29 lines
1.7 KiB
Plaintext
29 lines
1.7 KiB
Plaintext
:sig
|
|
DValue crypto_operation(DValue request)
|
|
|
|
:params
|
|
request : structured operation, algorithm, and operation-specific fields
|
|
return value : map with ok, bounded error code, and operation-specific output
|
|
|
|
:content
|
|
Runs one explicitly supported structured asymmetric cryptographic operation. The initial allowlist is `key_generate` with `ES256` and `jwt_sign` with `ES256`. Unknown operations and algorithms fail closed.
|
|
|
|
ES256 signing validates that `x`, `y`, and `d` form one P-256 key, forces the protected `alg` to `ES256`, and emits a compact JWT with a 64-byte JOSE signature. Requests are capped at 32 KiB; `cbor_decode` accepts at most 16 KiB decoded CBOR (21,846 canonical base64url characters), 256 nodes, and depth 16. CBOR is definite-length only, validates UTF-8 text, preserves typed map keys, rejects structurally duplicate keys and trailing bytes, and reports malformed CBOR as `invalid_cbor`. Header and claims roots must be JSON objects containing valid UTF-8 without raw control bytes.
|
|
|
|
This function does not replace typed digest, HMAC, password, randomness, or constant-time comparison APIs. It exposes no raw signing, arbitrary curve/digest selection, encryption, or generic OpenSSL access. Keep returned private JWKs secret.
|
|
|
|
:example
|
|
DValue key_request;
|
|
key_request["operation"] = "key_generate";
|
|
key_request["algorithm"] = "ES256";
|
|
DValue key = crypto_operation(key_request);
|
|
|
|
DValue sign_request;
|
|
sign_request["operation"] = "jwt_sign";
|
|
sign_request["algorithm"] = "ES256";
|
|
sign_request["private_jwk"] = key["private_jwk"];
|
|
sign_request["protected_header"]["typ"] = "JWT";
|
|
sign_request["claims"]["iss"] = "https://client.example";
|
|
DValue signed_jwt = crypto_operation(sign_request);
|
|
print(signed_jwt["ok"].to_bool() ? "signed" : "failed", "\n");
|