Mariano Cano
f425a81d36
Enforce the use of id and label when generating objects.
2021-02-04 12:53:08 -08:00
Mariano Cano
dd6a43ad13
Add fake implementation of pkcs11 key manager without cgo.
...
This allows other binaries to import pkcs11 directly even if they
are compiled without cgo.
2021-02-04 12:32:30 -08:00
Mariano Cano
3fdab93ab8
Add missing file.
2021-02-01 15:27:53 -08:00
Mariano Cano
a8260a3289
Add missing test.
2021-02-01 14:25:49 -08:00
Mariano Cano
41eff69fb3
Fix linting errors.
2021-02-01 14:22:53 -08:00
Mariano Cano
128d07f148
Use new GetEncoded method.
2021-02-01 14:17:39 -08:00
Mariano Cano
b28db61d5d
Add missing close causing panic with softhsm2.
2021-02-01 14:16:55 -08:00
Mariano Cano
a74fc7a0b2
Remove unnecessary methods and add missing tests.
2021-02-01 14:16:08 -08:00
Mariano Cano
50e9018a44
Fix missing return.
2021-01-28 19:53:25 -08:00
Mariano Cano
84a3c8c984
Rename nitrokey initialization to opensc.
2021-01-28 19:51:17 -08:00
Mariano Cano
b7afc92758
Complete tests.
2021-01-28 19:48:08 -08:00
Mariano Cano
3a479cb0e8
Add support for nitrokey.
2021-01-28 19:47:44 -08:00
Mariano Cano
e78d45a060
Add benchmarks for signing operations.
2021-01-28 19:46:48 -08:00
Mariano Cano
673675fa89
Convert pkcs11 tests to use tags.
2021-01-28 14:43:22 -08:00
Mariano Cano
6c113542c8
Fix ecdsa signature verification test.
2021-01-28 11:38:21 -08:00
Mariano Cano
35bf9b787e
Implement ecdsa.VerifyASN1 to be compatible with go < 1.15
2021-01-27 20:35:42 -08:00
Mariano Cano
d9da150a5f
Fix test.
2021-01-27 20:23:45 -08:00
Mariano Cano
294f84b8d4
Add initial set of unit tests for pkcs11 kms.
2021-01-27 20:17:14 -08:00
Mariano Cano
a6c784d5dd
Add missing pkcs11 package.
2021-01-26 20:15:57 -08:00
Mariano Cano
8dca652bc7
Add support for PKCS #11 KMS.
...
The implementation works with YubiHSM2. Unit tests are still pending.
Fixes #301
2021-01-26 20:03:53 -08:00
Mariano Cano
ccc403cf89
Fix comments, and return an error instead of fatal.
2020-11-18 17:50:21 -08:00
Anton Lundin
3e6137110b
Add support for using ssh-agent as a KMS
...
This adds a new KMS, SSHAgentKMS, which is a KMS to provide signing keys
for issuing ssh certificates signed by a key managed by a ssh-agent. It
uses the golang.org/x/crypto package to get a native Go implementation
to talk to a ssh-agent.
This was primarly written to be able to use gpg-agent to provide the
keys stored in a YubiKeys openpgp interface, but can be used for other
setups like proxying a ssh-agent over network.
That way the signing key for ssh certificates can be kept in a
"sign-only" hsm.
This code was written for my employer Intinor AB, but for simplicity
sake gifted to me to contribute upstream.
Signed-off-by: Anton Lundin <glance@acc.umu.se>
2020-11-04 09:06:23 +01:00
Mariano Cano
40d0596b71
Use smallstep/cli-utils instead of smallstep/cli
2020-10-29 13:10:03 -07:00
Mariano Cano
f100b2d0e3
Make the YubiKey management key configurable.
...
With this change the default management key is not required as the
user is able to set its own.
Fixes #323
2020-09-17 16:07:32 -07:00
Pierre Laden
692f7692a2
fix #2 indentation
2020-09-16 22:26:53 +02:00
Pierre Laden
290d5ee979
fix gofmt complain
2020-09-16 22:15:42 +02:00
Pierre Laden
179e793f1a
- provide PINpolicy always to piv-go to avoid trying to use attestation cert, which we might not have
...
- bump piv-go version to 1.6.0
2020-09-16 21:59:48 +02:00
Mariano Cano
d30a95236d
Use always go.step.sm/crypto
2020-08-14 15:33:50 -07:00
Mariano Cano
ddb4ca7a74
Move load of kms to main package.
...
With this change packages that import the authority won't load by
default all the supported kms with all its dependencies.
Fixes #228
2020-06-12 14:55:35 -07:00
Mariano Cano
6c9cd7050c
Add test with query strings.
2020-05-26 11:13:07 -07:00
Mariano Cano
dfe8e11e44
Remove anchor from link.
2020-05-26 10:55:26 -07:00
Mariano Cano
7104588fcb
Fix linter error.
2020-05-20 17:58:37 -07:00
Mariano Cano
aaf71ce66a
Add unit tests for awskms.
2020-05-20 17:04:01 -07:00
Mariano Cano
d4cb9f4ac7
Define an interface for kms operations.
...
This interface will be used for unit testing.
2020-05-20 12:43:14 -07:00
Mariano Cano
82fb96588e
Fix unit tests.
2020-05-19 17:45:15 -07:00
Mariano Cano
c32abb76cd
Add initial implementation to support AWS KMS.
2020-05-19 17:35:36 -07:00
Mariano Cano
b0f768a3fb
Add implementation of URIs for KMS.
...
Implementation is based on the PKCS #11 URI Scheme RFC
https://tools.ietf.org/html/rfc7512
2020-05-19 17:32:52 -07:00
Mariano Cano
012a4734bf
Add better messaging when yubikey is not detected.
2020-05-15 11:33:04 -07:00
Mariano Cano
7d61c0003c
Enable softkms and cloudkms.
2020-05-15 11:32:12 -07:00
Mariano Cano
63e36ecd7a
Refactor the initialization of KeyManagers.
2020-05-11 18:47:22 -07:00
Mariano Cano
029483463b
Remove extra +build statement.
2020-05-07 18:51:41 -07:00
Mariano Cano
677e99793e
Create alternative yubikey file when cgo is not enabled.
...
This yubikey will always fail.
2020-05-07 18:35:10 -07:00
Mariano Cano
6868190fff
Add initial support for yubikey.
2020-05-07 18:22:09 -07:00
Mariano Cano
1138cc4207
Retry CloudKMS GetPublicKey.
...
On HSM keys are not generated instantly and the GetPublicKey fails
with a FailedPrecondition error. This change will retry GetPublicKey
if this happens.
2020-02-21 12:36:29 -08:00
Mariano Cano
5c8c741fab
Fix linting issues.
2020-02-14 11:46:31 -08:00
Mariano Cano
dd5a96a42e
Fix typo.
2020-02-14 10:42:50 -08:00
Mariano Cano
b724f5a338
Fix typos.
2020-02-14 10:24:56 -08:00
Mariano Cano
6987a46b76
Skip test on travis.
2020-02-13 18:38:00 -08:00
Mariano Cano
b11bbd5728
Fix typo.
2020-02-13 18:34:43 -08:00
Mariano Cano
cff346e7fd
Skip test on travis, it won't fail because they have access to the KMS.
2020-02-13 15:49:16 -08:00