@@ -7,6 +7,7 @@ package httpsig
77import (
88 "bytes"
99 "crypto/ecdsa"
10+ "crypto/ed25519"
1011 "crypto/rsa"
1112 "errors"
1213 "io"
@@ -27,14 +28,11 @@ func sliceHas(haystack []string, needle string) bool {
2728}
2829
2930type Signer struct {
30- signer
31+ * signer
3132}
3233
3334func NewSigner (opts ... signOption ) * Signer {
34- s := signer {
35- keys : make (map [string ]sigHolder ),
36- nowFunc : time .Now ,
37- }
35+ s := signer {}
3836
3937 for _ , o := range opts {
4038 o .configureSign (& s )
@@ -47,13 +45,13 @@ func NewSigner(opts ...signOption) *Signer {
4745 // TODO: normalize headers? lowercase & de-dupe
4846
4947 // specialty components and digest first, for aesthetics
50- for _ , comp := range []string {"digest" , "@query" , "@path" , "@method" } {
48+ for _ , comp := range []string {"content- digest" , "@query" , "@path" , "@method" } {
5149 if ! sliceHas (s .headers , comp ) {
5250 s .headers = append ([]string {comp }, s .headers ... )
5351 }
5452 }
5553
56- return & Signer {s }
54+ return & Signer {& s }
5755}
5856
5957func (s * Signer ) Sign (r * http.Request ) error {
@@ -72,7 +70,7 @@ func (s *Signer) Sign(r *http.Request) error {
7270
7371 // Always set a digest (for now)
7472 // TODO: we could skip setting digest on an empty body if content-length is included in the sig
75- r .Header .Set ("Digest" , calcDigest (b .Bytes ()))
73+ r .Header .Set ("Content- Digest" , calcDigest (b .Bytes ()))
7674
7775 msg := messageFromRequest (r )
7876 hdr , err := s .signer .Sign (msg )
@@ -131,9 +129,9 @@ func (v *Verifier) Verify(r *http.Request) (keyID string, err error) {
131129 }
132130 }
133131
134- // Check the digest if set. We only support id- sha-256 for now.
132+ // Check the digest if set. We only support sha-512 for now.
135133 // TODO: option to require this?
136- if dig := r .Header .Get ("Digest" ); dig != "" {
134+ if dig := r .Header .Get ("Content- Digest" ); dig != "" {
137135 if ! verifyDigest (b .Bytes (), dig ) {
138136 return keyID , errors .New ("digest mismatch" )
139137 }
@@ -233,11 +231,27 @@ func WithVerifyingKeyResolver(resolver VerifyingKeyResolver) verifyOption {
233231 }
234232}
235233
234+ // WithSignRsaPkcs1v15Sha256 adds signing using `rsa-v1_5-sha256` with the given private key
235+ // using the given key id.
236+ func WithSignRsaPkcs1v15Sha256 (keyID string , pk * rsa.PrivateKey ) signOption {
237+ return & optImpl {
238+ s : func (s * signer ) { s .keys .Store (keyID , signRsaPkcs1v15Sha256 (pk )) },
239+ }
240+ }
241+
242+ // WithVerifyRsaPkcs1v15Sha256 adds signature verification using `rsa-v1_5-sha256` with the
243+ // given public key using the given key id.
244+ func WithVerifyRsaPkcs1v15Sha256 (keyID string , pk * rsa.PublicKey ) verifyOption {
245+ return & optImpl {
246+ v : func (v * verifier ) { v .keys .Store (keyID , verifyRsaPkcs1v15Sha256 (pk )) },
247+ }
248+ }
249+
236250// WithSignRsaPssSha512 adds signing using `rsa-pss-sha512` with the given private key
237251// using the given key id.
238252func WithSignRsaPssSha512 (keyID string , pk * rsa.PrivateKey ) signOption {
239253 return & optImpl {
240- s : func (s * signer ) { s .keys [ keyID ] = signRsaPssSha512 (pk ) },
254+ s : func (s * signer ) { s .keys . Store ( keyID , signRsaPssSha512 (pk ) ) },
241255 }
242256}
243257
@@ -253,7 +267,7 @@ func WithVerifyRsaPssSha512(keyID string, pk *rsa.PublicKey) verifyOption {
253267// using the given key id.
254268func WithSignEcdsaP256Sha256 (keyID string , pk * ecdsa.PrivateKey ) signOption {
255269 return & optImpl {
256- s : func (s * signer ) { s .keys [ keyID ] = signEccP256 (pk ) },
270+ s : func (s * signer ) { s .keys . Store ( keyID , signEccP256 (pk ) ) },
257271 }
258272}
259273
@@ -265,11 +279,43 @@ func WithVerifyEcdsaP256Sha256(keyID string, pk *ecdsa.PublicKey) verifyOption {
265279 }
266280}
267281
282+ // WithSignEcdsaP384Sha384 adds signing using `ecdsa-p384-sha384` with the given private key
283+ // using the given key id.
284+ func WithSignEcdsaP384Sha384 (keyID string , pk * ecdsa.PrivateKey ) signOption {
285+ return & optImpl {
286+ s : func (s * signer ) { s .keys .Store (keyID , signEccP384 (pk )) },
287+ }
288+ }
289+
290+ // WithVerifyEcdsaP384Sha384 adds signature verification using `ecdsa-p384-sha384` with the
291+ // given public key using the given key id.
292+ func WithVerifyEcdsaP384Sha384 (keyID string , pk * ecdsa.PublicKey ) verifyOption {
293+ return & optImpl {
294+ v : func (v * verifier ) { v .keys .Store (keyID , verifyEccP384 (pk )) },
295+ }
296+ }
297+
298+ // WithSignEd25519 adds signing using `ed25519` with the given private key
299+ // using the given key id.
300+ func WithSignEd25519 (keyID string , pk * ed25519.PrivateKey ) signOption {
301+ return & optImpl {
302+ s : func (s * signer ) { s .keys .Store (keyID , signEd25519 (pk )) },
303+ }
304+ }
305+
306+ // WithVerifyEd25519 adds signature verification using `ed25519` with the
307+ // given public key using the given key id.
308+ func WithVerifyEd25519 (keyID string , pk * ed25519.PublicKey ) verifyOption {
309+ return & optImpl {
310+ v : func (v * verifier ) { v .keys .Store (keyID , verifyEd25519 (pk )) },
311+ }
312+ }
313+
268314// WithHmacSha256 adds signing or signature verification using `hmac-sha256` with the
269315// given shared secret using the given key id.
270316func WithHmacSha256 (keyID string , secret []byte ) signOrVerifyOption {
271317 return & optImpl {
272- s : func (s * signer ) { s .keys [ keyID ] = signHmacSha256 (secret ) },
318+ s : func (s * signer ) { s .keys . Store ( keyID , signHmacSha256 (secret ) ) },
273319 v : func (v * verifier ) { v .keys .Store (keyID , verifyHmacSha256 (secret )) },
274320 }
275321}
0 commit comments