snowflake-sdk
Version:
Node.js driver for Snowflake
44 lines • 2.21 kB
JavaScript
;
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.CRL_SIGNATURE_VERIFIERS = void 0;
exports.isCrlSignatureValid = isCrlSignatureValid;
const crypto_1 = __importDefault(require("crypto"));
const asn1_js_rfc5280_1 = __importDefault(require("asn1.js-rfc5280"));
const oids_1 = require("./oids");
const rsassa_pss_parser_1 = require("./rsassa_pss_parser");
function digestVerifier(digestAlg) {
return (crl, issuerPublicKey) => {
const tbsEncoded = asn1_js_rfc5280_1.default.TBSCertList.encode(crl.tbsCertList, 'der');
return crypto_1.default.verify(digestAlg, tbsEncoded, issuerPublicKey, crl.signature.data);
};
}
function pssVerifier(crl, issuerPublicKey) {
const pssParams = (0, rsassa_pss_parser_1.parseRSASSAPSSParams)(crl.signatureAlgorithm.parameters);
const tbsEncoded = asn1_js_rfc5280_1.default.TBSCertList.encode(crl.tbsCertList, 'der');
return crypto_1.default.verify(pssParams.hashAlgorithm, tbsEncoded, {
key: issuerPublicKey,
padding: crypto_1.default.constants.RSA_PKCS1_PSS_PADDING,
saltLength: pssParams.saltLength,
}, crl.signature.data);
}
exports.CRL_SIGNATURE_VERIFIERS = {
[oids_1.ALGORITHM_OID.SHA256_WITH_RSA]: digestVerifier('sha256'),
[oids_1.ALGORITHM_OID.SHA384_WITH_RSA]: digestVerifier('sha384'),
[oids_1.ALGORITHM_OID.SHA512_WITH_RSA]: digestVerifier('sha512'),
[oids_1.ALGORITHM_OID.ECDSA_WITH_SHA256]: digestVerifier('sha256'),
[oids_1.ALGORITHM_OID.ECDSA_WITH_SHA384]: digestVerifier('sha384'),
[oids_1.ALGORITHM_OID.ECDSA_WITH_SHA512]: digestVerifier('sha512'),
[oids_1.ALGORITHM_OID.RSASSA_PSS]: pssVerifier,
};
function isCrlSignatureValid(crl, issuerPublicKey) {
const signatureAlgOid = crl.signatureAlgorithm.algorithm.join('.');
const verifier = exports.CRL_SIGNATURE_VERIFIERS[signatureAlgOid];
if (!verifier) {
throw new Error(`Unsupported signature algorithm: ${signatureAlgOid}`);
}
return verifier(crl, issuerPublicKey);
}
//# sourceMappingURL=crl_signature_verifier.js.map