certificates/kms/softkms/softkms.go

135 lines
3.7 KiB
Go
Raw Normal View History

2020-01-10 02:41:13 +00:00
package softkms
import (
"context"
"crypto"
"crypto/ecdsa"
"crypto/ed25519"
"crypto/rsa"
"crypto/x509"
"github.com/pkg/errors"
"github.com/smallstep/certificates/kms/apiv1"
"github.com/smallstep/cli/crypto/keys"
"github.com/smallstep/cli/crypto/pemutil"
)
type algorithmAttributes struct {
Type string
Curve string
}
// DefaultRSAKeySize is the default size for RSA keys.
const DefaultRSAKeySize = 3072
2020-01-10 02:41:13 +00:00
var signatureAlgorithmMapping = map[apiv1.SignatureAlgorithm]algorithmAttributes{
apiv1.UnspecifiedSignAlgorithm: algorithmAttributes{"EC", "P-256"},
apiv1.SHA256WithRSA: algorithmAttributes{"RSA", ""},
apiv1.SHA384WithRSA: algorithmAttributes{"RSA", ""},
apiv1.SHA512WithRSA: algorithmAttributes{"RSA", ""},
apiv1.SHA256WithRSAPSS: algorithmAttributes{"RSA", ""},
apiv1.SHA384WithRSAPSS: algorithmAttributes{"RSA", ""},
apiv1.SHA512WithRSAPSS: algorithmAttributes{"RSA", ""},
apiv1.ECDSAWithSHA256: algorithmAttributes{"EC", "P-256"},
apiv1.ECDSAWithSHA384: algorithmAttributes{"EC", "P-384"},
apiv1.ECDSAWithSHA512: algorithmAttributes{"EC", "P-521"},
apiv1.PureEd25519: algorithmAttributes{"OKP", "Ed25519"},
}
// generateKey is used for testing purposes.
var generateKey = func(kty, crv string, size int) (interface{}, interface{}, error) {
if kty == "RSA" && size == 0 {
size = DefaultRSAKeySize
}
return keys.GenerateKeyPair(kty, crv, size)
}
2020-01-10 02:41:13 +00:00
// SoftKSM is a key manager that uses keys stored in disk.
type SoftKMS struct{}
// New returns a new SoftKSM.
func New(ctx context.Context, opts apiv1.Options) (*SoftKMS, error) {
return &SoftKMS{}, nil
}
// Closes is a noop that just returns nil.
func (k *SoftKMS) Close() error {
return nil
}
2020-01-10 02:41:13 +00:00
// CreateSigner returns a new signer configured with the given signing key.
func (k *SoftKMS) CreateSigner(req *apiv1.CreateSignerRequest) (crypto.Signer, error) {
var opts []pemutil.Options
if req.Password != nil {
opts = append(opts, pemutil.WithPassword(req.Password))
2020-01-10 02:41:13 +00:00
}
switch {
case req.Signer != nil:
return req.Signer, nil
2020-01-10 02:41:13 +00:00
case len(req.SigningKeyPEM) != 0:
v, err := pemutil.ParseKey(req.SigningKeyPEM, opts...)
if err != nil {
return nil, err
}
sig, ok := v.(crypto.Signer)
if !ok {
return nil, errors.New("signingKeyPEM is not a crypto.Signer")
}
return sig, nil
case req.SigningKey != "":
v, err := pemutil.Read(req.SigningKey, opts...)
if err != nil {
return nil, err
}
sig, ok := v.(crypto.Signer)
if !ok {
return nil, errors.New("signingKey is not a crypto.Signer")
}
return sig, nil
default:
return nil, errors.New("failed to load softKMS: please define signingKeyPEM or signingKey")
}
}
func (k *SoftKMS) CreateKey(req *apiv1.CreateKeyRequest) (*apiv1.CreateKeyResponse, error) {
v, ok := signatureAlgorithmMapping[req.SignatureAlgorithm]
if !ok {
return nil, errors.Errorf("softKMS does not support signature algorithm '%s'", req.SignatureAlgorithm)
}
pub, priv, err := generateKey(v.Type, v.Curve, req.Bits)
2020-01-10 02:41:13 +00:00
if err != nil {
return nil, err
}
signer, ok := priv.(crypto.Signer)
if !ok {
return nil, errors.Errorf("softKMS createKey result is not a crypto.Signer: type %T", priv)
}
2020-01-10 02:41:13 +00:00
return &apiv1.CreateKeyResponse{
Name: req.Name,
PublicKey: pub,
PrivateKey: priv,
CreateSignerRequest: apiv1.CreateSignerRequest{
Signer: signer,
},
2020-01-10 02:41:13 +00:00
}, nil
}
func (k *SoftKMS) GetPublicKey(req *apiv1.GetPublicKeyRequest) (crypto.PublicKey, error) {
2020-01-10 02:41:13 +00:00
v, err := pemutil.Read(req.Name)
if err != nil {
return nil, err
}
switch vv := v.(type) {
2020-01-10 02:41:13 +00:00
case *x509.Certificate:
return vv.PublicKey, nil
2020-01-10 02:41:13 +00:00
case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:
return vv, nil
2020-01-10 02:41:13 +00:00
default:
return nil, errors.Errorf("unsupported public key type %T", v)
}
}