// Implements the JOSE Opaque Signer Interface. This enables signing
// the attestation report with hardware-based keys (such as TPM-based keys)
Implements the JOSE Opaque Signer Interface. This enables signing
the attestation report with hardware-based keys (such as TPM-based keys)
// Implements the JOSE Opaque Signer Interface . This enables signing // the attestation report with hardware - based keys ( such as TPM - based keys )
func (hws *hwSigner) SignPayload(payload []byte, alg jose.SignatureAlgorithm) ([]byte, error) {
	var keySize int
	var opts crypto.SignerOpts
	switch alg {
		case jose.RS256, jose.ES256: 
		keySize = 32 
		opts = crypto.SHA256
	case jose.PS256: 
		opts = &rsa.PSSOptions{SaltLength: 32, Hash: crypto.SHA256}
	case jose.RS384, jose.ES384: 
		keySize = 48
		opts = crypto.SHA384
	case jose.PS384: 
		opts = &rsa.PSSOptions{SaltLength: 48, Hash: crypto.SHA384}
	case jose.RS512, jose.ES512: 
		keySize = 66 
		opts = crypto.SHA512
	case jose.PS512: 
		opts = &rsa.PSSOptions{SaltLength: 64, Hash: crypto.SHA512}
	default:
		return nil, errors.New("Signing failed: Could not determine appropriate hash type")
	}
	hasher := opts.HashFunc().New()
	_, _ = hasher.Write(payload)
	hashed := hasher.Sum(nil)
	switch alg {
	case jose.ES256, jose.ES384, jose.ES512:
		asn1Sig, err := hws.signer.(crypto.Signer).Sign(rand.Reader, hashed, opts)
		if err != nil {
			return nil, err
		}
		type ecdsasig struct {
			R *big.Int
			S *big.Int
		}
		var esig ecdsasig
		ret := make([]byte, 2 * keySize)
		_, err = asn1.Unmarshal(asn1Sig, &esig)
		if err != nil {
			return nil, errors.New("ECDSA Signature was not in expected format.")
		}
		rBytes := esig.R.Bytes()
		sBytes := esig.S.Bytes()
		copy(ret[keySize - len(rBytes) : keySize], rBytes)
		copy(ret[2 * keySize - len(sBytes) : 2 * keySize], sBytes)
		return ret, nil
	default:
		return hws.signer.(crypto.Signer).Sign(rand.Reader, hashed, opts)
	}
}
func ( hws * hwSigner ) SignPayload ( payload [ ] byte , alg jose . SignatureAlgorithm ) ( [ ] byte , error ) { var keySize int var opts crypto . SignerOpts switch alg { case jose . RS256 , jose . ES256 : keySize = 32 opts = crypto . SHA256 case jose . PS256 : opts = & rsa . PSSOptions { SaltLength : 32 , Hash : crypto . SHA256 } case jose . RS384 , jose . ES384 : keySize = 48 opts = crypto . SHA384 case jose . PS384 : opts = & rsa . PSSOptions { SaltLength : 48 , Hash : crypto . SHA384 } case jose . RS512 , jose . ES512 : keySize = 66 opts = crypto . SHA512 case jose . PS512 : opts = & rsa . PSSOptions { SaltLength : 64 , Hash : crypto . SHA512 } default : return nil , errors . New ( " " ) } hasher := opts . HashFunc ( ) . New ( ) _ , _ = hasher . Write ( payload ) hashed := hasher . Sum ( nil ) switch alg { case jose . ES256 , jose . ES384 , jose . ES512 : asn1Sig , err := hws . signer . ( crypto . Signer ) . Sign ( rand . Reader , hashed , opts ) if err != nil { return nil , err } type ecdsasig struct { R * big . Int S * big . Int } var esig ecdsasig ret := make ( [ ] byte , 2 * keySize ) _ , err = asn1 . Unmarshal ( asn1Sig , & esig ) if err != nil { return nil , errors . New ( " " ) } rBytes := esig . R . Bytes ( ) sBytes := esig . S . Bytes ( ) copy ( ret [ keySize - len ( rBytes ) : keySize ] , rBytes ) copy ( ret [ 2 * keySize - len ( sBytes ) : 2 * keySize ] , sBytes ) return ret , nil default : return hws . signer . ( crypto . Signer ) . Sign ( rand . Reader , hashed , opts ) } }
Implements the JOSE Opaque Signer Interface.
Implements the JOSE Opaque Signer Interface .
// EC-specific: key size in byte for later padding // Determine hash / SignerOpts from algorithm // RSA, ECDSA with SHA256 // 256 bit // RSA PSS with SHA256 // we force default saltLengths, same as x509 and TPM2.0 // RSA, ECDSA with SHA384 // RSA PSS with SHA384 // RSA, ECDSA with SHA512 // 521 bit + padding // RSA PSS with SHA512 // Hash payload // According to documentation, Write() on hash never fails // sign payload // Obtain signature // Convert from asn1 format (as specified in crypto) to concatenated and padded format for go-jose // Fill return buffer with padded keys // The return format of all other signatures does not need to be adapted for go-jose