#15 #16

README.md

@@ -206,6 +206,10 @@ Uint8List rsaPublicKeyExponentToBytes(RSAPublicKey publicKey);
 Uint8List rsaPrivateKeyToBytes(RSAPrivateKey privateKey);
 ASN1Object encodeDN(Map<String, String> dn);
 X509CertificateData x509CertificateFromPem(String pem);
+AsymmetricKeyPair generateEcKeyPair();
+String encodeEcPublicKeyToPem(ECPublicKey publicKey);
+String encodeEcPrivateKeyToPem(ECPrivateKey ecPrivateKey);
+String generateEccCsrPem(Map<String, String> attributes, ECPrivateKey privateKey, ECPublicKey publicKey);
 ```
 
 ### IterableUtils

lib/src/X509Utils.dart

@@ -105,18 +105,12 @@ class X509Utils {
   }
 
   ///
-  /// Generates a [AsymmetricKeyPair] with the given [keySize].
+  /// Generates a elliptic curve [AsymmetricKeyPair] with the **prime256v1** algorithm.
   ///
-  static AsymmetricKeyPair generateEccKeyPair({int keySize = 256}) {
-    var keyParams = ECKeyGeneratorParameters(ECCurve_secp256r1());
+  static AsymmetricKeyPair generateEcKeyPair() {
+    var keyParams = ECKeyGeneratorParameters(ECCurve_prime256v1());
 
-    var secureRandom = FortunaRandom();
-    var random = Random.secure();
-    var seeds = <int>[];
-    for (var i = 0; i < 32; i++) {
-      seeds.add(random.nextInt(255));
-    }
-    secureRandom.seed(KeyParameter(Uint8List.fromList(seeds)));
+    var secureRandom = _getSecureRandom();
 
     var rngParams = ParametersWithRandom(keyParams, secureRandom);
     var k = ECKeyGenerator();
@@ -181,6 +175,8 @@ class X509Utils {
   ///
   /// Generates a eliptic curve Certificate Signing Request with the given [attributes] using the given [privateKey] and [publicKey].
   ///
+  /// The CSR will be signed with algorithm **SHA-256/ECDSA**.
+  ///
   static String generateEccCsrPem(Map<String, String> attributes,
       ECPrivateKey privateKey, ECPublicKey publicKey) {
     ASN1ObjectIdentifier.registerFrequentNames();
@@ -213,7 +209,8 @@ class X509Utils {
   }
 
   static ECSignature eccSign(Uint8List inBytes, ECPrivateKey privateKey) {
-    var signer = ECDSASigner();
+    var signer = Signer('SHA-256/ECDSA');
+    //var signer = ECDSASigner();
     var privParams = PrivateKeyParameter<ECPrivateKey>(privateKey);
     var signParams = ParametersWithRandom(
       privParams,
@@ -273,6 +270,15 @@ class X509Utils {
   ///
   /// Enode the given elliptic curve [publicKey] to PEM format.
   ///
+  /// This is descripted in https://tools.ietf.org/html/rfc5480
+  ///
+  /// ```ASN1
+  /// SubjectPublicKeyInfo  ::=  SEQUENCE  {
+  ///     algorithm         AlgorithmIdentifier,
+  ///     subjectPublicKey  BIT STRING
+  /// }
+  /// ```
+  ///
   static String encodeEcPublicKeyToPem(ECPublicKey publicKey) {
     ASN1ObjectIdentifier.registerFrequentNames();
     var outer = ASN1Sequence();
@@ -298,18 +304,36 @@ class X509Utils {
   /// ECPrivateKey ::= SEQUENCE {
   ///   version        INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1),
   ///   privateKey     OCTET STRING
+  ///   parameters [0] ECParameters {{ NamedCurve }} OPTIONAL
+  ///   publicKey  [1] BIT STRING OPTIONAL
   /// }
+  ///
   /// ```
   ///
+  /// As descripted in the mentioned RFC, all optional values will always be set.
+  ///
   static String encodeEcPrivateKeyToPem(ECPrivateKey ecPrivateKey) {
+    ASN1ObjectIdentifier.registerFrequentNames();
     var outer = ASN1Sequence();
 
     var version = ASN1Integer(BigInt.from(1));
     var privateKeyAsBytes = _bigIntToBytes(ecPrivateKey.d);
     var privateKey = ASN1OctetString(privateKeyAsBytes);
+    var choice = ASN1Sequence(tag: 0xA0);
+
+    choice
+        .add(ASN1ObjectIdentifier.fromName(ecPrivateKey.parameters.domainName));
+
+    var publicKey = ASN1Sequence(tag: 0xA1);
+
+    var subjectPublicKey =
+        ASN1BitString(ecPrivateKey.parameters.G.getEncoded(false));
+    publicKey.add(subjectPublicKey);
 
     outer.add(version);
     outer.add(privateKey);
+    outer.add(choice);
+    outer.add(publicKey);
     var dataBase64 = base64.encode(outer.encodedBytes);
     var chunks = StringUtils.chunk(dataBase64, 64);
 
@@ -761,7 +785,9 @@ class X509Utils {
   static ASN1Sequence _makeEccPublicKeyBlock(ECPublicKey publicKey) {
     var algorithm = ASN1Sequence();
     algorithm.add(ASN1ObjectIdentifier.fromName('ecPublicKey'));
-    algorithm.add(ASN1ObjectIdentifier.fromName('prime256v1'));
+    algorithm
+        .add(ASN1ObjectIdentifier.fromName(publicKey.parameters.domainName));
+
     var subjectPublicKey = ASN1BitString(publicKey.Q.getEncoded(false));
 
     var outer = ASN1Sequence();

test/x509_utils_test.dart

@@ -307,16 +307,15 @@ h9vE3e4Cq0OS3DA=
   });
 
   test('Test encodeECPublicKeyToPem', () {
-    var pair = X509Utils.generateEccKeyPair();
+    var pair = X509Utils.generateEcKeyPair();
     var pem = X509Utils.encodeEcPublicKeyToPem(pair.publicKey);
     expect(pem.startsWith('-----BEGIN EC PUBLIC KEY-----'), true);
     expect(pem.endsWith('-----END EC PUBLIC KEY-----'), true);
   });
 
   test('Test encodeECPrivateKeyToPem', () {
-    var pair = X509Utils.generateEccKeyPair();
+    var pair = X509Utils.generateEcKeyPair();
     var pem = X509Utils.encodeEcPrivateKeyToPem(pair.privateKey);
-    // TODO Check
     expect(pem.startsWith('-----BEGIN EC PRIVATE KEY-----'), true);
     expect(pem.endsWith('-----END EC PRIVATE KEY-----'), true);
   });
@@ -343,7 +342,7 @@ h9vE3e4Cq0OS3DA=
   });
 
   test('Test generateEccCsrPem', () {
-    var pair = X509Utils.generateEccKeyPair();
+    var pair = X509Utils.generateEcKeyPair();
     var dn = {
       'CN': 'basic-utils.dev',
       'O': 'Magic Company',
@@ -352,8 +351,6 @@ h9vE3e4Cq0OS3DA=
       'C': 'DE',
     };
     var csr = X509Utils.generateEccCsrPem(dn, pair.privateKey, pair.publicKey);
-    print(csr);
-    // TODO The CSR is missing a NULL value in its AlgorithmIdentifier parameter.
     var bytes = X509Utils.getBytesFromPEMString(csr);
     var sequence = ASN1Sequence.fromBytes(bytes);
     ASN1Sequence e1 = sequence.elements.elementAt(0);