kaidokert / krabitls-rs / 28917841471

85%

Build Type

push

github

Committed by web-flow

Commit Message

RSA client certificates (mTLS): RsaClientAuth + entropy-threaded ClientAuth::sign (#91)

* ClientAuth::sign: thread signing entropy through the trait

Randomized CertificateVerify schemes (RSA-PSS salt) need RNG output at
sign time, but the RNG is a borrowed connect() param and dyn ClientAuth
forbids a generic method. connect() now pre-draws 32 bytes (gated on
ACCEPT_CERT_REQUEST) into the engine; build_flight forwards them to
sign(). Ed25519 ignores the bytes — its flight is byte-identical.

* RsaClientAuth: RSA-2048 PSS client-cert signer (feature = rsa)

rsa_pss_rsae_sha256 CertificateVerify signatures over rsa_heapless 0.3's
no-alloc CT signing path (FixedUInt<u32,64,Ct>, salt = the connection
entropy, saltLen == hashLen per TLS 1.3 §4.2.3). RSA-2048 only. Unblinded
modexp — same physical-side-channel threat-model line as x25519.
Round-trip tested against the crate's own PSS verifier.

Coverage Stats

95 of 102 new or added lines in 6 files covered. (93.14%)

196 existing lines in 5 files now uncovered.

4881 of 5751 relevant lines covered (84.87%)

157.35 hits per line