionOaepMd5 => Self::RsaDecryptionOaepMd5,
71            NetHsmRsKeyMechanism::RsaDecryptionOaepSha1 => Self::RsaDecryptionOaepSha1,
72            NetHsmRsKeyMechanism::RsaDecryptionOaepSha224 => Self::RsaDecryptionOaepSha224,
73            NetHsmRsKeyMechanism::RsaDecryptionOaepSha256 => Self::RsaDecryptionOaepSha256,
74            NetHsmRsKeyMechanism::RsaDecryptionOaepSha384 => Self::RsaDecryptionOaepSha384,
75            NetHsmRsKeyMechanism::RsaDecryptionOaepSha512 => Self::RsaDecryptionOaepSha512,
76            NetHsmRsKeyMechanism::RsaDecryptionPkcs1 => Self::RsaDecryptionPkcs1,
77            NetHsmRsKeyMechanism::RsaDecryptionRaw => Self::RsaDecryptionRaw,
78            NetHsmRsKeyMechanism::RsaSignaturePkcs1 => Self::RsaSignaturePkcs1,
79            NetHsmRsKeyMechanism::RsaSignaturePssSha1 => Self::RsaSignaturePssSha1,
80            NetHsmRsKeyMechanism::RsaSignaturePssSha224 => Self::RsaSignaturePssSha224,
81            NetHsmRsKeyMechanism::RsaSignaturePssSha256 => Self::RsaSignaturePssSha256,
82            NetHsmRsKeyMechanism::RsaSignaturePssSha384 => Self::RsaSignaturePssSha384,
83            NetHsmRsKeyMechanism::RsaSignaturePssSha512 => Self::RsaSignaturePssSha512,
84            NetHsmRsKeyMechanism::RsaSignaturePssMd5 => {
85                return Err(Error::UnsupportedNetHsmSdkRsKeyMechanism {
86                    key_mechanism: value,
87                }
88                .into());
89            }
90            // NOTE: Upstream has marked all of their models non-exhaustive.
91            // Thus, comment the below on every update to nethsm-sdk-rs to check if there are new
92            // variants that should be supported... :(
93            key_mechanism => {
94                return Err(Error::UnsupportedNetHsmSdkRsKeyMechanism { key_mechanism }.into());
95            }
96        })
97    }
98}
99
100impl From<KeyMechanism> for NetHsmRsKeyMechanism {
101    fn from(value: KeyMechanism) -> Self {
102        match value {
103            KeyMechanism::AesDecryptionCbc => Self::AesDecryptionCbc,
104            KeyMechanism::AesEncryptionCbc => Self::AesEncryptionCbc,
105            KeyMechanism::EcdsaSignature => Self::EcdsaSignature,
106            KeyMechanism::EdDsaSignature => Self::EdDsaSignature,
107            KeyMechanism::RsaDecryptionOaepMd5 => Self::RsaDecryptionOaepMd5,
108            KeyMechanism::RsaDecryptionOaepSha1 => Self::RsaDecryptionOaepSha1,
109            KeyMechanism::RsaDecryptionOaepSha224 => Self::RsaDecryptionOaepSha224,
110            KeyMechanism::RsaDecryptionOaepSha256 => Self::RsaDecryptionOaepSha256,
111            KeyMechanism::RsaDecryptionOaepSha384 => Self::RsaDecryptionOaepSha384,
112            KeyMechanism::RsaDecryptionOaepSha512 => Self::RsaDecryptionOaepSha512,
113            KeyMechanism::RsaDecryptionPkcs1 => Self::RsaDecryptionPkcs1,
114            KeyMechanism::RsaDecryptionRaw => Self::RsaDecryptionRaw,
115            KeyMechanism::RsaSignaturePkcs1 => Self::RsaSignaturePkcs1,
116            KeyMechanism::RsaSignaturePssSha1 => Self::RsaSignaturePssSha1,
117            KeyMechanism::RsaSignaturePssSha224 => Self::RsaSignaturePssSha224,
118            KeyMechanism::RsaSignaturePssSha256 => Self::RsaSignaturePssSha256,
119            KeyMechanism::RsaSignaturePssSha384 => Self::RsaSignaturePssSha384,
120            KeyMechanism::RsaSignaturePssSha512 => Self::RsaSignaturePssSha512,
121        }
122    }
123}
124
125impl TryFrom<SignatureType> for SignMode {
126    type Error = crate::Error;
127
128    /// Creates a [`SignMode`] from a [`SignatureType`].
129    ///
130    /// # Note
131    ///
132    /// The more specific [`SignatureType::EcdsaP256`], [`SignatureType::EcdsaP384`] and
133    /// [`SignatureType::EcdsaP521`] are returned as [`SignMode::Ecdsa`].
134    ///
135    /// # Errors
136    ///
137    /// Returns an error if an unsupported SignatureType is encountered
138    fn try_from(value: SignatureType) -> Result<Self, Self::Error> {
139        Ok(match value {
140            SignatureType::Pkcs1 => SignMode::Pkcs1,
141            SignatureType::PssSha1 => SignMode::PssSha1,
142            SignatureType::PssSha224 => SignMode::PssSha224,
143            SignatureType::PssSha256 => SignMode::PssSha256,
144            SignatureType::PssSha384 => SignMode::PssSha384,
145            SignatureType::PssSha512 => SignMode::PssSha512,
146            SignatureType::EdDsa => SignMode::EdDsa,
147            SignatureType::EcdsaP224
148            | SignatureType::EcdsaP256
149            | SignatureType::EcdsaP384
150            | SignatureType::EcdsaP521 => SignMode::Ecdsa,
151            SignatureType::EcdsaK256 => {
152                return Err(Error::UnsupportedSignatureType {
153                    signature_type: SignatureType::EcdsaK256,
154                    context: "the NetHSM backend does not support it",
155                }
156                .into());
157            }
158        })
159    }
160}
161
162impl From<EncryptMode> for nethsm_sdk_rs::models::EncryptMode {
163    fn from(value: EncryptMode) -> Self {
164        match value {
165            EncryptMode::AesCbc => Self::AesCbc,
166        }
167    }
168}
169
170impl From<DecryptMode> for nethsm_sdk_rs::models::DecryptMode {
171    fn from(value: DecryptMode) -> Self {
172        match value {
173            DecryptMode::AesCbc => Self::AesCbc,
174            DecryptMode::OaepMd5 => Self::OaepMd5,
175            DecryptMode::OaepSha1 => Self::OaepSha1,
176            DecryptMode::OaepSha224 => Self::OaepSha224,
177            DecryptMode::OaepSha256 => Self::OaepSha256,
178            DecryptMode::OaepSha384 => Self::OaepSha384,
179            DecryptMode::OaepSha512 => Self::OaepSha512,
180            DecryptMode::Pkcs1 => Self::Pkcs1,
181            DecryptMode::Raw => Self::Raw,
182        }
183    }
184}
signstar_crypto/key/base/nethsm.rs

signstar_crypto/key/base/
nethsm.rs
