Struct VerifierLookup 

pub struct VerifierLookup<'a> {
    index: CertLookup<'a>,
}

An abstraction over a set of OpenpgpCert, to facilitate signature verification.

It can efficiently look up component keys that are appropriate for attempting validation of specific signatures.

Fields

index: CertLookup<'a>

Implementations

impl<'a> VerifierLookup<'a>

const CERTIFICATION_SIGNATURE_TYPES: &'static [SignatureType]

The signature types that we consider meaningful for certifications on identities.

Note that the set excludes SignatureType::CertPersona which is specified to not carry any meaningful information.

pub fn new(certs: &'a [OpenpgpCert]) -> Self

Creates a new VerifierLookup from a list of OpenpgpCerts.

pub(crate) fn get_matching_verifiers( &self, signature: &OpenpgpSignature, ) -> Vec<(SignatureVerifier, &'a OpenpgpCert)>

Returns a list of [SignatureVerifier] and OpenpgpCert tuples, that are reasonable candidates for attempting to verify an OpenpgpSignature.

Looks up all component keys that match the IssuerFingerprint and/or Issuer subpackets in signature, and returns them as [SignatureVerifier] objects. For informational purposes, each [SignatureVerifier] is accompanied by a reference to the OpenpgpCert that contains it.

Callers of this function will usually want to validate signature with the returned [SignatureVerifier]s.

fn candidate_certs(&self, signature: &Signature) -> Vec<&'a OpenpgpCert>

Returns a list of OpenpgpCerts that match either the IssuerFingerprint or IssuerKeyId subpackets in a [Signature].

All component keys of each OpenpgpCert are considered when matching against the IssuerFingerprint and IssuerKeyId subpackets of the signature. The returned OpenpgpCerts are deduplicated by their primary [Fingerprint].

Note

The lookup does not enforce any semantics constraints. It does not guarantee validity of certificates or component keys for any particular purpose. Semantics checks must be performed separately, after this lookup.

fn matches_issuer( signature: &OpenpgpSignature, verifier: &SignatureVerifier, ) -> bool

Checks if a [SignatureVerifier] matches any IssuerFingerprint or Issuer subpacket in an OpenpgpSignature.

pub fn valid_userid_certifications( &self, signatures: &[&'a Signature], target: &OpenpgpCert, target_user: &UserId, reference_time: SystemTime, ) -> Vec<(&'a OpenpgpCert, Vec<&'a Signature>)>

Returns pairs of OpenpgpCert and [Signature]s for third-party UserId certifications.

Filters signatures (a slice of third-party certifications over target and target_user) by policy, as well as temporal and cryptographic validity (at reference_time). The validated signatures are grouped by signer certificate.

Notes

• A certifying signature must pass [rpgpie]’s policy checks (i.e. cryptographic mechanisms that are considered weak at signature creation time are rejected).
• If a certifying signature has a “signature expiration time” that is after the reference time, that certifying signature is ignored (except for certification revocation signatures, which may not expire).
• The certifying signature may be younger than the data signature that is authenticated.
• The certifying certificate may be younger than the data signature that is authenticated.

fn lookup_third_party_certifier( &self, sig: &Signature, target: &OpenpgpCert, target_user: &UserId, ) -> Option<&'a OpenpgpCert>

Returns a matching OpenpgpCert for a third-party certification over a [UserId].

The considered certificate must be cryptographically valid and must have issued sig as a (third-party) certification over target and target_user.

If a signer is found, a reference to it is returned, otherwise None.

Trait Implementations

impl<'a> Debug for VerifierLookup<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> FromIterator<&'a OpenpgpCert> for VerifierLookup<'a>

fn from_iter<T: IntoIterator<Item = &'a OpenpgpCert>>(iter: T) -> Self

Creates a value from an iterator.