Function verify [src]

This function verifies: That the subject's issuer is indeed the provided issuer. The time validity of the subject. The signature.

Prototype

pub fn verify(parsed_subject: Parsed, parsed_issuer: Parsed, now_sec: i64) VerifyError!void

Parameters

parsed_subject: Parsedparsed_issuer: Parsednow_sec: i64

Possible Errors

CertificateExpired

CertificateFieldHasInvalidLength

CertificateFieldHasWrongDataType

CertificateIssuerMismatch

CertificateNotYetValid

CertificatePublicKeyInvalid

CertificateSignatureAlgorithmMismatch

CertificateSignatureAlgorithmUnsupported

CertificateSignatureInvalid

CertificateSignatureInvalidLength

CertificateSignatureNamedCurveUnsupported

CertificateSignatureUnsupportedBitCount

Source

  pub fn verify(parsed_subject: Parsed, parsed_issuer: Parsed, now_sec: i64) VerifyError!void {
    // Check that the subject's issuer name matches the issuer's
    // subject name.
    if (!mem.eql(u8, parsed_subject.issuer(), parsed_issuer.subject())) {
        return error.CertificateIssuerMismatch;
    }

    if (now_sec < parsed_subject.validity.not_before)
        return error.CertificateNotYetValid;
    if (now_sec > parsed_subject.validity.not_after)
        return error.CertificateExpired;

    switch (parsed_subject.signature_algorithm) {
        inline .sha1WithRSAEncryption,
        .sha224WithRSAEncryption,
        .sha256WithRSAEncryption,
        .sha384WithRSAEncryption,
        .sha512WithRSAEncryption,
        => |algorithm| return verifyRsa(
            algorithm.Hash(),
            parsed_subject.message(),
            parsed_subject.signature(),
            parsed_issuer.pub_key_algo,
            parsed_issuer.pubKey(),
        ),

        inline .ecdsa_with_SHA224,
        .ecdsa_with_SHA256,
        .ecdsa_with_SHA384,
        .ecdsa_with_SHA512,
        => |algorithm| return verify_ecdsa(
            algorithm.Hash(),
            parsed_subject.message(),
            parsed_subject.signature(),
            parsed_issuer.pub_key_algo,
            parsed_issuer.pubKey(),
        ),

        .md2WithRSAEncryption, .md5WithRSAEncryption => {
            return error.CertificateSignatureAlgorithmUnsupported;
        },

        .curveEd25519 => return verifyEd25519(
            parsed_subject.message(),
            parsed_subject.signature(),
            parsed_issuer.pub_key_algo,
            parsed_issuer.pubKey(),
        ),
    }
}  