Method verify

ra-tls/src/cert.rs:231–248

Verifies the signature of the CSR. # Arguments `signature` - The signature bytes to verify against the CSR data. # Returns `Ok(())` if the signature is valid and the magic string matches. # Errors Returns an error if: - The public key cannot be parsed - The algorithm is not ECDSA P-256 - The signature is invalid - The magic string does not match "please sign cert:"

(&self, signature: &[u8])

    /// - The signature is invalid
    /// - The magic string does not match "please sign cert:"
    fn verify(&self, signature: &[u8]) -> Result<()> {
        let encoded = self.data_to_sign();
        let (_rem, pki) =
            SubjectPublicKeyInfo::from_der(self.pubkey()).context("Failed to parse pubkey")?;
        let parsed_pki = pki.parsed().context("Failed to parse pki")?;
        if !matches!(parsed_pki, PublicKey::EC(_)) {
            bail!("Unsupported algorithm");
        }
        let key = UnparsedPublicKey::new(&ECDSA_P256_SHA256_ASN1, &pki.subject_public_key.data);
        // verify signature
        key.verify(&encoded, signature)
            .ok()
            .context("Invalid signature")?;
        if self.magic() != "please sign cert:" {
            bail!("Invalid confirm word");
        }
        Ok(())
    }

    /// Returns the data that should be signed or verified.
    ///