Specify signing algorithm in tests

httpsig.py

@@ -28,12 +28,41 @@ from utils import getSHA512
 from utils import localActorUrl
 
 
-def messageContentDigest(messageBodyJsonStr: str) -> str:
+def messageContentDigest(messageBodyJsonStr: str, digestAlgorithm: str) -> str:
+    """Returns the digest for the message body
+    """
     msg = messageBodyJsonStr.encode('utf-8')
-    hashResult = getSHA256(msg)
+    if digestAlgorithm == 'rsa-sha512' or \
+       digestAlgorithm == 'rsa-pss-sha512':
+        hashResult = getSHA512(msg)
+    else:
+        hashResult = getSHA256(msg)
     return base64.b64encode(hashResult).decode('utf-8')
 
 
+def getDigestPrefix(digestAlgorithm: str) -> str:
+    """Returns the prefix for the message body digest
+    """
+    if digestAlgorithm == 'rsa-sha512' or \
+       digestAlgorithm == 'rsa-pss-sha512':
+        return 'SHA-512'
+    return 'SHA-256'
+
+
+def getDigestAlgorithmFromHeaders(httpHeaders: {}) -> str:
+    """Returns the digest algorithm from http headers
+    """
+    digestStr = None
+    if httpHeaders.get('digest'):
+        digestStr = httpHeaders['digest']
+    elif httpHeaders.get('Digest'):
+        digestStr = httpHeaders['Digest']
+    if digestStr:
+        if digestStr.startswith('SHA-512'):
+            return 'rsa-sha512'
+    return 'rsa-sha256'
+
+
 def signPostHeaders(dateStr: str, privateKeyPem: str,
                     nickname: str,
                     domain: str, port: int,
@@ -41,10 +70,15 @@ def signPostHeaders(dateStr: str, privateKeyPem: str,
                     path: str,
                     httpPrefix: str,
                     messageBodyJsonStr: str,
-                    contentType: str) -> str:
+                    contentType: str,
+                    algorithm: str) -> str:
     """Returns a raw signature string that can be plugged into a header and
     used to verify the authenticity of an HTTP transmission.
     """
+    # it is assumed that the hash used for the digest will be the same
+    # as for the signature
+    digestAlgorithm = algorithm
+
     domain = getFullDomain(domain, port)
 
     toDomain = getFullDomain(toDomain, toPort)
@@ -65,13 +99,15 @@ def signPostHeaders(dateStr: str, privateKeyPem: str,
             'accept': contentType
         }
     else:
-        bodyDigest = messageContentDigest(messageBodyJsonStr)
+        bodyDigest = \
+            messageContentDigest(messageBodyJsonStr, digestAlgorithm)
+        digestPrefix = getDigestPrefix(digestAlgorithm)
         contentLength = len(messageBodyJsonStr)
         headers = {
             '(request-target)': f'post {path}',
             'host': toDomain,
             'date': dateStr,
-            'digest': f'SHA-256={bodyDigest}',
+            'digest': f'{digestPrefix}={bodyDigest}',
             'content-type': 'application/activity+json',
             'content-length': str(contentLength)
         }
@@ -100,7 +136,7 @@ def signPostHeaders(dateStr: str, privateKeyPem: str,
     # Put it into a valid HTTP signature format
     signatureDict = {
         'keyId': keyID,
-        'algorithm': 'rsa-sha256',
+        'algorithm': algorithm,
         'headers': ' '.join(signedHeaderKeys),
         'signature': signature
     }
@@ -122,6 +158,10 @@ def signPostHeadersNew(dateStr: str, privateKeyPem: str,
     used to verify the authenticity of an HTTP transmission.
     See https://tools.ietf.org/html/draft-ietf-httpbis-message-signatures
     """
+    # it is assumed that the hash used for the digest will be the same
+    # as for the signature
+    digestAlgorithm = algorithm
+
     domain = getFullDomain(domain, port)
 
     toDomain = getFullDomain(toDomain, toPort)
@@ -143,14 +183,15 @@ def signPostHeadersNew(dateStr: str, privateKeyPem: str,
             'date': dateStr
         }
     else:
-        bodyDigest = messageContentDigest(messageBodyJsonStr)
+        bodyDigest = messageContentDigest(messageBodyJsonStr, digestAlgorithm)
+        digestPrefix = getDigestPrefix(digestAlgorithm)
         contentLength = len(messageBodyJsonStr)
         headers = {
             '@request-target': f'post {path}',
             '@created': str(secondsSinceEpoch),
             'host': toDomain,
             'date': dateStr,
-            'digest': f'SHA-256={bodyDigest}',
+            'digest': f'{digestPrefix}={bodyDigest}',
             'content-type': 'application/activity+json',
             'content-length': str(contentLength)
         }
@@ -210,6 +251,8 @@ def createSignedHeader(dateStr: str, privateKeyPem: str, nickname: str,
                        contentType: str) -> {}:
     """Note that the domain is the destination, not the sender
     """
+    algorithm = 'rsa-sha256'
+    digestAlgorithm = 'rsa-sha256'
     headerDomain = getFullDomain(toDomain, toPort)
 
     # if no date is given then create one
@@ -230,15 +273,17 @@ def createSignedHeader(dateStr: str, privateKeyPem: str, nickname: str,
         signatureHeader = \
             signPostHeaders(dateStr, privateKeyPem, nickname,
                             domain, port, toDomain, toPort,
-                            path, httpPrefix, None, contentType)
+                            path, httpPrefix, None, contentType,
+                            algorithm)
     else:
-        bodyDigest = messageContentDigest(messageBodyJsonStr)
+        bodyDigest = messageContentDigest(messageBodyJsonStr, digestAlgorithm)
+        digestPrefix = getDigestPrefix(digestAlgorithm)
         contentLength = len(messageBodyJsonStr)
         headers = {
             '(request-target)': f'post {path}',
             'host': headerDomain,
             'date': dateStr,
-            'digest': f'SHA-256={bodyDigest}',
+            'digest': f'{digestPrefix}={bodyDigest}',
             'content-length': str(contentLength),
             'content-type': contentType
         }
@@ -247,7 +292,7 @@ def createSignedHeader(dateStr: str, privateKeyPem: str, nickname: str,
                             domain, port,
                             toDomain, toPort,
                             path, httpPrefix, messageBodyJsonStr,
-                            contentType)
+                            contentType, algorithm)
     headers['signature'] = signatureHeader
     return headers
 
@@ -341,6 +386,7 @@ def verifyPostHeaders(httpPrefix: str,
     # body (if a digest was included)
     signedHeaderList = []
     algorithm = 'rsa-sha256'
+    digestAlgorithm = 'rsa-sha256'
     for signedHeader in signatureDict[requestTargetKey].split(fieldSep2):
         signedHeader = signedHeader.strip()
         if debug:
@@ -387,7 +433,8 @@ def verifyPostHeaders(httpPrefix: str,
             if messageBodyDigest:
                 bodyDigest = messageBodyDigest
             else:
-                bodyDigest = messageContentDigest(messageBodyJsonStr)
+                bodyDigest = \
+                    messageContentDigest(messageBodyJsonStr, digestAlgorithm)
             signedHeaderList.append(f'digest: SHA-256={bodyDigest}')
         elif signedHeader == 'content-length':
             if headers.get(signedHeader):