89 lines
2.8 KiB
Go
89 lines
2.8 KiB
Go
package sshsig
|
|
|
|
import (
|
|
"crypto"
|
|
"errors"
|
|
"fmt"
|
|
"hash"
|
|
)
|
|
|
|
// supportedHashAlgorithm is a map of supported hash algorithms, as defined in
|
|
// the protocol.
|
|
// xref: https://github.com/openssh/openssh-portable/blob/V_9_2_P1/PROTOCOL.sshsig#L66-L67
|
|
var supportedHashAlgorithms = map[HashAlgorithm]crypto.Hash{
|
|
HashSHA256: crypto.SHA256,
|
|
HashSHA512: crypto.SHA512,
|
|
}
|
|
|
|
var (
|
|
// ErrUnsupportedHashAlgorithm is returned by Sign and Verify if the hash
|
|
// algorithm is not supported.
|
|
ErrUnsupportedHashAlgorithm = errors.New("unsupported hash algorithm")
|
|
// ErrUnavailableHashAlgorithm is returned by Sign and Verify if the hash
|
|
// algorithm is not available.
|
|
ErrUnavailableHashAlgorithm = errors.New("unavailable hash algorithm")
|
|
)
|
|
|
|
const (
|
|
// HashSHA256 is the SHA-256 hash algorithm.
|
|
HashSHA256 HashAlgorithm = "sha256"
|
|
// HashSHA512 is the SHA-512 hash algorithm.
|
|
HashSHA512 HashAlgorithm = "sha512"
|
|
)
|
|
|
|
// HashAlgorithm represents an algorithm used to compute a hash of a
|
|
// message.
|
|
type HashAlgorithm string
|
|
|
|
// Supported returns ErrUnsupportedHashAlgorithm if the hash algorithm is not
|
|
// supported, nil otherwise. Use Available if the intention is to make use of
|
|
// the hash algorithm, as it also checks if the hash algorithm is available.
|
|
func (h HashAlgorithm) Supported() error {
|
|
if _, ok := supportedHashAlgorithms[h]; !ok {
|
|
// TODO(hidde): if the number of supported hash algorithms grows, it
|
|
// might be worth generating the list of supported algorithms.
|
|
return fmt.Errorf("%w %q: must be %q or %q", ErrUnsupportedHashAlgorithm, h.String(), HashSHA256, HashSHA512)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Available returns ErrUnsupportedHashAlgorithm if the hash algorithm is not
|
|
// supported, ErrUnavailableHashAlgorithm if the hash algorithm is not available,
|
|
// nil otherwise.
|
|
func (h HashAlgorithm) Available() error {
|
|
if err := h.Supported(); err != nil {
|
|
return err
|
|
}
|
|
if !supportedHashAlgorithms[h].Available() {
|
|
return fmt.Errorf("%w %q", ErrUnavailableHashAlgorithm, h.String())
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Hash returns a hash.Hash for the hash algorithm. If the hash algorithm is
|
|
// not available, it panics. The library itself ensures that the hash algorithm
|
|
// is available before calling this function.
|
|
func (h HashAlgorithm) Hash() hash.Hash {
|
|
if h == "" {
|
|
panic("sshsig: hash algorithm not specified")
|
|
}
|
|
if err := h.Available(); err != nil {
|
|
panic("sshsig: " + err.Error())
|
|
}
|
|
return supportedHashAlgorithms[h].New()
|
|
}
|
|
|
|
// String returns the string representation of the hash algorithm.
|
|
func (h HashAlgorithm) String() string {
|
|
return string(h)
|
|
}
|
|
|
|
// SupportedHashAlgorithms returns a list of supported hash algorithms.
|
|
func SupportedHashAlgorithms() []HashAlgorithm {
|
|
var algorithms []HashAlgorithm
|
|
for algorithm := range supportedHashAlgorithms {
|
|
algorithms = append(algorithms, algorithm)
|
|
}
|
|
return algorithms
|
|
}
|