feat: imprint function

dignifiedquire · web-flow · commit c17d370b434e · 2025-05-23T22:44:27.000+02:00
Implement an Imprint trait that calculates fingerprint-like identifiers for keys, using arbitrary hash functions.
diff --git a/src/composed/signed_key/public.rs b/src/composed/signed_key/public.rs
@@ -11,12 +11,15 @@ use crate::{
         signed_key::SignedKeyDetails,
         ArmorOptions,
     },
-    crypto::{hash::HashAlgorithm, public_key::PublicKeyAlgorithm},
+    crypto::{
+        hash::{HashAlgorithm, KnownDigest},
+        public_key::PublicKeyAlgorithm,
+    },
     errors::{ensure, Result},
     packet::{self, Packet, PacketTrait, SignatureType},
     ser::Serialize,
     types::{
-        EskType, Fingerprint, KeyDetails, KeyId, KeyVersion, PacketLength, PkeskBytes,
+        EskType, Fingerprint, Imprint, KeyDetails, KeyId, KeyVersion, PacketLength, PkeskBytes,
         PublicKeyTrait, PublicParams, SignatureBytes, Tag,
     },
 };
@@ -195,6 +198,12 @@ impl KeyDetails for SignedPublicKey {
     }
 }
 
+impl Imprint for SignedPublicKey {
+    fn imprint<D: KnownDigest>(&self) -> Result<generic_array::GenericArray<u8, D::OutputSize>> {
+        self.primary_key.imprint::<D>()
+    }
+}
+
 impl PublicKeyTrait for SignedPublicKey {
     fn verify_signature(
         &self,
@@ -297,6 +306,12 @@ impl SignedPublicSubKey {
     }
 }
 
+impl Imprint for SignedPublicSubKey {
+    fn imprint<D: KnownDigest>(&self) -> Result<generic_array::GenericArray<u8, D::OutputSize>> {
+        self.key.imprint::<D>()
+    }
+}
+
 impl KeyDetails for SignedPublicSubKey {
     fn version(&self) -> KeyVersion {
         self.key.version()
diff --git a/src/composed/signed_key/secret.rs b/src/composed/signed_key/secret.rs
@@ -1,6 +1,7 @@
 use std::{io, ops::Deref};
 
 use chrono::{DateTime, Utc};
+use generic_array::GenericArray;
 use log::{debug, warn};
 use rand::{CryptoRng, Rng};
 
@@ -11,10 +12,11 @@ use crate::{
         signed_key::{SignedKeyDetails, SignedPublicSubKey},
         ArmorOptions, PlainSessionKey, SignedPublicKey,
     },
+    crypto::hash::KnownDigest,
     errors::{ensure, Result},
     packet::{self, Packet, PacketTrait, SignatureType},
     ser::Serialize,
-    types::{EskType, Password, PkeskBytes, PublicKeyTrait, Tag},
+    types::{EskType, Imprint, Password, PkeskBytes, PublicKeyTrait, Tag},
 };
 
 /// Represents a secret signed PGP key.
@@ -255,6 +257,12 @@ impl Deref for SignedSecretKey {
     }
 }
 
+impl Imprint for SignedSecretKey {
+    fn imprint<D: KnownDigest>(&self) -> Result<GenericArray<u8, D::OutputSize>> {
+        self.primary_key.imprint::<D>()
+    }
+}
+
 /// Represents a composed secret PGP SubKey.
 #[derive(Debug, PartialEq, Eq, Clone)]
 pub struct SignedSecretSubKey {
@@ -361,6 +369,12 @@ impl Serialize for SignedSecretSubKey {
     }
 }
 
+impl Imprint for SignedSecretSubKey {
+    fn imprint<D: KnownDigest>(&self) -> Result<GenericArray<u8, D::OutputSize>> {
+        self.key.imprint::<D>()
+    }
+}
+
 impl From<SignedSecretKey> for SignedPublicKey {
     fn from(value: SignedSecretKey) -> Self {
         let primary = value.primary_key.public_key();
diff --git a/src/crypto/hash.rs b/src/crypto/hash.rs
@@ -1,6 +1,6 @@
 use std::str::FromStr;
 
-use digest::DynDigest;
+use digest::{Digest, DynDigest};
 use md5::Md5;
 use num_enum::{FromPrimitive, IntoPrimitive};
 use ripemd::Ripemd160;
@@ -49,6 +49,18 @@ pub enum HashAlgorithm {
     Other(#[cfg_attr(test, proptest(strategy = "111u8.."))] u8),
 }
 
+/// Marker trait for supported hash algorithms
+pub trait KnownDigest: Digest {}
+
+impl KnownDigest for md5::Md5 {}
+impl KnownDigest for sha1_checked::Sha1 {}
+impl KnownDigest for Ripemd160 {}
+impl KnownDigest for sha2::Sha256 {}
+impl KnownDigest for sha2::Sha384 {}
+impl KnownDigest for sha2::Sha512 {}
+impl KnownDigest for sha3::Sha3_256 {}
+impl KnownDigest for sha3::Sha3_512 {}
+
 impl FromStr for HashAlgorithm {
     type Err = ();
 
diff --git a/src/packet/key/public.rs b/src/packet/key/public.rs
@@ -1,19 +1,25 @@
 use std::io::BufRead;
 
 use byteorder::{BigEndian, ByteOrder, WriteBytesExt};
+use digest::generic_array::GenericArray;
 use md5::Md5;
 use rand::{CryptoRng, Rng};
 use rsa::traits::PublicKeyParts;
-use sha1_checked::{Digest, Sha1};
+use sha1_checked::Sha1;
+use sha2::Sha256;
 
 use crate::{
-    crypto::{self, hash::HashAlgorithm, public_key::PublicKeyAlgorithm},
+    crypto::{
+        self,
+        hash::{HashAlgorithm, KnownDigest},
+        public_key::PublicKeyAlgorithm,
+    },
     errors::{bail, ensure, ensure_eq, unimplemented_err, unsupported_err, Result},
     packet::{PacketHeader, Signature, SignatureConfig, SignatureType, Subpacket, SubpacketData},
     ser::Serialize,
     types::{
-        EcdhPublicParams, EddsaLegacyPublicParams, EskType, Fingerprint, KeyDetails, KeyId,
-        KeyVersion, Mpi, Password, PkeskBytes, PublicKeyTrait, PublicParams, SecretKeyTrait,
+        EcdhPublicParams, EddsaLegacyPublicParams, EskType, Fingerprint, Imprint, KeyDetails,
+        KeyId, KeyVersion, Mpi, Password, PkeskBytes, PublicKeyTrait, PublicParams, SecretKeyTrait,
         SignatureBytes, Tag,
     },
 };
@@ -615,29 +621,24 @@ impl crate::packet::PacketTrait for PublicSubkey {
     }
 }
 
-impl KeyDetails for PubKeyInner {
-    fn version(&self) -> KeyVersion {
-        self.version
-    }
+impl PubKeyInner {
+    fn imprint<D: KnownDigest>(&self) -> Result<GenericArray<u8, D::OutputSize>> {
+        let mut hasher = D::new();
 
-    fn fingerprint(&self) -> Fingerprint {
         use crate::ser::Serialize;
 
         match self.version {
             KeyVersion::V2 | KeyVersion::V3 => {
-                let mut h = Md5::new();
-                self.public_params
-                    .to_writer(&mut h)
-                    .expect("write to hasher");
-                let digest = h.finalize();
+                let mut v: Vec<u8> = Vec::new();
+                self.public_params.to_writer(&mut v)?;
 
-                if self.version == KeyVersion::V2 {
-                    Fingerprint::V2(digest.into())
-                } else {
-                    Fingerprint::V3(digest.into())
-                }
+                hasher.update(&v);
+
+                Ok(hasher.finalize())
             }
             KeyVersion::V4 => {
+                hasher.update([0x99]);
+
                 // A one-octet version number (4).
                 let mut packet = vec![4, 0, 0, 0, 0];
 
@@ -646,60 +647,83 @@ impl KeyDetails for PubKeyInner {
 
                 // A one-octet number denoting the public-key algorithm of this key.
                 packet.push(self.algorithm.into());
-                self.public_params
-                    .to_writer(&mut packet)
-                    .expect("write to vec");
 
-                let mut h = Sha1::new();
-                h.update([0x99]);
-                h.write_u16::<BigEndian>(packet.len() as u16)
-                    .expect("write to hasher");
-                h.update(&packet);
+                self.public_params.to_writer(&mut packet)?;
 
-                let digest = h.finalize();
+                hasher.update((packet.len() as u16).to_be_bytes());
+                hasher.update(&packet);
 
-                Fingerprint::V4(digest.into())
+                Ok(hasher.finalize())
             }
-            KeyVersion::V5 => unimplemented!("V5 keys"),
+            KeyVersion::V5 => unsupported_err!("Imprint for V5 keys"),
             KeyVersion::V6 => {
-                // Serialize public parameters
-                let mut pp: Vec<u8> = vec![];
-                self.public_params
-                    .to_writer(&mut pp)
-                    .expect("serialize to Vec<u8>");
-
-                // A v6 fingerprint is the 256-bit SHA2-256 hash of:
-                let mut h = sha2::Sha256::new();
-
                 // a.1) 0x9B (1 octet)
-                h.update([0x9B]);
+                hasher.update([0x9B]);
+
+                // length of public parameters
+                let len = self.public_params.write_len() as u32;
 
                 // a.2) four-octet scalar octet count of (b)-(f)
-                let total_len: u32 = 1 + 4 + 1 + 4 + pp.len() as u32;
-                h.write_u32::<BigEndian>(total_len)
-                    .expect("write to hasher");
+                let total_len: u32 = 1 + 4 + 1 + 4 + len;
+                hasher.update(total_len.to_be_bytes());
 
                 // b) version number = 6 (1 octet);
-                h.update([0x06]);
+                hasher.update([0x06]);
 
                 // c) timestamp of key creation (4 octets);
-                h.write_u32::<BigEndian>(self.created_at.timestamp() as u32)
-                    .expect("write to hasher");
+                hasher.update((self.created_at.timestamp() as u32).to_be_bytes());
 
                 // d) algorithm (1 octet);
-                h.update([self.algorithm.into()]);
+                hasher.update([self.algorithm.into()]);
 
                 // e) four-octet scalar octet count for the following key material;
-                h.write_u32::<BigEndian>(pp.len() as u32)
-                    .expect("write to hasher");
+                hasher.update(len.to_be_bytes());
 
                 // f) algorithm-specific fields.
-                h.update(&pp);
+                let mut pp: Vec<u8> = vec![];
+                self.public_params.to_writer(&mut pp)?;
+                hasher.update(&pp);
 
-                let digest = h.finalize();
+                Ok(hasher.finalize())
+            }
+            KeyVersion::Other(v) => unsupported_err!("Imprint for {} keys", v),
+        }
+    }
+}
 
-                Fingerprint::V6(digest.into())
+impl KeyDetails for PubKeyInner {
+    fn version(&self) -> KeyVersion {
+        self.version
+    }
+
+    fn fingerprint(&self) -> Fingerprint {
+        match self.version {
+            KeyVersion::V2 | KeyVersion::V3 => {
+                if self.version == KeyVersion::V2 {
+                    Fingerprint::V2(
+                        self.imprint::<Md5>()
+                            .expect("failure is not an option")
+                            .into(),
+                    )
+                } else {
+                    Fingerprint::V3(
+                        self.imprint::<Md5>()
+                            .expect("failure is not an option")
+                            .into(),
+                    )
+                }
             }
+            KeyVersion::V4 => Fingerprint::V4(
+                self.imprint::<Sha1>()
+                    .expect("failure is not an option")
+                    .into(),
+            ),
+            KeyVersion::V5 => unimplemented!("V5 keys"),
+            KeyVersion::V6 => Fingerprint::V6(
+                self.imprint::<Sha256>()
+                    .expect("failure is not an option")
+                    .into(),
+            ),
             KeyVersion::Other(v) => unimplemented!("Unsupported key version {}", v),
         }
     }
@@ -896,6 +920,13 @@ impl KeyDetails for PublicKey {
         self.inner.algorithm()
     }
 }
+
+impl Imprint for PublicKey {
+    fn imprint<D: KnownDigest>(&self) -> Result<GenericArray<u8, D::OutputSize>> {
+        self.inner.imprint::<D>()
+    }
+}
+
 impl PublicKeyTrait for PublicKey {
     fn verify_signature(
         &self,
@@ -937,6 +968,12 @@ impl KeyDetails for PublicSubkey {
     }
 }
 
+impl Imprint for PublicSubkey {
+    fn imprint<D: KnownDigest>(&self) -> Result<GenericArray<u8, D::OutputSize>> {
+        self.inner.imprint::<D>()
+    }
+}
+
 impl PublicKeyTrait for PublicSubkey {
     fn verify_signature(
         &self,
diff --git a/src/packet/key/secret.rs b/src/packet/key/secret.rs
@@ -1,21 +1,25 @@
 use std::io::BufRead;
 
+use generic_array::GenericArray;
 use log::debug;
 use rand::{CryptoRng, Rng};
 
 use super::public::{encrypt, PubKeyInner};
 use crate::{
-    crypto::{hash::HashAlgorithm, public_key::PublicKeyAlgorithm},
+    crypto::{
+        hash::{HashAlgorithm, KnownDigest},
+        public_key::PublicKeyAlgorithm,
+    },
     errors::{bail, ensure_eq, unsupported_err, Result},
     packet::{
         PacketHeader, PacketTrait, Signature, SignatureConfig, SignatureType, Subpacket,
         SubpacketData,
     },
     ser::Serialize,
     types::{
-        EddsaLegacyPublicParams, EskType, Fingerprint, KeyDetails, KeyId, KeyVersion, Password,
-        PkeskBytes, PlainSecretParams, PublicKeyTrait, PublicParams, SecretKeyTrait, SecretParams,
-        SignatureBytes, Tag,
+        EddsaLegacyPublicParams, EskType, Fingerprint, Imprint, KeyDetails, KeyId, KeyVersion,
+        Password, PkeskBytes, PlainSecretParams, PublicKeyTrait, PublicParams, SecretKeyTrait,
+        SecretParams, SignatureBytes, Tag,
     },
 };
 
@@ -234,6 +238,12 @@ impl KeyDetails for SecretKey {
     }
 }
 
+impl Imprint for SecretKey {
+    fn imprint<D: KnownDigest>(&self) -> Result<GenericArray<u8, D::OutputSize>> {
+        self.details.imprint::<D>()
+    }
+}
+
 impl KeyDetails for SecretSubkey {
     fn version(&self) -> KeyVersion {
         self.details.version()
@@ -250,6 +260,12 @@ impl KeyDetails for SecretSubkey {
     }
 }
 
+impl Imprint for SecretSubkey {
+    fn imprint<D: KnownDigest>(&self) -> Result<GenericArray<u8, D::OutputSize>> {
+        self.details.imprint::<D>()
+    }
+}
+
 impl SecretKeyTrait for SecretSubkey {
     fn create_signature(
         &self,
diff --git a/src/types.rs b/src/types.rs
@@ -16,7 +16,7 @@ pub use self::{
     compression::CompressionAlgorithm,
     fingerprint::Fingerprint,
     key_id::KeyId,
-    key_traits::{KeyDetails, PublicKeyTrait, SecretKeyTrait},
+    key_traits::{Imprint, KeyDetails, PublicKeyTrait, SecretKeyTrait},
     mpi::Mpi,
     packet::*,
     params::*,
diff --git a/src/types/key_traits.rs b/src/types/key_traits.rs
diff --git a/tests/key_test.rs b/tests/key_test.rs
diff --git a/tests/openpgpjs.pub.asc b/tests/openpgpjs.pub.asc
