Merge pull request #1196 from sigstore/HashAlgorithmInVerifiers

Pipe algorithm registry into verifiers

Author: loosebazooka

sigstore-java/src/main/java/dev/sigstore/encryption/signers/EcdsaVerifier.java

@@ -15,15 +15,18 @@
  */
 package dev.sigstore.encryption.signers;
 
+import dev.sigstore.AlgorithmRegistry;
 import java.security.*;
 
 /** ECDSA verifier, instantiated by {@link Verifiers#newVerifier(PublicKey)}. */
 public class EcdsaVerifier implements Verifier {
 
   private final PublicKey publicKey;
+  private final AlgorithmRegistry.HashAlgorithm hashAlgorithm;
 
-  EcdsaVerifier(PublicKey publicKey) {
+  EcdsaVerifier(PublicKey publicKey, AlgorithmRegistry.HashAlgorithm hashAlgorithm) {
     this.publicKey = publicKey;
+    this.hashAlgorithm = hashAlgorithm;
   }
 
   @Override
@@ -34,7 +37,7 @@ public PublicKey getPublicKey() {
   @Override
   public boolean verify(byte[] artifact, byte[] signature)
       throws NoSuchAlgorithmException, InvalidKeyException, SignatureException {
-    var verifier = Signature.getInstance("SHA256withECDSA");
+    var verifier = Signature.getInstance(hashAlgorithm + "withECDSA");
     verifier.initVerify(publicKey);
     verifier.update(artifact);
     return verifier.verify(signature);

sigstore-java/src/main/java/dev/sigstore/encryption/signers/RsaVerifier.java

@@ -15,15 +15,18 @@
  */
 package dev.sigstore.encryption.signers;
 
+import dev.sigstore.AlgorithmRegistry;
 import java.security.*;
 
 /** RSA verifier, instantiated by {@link Verifiers#newVerifier(PublicKey)}. */
 public class RsaVerifier implements Verifier {
 
   private final PublicKey publicKey;
+  private final AlgorithmRegistry.HashAlgorithm hashAlgorithm;
 
-  RsaVerifier(PublicKey publicKey) {
+  RsaVerifier(PublicKey publicKey, AlgorithmRegistry.HashAlgorithm hashAlgorithm) {
     this.publicKey = publicKey;
+    this.hashAlgorithm = hashAlgorithm;
   }
 
   @Override
@@ -34,7 +37,7 @@ public PublicKey getPublicKey() {
   @Override
   public boolean verify(byte[] artifact, byte[] signature)
       throws NoSuchAlgorithmException, InvalidKeyException, SignatureException {
-    var verifier = Signature.getInstance("SHA256withRSA");
+    var verifier = Signature.getInstance(hashAlgorithm + "withRSA");
     verifier.initVerify(publicKey);
     verifier.update(artifact);
     return verifier.verify(signature);

sigstore-java/src/main/java/dev/sigstore/encryption/signers/Verifiers.java

@@ -15,6 +15,7 @@
  */
 package dev.sigstore.encryption.signers;
 
+import dev.sigstore.AlgorithmRegistry;
 import java.security.NoSuchAlgorithmException;
 import java.security.PublicKey;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
@@ -25,10 +26,10 @@ public class Verifiers {
   /** Returns a new verifier for the provided public key to use during verification. */
   public static Verifier newVerifier(PublicKey publicKey) throws NoSuchAlgorithmException {
     if (publicKey.getAlgorithm().equals("RSA")) {
-      return new RsaVerifier(publicKey);
+      return new RsaVerifier(publicKey, AlgorithmRegistry.HashAlgorithm.SHA2_256);
     }
     if (publicKey.getAlgorithm().equals("EC") || publicKey.getAlgorithm().equals("ECDSA")) {
-      return new EcdsaVerifier(publicKey);
+      return new EcdsaVerifier(publicKey, AlgorithmRegistry.HashAlgorithm.SHA2_256);
     }
     if (publicKey.getAlgorithm().equals("Ed25519")) {
       return new Ed25519Verifier(publicKey);