-
Notifications
You must be signed in to change notification settings - Fork 450
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Refactoring crypto code for future reuse. (#25148)
Refactoring crypto code for future reuse for #24869. No functional changes.
- Loading branch information
Showing
18 changed files
with
170 additions
and
173 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| package cryptoutil | ||
|
|
||
| import ( | ||
| "crypto" | ||
| "crypto/ecdsa" | ||
| "crypto/ed25519" | ||
| "crypto/elliptic" | ||
| "crypto/rsa" | ||
| "crypto/sha256" | ||
| "crypto/x509" | ||
| "encoding/asn1" | ||
| "encoding/pem" | ||
| "errors" | ||
| "fmt" | ||
| ) | ||
|
|
||
| // GenerateSubjectKeyID generates Subject Key Identifier (SKI) using SHA-256 | ||
| // hash of the public key bytes according to RFC 7093 section 2. | ||
| func GenerateSubjectKeyID(pub crypto.PublicKey) ([]byte, error) { | ||
| var pubBytes []byte | ||
| var err error | ||
| switch pub := pub.(type) { | ||
| case *rsa.PublicKey: | ||
| pubBytes, err = asn1.Marshal(*pub) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| case *ecdsa.PublicKey: | ||
| pubBytes = elliptic.Marshal(pub.Curve, pub.X, pub.Y) | ||
| default: | ||
| return nil, errors.New("only ECDSA and RSA public keys are supported") | ||
| } | ||
|
|
||
| hash := sha256.Sum256(pubBytes) | ||
|
|
||
| // According to RFC 7093, The keyIdentifier is composed of the leftmost | ||
| // 160-bits of the SHA-256 hash of the value of the BIT STRING | ||
| // subjectPublicKey (excluding the tag, length, and number of unused bits). | ||
| return hash[:20], nil | ||
| } | ||
|
|
||
| // ParsePrivateKey parses a PEM encoded private key and returns a crypto.PrivateKey. | ||
| // It can be used for private keys passed in from environment variables or command line or files. | ||
| func ParsePrivateKey(privKeyPEM []byte, keyName string) (crypto.PrivateKey, error) { | ||
| block, _ := pem.Decode(privKeyPEM) | ||
| if block == nil { | ||
| return nil, fmt.Errorf("failed to decode %s", keyName) | ||
| } | ||
|
|
||
| // The code below is based on tls.parsePrivateKey | ||
| // https://cs.opensource.google/go/go/+/release-branch.go1.23:src/crypto/tls/tls.go;l=355-372 | ||
| if key, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil { | ||
| return key, nil | ||
| } | ||
| if key, err := x509.ParsePKCS8PrivateKey(block.Bytes); err == nil { | ||
| switch key := key.(type) { | ||
| case *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey: | ||
| return key, nil | ||
| default: | ||
| return nil, fmt.Errorf("unmarshaled PKCS8 %s is not an RSA, ECDSA, or Ed25519 private key", keyName) | ||
| } | ||
| } | ||
| if key, err := x509.ParseECPrivateKey(block.Bytes); err == nil { | ||
| return key, nil | ||
| } | ||
|
|
||
| return nil, fmt.Errorf("failed to parse %s of type %s", keyName, block.Type) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| package cryptoutil | ||
|
|
||
| import ( | ||
| "crypto" | ||
| "crypto/ecdsa" | ||
| "crypto/elliptic" | ||
| "crypto/rand" | ||
| "crypto/rsa" | ||
| "math/big" | ||
| "os" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| func TestGenerateSubjectKeyID(t *testing.T) { | ||
| ecKey, err := ecdsa.GenerateKey(elliptic.P224(), rand.Reader) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| for _, test := range []struct { | ||
| testName string | ||
| pub crypto.PublicKey | ||
| }{ | ||
| {"RSA", &rsa.PublicKey{N: big.NewInt(123), E: 65537}}, | ||
| {"ECDSA", ecKey.Public()}, | ||
| } { | ||
| test := test | ||
| t.Run(test.testName, func(t *testing.T) { | ||
| t.Parallel() | ||
| ski, err := GenerateSubjectKeyID(test.pub) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if len(ski) != 20 { | ||
| t.Fatalf("unexpected subject public key identifier length: %d", len(ski)) | ||
| } | ||
| ski2, err := GenerateSubjectKeyID(test.pub) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if !testSKIEq(ski, ski2) { | ||
| t.Fatal("subject key identifier generation is not deterministic") | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func testSKIEq(a, b []byte) bool { | ||
| if len(a) != len(b) { | ||
| return false | ||
| } | ||
|
|
||
| for i := range a { | ||
| if a[i] != b[i] { | ||
| return false | ||
| } | ||
| } | ||
|
|
||
| return true | ||
| } | ||
|
|
||
| func TestParsePrivateKey(t *testing.T) { | ||
| t.Parallel() | ||
| // nil block not allowed | ||
| _, err := ParsePrivateKey(nil, "APNS private key") | ||
| assert.ErrorContains(t, err, "failed to decode") | ||
|
|
||
| // encrypted pkcs8 not supported | ||
| pkcs8Encrypted, err := os.ReadFile("testdata/pkcs8-encrypted.key") | ||
| require.NoError(t, err) | ||
| _, err = ParsePrivateKey(pkcs8Encrypted, "APNS private key") | ||
| assert.ErrorContains(t, err, "failed to parse APNS private key of type ENCRYPTED PRIVATE KEY") | ||
|
|
||
| // X25519 pkcs8 not supported | ||
| pkcs8Encrypted, err = os.ReadFile("testdata/pkcs8-x25519.key") | ||
| require.NoError(t, err) | ||
| _, err = ParsePrivateKey(pkcs8Encrypted, "APNS private key") | ||
| assert.ErrorContains(t, err, "unmarshaled PKCS8 APNS private key is not") | ||
|
|
||
| // In this test, the pkcs1 key and pkcs8 keys are the same key, just different formats | ||
| pkcs1, err := os.ReadFile("testdata/pkcs1.key") | ||
| require.NoError(t, err) | ||
| pkcs1Key, err := ParsePrivateKey(pkcs1, "APNS private key") | ||
| require.NoError(t, err) | ||
|
|
||
| pkcs8, err := os.ReadFile("testdata/pkcs8-rsa.key") | ||
| require.NoError(t, err) | ||
| pkcs8Key, err := ParsePrivateKey(pkcs8, "APNS private key") | ||
| require.NoError(t, err) | ||
|
|
||
| assert.Equal(t, pkcs1Key, pkcs8Key) | ||
| } |
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.