-
Notifications
You must be signed in to change notification settings - Fork 4
/
key.go
187 lines (164 loc) · 4.78 KB
/
key.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
package dsig
import (
"crypto"
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rand"
"errors"
"fmt"
"github.com/google/uuid"
"github.com/square/go-jose/v3"
)
const defaultKeyUse = "sig"
// The crypto/elliptic package doesn't provide constants for this.
const (
curveAlgorithmP256 = "P-256"
)
// PrivateKey makes it easy to deal with private keys used to sign data
// and created signatures.
// These should obviously be kept secure and be used to generate the public
// keys.
type PrivateKey struct {
jwk *jose.JSONWebKey
}
// PublicKey is generated from the private key and can be shared freely as it
// cannot be used to create signatures.
type PublicKey struct {
jwk *jose.JSONWebKey
}
// NewES256Key provides a new ECDSA 256 bit private key and assigns it
// an ID.
func NewES256Key() *PrivateKey {
pubCurve := elliptic.P256()
pk, _ := ecdsa.GenerateKey(pubCurve, rand.Reader)
return newKey(pk, string(jose.ES256))
}
func newKey(pk interface{}, alg string) *PrivateKey {
k := new(PrivateKey)
k.jwk = new(jose.JSONWebKey)
k.jwk.Key = pk
k.jwk.Algorithm = alg
k.jwk.Use = defaultKeyUse
k.jwk.KeyID = uuid.Must(uuid.NewRandom()).String()
return k
}
// ID provides the private key's UUID
func (k *PrivateKey) ID() string {
return k.jwk.KeyID
}
// ID provides the public key's UUID
func (k *PublicKey) ID() string {
return k.jwk.KeyID
}
// signatureAlgorithm attempts to determine the key's algorithm based on the
// key fields. This is a bit more reliable than depending on the
// optional `alg` property. Algorithm names provided match those
// required for signatures. Anything not defined here will not be supported
// for the time being.
func (k *PrivateKey) signatureAlgorithm() (jose.SignatureAlgorithm, error) {
if pk, ok := k.jwk.Key.(*ecdsa.PrivateKey); ok {
switch pk.Params().Name {
case curveAlgorithmP256:
return jose.ES256, nil
}
}
return "", errors.New("unrecognized key signature algorithm")
}
// Validate let's us know if the private key was generated or parsed correctly.
func (k *PrivateKey) Validate() error {
if k.jwk == nil {
return errors.New("key not set")
}
if k.ID() == "" {
return errors.New("id required")
}
if !k.jwk.Valid() {
return errors.New("jose key is invalid")
}
if k.jwk.IsPublic() {
return errors.New("private key only contains public part")
}
return nil
}
// Validate let's us know if the public key was parsed correctly.
func (k *PublicKey) Validate() error {
if k.jwk == nil {
return errors.New("key not set")
}
if k.ID() == "" {
return errors.New("id required")
}
if !k.jwk.Valid() {
return errors.New("jose key is invalid")
}
if !k.jwk.IsPublic() {
return errors.New("public key is private")
}
return nil
}
// Public provides the public counterpart of a private key, ready to be used
// to be persisted in a key store and verify signatures.
func (k *PrivateKey) Public() *PublicKey {
pk := new(PublicKey)
jwk := k.jwk.Public()
pk.jwk = &jwk
return pk
}
// Sign is a helper method that will generate a signature using the
// private key.
func (k *PrivateKey) Sign(data interface{}) (*Signature, error) {
return NewSignature(k, data)
}
// Verify is a wrapper around the signature's VerifyPayload method for
// the sake of convenience.
func (k *PublicKey) Verify(sig *Signature, payload interface{}) error {
return sig.VerifyPayload(k, payload)
}
// Thumbprint returns the SHA256 hex string of the private key's thumbprint.
// Extremely useful for quickly checking that two keys, either public or private,
// are the same.
func (k *PrivateKey) Thumbprint() string {
return keyThumbprint(k.jwk)
}
// Thumbprint returns the SHA256 hex string of the public key's thumbprint.
// Extremely useful for quickly checking that two keys are the same.
func (k *PublicKey) Thumbprint() string {
return keyThumbprint(k.jwk)
}
func keyThumbprint(jwk *jose.JSONWebKey) string {
d, err := jwk.Thumbprint(crypto.SHA256)
if err != nil {
return ""
}
return fmt.Sprintf("%x", d)
}
// MarshalJSON provides the JSON version of the key.
func (k *PrivateKey) MarshalJSON() ([]byte, error) {
return k.jwk.MarshalJSON()
}
// MarshalJSON provides the JSON version of the key.
func (k *PublicKey) MarshalJSON() ([]byte, error) {
return k.jwk.MarshalJSON()
}
// UnmarshalJSON parses the JSON private key data. You should perform
// validation on the key to ensure it was provided correctly.
func (k *PrivateKey) UnmarshalJSON(data []byte) error {
if len(data) == 0 {
return nil
}
if k.jwk == nil {
k.jwk = new(jose.JSONWebKey)
}
return k.jwk.UnmarshalJSON(data)
}
// UnmarshalJSON parses the JSON public key data. You should perform
// validation on the key to ensure it was provided correctly.
func (k *PublicKey) UnmarshalJSON(data []byte) error {
if len(data) == 0 {
return nil
}
if k.jwk == nil {
k.jwk = new(jose.JSONWebKey)
}
return k.jwk.UnmarshalJSON(data)
}