-
Notifications
You must be signed in to change notification settings - Fork 323
Expose cryptography backends via CryptoProvider #452
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
4483fd7 to
370f904
Compare
|
@Keats any chance of a review on this? |
|
Would this allow applications to use rustls rather than openssl? |
|
@drusellers As far as I know rustls doesn't implement the cryptography directly, rather it relies on other crates like |
Keats
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this can be simplified
| Algorithm::PS384 => Box::new(rsa::RsaPss384Signer::new(key)?) as Box<dyn JwtSigner>, | ||
| Algorithm::PS512 => Box::new(rsa::RsaPss512Signer::new(key)?) as Box<dyn JwtSigner>, | ||
| Algorithm::EdDSA => Box::new(eddsa::EdDSASigner::new(key)?) as Box<dyn JwtSigner>, | ||
| }; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
that will get more complex if we start supporting some alg in some backend like #461
38698b3 to
3344881
Compare
|
@Keats I made the JWK functions private after all. For the In regards to the macro, I also left it as is, if #461 goes through and does gate the implementation itself behind a feature, I guess the best would be to remove the macro and write the functions by hand for each built-in provider. As for the example, I used the |
Adds a
CryptoProviderstruct that allows replacing the built-in providers with something custom.All the details from this implementation that could be considered "interesting" are stolen straight from
rustls's CryptoProvider.I've marked the
new_signer,new_verifierand JWK functions from the two built in backends aspub, so you can do stuff like this:i.e. overwrite just specific algorithms.
One area I'm a little unsure about is
JwkUtils, 1) about the name and 2) about theDefaultimplementation. TheCryptoProvider::signer_andCryptoProvider::verifier_factoryfunctions are obviously mandatory for a custom provider, but not everyone uses JWK, so the default just uses dummy functions withunimplemented!().