You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
632 lines
14 KiB
632 lines
14 KiB
// Copyright 2018 Joyent, Inc.
|
|
|
|
module.exports = {
|
|
read: read,
|
|
readPkcs8: readPkcs8,
|
|
write: write,
|
|
writePkcs8: writePkcs8,
|
|
pkcs8ToBuffer: pkcs8ToBuffer,
|
|
|
|
readECDSACurve: readECDSACurve,
|
|
writeECDSACurve: writeECDSACurve
|
|
};
|
|
|
|
var assert = require('assert-plus');
|
|
var asn1 = require('asn1');
|
|
var Buffer = require('safer-buffer').Buffer;
|
|
var algs = require('../algs');
|
|
var utils = require('../utils');
|
|
var Key = require('../key');
|
|
var PrivateKey = require('../private-key');
|
|
var pem = require('./pem');
|
|
|
|
function read(buf, options) {
|
|
return (pem.read(buf, options, 'pkcs8'));
|
|
}
|
|
|
|
function write(key, options) {
|
|
return (pem.write(key, options, 'pkcs8'));
|
|
}
|
|
|
|
/* Helper to read in a single mpint */
|
|
function readMPInt(der, nm) {
|
|
assert.strictEqual(der.peek(), asn1.Ber.Integer,
|
|
nm + ' is not an Integer');
|
|
return (utils.mpNormalize(der.readString(asn1.Ber.Integer, true)));
|
|
}
|
|
|
|
function readPkcs8(alg, type, der) {
|
|
/* Private keys in pkcs#8 format have a weird extra int */
|
|
if (der.peek() === asn1.Ber.Integer) {
|
|
assert.strictEqual(type, 'private',
|
|
'unexpected Integer at start of public key');
|
|
der.readString(asn1.Ber.Integer, true);
|
|
}
|
|
|
|
der.readSequence();
|
|
var next = der.offset + der.length;
|
|
|
|
var oid = der.readOID();
|
|
switch (oid) {
|
|
case '1.2.840.113549.1.1.1':
|
|
der._offset = next;
|
|
if (type === 'public')
|
|
return (readPkcs8RSAPublic(der));
|
|
else
|
|
return (readPkcs8RSAPrivate(der));
|
|
case '1.2.840.10040.4.1':
|
|
if (type === 'public')
|
|
return (readPkcs8DSAPublic(der));
|
|
else
|
|
return (readPkcs8DSAPrivate(der));
|
|
case '1.2.840.10045.2.1':
|
|
if (type === 'public')
|
|
return (readPkcs8ECDSAPublic(der));
|
|
else
|
|
return (readPkcs8ECDSAPrivate(der));
|
|
case '1.3.101.112':
|
|
if (type === 'public') {
|
|
return (readPkcs8EdDSAPublic(der));
|
|
} else {
|
|
return (readPkcs8EdDSAPrivate(der));
|
|
}
|
|
case '1.3.101.110':
|
|
if (type === 'public') {
|
|
return (readPkcs8X25519Public(der));
|
|
} else {
|
|
return (readPkcs8X25519Private(der));
|
|
}
|
|
default:
|
|
throw (new Error('Unknown key type OID ' + oid));
|
|
}
|
|
}
|
|
|
|
function readPkcs8RSAPublic(der) {
|
|
// bit string sequence
|
|
der.readSequence(asn1.Ber.BitString);
|
|
der.readByte();
|
|
der.readSequence();
|
|
|
|
// modulus
|
|
var n = readMPInt(der, 'modulus');
|
|
var e = readMPInt(der, 'exponent');
|
|
|
|
// now, make the key
|
|
var key = {
|
|
type: 'rsa',
|
|
source: der.originalInput,
|
|
parts: [
|
|
{ name: 'e', data: e },
|
|
{ name: 'n', data: n }
|
|
]
|
|
};
|
|
|
|
return (new Key(key));
|
|
}
|
|
|
|
function readPkcs8RSAPrivate(der) {
|
|
der.readSequence(asn1.Ber.OctetString);
|
|
der.readSequence();
|
|
|
|
var ver = readMPInt(der, 'version');
|
|
assert.equal(ver[0], 0x0, 'unknown RSA private key version');
|
|
|
|
// modulus then public exponent
|
|
var n = readMPInt(der, 'modulus');
|
|
var e = readMPInt(der, 'public exponent');
|
|
var d = readMPInt(der, 'private exponent');
|
|
var p = readMPInt(der, 'prime1');
|
|
var q = readMPInt(der, 'prime2');
|
|
var dmodp = readMPInt(der, 'exponent1');
|
|
var dmodq = readMPInt(der, 'exponent2');
|
|
var iqmp = readMPInt(der, 'iqmp');
|
|
|
|
// now, make the key
|
|
var key = {
|
|
type: 'rsa',
|
|
parts: [
|
|
{ name: 'n', data: n },
|
|
{ name: 'e', data: e },
|
|
{ name: 'd', data: d },
|
|
{ name: 'iqmp', data: iqmp },
|
|
{ name: 'p', data: p },
|
|
{ name: 'q', data: q },
|
|
{ name: 'dmodp', data: dmodp },
|
|
{ name: 'dmodq', data: dmodq }
|
|
]
|
|
};
|
|
|
|
return (new PrivateKey(key));
|
|
}
|
|
|
|
function readPkcs8DSAPublic(der) {
|
|
der.readSequence();
|
|
|
|
var p = readMPInt(der, 'p');
|
|
var q = readMPInt(der, 'q');
|
|
var g = readMPInt(der, 'g');
|
|
|
|
// bit string sequence
|
|
der.readSequence(asn1.Ber.BitString);
|
|
der.readByte();
|
|
|
|
var y = readMPInt(der, 'y');
|
|
|
|
// now, make the key
|
|
var key = {
|
|
type: 'dsa',
|
|
parts: [
|
|
{ name: 'p', data: p },
|
|
{ name: 'q', data: q },
|
|
{ name: 'g', data: g },
|
|
{ name: 'y', data: y }
|
|
]
|
|
};
|
|
|
|
return (new Key(key));
|
|
}
|
|
|
|
function readPkcs8DSAPrivate(der) {
|
|
der.readSequence();
|
|
|
|
var p = readMPInt(der, 'p');
|
|
var q = readMPInt(der, 'q');
|
|
var g = readMPInt(der, 'g');
|
|
|
|
der.readSequence(asn1.Ber.OctetString);
|
|
var x = readMPInt(der, 'x');
|
|
|
|
/* The pkcs#8 format does not include the public key */
|
|
var y = utils.calculateDSAPublic(g, p, x);
|
|
|
|
var key = {
|
|
type: 'dsa',
|
|
parts: [
|
|
{ name: 'p', data: p },
|
|
{ name: 'q', data: q },
|
|
{ name: 'g', data: g },
|
|
{ name: 'y', data: y },
|
|
{ name: 'x', data: x }
|
|
]
|
|
};
|
|
|
|
return (new PrivateKey(key));
|
|
}
|
|
|
|
function readECDSACurve(der) {
|
|
var curveName, curveNames;
|
|
var j, c, cd;
|
|
|
|
if (der.peek() === asn1.Ber.OID) {
|
|
var oid = der.readOID();
|
|
|
|
curveNames = Object.keys(algs.curves);
|
|
for (j = 0; j < curveNames.length; ++j) {
|
|
c = curveNames[j];
|
|
cd = algs.curves[c];
|
|
if (cd.pkcs8oid === oid) {
|
|
curveName = c;
|
|
break;
|
|
}
|
|
}
|
|
|
|
} else {
|
|
// ECParameters sequence
|
|
der.readSequence();
|
|
var version = der.readString(asn1.Ber.Integer, true);
|
|
assert.strictEqual(version[0], 1, 'ECDSA key not version 1');
|
|
|
|
var curve = {};
|
|
|
|
// FieldID sequence
|
|
der.readSequence();
|
|
var fieldTypeOid = der.readOID();
|
|
assert.strictEqual(fieldTypeOid, '1.2.840.10045.1.1',
|
|
'ECDSA key is not from a prime-field');
|
|
var p = curve.p = utils.mpNormalize(
|
|
der.readString(asn1.Ber.Integer, true));
|
|
/*
|
|
* p always starts with a 1 bit, so count the zeros to get its
|
|
* real size.
|
|
*/
|
|
curve.size = p.length * 8 - utils.countZeros(p);
|
|
|
|
// Curve sequence
|
|
der.readSequence();
|
|
curve.a = utils.mpNormalize(
|
|
der.readString(asn1.Ber.OctetString, true));
|
|
curve.b = utils.mpNormalize(
|
|
der.readString(asn1.Ber.OctetString, true));
|
|
if (der.peek() === asn1.Ber.BitString)
|
|
curve.s = der.readString(asn1.Ber.BitString, true);
|
|
|
|
// Combined Gx and Gy
|
|
curve.G = der.readString(asn1.Ber.OctetString, true);
|
|
assert.strictEqual(curve.G[0], 0x4,
|
|
'uncompressed G is required');
|
|
|
|
curve.n = utils.mpNormalize(
|
|
der.readString(asn1.Ber.Integer, true));
|
|
curve.h = utils.mpNormalize(
|
|
der.readString(asn1.Ber.Integer, true));
|
|
assert.strictEqual(curve.h[0], 0x1, 'a cofactor=1 curve is ' +
|
|
'required');
|
|
|
|
curveNames = Object.keys(algs.curves);
|
|
var ks = Object.keys(curve);
|
|
for (j = 0; j < curveNames.length; ++j) {
|
|
c = curveNames[j];
|
|
cd = algs.curves[c];
|
|
var equal = true;
|
|
for (var i = 0; i < ks.length; ++i) {
|
|
var k = ks[i];
|
|
if (cd[k] === undefined)
|
|
continue;
|
|
if (typeof (cd[k]) === 'object' &&
|
|
cd[k].equals !== undefined) {
|
|
if (!cd[k].equals(curve[k])) {
|
|
equal = false;
|
|
break;
|
|
}
|
|
} else if (Buffer.isBuffer(cd[k])) {
|
|
if (cd[k].toString('binary')
|
|
!== curve[k].toString('binary')) {
|
|
equal = false;
|
|
break;
|
|
}
|
|
} else {
|
|
if (cd[k] !== curve[k]) {
|
|
equal = false;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
if (equal) {
|
|
curveName = c;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
return (curveName);
|
|
}
|
|
|
|
function readPkcs8ECDSAPrivate(der) {
|
|
var curveName = readECDSACurve(der);
|
|
assert.string(curveName, 'a known elliptic curve');
|
|
|
|
der.readSequence(asn1.Ber.OctetString);
|
|
der.readSequence();
|
|
|
|
var version = readMPInt(der, 'version');
|
|
assert.equal(version[0], 1, 'unknown version of ECDSA key');
|
|
|
|
var d = der.readString(asn1.Ber.OctetString, true);
|
|
var Q;
|
|
|
|
if (der.peek() == 0xa0) {
|
|
der.readSequence(0xa0);
|
|
der._offset += der.length;
|
|
}
|
|
if (der.peek() == 0xa1) {
|
|
der.readSequence(0xa1);
|
|
Q = der.readString(asn1.Ber.BitString, true);
|
|
Q = utils.ecNormalize(Q);
|
|
}
|
|
|
|
if (Q === undefined) {
|
|
var pub = utils.publicFromPrivateECDSA(curveName, d);
|
|
Q = pub.part.Q.data;
|
|
}
|
|
|
|
var key = {
|
|
type: 'ecdsa',
|
|
parts: [
|
|
{ name: 'curve', data: Buffer.from(curveName) },
|
|
{ name: 'Q', data: Q },
|
|
{ name: 'd', data: d }
|
|
]
|
|
};
|
|
|
|
return (new PrivateKey(key));
|
|
}
|
|
|
|
function readPkcs8ECDSAPublic(der) {
|
|
var curveName = readECDSACurve(der);
|
|
assert.string(curveName, 'a known elliptic curve');
|
|
|
|
var Q = der.readString(asn1.Ber.BitString, true);
|
|
Q = utils.ecNormalize(Q);
|
|
|
|
var key = {
|
|
type: 'ecdsa',
|
|
parts: [
|
|
{ name: 'curve', data: Buffer.from(curveName) },
|
|
{ name: 'Q', data: Q }
|
|
]
|
|
};
|
|
|
|
return (new Key(key));
|
|
}
|
|
|
|
function readPkcs8EdDSAPublic(der) {
|
|
if (der.peek() === 0x00)
|
|
der.readByte();
|
|
|
|
var A = utils.readBitString(der);
|
|
|
|
var key = {
|
|
type: 'ed25519',
|
|
parts: [
|
|
{ name: 'A', data: utils.zeroPadToLength(A, 32) }
|
|
]
|
|
};
|
|
|
|
return (new Key(key));
|
|
}
|
|
|
|
function readPkcs8X25519Public(der) {
|
|
var A = utils.readBitString(der);
|
|
|
|
var key = {
|
|
type: 'curve25519',
|
|
parts: [
|
|
{ name: 'A', data: utils.zeroPadToLength(A, 32) }
|
|
]
|
|
};
|
|
|
|
return (new Key(key));
|
|
}
|
|
|
|
function readPkcs8EdDSAPrivate(der) {
|
|
if (der.peek() === 0x00)
|
|
der.readByte();
|
|
|
|
der.readSequence(asn1.Ber.OctetString);
|
|
var k = der.readString(asn1.Ber.OctetString, true);
|
|
k = utils.zeroPadToLength(k, 32);
|
|
|
|
var A;
|
|
if (der.peek() === asn1.Ber.BitString) {
|
|
A = utils.readBitString(der);
|
|
A = utils.zeroPadToLength(A, 32);
|
|
} else {
|
|
A = utils.calculateED25519Public(k);
|
|
}
|
|
|
|
var key = {
|
|
type: 'ed25519',
|
|
parts: [
|
|
{ name: 'A', data: utils.zeroPadToLength(A, 32) },
|
|
{ name: 'k', data: utils.zeroPadToLength(k, 32) }
|
|
]
|
|
};
|
|
|
|
return (new PrivateKey(key));
|
|
}
|
|
|
|
function readPkcs8X25519Private(der) {
|
|
if (der.peek() === 0x00)
|
|
der.readByte();
|
|
|
|
der.readSequence(asn1.Ber.OctetString);
|
|
var k = der.readString(asn1.Ber.OctetString, true);
|
|
k = utils.zeroPadToLength(k, 32);
|
|
|
|
var A = utils.calculateX25519Public(k);
|
|
|
|
var key = {
|
|
type: 'curve25519',
|
|
parts: [
|
|
{ name: 'A', data: utils.zeroPadToLength(A, 32) },
|
|
{ name: 'k', data: utils.zeroPadToLength(k, 32) }
|
|
]
|
|
};
|
|
|
|
return (new PrivateKey(key));
|
|
}
|
|
|
|
function pkcs8ToBuffer(key) {
|
|
var der = new asn1.BerWriter();
|
|
writePkcs8(der, key);
|
|
return (der.buffer);
|
|
}
|
|
|
|
function writePkcs8(der, key) {
|
|
der.startSequence();
|
|
|
|
if (PrivateKey.isPrivateKey(key)) {
|
|
var sillyInt = Buffer.from([0]);
|
|
der.writeBuffer(sillyInt, asn1.Ber.Integer);
|
|
}
|
|
|
|
der.startSequence();
|
|
switch (key.type) {
|
|
case 'rsa':
|
|
der.writeOID('1.2.840.113549.1.1.1');
|
|
if (PrivateKey.isPrivateKey(key))
|
|
writePkcs8RSAPrivate(key, der);
|
|
else
|
|
writePkcs8RSAPublic(key, der);
|
|
break;
|
|
case 'dsa':
|
|
der.writeOID('1.2.840.10040.4.1');
|
|
if (PrivateKey.isPrivateKey(key))
|
|
writePkcs8DSAPrivate(key, der);
|
|
else
|
|
writePkcs8DSAPublic(key, der);
|
|
break;
|
|
case 'ecdsa':
|
|
der.writeOID('1.2.840.10045.2.1');
|
|
if (PrivateKey.isPrivateKey(key))
|
|
writePkcs8ECDSAPrivate(key, der);
|
|
else
|
|
writePkcs8ECDSAPublic(key, der);
|
|
break;
|
|
case 'ed25519':
|
|
der.writeOID('1.3.101.112');
|
|
if (PrivateKey.isPrivateKey(key))
|
|
throw (new Error('Ed25519 private keys in pkcs8 ' +
|
|
'format are not supported'));
|
|
writePkcs8EdDSAPublic(key, der);
|
|
break;
|
|
default:
|
|
throw (new Error('Unsupported key type: ' + key.type));
|
|
}
|
|
|
|
der.endSequence();
|
|
}
|
|
|
|
function writePkcs8RSAPrivate(key, der) {
|
|
der.writeNull();
|
|
der.endSequence();
|
|
|
|
der.startSequence(asn1.Ber.OctetString);
|
|
der.startSequence();
|
|
|
|
var version = Buffer.from([0]);
|
|
der.writeBuffer(version, asn1.Ber.Integer);
|
|
|
|
der.writeBuffer(key.part.n.data, asn1.Ber.Integer);
|
|
der.writeBuffer(key.part.e.data, asn1.Ber.Integer);
|
|
der.writeBuffer(key.part.d.data, asn1.Ber.Integer);
|
|
der.writeBuffer(key.part.p.data, asn1.Ber.Integer);
|
|
der.writeBuffer(key.part.q.data, asn1.Ber.Integer);
|
|
if (!key.part.dmodp || !key.part.dmodq)
|
|
utils.addRSAMissing(key);
|
|
der.writeBuffer(key.part.dmodp.data, asn1.Ber.Integer);
|
|
der.writeBuffer(key.part.dmodq.data, asn1.Ber.Integer);
|
|
der.writeBuffer(key.part.iqmp.data, asn1.Ber.Integer);
|
|
|
|
der.endSequence();
|
|
der.endSequence();
|
|
}
|
|
|
|
function writePkcs8RSAPublic(key, der) {
|
|
der.writeNull();
|
|
der.endSequence();
|
|
|
|
der.startSequence(asn1.Ber.BitString);
|
|
der.writeByte(0x00);
|
|
|
|
der.startSequence();
|
|
der.writeBuffer(key.part.n.data, asn1.Ber.Integer);
|
|
der.writeBuffer(key.part.e.data, asn1.Ber.Integer);
|
|
der.endSequence();
|
|
|
|
der.endSequence();
|
|
}
|
|
|
|
function writePkcs8DSAPrivate(key, der) {
|
|
der.startSequence();
|
|
der.writeBuffer(key.part.p.data, asn1.Ber.Integer);
|
|
der.writeBuffer(key.part.q.data, asn1.Ber.Integer);
|
|
der.writeBuffer(key.part.g.data, asn1.Ber.Integer);
|
|
der.endSequence();
|
|
|
|
der.endSequence();
|
|
|
|
der.startSequence(asn1.Ber.OctetString);
|
|
der.writeBuffer(key.part.x.data, asn1.Ber.Integer);
|
|
der.endSequence();
|
|
}
|
|
|
|
function writePkcs8DSAPublic(key, der) {
|
|
der.startSequence();
|
|
der.writeBuffer(key.part.p.data, asn1.Ber.Integer);
|
|
der.writeBuffer(key.part.q.data, asn1.Ber.Integer);
|
|
der.writeBuffer(key.part.g.data, asn1.Ber.Integer);
|
|
der.endSequence();
|
|
der.endSequence();
|
|
|
|
der.startSequence(asn1.Ber.BitString);
|
|
der.writeByte(0x00);
|
|
der.writeBuffer(key.part.y.data, asn1.Ber.Integer);
|
|
der.endSequence();
|
|
}
|
|
|
|
function writeECDSACurve(key, der) {
|
|
var curve = algs.curves[key.curve];
|
|
if (curve.pkcs8oid) {
|
|
/* This one has a name in pkcs#8, so just write the oid */
|
|
der.writeOID(curve.pkcs8oid);
|
|
|
|
} else {
|
|
// ECParameters sequence
|
|
der.startSequence();
|
|
|
|
var version = Buffer.from([1]);
|
|
der.writeBuffer(version, asn1.Ber.Integer);
|
|
|
|
// FieldID sequence
|
|
der.startSequence();
|
|
der.writeOID('1.2.840.10045.1.1'); // prime-field
|
|
der.writeBuffer(curve.p, asn1.Ber.Integer);
|
|
der.endSequence();
|
|
|
|
// Curve sequence
|
|
der.startSequence();
|
|
var a = curve.p;
|
|
if (a[0] === 0x0)
|
|
a = a.slice(1);
|
|
der.writeBuffer(a, asn1.Ber.OctetString);
|
|
der.writeBuffer(curve.b, asn1.Ber.OctetString);
|
|
der.writeBuffer(curve.s, asn1.Ber.BitString);
|
|
der.endSequence();
|
|
|
|
der.writeBuffer(curve.G, asn1.Ber.OctetString);
|
|
der.writeBuffer(curve.n, asn1.Ber.Integer);
|
|
var h = curve.h;
|
|
if (!h) {
|
|
h = Buffer.from([1]);
|
|
}
|
|
der.writeBuffer(h, asn1.Ber.Integer);
|
|
|
|
// ECParameters
|
|
der.endSequence();
|
|
}
|
|
}
|
|
|
|
function writePkcs8ECDSAPublic(key, der) {
|
|
writeECDSACurve(key, der);
|
|
der.endSequence();
|
|
|
|
var Q = utils.ecNormalize(key.part.Q.data, true);
|
|
der.writeBuffer(Q, asn1.Ber.BitString);
|
|
}
|
|
|
|
function writePkcs8ECDSAPrivate(key, der) {
|
|
writeECDSACurve(key, der);
|
|
der.endSequence();
|
|
|
|
der.startSequence(asn1.Ber.OctetString);
|
|
der.startSequence();
|
|
|
|
var version = Buffer.from([1]);
|
|
der.writeBuffer(version, asn1.Ber.Integer);
|
|
|
|
der.writeBuffer(key.part.d.data, asn1.Ber.OctetString);
|
|
|
|
der.startSequence(0xa1);
|
|
var Q = utils.ecNormalize(key.part.Q.data, true);
|
|
der.writeBuffer(Q, asn1.Ber.BitString);
|
|
der.endSequence();
|
|
|
|
der.endSequence();
|
|
der.endSequence();
|
|
}
|
|
|
|
function writePkcs8EdDSAPublic(key, der) {
|
|
der.endSequence();
|
|
|
|
utils.writeBitString(der, key.part.A.data);
|
|
}
|
|
|
|
function writePkcs8EdDSAPrivate(key, der) {
|
|
der.endSequence();
|
|
|
|
var k = utils.mpNormalize(key.part.k.data, true);
|
|
der.startSequence(asn1.Ber.OctetString);
|
|
der.writeBuffer(k, asn1.Ber.OctetString);
|
|
der.endSequence();
|
|
}
|