From 79f8b70d71af9abc70030f2aa5d13b53bdd50810 Mon Sep 17 00:00:00 2001 From: "nikita.kalinichenko" Date: Wed, 11 Oct 2023 02:16:30 +0300 Subject: [PATCH 1/5] Added CKM_AES_CBC_ENCRYPT_DATA; Added CKM_GENERIC_SECRET_KEY_GEN; Added prettier `MechanismInfo` fmt. Signed-off-by: nikita.kalinichenko --- cryptoki/src/mechanism/ekdf.rs | 55 ++++++++++++++++++++++++ cryptoki/src/mechanism/mechanism_info.rs | 19 +++++++- cryptoki/src/mechanism/mod.rs | 53 +++++++++++++++++------ 3 files changed, 113 insertions(+), 14 deletions(-) create mode 100644 cryptoki/src/mechanism/ekdf.rs diff --git a/cryptoki/src/mechanism/ekdf.rs b/cryptoki/src/mechanism/ekdf.rs new file mode 100644 index 00000000..940f58e9 --- /dev/null +++ b/cryptoki/src/mechanism/ekdf.rs @@ -0,0 +1,55 @@ +// Copyright 2021 Contributors to the Parsec project. +// SPDX-License-Identifier: Apache-2.0 +//! Mechanisms of key derivation by data encryption +//! See: https://docs.oasis-open.org/pkcs11/pkcs11-spec/v3.1/os/pkcs11-spec-v3.1-os.html#_Toc111203514 + +use std::{convert::TryInto, marker::PhantomData, slice}; + +/// AES CBC derivation parameters. +/// +/// The mechanisms will function by performing the encryption over the data provided using the base +/// key. The resulting cipher text shall be used to create the key value of the resulting key. +/// +/// This structure wraps a `CK_AES_CBC_ENCRYPT_DATA_PARAMS` structure. +#[derive(Debug, Clone, Copy)] +#[repr(transparent)] +pub struct AesCbcDeriveParams<'a> { + inner: cryptoki_sys::CK_AES_CBC_ENCRYPT_DATA_PARAMS, + + /// Marker type to ensure we don't outlive the data + _marker: PhantomData<&'a [u8]>, +} + +impl<'a> AesCbcDeriveParams<'a> { + /// Construct parameters for key derivation via encryption (EKDF). + /// + /// # Arguments + /// + /// * `iv` - The initialization vector + /// + /// * `data` - Data that will be encryption with the base key to obtain + /// the new key from the resulted cypher. + pub fn new(iv: [u8; 16], data: &'a [u8]) -> Self { + Self { + inner: cryptoki_sys::CK_AES_CBC_ENCRYPT_DATA_PARAMS { + iv, + pData: data.as_ptr() as *mut _, + length: data + .len() + .try_into() + .expect("data length does not fit in CK_ULONG"), + }, + _marker: PhantomData, + } + } + + /// The initialization vector. + pub fn iv(&self) -> &'a [u8] { + unsafe { slice::from_raw_parts(self.inner.iv.as_ptr(), self.inner.iv.len()) } + } + + /// The data. + pub fn data(&self) -> &'a [u8] { + unsafe { slice::from_raw_parts(self.inner.pData, self.inner.length as _) } + } +} diff --git a/cryptoki/src/mechanism/mechanism_info.rs b/cryptoki/src/mechanism/mechanism_info.rs index 8f49561b..075c1486 100644 --- a/cryptoki/src/mechanism/mechanism_info.rs +++ b/cryptoki/src/mechanism/mechanism_info.rs @@ -4,7 +4,7 @@ use bitflags::bitflags; use cryptoki_sys::*; -use std::fmt::Debug; +use std::fmt::{Debug, Formatter}; bitflags! { struct MechanismInfoFlags: CK_FLAGS { @@ -219,6 +219,23 @@ impl MechanismInfo { } } +impl std::fmt::Display for MechanismInfo { + fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result { + let flags = format!("{0:#?}", self.flags); + let key_size_info = match self.min_key_size == 0 && self.max_key_size == 0 { + true => String::new(), + false => { + if self.max_key_size == 0 { + format!(", min_key_size={}", self.min_key_size) + } else { + format!(", min_key_size={}, max_key_size={}", self.min_key_size, self.max_key_size) + } + } + }; + write!(f, "{}{}", flags, key_size_info) + } +} + #[doc(hidden)] impl From for MechanismInfo { fn from(val: CK_MECHANISM_INFO) -> Self { diff --git a/cryptoki/src/mechanism/mod.rs b/cryptoki/src/mechanism/mod.rs index e6bed66e..e9684341 100644 --- a/cryptoki/src/mechanism/mod.rs +++ b/cryptoki/src/mechanism/mod.rs @@ -6,6 +6,7 @@ pub mod aead; pub mod elliptic_curve; mod mechanism_info; pub mod rsa; +pub mod ekdf; use crate::error::Error; use cryptoki_sys::*; @@ -17,6 +18,7 @@ use std::ops::Deref; use std::ptr::null_mut; pub use mechanism_info::MechanismInfo; +use crate::mechanism::rsa::{PkcsOaepParams, PkcsOaepSource}; #[derive(Copy, Debug, Clone, PartialEq, Eq)] // transparent so that a vector of MechanismType should have the same layout than a vector of @@ -64,6 +66,9 @@ impl MechanismType { /// AES-GCM mechanism pub const AES_GCM: MechanismType = MechanismType { val: CKM_AES_GCM }; + /// Derivation via encryption + pub const AES_CBC_ENCRYPT_DATA: MechanismType = MechanismType { val: CKM_AES_CBC_ENCRYPT_DATA }; + // RSA /// PKCS #1 RSA key pair generation mechanism pub const RSA_PKCS_KEY_PAIR_GEN: MechanismType = MechanismType { @@ -241,6 +246,10 @@ impl MechanismType { pub const SHA512_RSA_PKCS_PSS: MechanismType = MechanismType { val: CKM_SHA512_RSA_PKCS_PSS, }; + /// GENERIC-SECRET-KEY-GEN mechanism + pub const GENERIC_SECRET_KEY_GEN: MechanismType = MechanismType{ + val: CKM_GENERIC_SECRET_KEY_GEN + }; pub(crate) fn stringify(mech: CK_MECHANISM_TYPE) -> String { match mech { @@ -629,6 +638,7 @@ impl TryFrom for MechanismType { fn try_from(mechanism_type: CK_MECHANISM_TYPE) -> Result { match mechanism_type { CKM_AES_KEY_GEN => Ok(MechanismType::AES_KEY_GEN), + CKM_AES_CBC_ENCRYPT_DATA => Ok(MechanismType::AES_CBC_ENCRYPT_DATA), CKM_RSA_PKCS_KEY_PAIR_GEN => Ok(MechanismType::RSA_PKCS_KEY_PAIR_GEN), CKM_RSA_PKCS => Ok(MechanismType::RSA_PKCS), CKM_RSA_PKCS_PSS => Ok(MechanismType::RSA_PKCS_PSS), @@ -648,6 +658,7 @@ impl TryFrom for MechanismType { CKM_SHA256_RSA_PKCS => Ok(MechanismType::SHA256_RSA_PKCS), CKM_SHA384_RSA_PKCS => Ok(MechanismType::SHA384_RSA_PKCS), CKM_SHA512_RSA_PKCS => Ok(MechanismType::SHA512_RSA_PKCS), + CKM_GENERIC_SECRET_KEY_GEN => Ok(MechanismType::GENERIC_SECRET_KEY_GEN), other => { error!("Mechanism type {} is not supported.", other); Err(Error::NotSupported) @@ -689,6 +700,14 @@ pub enum Mechanism<'a> { AesKeyWrapPad, /// AES-GCM mechanism AesGcm(aead::GcmParams<'a>), + /// AES-CBC-ENCRYPT-DATA mechanism + /// + /// The parameter to this mechanism is the initialization vector and the message to encrypt. These mechanisms allow + /// derivation of keys using the result of an encryption operation as the key value. + /// + /// For derivation, the message length must be a multiple of the block + /// size. See https://www.cryptsoft.com/pkcs11doc/v220/ + AesCbcEncryptData(ekdf::AesCbcDeriveParams<'a>), // RSA /// PKCS #1 RSA key pair generation mechanism @@ -701,7 +720,7 @@ pub enum Mechanism<'a> { RsaPkcsPss(rsa::PkcsPssParams), /// Multi-purpose mechanism based on the RSA public-key cryptosystem and the OAEP block format /// defined in PKCS #1 - RsaPkcsOaep(rsa::PkcsOaepParams<'a>), + RsaPkcsOaep(PkcsOaepParams<'a>), /// Multi-purpose mechanism based on the RSA public-key cryptosystem. This is so-called "raw" /// RSA, as assumed in X.509. RsaX509, @@ -816,6 +835,9 @@ pub enum Mechanism<'a> { Sha384RsaPkcsPss(rsa::PkcsPssParams), /// SHA256-RSA-PKCS-PSS mechanism Sha512RsaPkcsPss(rsa::PkcsPssParams), + + /// GENERIC-SECRET-KEY-GEN mechanism + GenericSecretKeyGen } impl Mechanism<'_> { @@ -829,7 +851,7 @@ impl Mechanism<'_> { Mechanism::AesKeyWrap => MechanismType::AES_KEY_WRAP, Mechanism::AesKeyWrapPad => MechanismType::AES_KEY_WRAP_PAD, Mechanism::AesGcm(_) => MechanismType::AES_GCM, - + Mechanism::AesCbcEncryptData(_) =>MechanismType::AES_CBC_ENCRYPT_DATA, Mechanism::RsaPkcsKeyPairGen => MechanismType::RSA_PKCS_KEY_PAIR_GEN, Mechanism::RsaPkcs => MechanismType::RSA_PKCS, Mechanism::RsaPkcsPss(_) => MechanismType::RSA_PKCS_PSS, @@ -874,6 +896,8 @@ impl Mechanism<'_> { Mechanism::Sha256RsaPkcsPss(_) => MechanismType::SHA256_RSA_PKCS_PSS, Mechanism::Sha384RsaPkcsPss(_) => MechanismType::SHA384_RSA_PKCS_PSS, Mechanism::Sha512RsaPkcsPss(_) => MechanismType::SHA512_RSA_PKCS_PSS, + + Mechanism::GenericSecretKeyGen => MechanismType::GENERIC_SECRET_KEY_GEN } } } @@ -883,9 +907,13 @@ impl From<&Mechanism<'_>> for CK_MECHANISM { let mechanism = mech.mechanism_type().into(); match mech { // Mechanisms with parameters - Mechanism::AesCbc(params) | Mechanism::AesCbcPad(params) => { + Mechanism::AesCbc(params) + | Mechanism::AesCbcPad(params) => { make_mechanism(mechanism, params) - } + }, + Mechanism::AesCbcEncryptData(params) => { + make_mechanism(mechanism, params) + }, Mechanism::DesCbc(params) | Mechanism::Des3Cbc(params) | Mechanism::DesCbcPad(params) @@ -936,7 +964,8 @@ impl From<&Mechanism<'_>> for CK_MECHANISM { | Mechanism::Sha224RsaPkcs | Mechanism::Sha256RsaPkcs | Mechanism::Sha384RsaPkcs - | Mechanism::Sha512RsaPkcs => CK_MECHANISM { + | Mechanism::Sha512RsaPkcs + | Mechanism::GenericSecretKeyGen => CK_MECHANISM { mechanism, pParameter: null_mut(), ulParameterLen: 0, @@ -961,7 +990,7 @@ fn make_mechanism(mechanism: CK_MECHANISM_TYPE, param: &T) -> CK_MECHANISM { #[cfg(feature = "psa-crypto-conversions")] #[allow(deprecated)] -impl TryFrom for Mechanism { +impl TryFrom for Mechanism<'_> { type Error = Error; fn try_from(alg: psa_crypto::types::algorithm::Algorithm) -> Result { @@ -989,13 +1018,11 @@ impl TryFrom for Mechanism { Ok(Mechanism::Ecdsa) } Algorithm::AsymmetricEncryption(AsymmetricEncryption::RsaOaep { hash_alg }) => { - Ok(Mechanism::RsaPkcsOaep(rsa::PkcsOaepParams { - hash_alg: Mechanism::try_from(Algorithm::from(hash_alg))?.mechanism_type(), - mgf: rsa::PkcsMgfType::from_psa_crypto_hash(hash_alg)?, - source: rsa::PkcsOaepSourceType::DATA_SPECIFIED, - source_data: std::ptr::null(), - source_data_len: 0.into(), - })) + Ok(Mechanism::RsaPkcsOaep(PkcsOaepParams::new( + Mechanism::try_from(Algorithm::from(hash_alg))?.mechanism_type(), + rsa::PkcsMgfType::from_psa_crypto_hash(hash_alg)?, + PkcsOaepSource::empty(), + ))) } alg => { error!("{:?} is not a supported algorithm", alg); From 99c515f0352375cbb4ad2523c9fc56056c4e6507 Mon Sep 17 00:00:00 2001 From: "nikita.kalinichenko" Date: Thu, 12 Oct 2023 01:15:55 +0300 Subject: [PATCH 2/5] fix formatting and docs Signed-off-by: nikita.kalinichenko --- cryptoki/src/mechanism/ekdf.rs | 2 +- cryptoki/src/mechanism/mechanism_info.rs | 6 +++-- cryptoki/src/mechanism/mod.rs | 31 ++++++++++++------------ 3 files changed, 20 insertions(+), 19 deletions(-) diff --git a/cryptoki/src/mechanism/ekdf.rs b/cryptoki/src/mechanism/ekdf.rs index 940f58e9..b8a41e53 100644 --- a/cryptoki/src/mechanism/ekdf.rs +++ b/cryptoki/src/mechanism/ekdf.rs @@ -1,7 +1,7 @@ // Copyright 2021 Contributors to the Parsec project. // SPDX-License-Identifier: Apache-2.0 //! Mechanisms of key derivation by data encryption -//! See: https://docs.oasis-open.org/pkcs11/pkcs11-spec/v3.1/os/pkcs11-spec-v3.1-os.html#_Toc111203514 +//! See: use std::{convert::TryInto, marker::PhantomData, slice}; diff --git a/cryptoki/src/mechanism/mechanism_info.rs b/cryptoki/src/mechanism/mechanism_info.rs index 075c1486..7372f1d2 100644 --- a/cryptoki/src/mechanism/mechanism_info.rs +++ b/cryptoki/src/mechanism/mechanism_info.rs @@ -79,7 +79,6 @@ impl MechanismInfo { } /// True if the mechanism can be used to digest a message - /// // TODO See [`Session::digest`](crate::session::Session::digest) pub fn digest(&self) -> bool { self.flags.contains(MechanismInfoFlags::DIGEST) @@ -228,7 +227,10 @@ impl std::fmt::Display for MechanismInfo { if self.max_key_size == 0 { format!(", min_key_size={}", self.min_key_size) } else { - format!(", min_key_size={}, max_key_size={}", self.min_key_size, self.max_key_size) + format!( + ", min_key_size={}, max_key_size={}", + self.min_key_size, self.max_key_size + ) } } }; diff --git a/cryptoki/src/mechanism/mod.rs b/cryptoki/src/mechanism/mod.rs index e9684341..a85d7a36 100644 --- a/cryptoki/src/mechanism/mod.rs +++ b/cryptoki/src/mechanism/mod.rs @@ -3,10 +3,10 @@ //! Data types for mechanisms pub mod aead; +pub mod ekdf; pub mod elliptic_curve; mod mechanism_info; pub mod rsa; -pub mod ekdf; use crate::error::Error; use cryptoki_sys::*; @@ -17,8 +17,8 @@ use std::fmt::Formatter; use std::ops::Deref; use std::ptr::null_mut; +use crate::mechanism::rsa::PkcsOaepParams; pub use mechanism_info::MechanismInfo; -use crate::mechanism::rsa::{PkcsOaepParams, PkcsOaepSource}; #[derive(Copy, Debug, Clone, PartialEq, Eq)] // transparent so that a vector of MechanismType should have the same layout than a vector of @@ -67,7 +67,9 @@ impl MechanismType { pub const AES_GCM: MechanismType = MechanismType { val: CKM_AES_GCM }; /// Derivation via encryption - pub const AES_CBC_ENCRYPT_DATA: MechanismType = MechanismType { val: CKM_AES_CBC_ENCRYPT_DATA }; + pub const AES_CBC_ENCRYPT_DATA: MechanismType = MechanismType { + val: CKM_AES_CBC_ENCRYPT_DATA, + }; // RSA /// PKCS #1 RSA key pair generation mechanism @@ -247,8 +249,8 @@ impl MechanismType { val: CKM_SHA512_RSA_PKCS_PSS, }; /// GENERIC-SECRET-KEY-GEN mechanism - pub const GENERIC_SECRET_KEY_GEN: MechanismType = MechanismType{ - val: CKM_GENERIC_SECRET_KEY_GEN + pub const GENERIC_SECRET_KEY_GEN: MechanismType = MechanismType { + val: CKM_GENERIC_SECRET_KEY_GEN, }; pub(crate) fn stringify(mech: CK_MECHANISM_TYPE) -> String { @@ -706,7 +708,7 @@ pub enum Mechanism<'a> { /// derivation of keys using the result of an encryption operation as the key value. /// /// For derivation, the message length must be a multiple of the block - /// size. See https://www.cryptsoft.com/pkcs11doc/v220/ + /// size. See . AesCbcEncryptData(ekdf::AesCbcDeriveParams<'a>), // RSA @@ -837,7 +839,7 @@ pub enum Mechanism<'a> { Sha512RsaPkcsPss(rsa::PkcsPssParams), /// GENERIC-SECRET-KEY-GEN mechanism - GenericSecretKeyGen + GenericSecretKeyGen, } impl Mechanism<'_> { @@ -851,7 +853,7 @@ impl Mechanism<'_> { Mechanism::AesKeyWrap => MechanismType::AES_KEY_WRAP, Mechanism::AesKeyWrapPad => MechanismType::AES_KEY_WRAP_PAD, Mechanism::AesGcm(_) => MechanismType::AES_GCM, - Mechanism::AesCbcEncryptData(_) =>MechanismType::AES_CBC_ENCRYPT_DATA, + Mechanism::AesCbcEncryptData(_) => MechanismType::AES_CBC_ENCRYPT_DATA, Mechanism::RsaPkcsKeyPairGen => MechanismType::RSA_PKCS_KEY_PAIR_GEN, Mechanism::RsaPkcs => MechanismType::RSA_PKCS, Mechanism::RsaPkcsPss(_) => MechanismType::RSA_PKCS_PSS, @@ -897,7 +899,7 @@ impl Mechanism<'_> { Mechanism::Sha384RsaPkcsPss(_) => MechanismType::SHA384_RSA_PKCS_PSS, Mechanism::Sha512RsaPkcsPss(_) => MechanismType::SHA512_RSA_PKCS_PSS, - Mechanism::GenericSecretKeyGen => MechanismType::GENERIC_SECRET_KEY_GEN + Mechanism::GenericSecretKeyGen => MechanismType::GENERIC_SECRET_KEY_GEN, } } } @@ -907,13 +909,10 @@ impl From<&Mechanism<'_>> for CK_MECHANISM { let mechanism = mech.mechanism_type().into(); match mech { // Mechanisms with parameters - Mechanism::AesCbc(params) - | Mechanism::AesCbcPad(params) => { + Mechanism::AesCbc(params) | Mechanism::AesCbcPad(params) => { make_mechanism(mechanism, params) - }, - Mechanism::AesCbcEncryptData(params) => { - make_mechanism(mechanism, params) - }, + } + Mechanism::AesCbcEncryptData(params) => make_mechanism(mechanism, params), Mechanism::DesCbc(params) | Mechanism::Des3Cbc(params) | Mechanism::DesCbcPad(params) @@ -1021,7 +1020,7 @@ impl TryFrom for Mechanism<'_> { Ok(Mechanism::RsaPkcsOaep(PkcsOaepParams::new( Mechanism::try_from(Algorithm::from(hash_alg))?.mechanism_type(), rsa::PkcsMgfType::from_psa_crypto_hash(hash_alg)?, - PkcsOaepSource::empty(), + rsa::PkcsOaepSource::empty(), ))) } alg => { From 5a9d31c7ca28b79cc961abb7fed960d90978b416 Mon Sep 17 00:00:00 2001 From: "nikita.kalinichenko" Date: Fri, 13 Oct 2023 02:38:13 +0300 Subject: [PATCH 3/5] added tests for `CKM_AES_CBC_ENCRYPT_DATA` and `CKM_GENERIC_SECRET_KEY_GEN` Signed-off-by: nikita.kalinichenko --- cryptoki/tests/basic.rs | 82 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 82 insertions(+) diff --git a/cryptoki/tests/basic.rs b/cryptoki/tests/basic.rs index 3c363a75..e8ef33f7 100644 --- a/cryptoki/tests/basic.rs +++ b/cryptoki/tests/basic.rs @@ -15,6 +15,7 @@ use serial_test::serial; use std::collections::HashMap; use std::thread; +use cryptoki::mechanism::ekdf::AesCbcDeriveParams; use testresult::TestResult; #[test] @@ -1105,3 +1106,84 @@ fn wait_for_slot_event() { res ); } + +#[test] +#[serial] +fn generate_generic_secret_key() -> TestResult { + let (pkcs11, slot) = init_pins(); + let session = pkcs11.open_rw_session(slot)?; + session.login(UserType::User, Some(&AuthPin::new(USER_PIN.into())))?; + + let key_label = Attribute::Label(b"test_generic_secret_key_gen".to_vec()); + let key_template = vec![ + Attribute::Class(ObjectClass::SECRET_KEY), + Attribute::KeyType(KeyType::GENERIC_SECRET), + Attribute::Token(true), + Attribute::Sensitive(true), + Attribute::Private(true), + Attribute::ValueLen(512.into()), + key_label.clone(), + ]; + + let key = session.generate_key(&Mechanism::GenericSecretKeyGen, &key_template)?; + let attributes_result = session.find_objects(&[key_label])?.remove(0); + assert_eq!(key, attributes_result); + + Ok(()) +} + +#[test] +#[serial] +fn ekdf_aes_cbc_encrypt_data() -> TestResult { + let (pkcs11, slot) = init_pins(); + let session = pkcs11.open_rw_session(slot)?; + session.login(UserType::User, Some(&AuthPin::new(USER_PIN.into())))?; + + // key template + let key_template = vec![ + Attribute::Class(ObjectClass::SECRET_KEY), + Attribute::KeyType(KeyType::AES), + Attribute::Token(true), + Attribute::Sensitive(true), + Attribute::Private(true), + Attribute::ValueLen(32.into()), + Attribute::Derive(true), + ]; + + // generate master key + let master_key_label = Attribute::Label(b"test_aes_cbc_encrypt_data_master_key".to_vec()); + let mut master_key_template = key_template.clone(); + master_key_template.insert(0, master_key_label.clone()); + + let master_key = session.generate_key(&Mechanism::AesKeyGen, &master_key_template)?; + assert_eq!( + master_key, + session.find_objects(&[master_key_label])?.remove(0) + ); + + // generate a derived pair + let derived_key_label = Attribute::Label(b"test_aes_cbc_encrypt_data_child_key".to_vec()); + let mut derived_key_template = key_template.clone(); + derived_key_template.insert(0, derived_key_label.clone()); + + // ============================================== IMPORTANT ============================================== + // When using this derivation method in production, be aware that it's better to keep first bytes of data + // filled with actual data (e.g., derivation path) - this shall cause CBC mode to propagate randomness to + // remaining 128 bit-wide AES blocks. + // Otherwise, if filling only last bytes, you are risking to keep first N of 128 bit-wide chunks of your + // derived private key the same for all child keys. If deriving a key for 256-bit AES, this means half of + // the key to be static. + // ======================================================================================================= + let aes_cbc_derive_params = AesCbcDeriveParams::new([0u8; 16], [1u8; 32].as_slice()); + let derived_key = session.derive_key( + &Mechanism::AesCbcEncryptData(aes_cbc_derive_params), + master_key, + &derived_key_template, + )?; + assert_eq!( + derived_key, + session.find_objects(&[derived_key_label])?.remove(0) + ); + + Ok(()) +} From 437ccbdcbfaa431232080e292e690c455ad2960b Mon Sep 17 00:00:00 2001 From: "nikita.kalinichenko" Date: Sat, 14 Oct 2023 02:07:55 +0300 Subject: [PATCH 4/5] simplify `MechanismInfo` fmt Signed-off-by: nikita.kalinichenko --- cryptoki/src/mechanism/mechanism_info.rs | 28 +++++++++++------------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/cryptoki/src/mechanism/mechanism_info.rs b/cryptoki/src/mechanism/mechanism_info.rs index 7372f1d2..e0c757f0 100644 --- a/cryptoki/src/mechanism/mechanism_info.rs +++ b/cryptoki/src/mechanism/mechanism_info.rs @@ -220,21 +220,19 @@ impl MechanismInfo { impl std::fmt::Display for MechanismInfo { fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result { - let flags = format!("{0:#?}", self.flags); - let key_size_info = match self.min_key_size == 0 && self.max_key_size == 0 { - true => String::new(), - false => { - if self.max_key_size == 0 { - format!(", min_key_size={}", self.min_key_size) - } else { - format!( - ", min_key_size={}, max_key_size={}", - self.min_key_size, self.max_key_size - ) - } - } - }; - write!(f, "{}{}", flags, key_size_info) + write!(f, "{:#?}", self.flags)?; + + if self.min_key_size == 0 && self.max_key_size == 0 { + return Ok(()); + } + + write!(f, ", min_key_size={}", self.min_key_size)?; + + if self.max_key_size != 0 { + write!(f, ", max_key_size={}", self.max_key_size)?; + } + + Ok(()) } } From f21c57555fb8cf40d07c4a117e2a576b56a42969 Mon Sep 17 00:00:00 2001 From: Nikita Kalinichenko Date: Tue, 17 Oct 2023 23:35:13 +0300 Subject: [PATCH 5/5] Update cryptoki/src/mechanism/ekdf.rs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Accepting the suggested change in copyright notice; Co-authored-by: Ionuț Mihalcea Signed-off-by: nikita.kalinichenko --- cryptoki/src/mechanism/ekdf.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cryptoki/src/mechanism/ekdf.rs b/cryptoki/src/mechanism/ekdf.rs index b8a41e53..e8a3e05f 100644 --- a/cryptoki/src/mechanism/ekdf.rs +++ b/cryptoki/src/mechanism/ekdf.rs @@ -1,4 +1,4 @@ -// Copyright 2021 Contributors to the Parsec project. +// Copyright 2023 Contributors to the Parsec project. // SPDX-License-Identifier: Apache-2.0 //! Mechanisms of key derivation by data encryption //! See: