feat(rust/signed-doc): CBOR encoder using minicbor

rust/signed_doc/Cargo.toml

@@ -12,12 +12,13 @@ workspace = true
 
 [dependencies]
 catalyst-types = { version = "0.0.3", path = "../catalyst-types" }
+cbork-utils = { version = "0.0.1", path = "../cbork-utils" }
 
 anyhow = "1.0.95"
 serde = { version = "1.0.217", features = ["derive"] }
 serde_json = "1.0.134"
-coset = "0.3.8"
-minicbor = { version = "0.25.1", features = ["half"] }
+coset = { version = "0.3.8", features = ["std"] }
+minicbor = { version = "0.25.1", features = ["std", "half"] }
 brotli = "7.0.0"
 ed25519-dalek = { version = "2.1.1", features = ["rand_core", "pem"] }
 hex = "0.4.3"
@@ -29,6 +30,7 @@ futures = "0.3.31"
 ed25519-bip32 = "0.4.1" # used by the `mk_signed_doc` cli tool
 tracing = "0.1.40"
 thiserror = "2.0.11"
+indexmap = "2.9.0"
 
 [dev-dependencies]
 base64-url = "3.0.0"

rust/signed_doc/bins/mk_signed_doc.rs

@@ -9,7 +9,7 @@ use std::{
 };
 
 use anyhow::Context;
-use catalyst_signed_doc::{Builder, CatalystId, CatalystSignedDocument};
+use catalyst_signed_doc::{CatalystId, CatalystSignedDocument, CoseSignBuilder};
 use clap::Parser;
 
 fn main() {
@@ -66,7 +66,7 @@ impl Cli {
  // Possibly encode if Metadata has an encoding set.
  let payload = serde_json::to_vec(&json_doc)?;
  // Start with no signatures.
- let signed_doc = Builder::new()
+ let signed_doc = CoseSignBuilder::new()
  .with_decoded_content(payload)
  .with_json_metadata(metadata)?
  .build();

rust/signed_doc/src/cose_sign/helpers.rs

@@ -0,0 +1,101 @@
+use minicbor::{
+ bytes::{ByteArray, ByteSlice},
+ data::Tagged,
+ Encode as _,
+};
+
+use super::VecEncodeError;
+
+/// Encode headers using the provided cbor-encoded key-value pairs,
+/// conforming to the [RFC 8152 specification](https://datatracker.ietf.org/doc/html/rfc8152#autoid-8).
+pub fn encode_headers<'a, I>(iter: I) -> Vec<u8>
+where I: IntoIterator<Item = (&'a [u8], &'a [u8]), IntoIter: ExactSizeIterator> {
+ let mut encoder = minicbor::Encoder::new(vec![]);
+
+ let iter = iter.into_iter();
+ let map_len = u64::try_from(iter.len()).unwrap_or(u64::MAX);
+ encoder.map(map_len);
+
+ for (encoded_key, encoded_v) in iter {
+ // Writing a pre-encoded field of the map.
+ encoder.writer_mut().extend_from_slice(encoded_key);
+ encoder.writer_mut().extend_from_slice(encoded_v);
+ }
+
+ encoder.into_writer()
+}
+
+/// Encode a single protected `kid` header for the COSE Signature.
+///
+/// # Errors
+///
+/// - If encoding of the `kid` fails.
+pub fn encoed_kid_header(kid: &[u8]) -> Result<Vec<u8>, VecEncodeError> {
+ /// The KID label as per [RFC 8152 3.1 section](https://datatracker.ietf.org/doc/html/rfc8152#section-3.1).
+ pub const KID_LABEL: u8 = 4;
+
+ let mut encoder = minicbor::Encoder::new(vec![]);
+ // A map with a single `kid` field.
+ encoder.map(1u64)?.u8(KID_LABEL)?.bytes(kid)?;
+ Ok(encoder.into_writer())
+}
+
+/// Create a binary blob that will be signed. No support for unprotected headers.
+///
+/// Described in [section 2 of RFC 8152](https://datatracker.ietf.org/doc/html/rfc8152#section-2).
+pub fn encode_tbs_data(
+ protected_headers: &[u8], signature_header: &[u8], content: Option<&[u8]>,
+) -> Result<Vec<u8>, VecEncodeError> {
+ /// The context string as per [RFC 8152 section 4.4](https://datatracker.ietf.org/doc/html/rfc8152#section-4.4).
+ const SIGNATURE_CONTEXT: &str = "Signature";
+
+ minicbor::to_vec((
+ SIGNATURE_CONTEXT,
+ <&ByteSlice>::from(protected_headers),
+ <&ByteSlice>::from(signature_header),
+ ByteArray::from([]), // no aad.
+ <&ByteSlice>::from(content.unwrap_or(&[])), // allowing no payload (i.e. no content).
+ ))
+}
+
+/// Encode COSE signature.
+///
+/// Signature bytes should represent a cryptographic signature.
+pub fn encode_cose_signature(
+ protected_header: &[u8], signature_bytes: &[u8],
+) -> Result<Vec<u8>, VecEncodeError> {
+ minicbor::to_vec([
+ <&ByteSlice>::from(protected_header),
+ <&ByteSlice>::from(signature_bytes),
+ ])
+}
+
+/// Encode an array from an iterator of pre-encoded COSE Signature items.
+fn encode_cose_signature_array<S>(signatures: S) -> Result<Vec<u8>, VecEncodeError>
+where S: IntoIterator<Item: AsRef<[u8]>, IntoIter: ExactSizeIterator> {
+ let iter = signatures.into_iter();
+ let array_len = u64::try_from(iter.len().saturating_add(1)).unwrap_or(u64::MAX);
+ let mut encoder = minicbor::Encoder::new(vec![]);
+ encoder.array(array_len)?;
+ for signature in iter {
+ encoder.bytes(signature.as_ref())?;
+ }
+ Ok(encoder.into_writer())
+}
+
+/// Make cbor-encoded tagged [RFC9052-CoseSign](https://datatracker.ietf.org/doc/html/rfc9052).
+pub fn encode_cose_sign<W: minicbor::encode::Write, S>(
+ e: &mut minicbor::encode::Encoder<W>, protected: &[u8], payload: Option<&[u8]>, signatures: S,
+) -> Result<(), minicbor::encode::Error<W::Error>>
+where S: IntoIterator<Item: AsRef<[u8]>, IntoIter: ExactSizeIterator> {
+ /// From the table in [section 2 of RFC 8152](https://datatracker.ietf.org/doc/html/rfc8152#section-2).
+ const COSE_SIGN_TAG: u64 = 98;
+
+ let tagged_array = Tagged::<COSE_SIGN_TAG, _>::new((
+ <&ByteSlice>::from(protected),
+ ByteArray::from([]), // unprotected.
+ payload.map(<&ByteSlice>::from), // allowing `NULL`.
+ encode_cose_signature_array(signatures).map_err(minicbor::encode::Error::custom)?,
+ ));
+ tagged_array.encode(e, &mut ())
+}