1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
// Copyright 2024 OpenPubkey
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
// SPDX-License-Identifier: Apache-2.0
package util
import (
"crypto"
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rand"
"crypto/rsa"
"crypto/x509"
"encoding/pem"
"fmt"
"os"
"github.com/lestrrat-go/jwx/v2/jwa"
"golang.org/x/crypto/ed25519"
)
func SKToX509Bytes(sk *ecdsa.PrivateKey) ([]byte, error) {
x509Encoded, err := x509.MarshalECPrivateKey(sk)
if err != nil {
return nil, err
}
return pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: x509Encoded}), nil
}
func WriteSKFile(fpath string, sk *ecdsa.PrivateKey) error {
pemBytes, err := SKToX509Bytes(sk)
if err != nil {
return err
}
return os.WriteFile(fpath, pemBytes, 0600)
}
func ReadSKFile(fpath string) (*ecdsa.PrivateKey, error) {
pemBytes, err := os.ReadFile(fpath)
if err != nil {
return nil, err
}
block, _ := pem.Decode([]byte(pemBytes))
return x509.ParseECPrivateKey(block.Bytes)
}
func GenKeyPair(alg jwa.KeyAlgorithm) (crypto.Signer, error) {
switch alg {
case jwa.ES256:
return ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
case jwa.RS256: // RSASSA-PKCS-v1.5 using SHA-256
return rsa.GenerateKey(rand.Reader, 2048)
case jwa.EdDSA:
_, privateKey, err := ed25519.GenerateKey(rand.Reader)
return privateKey, err
default:
return nil, fmt.Errorf("unsupported algorithm: %s", alg.String())
}
}
func B64SHA3_256(msg []byte) []byte {
h := crypto.SHA3_256.New()
h.Write(msg)
image := h.Sum(nil)
return Base64EncodeForJWT(image)
}
|
