Feature/awesn2

build-logic/src/main/kotlin/at/asitplus/gradle/SignumConventionsPlugin.kt → buildlogic/src/main/kotlin/at/asitplus/gradle/SignumConventionsPlugin.kt

@@ -51,8 +51,12 @@ class SignumConventionsExtension(private val project: Project) {
         //if we do this properly, cinterop (swift-klib) blows up, so we hack!
         project.afterEvaluate {
             //work around IDEA BUG not finding any test deps on non-JVM!
+            (project.kotlinExtension as KotlinMultiplatformExtension). compilerOptions {
+                freeCompilerArgs.add("-Xcontext-parameters")
+            }
             (project.kotlinExtension as KotlinMultiplatformExtension).sourceSets.filter { it.name.endsWith("Test") }
-                .forEach { it.dependencies { addTestExtensions() } }
+                .forEach {
+                    it.dependencies { addTestExtensions() } }
             tasks.withType<Test>().configureEach {
                 maxHeapSize = "10G"
             }

gradle.properties

@@ -30,4 +30,4 @@ systemProp.org.gradle.internal.http.socketTimeout     = 1200000
 
 kotlin.build.report.output=json
 kotlin.build.report.json.directory=./metrics
-returnValueChecker=full
+returnValueChecker=full

gradle/libs.versions.toml

@@ -1,5 +1,5 @@
 [versions]
-kotlin = "2.3.20"
+kotlin = "2.4.0"
 agp = "8.12.3"
 core = "1.5.0"
 kotlinxIoCore = "0.9.0"
@@ -9,12 +9,15 @@ bignum = "0.3.10"
 jose = "9.31"
 kotlinpoet = "2.2.0"
 kotlincryptoRandom = "0.6.0"
-asp = "20260610"
+asp = "20260701"
 classgraph = "4.8.184"
-bouncycastle= "1.83"
-testballoon = "1.0.0-K2.3.20"
-#testballoonAddons = "0.15.0"
+bouncycastle= "1.84"
+testballoon = "1.0.0-K2.4.0-Beta2"
 serialization = "1.11.0"
+cidre = "0.4.0"
+urikmp = "0.0.20"
+awesn1 = "0.5.0"
+modulator = "0.1.0"
 
 [libraries]
 bignum = { group = "com.ionspin.kotlin", name = "bignum", version.ref = "bignum" }
@@ -26,9 +29,15 @@ multibase = { module = "at.asitplus:multibase", version.ref = "multibase" }
 securerandom = { module = "org.kotlincrypto.random:crypto-rand", version.ref = "kotlincryptoRandom" }
 asp = { module = "at.asitplus.gradle:k2", version.ref = "asp" }
 classgraph = { group = "io.github.classgraph", name = "classgraph", version.ref = "classgraph" }
+awesn1-crypto = {module = "at.asitplus.awesn1:crypto", version.ref= "awesn1"}
+awesn1-oids = {module = "at.asitplus.awesn1:oids", version.ref= "awesn1"}
+awesn1-io = {module = "at.asitplus.awesn1:kxs-io", version.ref= "awesn1"}
+cidre = { module = "at.asitplus:cidre", version.ref = "cidre"}
+urikmp = {module = "com.eygraber:uri-kmp", version.ref = "urikmp"}
 
 #for build logic conventions plugin, as it needs the artefact, not the plugin ID
 agp = { module = "com.android.tools.build:gradle", version.ref = "agp" }
+modulator = { module = "at.asitplus:gradle-modulator", version.ref = "modulator" }
 
 [plugins]
 asp = { id = "at.asitplus.gradle.conventions", version.ref = "asp" }

indispensable-asn1/src/commonMain/kotlin/at/asitplus/signum/indispensable/asn1/PemEncodable.kt

@@ -91,7 +91,7 @@ private val PemEncodable<*>.postEB: String get() = "$FENCE_PREFIX_END${this.cano
  * Encodes this [PemEncodable] into a PEM-encoded string
  */
 @OptIn(ExperimentalEncodingApi::class)
-fun PemEncodable<*>.encodeToPEM(): KmmResult<String> = catching {
+fun PemEncodable<*>.encodeToPem(): KmmResult<String> = catching {
     "$preEB\n" + Base64.Mime.encode(encodeToDer()).lines().joinToString("").chunked(64)
         .joinToString(separator = "\n", postfix = "\n") + postEB
 }

indispensable-cosef/build.gradle.kts

@@ -38,7 +38,8 @@ exportXCFramework(
     datetime(),
     kmmresult(),
     project(":indispensable"),
-    project(":indispensable-asn1"),
+    libs.awesn1.crypto,
+    libs.awesn1.oids,
     libs.bignum
 
 )

indispensable-cosef/src/commonMain/kotlin/at/asitplus/signum/indispensable/cosef/CoseAlgorithm.kt

@@ -130,7 +130,7 @@ sealed interface CoseAlgorithm : Enumerable {
 
         // RSASSA-PKCS1-v1_5 using SHA-1
         @Serializable(with = CoseAlgorithmSerializer::class)
-        data object RS1 : Signature(-65535, SignatureAlgorithm.RSA(Digest.SHA1, RSAPadding.PKCS1))
+        data object RS1 : Signature(-65535, SignatureAlgorithm.RSA(SignatureAlgorithm.RSA.Parameters.Pkcs1Padded(Digest.SHA1)))
 
         companion object : Enumeration<Signature> {
             override val entries: Collection<Signature> by lazy {
@@ -311,15 +311,15 @@ fun SignatureAlgorithm.toCoseAlgorithm(): KmmResult<CoseAlgorithm.Signature> = c
             else -> throw UnsupportedCryptoException("ECDSA with ${this.digest} is unsupported by COSE")
         }
 
-        is SignatureAlgorithm.RSA -> when (this.padding) {
-            RSAPadding.PKCS1 -> when (this.digest) {
+        is SignatureAlgorithm.RSA -> when (this.parameters) {
+            is SignatureAlgorithm.RSA.Parameters.Pkcs1Padded -> when (this.digest) {
                 Digest.SHA1 -> CoseAlgorithm.Signature.RS1
                 Digest.SHA256 -> CoseAlgorithm.Signature.RS256
                 Digest.SHA384 -> CoseAlgorithm.Signature.RS384
                 Digest.SHA512 -> CoseAlgorithm.Signature.RS512
             }
 
-            RSAPadding.PSS -> when (this.digest) {
+            is SignatureAlgorithm.RSA.Parameters.PssPadded -> when (this.digest) {
                 Digest.SHA256 -> CoseAlgorithm.Signature.PS256
                 Digest.SHA384 -> CoseAlgorithm.Signature.PS384
                 Digest.SHA512 -> CoseAlgorithm.Signature.PS512
@@ -370,4 +370,4 @@ fun SpecializedDataIntegrityAlgorithm.toCoseAlgorithm(): KmmResult<CoseAlgorithm
 
 /** Tries to find a matching COSE algorithm. Note that COSE imposes curve restrictions on ECDSA based on the digest. */
 fun SpecializedMessageAuthenticationCode.toCoseAlgorithm(): KmmResult<CoseAlgorithm.MAC> =
-    this.algorithm.toCoseAlgorithm()
+    this.algorithm.toCoseAlgorithm()

indispensable-cosef/src/commonMain/kotlin/at/asitplus/signum/indispensable/cosef/CoseKeyParams.kt

@@ -5,8 +5,8 @@ import at.asitplus.KmmResult.Companion.failure
 import at.asitplus.catching
 import at.asitplus.signum.indispensable.CryptoPublicKey
 import at.asitplus.signum.indispensable.SpecializedCryptoPublicKey
-import at.asitplus.signum.indispensable.asn1.Asn1Integer
-import at.asitplus.signum.indispensable.asn1.encoding.decodeFromAsn1ContentBytes
+import at.asitplus.awesn1.Asn1Integer
+import at.asitplus.awesn1.encoding.decodeFromAsn1ContentBytes
 
 /**
  * Wrapper to handle parameters for different COSE public key types.

indispensable-cosef/src/commonMain/kotlin/at/asitplus/signum/indispensable/cosef/CoseSerializer.kt

@@ -2,12 +2,11 @@ package at.asitplus.signum.indispensable.cosef
 
 import at.asitplus.signum.indispensable.CryptoSignature
 import at.asitplus.signum.indispensable.SignatureAlgorithm
-import at.asitplus.signum.indispensable.X509SignatureAlgorithm
 import at.asitplus.signum.indispensable.cosef.io.ByteStringWrapperSerializer
 import at.asitplus.signum.indispensable.cosef.io.coseCompliantSerializer
 import at.asitplus.signum.indispensable.io.Base64Strict
 import at.asitplus.signum.indispensable.io.TransformingSerializerTemplate
-import at.asitplus.signum.indispensable.pki.X509Certificate
+import at.asitplus.signum.indispensable.pki.Certificate
 import io.matthewnelson.encoding.base64.Base64
 import io.matthewnelson.encoding.core.Decoder.Companion.decodeToByteArray
 import io.matthewnelson.encoding.core.Encoder.Companion.encodeToString
@@ -127,10 +126,9 @@ private fun <P : Any?> ByteArray.fromByteStringWrapper(serializer: KSerializer<P
 
 private fun CoseHeader.usesEC(): Boolean? = when (algorithm) {
     null -> certificateChain?.firstOrNull()
-        ?.let { X509Certificate.decodeFromDerOrNull(it) }
-        ?.let { it.signatureAlgorithm is X509SignatureAlgorithm.ECDSA }
+        ?.let { Certificate.decodeFromByteArray(it) }
+        ?.let { it.signatureAlgorithm is SignatureAlgorithm.ECDSA }
     is CoseAlgorithm.Signature -> (algorithm.algorithm is SignatureAlgorithm.ECDSA)
     else -> false
 }
 
-

indispensable-cosef/src/jvmTest/kotlin/ConversionTests.kt

@@ -4,7 +4,6 @@ import at.asitplus.signum.indispensable.cosef.CoseAlgorithm
 import at.asitplus.signum.indispensable.cosef.toCoseAlgorithm
 import at.asitplus.signum.indispensable.cosef.toCoseKey
 import at.asitplus.signum.indispensable.toCryptoPublicKey
-import at.asitplus.signum.indispensable.toX509SignatureAlgorithm
 import at.asitplus.testballoon.matrix.*
 import io.kotest.matchers.shouldBe
 import io.kotest.matchers.shouldNotBe
@@ -30,17 +29,19 @@ val ConversionTests by matrixSuite {
             }
         }
     }
-    "COSE -> X509 -> COSE" - {
+    "COSE -> SigAlg -> COSE" - {
         data(CoseAlgorithm.Signature.entries) - {
-            it.toX509SignatureAlgorithm().getOrNull()?.let { x509 ->
+            it.algorithm.asn1Representation.let { x509 ->
                 if (it.algorithm is SignatureAlgorithm.ECDSA && (it.algorithm as SignatureAlgorithm.ECDSA).requiredCurve != null) {
                     "Curve information is lost" {
-                        val algorithm = x509.toCoseAlgorithm().getOrThrow()
+                        val algorithm = SignatureAlgorithm(x509).toCoseAlgorithm().getOrThrow()
                         algorithm shouldNotBe it
                         algorithm.toString().takeLast(3) shouldBe it.toString().takeLast(3)
                         algorithm.toString().take(2) shouldBe it.toString().take(2)
                     }
-                } else "is stable" { x509.toCoseAlgorithm() shouldSucceedWith it }
+                } else "is stable" {
+                    SignatureAlgorithm(x509).toCoseAlgorithm() shouldSucceedWith it
+                }
             }
         }
     }

indispensable-josef/build.gradle.kts

@@ -46,7 +46,8 @@ exportXCFramework(
     datetime(),
     kmmresult(),
     project(":indispensable"),
-    project(":indispensable-asn1"),
+    libs.awesn1.crypto,
+    libs.awesn1.oids,
     libs.bignum
 
 )

indispensable-josef/src/commonMain/kotlin/at/asitplus/signum/indispensable/josef/JsonWebKey.kt

@@ -9,7 +9,7 @@ import at.asitplus.signum.indispensable.CryptoPublicKey.EC.Companion.fromUncompr
 import at.asitplus.signum.indispensable.ECCurve
 import at.asitplus.signum.indispensable.SecretExposure
 import at.asitplus.signum.indispensable.SpecializedCryptoPublicKey
-import at.asitplus.signum.indispensable.asn1.Asn1Integer
+import at.asitplus.awesn1.Asn1Integer
 import at.asitplus.signum.indispensable.io.Base64UrlStrict
 import at.asitplus.signum.indispensable.io.ByteArrayBase64UrlSerializer
 import at.asitplus.signum.indispensable.io.CertificateChainBase64Serializer

indispensable-josef/src/commonMain/kotlin/at/asitplus/signum/indispensable/josef/JwsAlgorithm.kt

@@ -84,7 +84,7 @@ sealed class JwsAlgorithm(override val identifier: String) :
             /** The one exception, which is not a valid JWS algorithm identifier */
 
             @Serializable(with = JwsAlgorithmSerializer::class)
-            data object NON_JWS_SHA1_WITH_RSA : RSA("RS1", SignatureAlgorithm.RSA(Digest.SHA1, RSAPadding.PKCS1))
+            data object NON_JWS_SHA1_WITH_RSA : RSA("RS1", SignatureAlgorithm.RSA(SignatureAlgorithm.RSA.Parameters.Pkcs1Padded(Digest.SHA1)))
             companion object : Enumeration<RSA> {
                 override val entries: Collection<RSA> by lazy {
                     setOf(
@@ -184,15 +184,15 @@ fun SignatureAlgorithm.toJwsAlgorithm(): KmmResult<JwsAlgorithm> = catching {
             else -> throw IllegalArgumentException("ECDSA with ${this.digest} is unsupported by JWS")
         }
 
-        is SignatureAlgorithm.RSA -> when (this.padding) {
-            RSAPadding.PKCS1 -> when (this.digest) {
+        is SignatureAlgorithm.RSA -> when (this.parameters) {
+            is SignatureAlgorithm.RSA.Parameters.Pkcs1Padded -> when (this.digest) {
                 Digest.SHA1 -> JwsAlgorithm.Signature.NON_JWS_SHA1_WITH_RSA
                 Digest.SHA256 -> JwsAlgorithm.Signature.RS256
                 Digest.SHA384 -> JwsAlgorithm.Signature.RS384
                 Digest.SHA512 -> JwsAlgorithm.Signature.RS512
             }
 
-            RSAPadding.PSS -> when (this.digest) {
+            is SignatureAlgorithm.RSA.Parameters.PssPadded -> when (this.digest) {
                 Digest.SHA256 -> JwsAlgorithm.Signature.PS256
                 Digest.SHA384 -> JwsAlgorithm.Signature.PS384
                 Digest.SHA512 -> JwsAlgorithm.Signature.PS512
@@ -229,4 +229,4 @@ fun SpecializedMessageAuthenticationCode.toJwsAlgorithm() =
 
 /** Tries to find a matching JWS algorithm.*/
 fun SpecializedSignatureAlgorithm.toJwsAlgorithm() =
-    this.algorithm.toJwsAlgorithm()
+    this.algorithm.toJwsAlgorithm()

indispensable-josef/src/commonMain/kotlin/at/asitplus/signum/indispensable/josef/JwsExtensions.kt

@@ -1,6 +1,6 @@
 package at.asitplus.signum.indispensable.josef
 
-import at.asitplus.signum.indispensable.asn1.encoding.encodeTo4Bytes
+import at.asitplus.awesn1.encoding.encodeTo4Bytes
 
 object JwsExtensions {
 

indispensable-josef/src/commonMain/kotlin/at/asitplus/signum/indispensable/josef/JwsHeader.kt

@@ -422,7 +422,7 @@ data class JwsHeader(
     val publicKey: CryptoPublicKey? by lazy {
         jsonWebKey?.toCryptoPublicKey()?.getOrNull()
             ?: keyId?.let { catching { CryptoPublicKey.fromDid(it) } }?.getOrNull()
-            ?: certificateChain?.leaf?.decodedPublicKey?.getOrNull()
+            ?: certificateChain?.leaf?.publicKey
     }
 
     val keyAttestationParsed: JwsCompactTyped<KeyAttestationJwt>? by lazy {

indispensable-josef/src/commonMain/kotlin/at/asitplus/signum/indispensable/josef/io/JwsCertificateSerializer.kt

@@ -1,11 +1,13 @@
 package at.asitplus.signum.indispensable.josef.io
 
+import at.asitplus.signum.indispensable.decodeFromDer
+import at.asitplus.signum.indispensable.encodeToDer
 import at.asitplus.signum.indispensable.io.ByteArrayBase64Serializer
 import at.asitplus.signum.indispensable.io.TransformingSerializerTemplate
-import at.asitplus.signum.indispensable.pki.X509Certificate
+import at.asitplus.signum.indispensable.pki.Certificate
 
-object JwsCertificateSerializer : TransformingSerializerTemplate<X509Certificate, ByteArray>(
+object JwsCertificateSerializer : TransformingSerializerTemplate<Certificate, ByteArray>(
     parent = ByteArrayBase64Serializer,
-    encodeAs = X509Certificate::encodeToDer,
-    decodeAs = { X509Certificate.decodeFromDer(it) } //workaround iOS compilation bug KT-71498
+    encodeAs = Certificate::encodeToDer,
+    decodeAs = { Certificate.decodeFromDer(it) } //workaround iOS compilation bug KT-71498
 )

indispensable-josef/src/commonTest/kotlin/TestSessionConfig.kt

@@ -1,8 +1,18 @@
 import at.asitplus.testballoon.matrix.ExecutionMode
 import at.asitplus.testballoon.matrix.MatrixTestDefaults
 import de.infix.testBalloon.framework.core.TestSession
+import org.kotlincrypto.random.CryptoRand
+import org.kotlincrypto.random.DelicateCryptoRandApi
+import kotlin.random.Random
 
 //Supercharge tests with concurrency!
 class ModuleTestSession : TestSession(
     testConfig = DefaultConfiguration.apply { MatrixTestDefaults { execution = ExecutionMode.Concurrent(64) } }
 )
+
+// CryptRand != Random, see https://github.com/KotlinCrypto/random/issues/50
+@OptIn(DelicateCryptoRandApi::class)
+object InsecureRandom : CryptoRand() {
+    override fun nextBytes(buf: ByteArray) = Random.nextBytes(buf)
+    fun nextBytes(n: Int) = ByteArray(n).also { nextBytes(it) }
+}

indispensable-josef/src/commonTest/kotlin/at/asitplus/signum/indispensable/josef/JsonWebKeyTest.kt

@@ -2,7 +2,7 @@ package at.asitplus.signum.indispensable.josef
 
 import at.asitplus.signum.indispensable.CryptoPublicKey
 import at.asitplus.signum.indispensable.ECCurve
-import at.asitplus.signum.indispensable.asn1.Asn1Integer
+import at.asitplus.awesn1.Asn1Integer
 import at.asitplus.signum.indispensable.io.Base64UrlStrict
 import at.asitplus.testballoon.matrix.*
 import io.kotest.matchers.shouldBe

indispensable-josef/src/jvmTest/kotlin/at/asitplus/signum/indispensable/josef/ConversionTest.kt

@@ -1,12 +1,9 @@
 package at.asitplus.signum.indispensable.josef
 
 import at.asitplus.KmmResult
-import at.asitplus.signum.indispensable.toX509SignatureAlgorithm
+import at.asitplus.signum.indispensable.SignatureAlgorithm
 import at.asitplus.testballoon.matrix.*
 import io.kotest.matchers.shouldBe
-import de.infix.testBalloon.framework.core.TestConfig
-import kotlin.time.Duration.Companion.minutes
-import de.infix.testBalloon.framework.core.testScope
 
 //somehow including kmmresult-test makes this fail
 infix fun <T> KmmResult<T>.shouldSucceedWith(b: T): T =
@@ -28,8 +25,8 @@ val ConversionTest by matrixSuite {
     }
     "JWS -> X509 -> JWS is stable" - {
         data(JwsAlgorithm.Signature.entries) test {
-            it.toX509SignatureAlgorithm().getOrNull()?.let { x509 ->
-                x509.toJwsAlgorithm() shouldSucceedWith it
+            it.algorithm.asn1Representation.let { x509 ->
+                SignatureAlgorithm(x509).toJwsAlgorithm() shouldSucceedWith it
             }
         }
     }

indispensable-josef/src/jvmTest/kotlin/at/asitplus/signum/indispensable/josef/JsonWebKeyJvmTest.kt

@@ -3,8 +3,8 @@ package at.asitplus.signum.indispensable.josef
 import at.asitplus.signum.indispensable.CryptoPublicKey
 import at.asitplus.signum.indispensable.CryptoPublicKey.EC.Companion.fromUncompressed
 import at.asitplus.signum.indispensable.ECCurve
-import at.asitplus.signum.indispensable.asn1.Asn1Integer
-import at.asitplus.signum.indispensable.asn1.toAsn1Integer
+import at.asitplus.awesn1.Asn1Integer
+import at.asitplus.awesn1.toAsn1Integer
 import at.asitplus.signum.internals.ensureSize
 import at.asitplus.testballoon.matrix.*
 import io.kotest.matchers.nulls.shouldNotBeNull

indispensable-josef/src/jvmTest/kotlin/at/asitplus/signum/indispensable/josef/JweEncryptedTest.kt

@@ -22,13 +22,6 @@ import java.net.URI
 import javax.crypto.KeyGenerator
 import kotlin.random.Random
 
-// CryptRand != Random, see https://github.com/KotlinCrypto/random/issues/50
-@OptIn(DelicateCryptoRandApi::class)
-private object InsecureRandom : CryptoRand() {
-    override fun nextBytes(buf: ByteArray) = Random.nextBytes(buf)
-    fun nextBytes(n: Int) = ByteArray(n).also { nextBytes(it) }
-}
-
 @OptIn(HazardousMaterials::class)
 val JweEncryptedTest by matrixSuite {