forked from TrueCloudLab/certificates
140 lines
3.7 KiB
Go
140 lines
3.7 KiB
Go
package softkms
|
|
|
|
import (
|
|
"context"
|
|
"crypto"
|
|
"crypto/ecdsa"
|
|
"crypto/ed25519"
|
|
"crypto/rsa"
|
|
"crypto/x509"
|
|
|
|
"github.com/pkg/errors"
|
|
"github.com/smallstep/certificates/kms/apiv1"
|
|
"github.com/smallstep/cli/crypto/keys"
|
|
"github.com/smallstep/cli/crypto/pemutil"
|
|
)
|
|
|
|
type algorithmAttributes struct {
|
|
Type string
|
|
Curve string
|
|
}
|
|
|
|
// DefaultRSAKeySize is the default size for RSA keys.
|
|
const DefaultRSAKeySize = 3072
|
|
|
|
var signatureAlgorithmMapping = map[apiv1.SignatureAlgorithm]algorithmAttributes{
|
|
apiv1.UnspecifiedSignAlgorithm: {"EC", "P-256"},
|
|
apiv1.SHA256WithRSA: {"RSA", ""},
|
|
apiv1.SHA384WithRSA: {"RSA", ""},
|
|
apiv1.SHA512WithRSA: {"RSA", ""},
|
|
apiv1.SHA256WithRSAPSS: {"RSA", ""},
|
|
apiv1.SHA384WithRSAPSS: {"RSA", ""},
|
|
apiv1.SHA512WithRSAPSS: {"RSA", ""},
|
|
apiv1.ECDSAWithSHA256: {"EC", "P-256"},
|
|
apiv1.ECDSAWithSHA384: {"EC", "P-384"},
|
|
apiv1.ECDSAWithSHA512: {"EC", "P-521"},
|
|
apiv1.PureEd25519: {"OKP", "Ed25519"},
|
|
}
|
|
|
|
// generateKey is used for testing purposes.
|
|
var generateKey = func(kty, crv string, size int) (interface{}, interface{}, error) {
|
|
if kty == "RSA" && size == 0 {
|
|
size = DefaultRSAKeySize
|
|
}
|
|
return keys.GenerateKeyPair(kty, crv, size)
|
|
}
|
|
|
|
// SoftKMS is a key manager that uses keys stored in disk.
|
|
type SoftKMS struct{}
|
|
|
|
// New returns a new SoftKMS.
|
|
func New(ctx context.Context, opts apiv1.Options) (*SoftKMS, error) {
|
|
return &SoftKMS{}, nil
|
|
}
|
|
|
|
func init() {
|
|
apiv1.Register(apiv1.SoftKMS, func(ctx context.Context, opts apiv1.Options) (apiv1.KeyManager, error) {
|
|
return New(ctx, opts)
|
|
})
|
|
}
|
|
|
|
// Close is a noop that just returns nil.
|
|
func (k *SoftKMS) Close() error {
|
|
return nil
|
|
}
|
|
|
|
// CreateSigner returns a new signer configured with the given signing key.
|
|
func (k *SoftKMS) CreateSigner(req *apiv1.CreateSignerRequest) (crypto.Signer, error) {
|
|
var opts []pemutil.Options
|
|
if req.Password != nil {
|
|
opts = append(opts, pemutil.WithPassword(req.Password))
|
|
}
|
|
|
|
switch {
|
|
case req.Signer != nil:
|
|
return req.Signer, nil
|
|
case len(req.SigningKeyPEM) != 0:
|
|
v, err := pemutil.ParseKey(req.SigningKeyPEM, opts...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
sig, ok := v.(crypto.Signer)
|
|
if !ok {
|
|
return nil, errors.New("signingKeyPEM is not a crypto.Signer")
|
|
}
|
|
return sig, nil
|
|
case req.SigningKey != "":
|
|
v, err := pemutil.Read(req.SigningKey, opts...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
sig, ok := v.(crypto.Signer)
|
|
if !ok {
|
|
return nil, errors.New("signingKey is not a crypto.Signer")
|
|
}
|
|
return sig, nil
|
|
default:
|
|
return nil, errors.New("failed to load softKMS: please define signingKeyPEM or signingKey")
|
|
}
|
|
}
|
|
|
|
func (k *SoftKMS) CreateKey(req *apiv1.CreateKeyRequest) (*apiv1.CreateKeyResponse, error) {
|
|
v, ok := signatureAlgorithmMapping[req.SignatureAlgorithm]
|
|
if !ok {
|
|
return nil, errors.Errorf("softKMS does not support signature algorithm '%s'", req.SignatureAlgorithm)
|
|
}
|
|
|
|
pub, priv, err := generateKey(v.Type, v.Curve, req.Bits)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
signer, ok := priv.(crypto.Signer)
|
|
if !ok {
|
|
return nil, errors.Errorf("softKMS createKey result is not a crypto.Signer: type %T", priv)
|
|
}
|
|
|
|
return &apiv1.CreateKeyResponse{
|
|
Name: req.Name,
|
|
PublicKey: pub,
|
|
PrivateKey: priv,
|
|
CreateSignerRequest: apiv1.CreateSignerRequest{
|
|
Signer: signer,
|
|
},
|
|
}, nil
|
|
}
|
|
|
|
func (k *SoftKMS) GetPublicKey(req *apiv1.GetPublicKeyRequest) (crypto.PublicKey, error) {
|
|
v, err := pemutil.Read(req.Name)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
switch vv := v.(type) {
|
|
case *x509.Certificate:
|
|
return vv.PublicKey, nil
|
|
case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:
|
|
return vv, nil
|
|
default:
|
|
return nil, errors.Errorf("unsupported public key type %T", v)
|
|
}
|
|
}
|