Compare commits
No commits in common. "master" and "v0.1.1" have entirely different histories.
227
README.md
227
README.md
@ -1,224 +1,55 @@
|
|||||||
[Eckles.js](https://git.coolaj86.com/coolaj86/eckles.js)
|
eckles.js
|
||||||
=========
|
=========
|
||||||
|
|
||||||
A [Root](https://therootcompany.com) Project.
|
ECDSA tools. Lightweight. Zero Dependencies. Universal compatibility.
|
||||||
Built for [ACME.js](https://git.coolaj86.com/coolaj86/acme.js)
|
|
||||||
and [Greenlock.js](https://git.coolaj86.com/coolaj86/greenlock.js)
|
|
||||||
|
|
||||||
| < 600 lines of code | 3kb gzipped | 10kb minified | 17kb with comments |
|
> I _just_ cleaned up the PEM-to-JWK functionality enough to publish.
|
||||||
|
> I also have the JWK-to-PEM functionality _mostly_ built, but not enough to publish.
|
||||||
|
|
||||||
ECDSA (elliptic curve) tools. Lightweight. Zero Dependencies. Universal compatibility.
|
* P-256 (prime256v1, secp256r1)
|
||||||
|
* P-384 (secp384r1)
|
||||||
* [x] Fast and Easy EC Key Generation
|
* PKCS#8
|
||||||
* [x] PEM-to-JWK
|
* SEC1/X9.62
|
||||||
* [x] JWK-to-PEM
|
* PEM-to-JWK
|
||||||
* [x] JWK thumbprint
|
|
||||||
* [x] SSH "pub" format
|
|
||||||
* [x] CLI
|
|
||||||
* See [Eckles CLI](https://git.coolaj86.com/coolaj86/eckles-cli.js)
|
|
||||||
* [ ] RSA
|
|
||||||
* **Need RSA tools?** Check out [Rasha.js](https://git.coolaj86.com/coolaj86/rasha.js)
|
|
||||||
|
|
||||||
## Install
|
|
||||||
|
|
||||||
For node.js:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
npm install --save eckles
|
|
||||||
```
|
|
||||||
|
|
||||||
CLI:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
npm install -g eckles
|
|
||||||
```
|
|
||||||
|
|
||||||
See [Eckles CLI](https://git.coolaj86.com/coolaj86/eckles-cli.js)
|
|
||||||
|
|
||||||
## Generate EC (ECDSA/ECDH) Key
|
|
||||||
|
|
||||||
Achieves the *fastest possible key generation* using node's native EC bindings to OpenSSL,
|
|
||||||
then converts to JWK for ease-of-use.
|
|
||||||
|
|
||||||
```js
|
```js
|
||||||
Eckles.generate({ format: 'jwk' }).then(function (keypair) {
|
var eckles = require('eckles');
|
||||||
console.log(keypair.private);
|
var pem = require('fs').readFileSync('./fixtures/privkey-ec-p256.sec1.pem', 'ascii')
|
||||||
console.log(keypair.public);
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
**options**
|
eckles.import({ pem: pem }).then(function (jwk) {
|
||||||
|
|
||||||
* `format` defaults to `'jwk'`
|
|
||||||
* `'sec1'` (traditional)
|
|
||||||
* `'pkcs8'`
|
|
||||||
* `'ssh'`
|
|
||||||
* `encoding` defaults to `'json'`
|
|
||||||
* `'pem'` (type + DER.toString('base64'))
|
|
||||||
* `'der'`
|
|
||||||
|
|
||||||
**advanced options**
|
|
||||||
|
|
||||||
* `namedCurve` defaults to `'P-256'`
|
|
||||||
* `P-384` is also supported
|
|
||||||
* larger keys have not been implemented
|
|
||||||
* A) because they're a senseless waste
|
|
||||||
* B) they have similar, but slightly different formats
|
|
||||||
|
|
||||||
## PEM-to-JWK
|
|
||||||
|
|
||||||
* [x] SEC1/X9.62, PKCS#8, SPKI/PKIX
|
|
||||||
* [x] P-256 (prime256v1, secp256r1), P-384 (secp384r1)
|
|
||||||
* [x] SSH (RFC4716), (RFC 4716/SSH2)
|
|
||||||
|
|
||||||
```js
|
|
||||||
var Eckles = require('eckles');
|
|
||||||
var pem = require('fs')
|
|
||||||
.readFileSync('./node_modles/eckles/fixtures/privkey-ec-p256.sec1.pem', 'ascii');
|
|
||||||
|
|
||||||
Eckles.import({ pem: pem }).then(function (jwk) {
|
|
||||||
console.log(jwk);
|
console.log(jwk);
|
||||||
|
/*
|
||||||
|
{
|
||||||
|
"kty": "EC",
|
||||||
|
"crv": "P-256",
|
||||||
|
"d": "iYydo27aNGO9DBUWeGEPD8oNi1LZDqfxPmQlieLBjVQ",
|
||||||
|
"x": "IT1SWLxsacPiE5Z16jkopAn8_-85rMjgyCokrnjDft4",
|
||||||
|
"y": "mP2JwOAOdMmXuwpxbKng3KZz27mz-nKWIlXJ3rzSGMo"
|
||||||
|
}
|
||||||
|
*/
|
||||||
});
|
});
|
||||||
```
|
```
|
||||||
|
|
||||||
|
<!--
|
||||||
```js
|
```js
|
||||||
{
|
eckles.export({ jwk: jwk }).then(function (pem) {
|
||||||
"kty": "EC",
|
// PEM in pkcs#8 format
|
||||||
"crv": "P-256",
|
|
||||||
"d": "iYydo27aNGO9DBUWeGEPD8oNi1LZDqfxPmQlieLBjVQ",
|
|
||||||
"x": "IT1SWLxsacPiE5Z16jkopAn8_-85rMjgyCokrnjDft4",
|
|
||||||
"y": "mP2JwOAOdMmXuwpxbKng3KZz27mz-nKWIlXJ3rzSGMo"
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
## JWK-to-PEM
|
|
||||||
|
|
||||||
* [x] SEC1/X9.62, PKCS#8, SPKI/PKIX
|
|
||||||
* [x] P-256 (prime256v1, secp256r1), P-384 (secp384r1)
|
|
||||||
* [x] SSH (RFC4716), (RFC 4716/SSH2)
|
|
||||||
|
|
||||||
```js
|
|
||||||
var Eckles = require('eckles');
|
|
||||||
var jwk = require('eckles/fixtures/privkey-ec-p256.jwk.json');
|
|
||||||
|
|
||||||
Eckles.export({ jwk: jwk }).then(function (pem) {
|
|
||||||
// PEM in SEC1 (x9.62) format
|
|
||||||
console.log(pem);
|
console.log(pem);
|
||||||
});
|
});
|
||||||
```
|
```
|
||||||
|
|
||||||
```
|
|
||||||
-----BEGIN EC PRIVATE KEY-----
|
|
||||||
MHcCAQEEIImMnaNu2jRjvQwVFnhhDw/KDYtS2Q6n8T5kJYniwY1UoAoGCCqGSM49
|
|
||||||
AwEHoUQDQgAEIT1SWLxsacPiE5Z16jkopAn8/+85rMjgyCokrnjDft6Y/YnA4A50
|
|
||||||
yZe7CnFsqeDcpnPbubP6cpYiVcnevNIYyg==
|
|
||||||
-----END EC PRIVATE KEY-----
|
|
||||||
```
|
|
||||||
|
|
||||||
### Advanced Options
|
|
||||||
|
|
||||||
`format: 'pkcs8'`:
|
|
||||||
|
|
||||||
The default output format is `sec1`/`x9.62` (EC-specific format) is used for private keys.
|
|
||||||
Use `format: 'pkcs8'` to output in PKCS#8 format instead.
|
|
||||||
|
|
||||||
```js
|
```js
|
||||||
Eckles.export({ jwk: jwk, format: 'pkcs8' }).then(function (pem) {
|
eckles.exportSEC1(jwk).then(function (pem) {
|
||||||
// PEM in PKCS#8 format
|
// PEM in sec1 (x9.62) format
|
||||||
console.log(pem);
|
console.log(pem);
|
||||||
});
|
});
|
||||||
```
|
```
|
||||||
|
-->
|
||||||
|
|
||||||
```
|
Goals
|
||||||
-----BEGIN PRIVATE KEY-----
|
|
||||||
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgiYydo27aNGO9DBUW
|
|
||||||
eGEPD8oNi1LZDqfxPmQlieLBjVShRANCAAQhPVJYvGxpw+ITlnXqOSikCfz/7zms
|
|
||||||
yODIKiSueMN+3pj9icDgDnTJl7sKcWyp4Nymc9u5s/pyliJVyd680hjK
|
|
||||||
-----END PRIVATE KEY-----
|
|
||||||
```
|
|
||||||
|
|
||||||
`format: 'ssh'`:
|
|
||||||
|
|
||||||
Although SSH uses SEC1 for private keys, it uses ts own special non-ASN1 format
|
|
||||||
(affectionately known as rfc4716) for public keys. I got curious and then decided
|
|
||||||
to add this format as well.
|
|
||||||
|
|
||||||
To get the same format as you
|
|
||||||
would get with `ssh-keygen`, pass `ssh` as the format option:
|
|
||||||
|
|
||||||
```js
|
|
||||||
Eckles.export({ jwk: jwk, format: 'ssh' }).then(function (pub) {
|
|
||||||
// Special SSH2 Public Key format (RFC 4716)
|
|
||||||
console.log(pub);
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
```
|
|
||||||
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCE9Uli8bGnD4hOWdeo5KKQJ/P/vOazI4MgqJK54w37emP2JwOAOdMmXuwpxbKng3KZz27mz+nKWIlXJ3rzSGMo= P-256@localhost
|
|
||||||
```
|
|
||||||
|
|
||||||
`public: 'true'`:
|
|
||||||
|
|
||||||
If a private key is used as input, a private key will be output.
|
|
||||||
|
|
||||||
If you'd like to output a public key instead you can pass `public: true` or `format: 'spki'`.
|
|
||||||
|
|
||||||
```js
|
|
||||||
Eckles.export({ jwk: jwk, public: true }).then(function (pem) {
|
|
||||||
// PEM in SPKI/PKIX format
|
|
||||||
console.log(pem);
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
```
|
|
||||||
-----BEGIN PUBLIC KEY-----
|
|
||||||
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIT1SWLxsacPiE5Z16jkopAn8/+85
|
|
||||||
rMjgyCokrnjDft6Y/YnA4A50yZe7CnFsqeDcpnPbubP6cpYiVcnevNIYyg==
|
|
||||||
-----END PUBLIC KEY-----
|
|
||||||
```
|
|
||||||
|
|
||||||
## JWK Thumbprint
|
|
||||||
|
|
||||||
```js
|
|
||||||
Eckles.thumbprint({ jwk: jwk }).then(function (thumbprint) {
|
|
||||||
console.log(thumbprint);
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
Testing
|
|
||||||
-------
|
|
||||||
|
|
||||||
All cases are tested in `test.sh`.
|
|
||||||
|
|
||||||
You can compare these keys to the ones that you get from OpenSSL, ssh-keygen, and WebCrypto:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Generate EC P-256 Keypair
|
|
||||||
openssl ecparam -genkey -name prime256v1 -noout -out ./privkey-ec-p256.sec1.pem
|
|
||||||
|
|
||||||
# Export Public-only EC Key (as SPKI)
|
|
||||||
openssl ec -in ./privkey-ec-p256.sec1.pem -pubout -out ./pub-ec-p256.spki.pem
|
|
||||||
|
|
||||||
# Convert SEC1 (traditional) EC Keypair to PKCS8 format
|
|
||||||
openssl pkcs8 -topk8 -nocrypt -in ./privkey-ec-p256.sec1.pem -out ./privkey-ec-p256.pkcs8.pem
|
|
||||||
|
|
||||||
# Convert EC public key to SSH format
|
|
||||||
ssh-keygen -f ./pub-ec-p256.spki.pem -i -mPKCS8 > ./pub-ec-p256.ssh.pub
|
|
||||||
```
|
|
||||||
|
|
||||||
Goals of this project
|
|
||||||
-----
|
-----
|
||||||
|
|
||||||
* Zero Dependencies
|
* Zero Dependencies
|
||||||
* Focused support for P-256 and P-384, which are already universally supported.
|
* Focused support for P-256 and P-384, which are already universally supported.
|
||||||
* Convert both ways
|
* Convert both ways
|
||||||
* Browser support as well (TODO)
|
* Browser support as well
|
||||||
* OpenSSL, ssh-keygen, and WebCrypto compatibility
|
|
||||||
|
|
||||||
Legal
|
|
||||||
-----
|
|
||||||
|
|
||||||
[Eckles.js](https://git.coolaj86.com/coolaj86/eckles.js) |
|
|
||||||
MPL-2.0 |
|
|
||||||
[Terms of Use](https://therootcompany.com/legal/#terms) |
|
|
||||||
[Privacy Policy](https://therootcompany.com/legal/#privacy)
|
|
||||||
|
|||||||
@ -2,69 +2,13 @@
|
|||||||
'use strict';
|
'use strict';
|
||||||
|
|
||||||
var fs = require('fs');
|
var fs = require('fs');
|
||||||
var Eckles = require('../index.js');
|
var eckles = require('../index.js');
|
||||||
|
|
||||||
var infile = process.argv[2];
|
var infile = process.argv[2];
|
||||||
var format = process.argv[3];
|
//var outfile = process.argv[3];
|
||||||
|
|
||||||
if (!infile) {
|
var keypem = fs.readFileSync(infile, 'ascii');
|
||||||
infile = 'jwk';
|
|
||||||
}
|
|
||||||
|
|
||||||
if (-1 !== [ 'jwk', 'pem', 'json', 'der', 'sec1', 'pkcs8', 'spki', 'ssh' ].indexOf(infile)) {
|
eckles.import({ pem: keypem }).then(function (jwk) {
|
||||||
console.log("Generating new key...");
|
console.log(JSON.stringify(jwk, null, 2));
|
||||||
Eckles.generate({
|
});
|
||||||
format: infile
|
|
||||||
, namedCurve: format === 'P-384' ? 'P-384' : 'P-256'
|
|
||||||
, encoding: format === 'der' ? 'der' : 'pem'
|
|
||||||
}).then(function (key) {
|
|
||||||
if ('der' === infile || 'der' === format) {
|
|
||||||
key.private = key.private.toString('binary');
|
|
||||||
key.public = key.public.toString('binary');
|
|
||||||
}
|
|
||||||
console.log(key.private);
|
|
||||||
console.log(key.public);
|
|
||||||
}).catch(function (err) {
|
|
||||||
console.error(err);
|
|
||||||
process.exit(1);
|
|
||||||
});
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
var key = fs.readFileSync(infile, 'ascii');
|
|
||||||
|
|
||||||
try {
|
|
||||||
key = JSON.parse(key);
|
|
||||||
} catch(e) {
|
|
||||||
// ignore
|
|
||||||
}
|
|
||||||
|
|
||||||
var thumbprint = ('thumbprint' === format);
|
|
||||||
if (thumbprint) {
|
|
||||||
format = 'public';
|
|
||||||
}
|
|
||||||
|
|
||||||
if ('string' === typeof key) {
|
|
||||||
if (thumbprint) {
|
|
||||||
Eckles.thumbprint({ pem: key }).then(console.log);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
var pub = (-1 !== [ 'public', 'spki', 'pkix' ].indexOf(format));
|
|
||||||
Eckles.import({ pem: key, public: (pub || format) }).then(function (jwk) {
|
|
||||||
console.log(JSON.stringify(jwk, null, 2));
|
|
||||||
}).catch(function (err) {
|
|
||||||
console.error(err);
|
|
||||||
process.exit(1);
|
|
||||||
});
|
|
||||||
} else {
|
|
||||||
if (thumbprint) {
|
|
||||||
Eckles.thumbprint({ jwk: key }).then(console.log);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
Eckles.export({ jwk: key, format: format }).then(function (pem) {
|
|
||||||
console.log(pem);
|
|
||||||
}).catch(function (err) {
|
|
||||||
console.error(err);
|
|
||||||
process.exit(2);
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|||||||
@ -1,7 +0,0 @@
|
|||||||
{
|
|
||||||
"kty": "EC",
|
|
||||||
"crv": "P-256",
|
|
||||||
"d": "iYydo27aNGO9DBUWeGEPD8oNi1LZDqfxPmQlieLBjVQ",
|
|
||||||
"x": "IT1SWLxsacPiE5Z16jkopAn8_-85rMjgyCokrnjDft4",
|
|
||||||
"y": "mP2JwOAOdMmXuwpxbKng3KZz27mz-nKWIlXJ3rzSGMo"
|
|
||||||
}
|
|
||||||
@ -1,5 +1,5 @@
|
|||||||
-----BEGIN PRIVATE KEY-----
|
-----BEGIN EC PRIVATE KEY-----
|
||||||
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgiYydo27aNGO9DBUW
|
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgiYydo27aNGO9DBUW
|
||||||
eGEPD8oNi1LZDqfxPmQlieLBjVShRANCAAQhPVJYvGxpw+ITlnXqOSikCfz/7zms
|
eGEPD8oNi1LZDqfxPmQlieLBjVShRANCAAQhPVJYvGxpw+ITlnXqOSikCfz/7zms
|
||||||
yODIKiSueMN+3pj9icDgDnTJl7sKcWyp4Nymc9u5s/pyliJVyd680hjK
|
yODIKiSueMN+3pj9icDgDnTJl7sKcWyp4Nymc9u5s/pyliJVyd680hjK
|
||||||
-----END PRIVATE KEY-----
|
-----END EC PRIVATE KEY-----
|
||||||
|
|||||||
@ -1,7 +0,0 @@
|
|||||||
{
|
|
||||||
"kty": "EC",
|
|
||||||
"crv": "P-384",
|
|
||||||
"d": "XlyuCEWSTTS8U79O_Mz05z18vh4kb10szvu_7pdXuGWV6lfEyPExyUYWsA6A2kdV",
|
|
||||||
"x": "2zEU0bKCa7ejKLIJ8oPGnLhqhxyiv4_w38K2a0SPC6dsSd9_glNJ8lcqv0sff5Gb",
|
|
||||||
"y": "VD4jnu83S6scn6_TeAj3EZOREGbOs6dzoVpaugn-XQMMyC9O4VLbDDFGBZTJlMsb"
|
|
||||||
}
|
|
||||||
@ -1,6 +1,6 @@
|
|||||||
-----BEGIN PRIVATE KEY-----
|
-----BEGIN EC PRIVATE KEY-----
|
||||||
MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBeXK4IRZJNNLxTv078
|
MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBeXK4IRZJNNLxTv078
|
||||||
zPTnPXy+HiRvXSzO+7/ul1e4ZZXqV8TI8THJRhawDoDaR1WhZANiAATbMRTRsoJr
|
zPTnPXy+HiRvXSzO+7/ul1e4ZZXqV8TI8THJRhawDoDaR1WhZANiAATbMRTRsoJr
|
||||||
t6Mosgnyg8acuGqHHKK/j/DfwrZrRI8Lp2xJ33+CU0nyVyq/Sx9/kZtUPiOe7zdL
|
t6Mosgnyg8acuGqHHKK/j/DfwrZrRI8Lp2xJ33+CU0nyVyq/Sx9/kZtUPiOe7zdL
|
||||||
qxyfr9N4CPcRk5EQZs6zp3OhWlq6Cf5dAwzIL07hUtsMMUYFlMmUyxs=
|
qxyfr9N4CPcRk5EQZs6zp3OhWlq6Cf5dAwzIL07hUtsMMUYFlMmUyxs=
|
||||||
-----END PRIVATE KEY-----
|
-----END EC PRIVATE KEY-----
|
||||||
|
|||||||
@ -1,6 +0,0 @@
|
|||||||
{
|
|
||||||
"kty": "EC",
|
|
||||||
"crv": "P-256",
|
|
||||||
"x": "IT1SWLxsacPiE5Z16jkopAn8_-85rMjgyCokrnjDft4",
|
|
||||||
"y": "mP2JwOAOdMmXuwpxbKng3KZz27mz-nKWIlXJ3rzSGMo"
|
|
||||||
}
|
|
||||||
@ -1 +0,0 @@
|
|||||||
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCE9Uli8bGnD4hOWdeo5KKQJ/P/vOazI4MgqJK54w37emP2JwOAOdMmXuwpxbKng3KZz27mz+nKWIlXJ3rzSGMo= P-256@localhost
|
|
||||||
@ -1,6 +0,0 @@
|
|||||||
{
|
|
||||||
"kty": "EC",
|
|
||||||
"crv": "P-384",
|
|
||||||
"x": "2zEU0bKCa7ejKLIJ8oPGnLhqhxyiv4_w38K2a0SPC6dsSd9_glNJ8lcqv0sff5Gb",
|
|
||||||
"y": "VD4jnu83S6scn6_TeAj3EZOREGbOs6dzoVpaugn-XQMMyC9O4VLbDDFGBZTJlMsb"
|
|
||||||
}
|
|
||||||
@ -1 +0,0 @@
|
|||||||
ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBNsxFNGygmu3oyiyCfKDxpy4aoccor+P8N/CtmtEjwunbEnff4JTSfJXKr9LH3+Rm1Q+I57vN0urHJ+v03gI9xGTkRBmzrOnc6FaWroJ/l0DDMgvTuFS2wwxRgWUyZTLGw== P-384@localhost
|
|
||||||
61
lib/asn1.js
61
lib/asn1.js
@ -1,61 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var Enc = require('./encoding.js');
|
|
||||||
|
|
||||||
//
|
|
||||||
// A dumbed-down, minimal ASN.1 packer
|
|
||||||
//
|
|
||||||
|
|
||||||
// Almost every ASN.1 type that's important for CSR
|
|
||||||
// can be represented generically with only a few rules.
|
|
||||||
var ASN1 = module.exports = function ASN1(/*type, hexstrings...*/) {
|
|
||||||
var args = Array.prototype.slice.call(arguments);
|
|
||||||
var typ = args.shift();
|
|
||||||
var str = args.join('').replace(/\s+/g, '').toLowerCase();
|
|
||||||
var len = (str.length/2);
|
|
||||||
var lenlen = 0;
|
|
||||||
var hex = typ;
|
|
||||||
|
|
||||||
// We can't have an odd number of hex chars
|
|
||||||
if (len !== Math.round(len)) {
|
|
||||||
throw new Error("invalid hex");
|
|
||||||
}
|
|
||||||
|
|
||||||
// The first byte of any ASN.1 sequence is the type (Sequence, Integer, etc)
|
|
||||||
// The second byte is either the size of the value, or the size of its size
|
|
||||||
|
|
||||||
// 1. If the second byte is < 0x80 (128) it is considered the size
|
|
||||||
// 2. If it is > 0x80 then it describes the number of bytes of the size
|
|
||||||
// ex: 0x82 means the next 2 bytes describe the size of the value
|
|
||||||
// 3. The special case of exactly 0x80 is "indefinite" length (to end-of-file)
|
|
||||||
|
|
||||||
if (len > 127) {
|
|
||||||
lenlen += 1;
|
|
||||||
while (len > 255) {
|
|
||||||
lenlen += 1;
|
|
||||||
len = len >> 8;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (lenlen) { hex += Enc.numToHex(0x80 + lenlen); }
|
|
||||||
return hex + Enc.numToHex(str.length/2) + str;
|
|
||||||
};
|
|
||||||
|
|
||||||
// The Integer type has some special rules
|
|
||||||
ASN1.UInt = function UINT() {
|
|
||||||
var str = Array.prototype.slice.call(arguments).join('');
|
|
||||||
var first = parseInt(str.slice(0, 2), 16);
|
|
||||||
|
|
||||||
// If the first byte is 0x80 or greater, the number is considered negative
|
|
||||||
// Therefore we add a '00' prefix if the 0x80 bit is set
|
|
||||||
if (0x80 & first) { str = '00' + str; }
|
|
||||||
|
|
||||||
return ASN1('02', str);
|
|
||||||
};
|
|
||||||
|
|
||||||
// The Bit String type also has a special rule
|
|
||||||
ASN1.BitStr = function BITSTR() {
|
|
||||||
var str = Array.prototype.slice.call(arguments).join('');
|
|
||||||
// '00' is a mask of how many bits of the next byte to ignore
|
|
||||||
return ASN1('03', '00' + str);
|
|
||||||
};
|
|
||||||
443
lib/eckles.js
443
lib/eckles.js
@ -1,11 +1,6 @@
|
|||||||
'use strict';
|
'use strict';
|
||||||
|
|
||||||
var EC = module.exports;
|
var Hex = {};
|
||||||
|
|
||||||
var Enc = require('./encoding.js');
|
|
||||||
var PEM = require('./pem.js');
|
|
||||||
var SSH = require('./ssh.js');
|
|
||||||
var x509 = require('./x509.js');
|
|
||||||
|
|
||||||
// 1.2.840.10045.3.1.7
|
// 1.2.840.10045.3.1.7
|
||||||
// prime256v1 (ANSI X9.62 named elliptic curve)
|
// prime256v1 (ANSI X9.62 named elliptic curve)
|
||||||
@ -14,237 +9,235 @@ var OBJ_ID_EC = '06 08 2A8648CE3D030107'.replace(/\s+/g, '').toLowerCase();
|
|||||||
// secp384r1 (SECG (Certicom) named elliptic curve)
|
// secp384r1 (SECG (Certicom) named elliptic curve)
|
||||||
var OBJ_ID_EC_384 = '06 05 2B81040022'.replace(/\s+/g, '').toLowerCase();
|
var OBJ_ID_EC_384 = '06 05 2B81040022'.replace(/\s+/g, '').toLowerCase();
|
||||||
|
|
||||||
|
|
||||||
// The one good thing that came from the b***kchain hysteria: good EC documentation
|
// The one good thing that came from the b***kchain hysteria: good EC documentation
|
||||||
// https://davidederosa.com/basic-blockchain-programming/elliptic-curve-keys/
|
// https://davidederosa.com/basic-blockchain-programming/elliptic-curve-keys/
|
||||||
|
|
||||||
|
var PEM = {};
|
||||||
|
PEM._toUrlSafeBase64 = function (u8) {
|
||||||
|
//console.log('Len:', u8.byteLength);
|
||||||
|
return Buffer.from(u8).toString('base64')
|
||||||
|
.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
|
||||||
|
};
|
||||||
|
|
||||||
|
function toHex(ab) {
|
||||||
|
var hex = [];
|
||||||
|
var u8 = new Uint8Array(ab);
|
||||||
|
var size = u8.byteLength;
|
||||||
|
var i;
|
||||||
|
var h;
|
||||||
|
for (i = 0; i < size; i += 1) {
|
||||||
|
h = u8[i].toString(16);
|
||||||
|
if (2 === h.length) {
|
||||||
|
hex.push(h);
|
||||||
|
} else {
|
||||||
|
hex.push('0' + h);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return hex.join('').replace(/\s+/g, '').toLowerCase();
|
||||||
|
}
|
||||||
|
Hex.fromAB = toHex;
|
||||||
|
|
||||||
|
function parsePem(pem) {
|
||||||
|
var typ;
|
||||||
|
var pub;
|
||||||
|
var crv;
|
||||||
|
var der = Buffer.from(pem.split(/\n/).filter(function (line, i) {
|
||||||
|
if (0 === i) {
|
||||||
|
if (/ PUBLIC /.test(line)) {
|
||||||
|
pub = true;
|
||||||
|
} else if (/ PRIVATE /.test(line)) {
|
||||||
|
pub = false;
|
||||||
|
}
|
||||||
|
if (/ EC/.test(line)) {
|
||||||
|
typ = 'EC';
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return !/---/.test(line);
|
||||||
|
}).join(''), 'base64');
|
||||||
|
|
||||||
|
if (!typ || 'EC' === typ) {
|
||||||
|
var hex = toHex(der);
|
||||||
|
if (-1 !== hex.indexOf(OBJ_ID_EC)) {
|
||||||
|
typ = 'EC';
|
||||||
|
crv = 'P-256';
|
||||||
|
} else if (-1 !== hex.indexOf(OBJ_ID_EC_384)) {
|
||||||
|
typ = 'EC';
|
||||||
|
crv = 'P-384';
|
||||||
|
} else {
|
||||||
|
// TODO support P-384 as well (but probably nothing else)
|
||||||
|
console.warn("unsupported ec curve");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return { typ: typ, pub: pub, der: der, crv: crv };
|
||||||
|
}
|
||||||
|
|
||||||
|
function parseEcOnlyPrivkey(u8, jwk) {
|
||||||
|
var index = 7;
|
||||||
|
var len = 32;
|
||||||
|
var olen = OBJ_ID_EC.length/2;
|
||||||
|
|
||||||
|
if ("P-384" === jwk.crv) {
|
||||||
|
olen = OBJ_ID_EC_384.length/2;
|
||||||
|
index = 8;
|
||||||
|
len = 48;
|
||||||
|
}
|
||||||
|
if (len !== u8[index - 1]) {
|
||||||
|
throw new Error("Unexpected bitlength " + len);
|
||||||
|
}
|
||||||
|
|
||||||
|
// private part is d
|
||||||
|
var d = u8.slice(index, index + len);
|
||||||
|
// compression bit index
|
||||||
|
var ci = index + len + 2 + olen + 2 + 3;
|
||||||
|
var c = u8[ci];
|
||||||
|
var x, y;
|
||||||
|
|
||||||
|
if (0x04 === c) {
|
||||||
|
y = u8.slice(ci + 1 + len, ci + 1 + len + len);
|
||||||
|
} else if (0x02 !== c) {
|
||||||
|
throw new Error("not a supported EC private key");
|
||||||
|
}
|
||||||
|
x = u8.slice(ci + 1, ci + 1 + len);
|
||||||
|
|
||||||
|
return {
|
||||||
|
kty: jwk.kty
|
||||||
|
, crv: jwk.crv
|
||||||
|
, d: PEM._toUrlSafeBase64(d)
|
||||||
|
//, dh: d
|
||||||
|
, x: PEM._toUrlSafeBase64(x)
|
||||||
|
//, xh: x
|
||||||
|
, y: PEM._toUrlSafeBase64(y)
|
||||||
|
//, yh: y
|
||||||
|
};
|
||||||
|
}
|
||||||
|
function parseEcPkcs8Privkey(u8, jwk) {
|
||||||
|
var index = 24 + (OBJ_ID_EC.length/2);
|
||||||
|
var len = 32;
|
||||||
|
if ("P-384" === jwk.crv) {
|
||||||
|
index = 24 + (OBJ_ID_EC_384.length/2) + 2;
|
||||||
|
len = 48;
|
||||||
|
}
|
||||||
|
|
||||||
|
//console.log(index, u8.slice(index));
|
||||||
|
if (0x04 !== u8[index]) {
|
||||||
|
//console.log(jwk);
|
||||||
|
throw new Error("privkey not found");
|
||||||
|
}
|
||||||
|
var d = u8.slice(index+2, index+2+len);
|
||||||
|
var ci = index+2+len+5;
|
||||||
|
var xi = ci+1;
|
||||||
|
var x = u8.slice(xi, xi + len);
|
||||||
|
var yi = xi+len;
|
||||||
|
var y;
|
||||||
|
if (0x04 === u8[ci]) {
|
||||||
|
y = u8.slice(yi, yi + len);
|
||||||
|
} else if (0x02 !== u8[ci]) {
|
||||||
|
throw new Error("invalid compression bit (expected 0x04 or 0x02)");
|
||||||
|
}
|
||||||
|
|
||||||
|
return {
|
||||||
|
kty: jwk.kty
|
||||||
|
, crv: jwk.crv
|
||||||
|
, d: PEM._toUrlSafeBase64(d)
|
||||||
|
//, dh: d
|
||||||
|
, x: PEM._toUrlSafeBase64(x)
|
||||||
|
//, xh: x
|
||||||
|
, y: PEM._toUrlSafeBase64(y)
|
||||||
|
//, yh: y
|
||||||
|
};
|
||||||
|
}
|
||||||
|
function parseEcPub(u8, jwk) {
|
||||||
|
var ci = 16 + OBJ_ID_EC.length/2;
|
||||||
|
var len = 32;
|
||||||
|
|
||||||
|
if ("P-384" === jwk.crv) {
|
||||||
|
ci = 16 + OBJ_ID_EC_384.length/2;
|
||||||
|
len = 48;
|
||||||
|
}
|
||||||
|
|
||||||
|
var c = u8[ci];
|
||||||
|
var xi = ci + 1;
|
||||||
|
var x = u8.slice(xi, xi + len);
|
||||||
|
var yi = xi + len;
|
||||||
|
var y;
|
||||||
|
if (0x04 === c) {
|
||||||
|
y = u8.slice(yi, yi + len);
|
||||||
|
} else if (0x02 !== c) {
|
||||||
|
throw new Error("not a supported EC private key");
|
||||||
|
}
|
||||||
|
|
||||||
|
return {
|
||||||
|
kty: jwk.kty
|
||||||
|
, crv: jwk.crv
|
||||||
|
, x: PEM._toUrlSafeBase64(x)
|
||||||
|
//, xh: x
|
||||||
|
, y: PEM._toUrlSafeBase64(y)
|
||||||
|
//, yh: y
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
/*global Promise*/
|
/*global Promise*/
|
||||||
EC.generate = function (opts) {
|
function parseEcPrivkey(opts) {
|
||||||
return Promise.resolve().then(function () {
|
return Promise.resolve().then(function () {
|
||||||
var typ = 'ec';
|
if (!opts || !opts.pem) {
|
||||||
var format = opts.format;
|
throw new Error("must pass { pem: pem }");
|
||||||
var encoding = opts.encoding;
|
|
||||||
var priv;
|
|
||||||
var pub = 'spki';
|
|
||||||
|
|
||||||
if (!format) {
|
|
||||||
format = 'jwk';
|
|
||||||
}
|
|
||||||
if (-1 !== [ 'spki', 'pkcs8', 'ssh' ].indexOf(format)) {
|
|
||||||
format = 'pkcs8';
|
|
||||||
}
|
}
|
||||||
|
var pem = opts.pem;
|
||||||
|
var u8 = parsePem(pem).der;
|
||||||
|
var hex = toHex(u8);
|
||||||
|
var jwk = { kty: 'EC', crv: null, x: null, y: null };
|
||||||
|
|
||||||
if ('pem' === format) {
|
//console.log();
|
||||||
format = 'sec1';
|
if (-1 !== hex.indexOf(OBJ_ID_EC)) {
|
||||||
encoding = 'pem';
|
jwk.crv = "P-256";
|
||||||
} else if ('der' === format) {
|
|
||||||
format = 'sec1';
|
|
||||||
encoding = 'der';
|
|
||||||
}
|
|
||||||
|
|
||||||
if ('jwk' === format || 'json' === format) {
|
// PKCS8
|
||||||
format = 'jwk';
|
if (0x02 === u8[3] && 0x30 === u8[6] && 0x06 === u8[8]) {
|
||||||
encoding = 'json';
|
//console.log("PKCS8", u8[3].toString(16), u8[6].toString(16), u8[8].toString(16));
|
||||||
} else {
|
return parseEcPkcs8Privkey(u8, jwk);
|
||||||
priv = format;
|
// EC-only
|
||||||
}
|
} else if (0x02 === u8[2] && 0x04 === u8[5] && 0xA0 === u8[39]) {
|
||||||
|
//console.log("EC---", u8[2].toString(16), u8[5].toString(16), u8[39].toString(16));
|
||||||
if (!encoding) {
|
return parseEcOnlyPrivkey(u8, jwk);
|
||||||
encoding = 'pem';
|
// SPKI/PKIK (Public)
|
||||||
}
|
} else if (0x30 === u8[2] && 0x06 === u8[4] && 0x06 === u8[13]) {
|
||||||
|
//console.log("SPKI-", u8[2].toString(16), u8[4].toString(16), u8[13].toString(16));
|
||||||
if (priv) {
|
return parseEcPub(u8, jwk);
|
||||||
priv = { type: priv, format: encoding };
|
// Error
|
||||||
pub = { type: pub, format: encoding };
|
} else {
|
||||||
} else {
|
//console.log("PKCS8", u8[3].toString(16), u8[6].toString(16), u8[8].toString(16));
|
||||||
// jwk
|
//console.log("EC---", u8[2].toString(16), u8[5].toString(16), u8[39].toString(16));
|
||||||
priv = { type: 'sec1', format: 'pem' };
|
//console.log("SPKI-", u8[2].toString(16), u8[4].toString(16), u8[13].toString(16));
|
||||||
pub = { type: 'spki', format: 'pem' };
|
throw new Error("unrecognized key format");
|
||||||
}
|
|
||||||
|
|
||||||
return new Promise(function (resolve, reject) {
|
|
||||||
return require('crypto').generateKeyPair(typ, {
|
|
||||||
namedCurve: opts.crv || opts.namedCurve || 'P-256'
|
|
||||||
, privateKeyEncoding: priv
|
|
||||||
, publicKeyEncoding: pub
|
|
||||||
}, function (err, pubkey, privkey) {
|
|
||||||
if (err) { reject(err); }
|
|
||||||
resolve({
|
|
||||||
private: privkey
|
|
||||||
, public: pubkey
|
|
||||||
});
|
|
||||||
});
|
|
||||||
}).then(function (keypair) {
|
|
||||||
if ('jwk' === format) {
|
|
||||||
return {
|
|
||||||
private: EC.importSync({ pem: keypair.private, format: priv.type })
|
|
||||||
, public: EC.importSync({ pem: keypair.public, format: pub.type, public: true })
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
} else if (-1 !== hex.indexOf(OBJ_ID_EC_384)) {
|
||||||
|
jwk.crv = "P-384";
|
||||||
|
|
||||||
if ('ssh' !== opts.format) {
|
// PKCS8
|
||||||
return keypair;
|
if (0x02 === u8[3] && 0x30 === u8[6] && 0x06 === u8[8]) {
|
||||||
|
//console.log("PKCS8", u8[3].toString(16), u8[6].toString(16), u8[8].toString(16));
|
||||||
|
return parseEcPkcs8Privkey(u8, jwk);
|
||||||
|
// EC-only
|
||||||
|
} else if (0x02 === u8[3] && 0x04 === u8[6] && 0xA0 === u8[56]) {
|
||||||
|
//console.log("EC---", u8[3].toString(16), u8[6].toString(16), u8[56].toString(16));
|
||||||
|
return parseEcOnlyPrivkey(u8, jwk);
|
||||||
|
// SPKI/PKIK (Public)
|
||||||
|
} else if (0x30 === u8[2] && 0x06 === u8[4] && 0x06 === u8[13]) {
|
||||||
|
//console.log("SPKI-", u8[2].toString(16), u8[4].toString(16), u8[13].toString(16));
|
||||||
|
return parseEcPub(u8, jwk);
|
||||||
|
// Error
|
||||||
|
} else {
|
||||||
|
//console.log("PKCS8", u8[3].toString(16), u8[6].toString(16), u8[8].toString(16));
|
||||||
|
//console.log("EC---", u8[3].toString(16), u8[6].toString(16), u8[56].toString(16));
|
||||||
|
//console.log("SPKI-", u8[2].toString(16), u8[4].toString(16), u8[13].toString(16));
|
||||||
|
throw new Error("unrecognized key format");
|
||||||
}
|
}
|
||||||
|
|
||||||
return {
|
|
||||||
private: keypair.private
|
|
||||||
, public: EC.exportSync({ jwk: EC.importSync({
|
|
||||||
pem: keypair.public, format: format, public: true
|
|
||||||
}), format: opts.format, public: true })
|
|
||||||
};
|
|
||||||
});
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
EC.importSync = function importEcSync(opts) {
|
|
||||||
if (!opts || !opts.pem || 'string' !== typeof opts.pem) {
|
|
||||||
throw new Error("must pass { pem: pem } as a string");
|
|
||||||
}
|
|
||||||
if (0 === opts.pem.indexOf('ecdsa-sha2-')) {
|
|
||||||
return SSH.parseSsh(opts.pem);
|
|
||||||
}
|
|
||||||
var pem = opts.pem;
|
|
||||||
var u8 = PEM.parseBlock(pem).bytes;
|
|
||||||
var hex = Enc.bufToHex(u8);
|
|
||||||
var jwk = { kty: 'EC', crv: null, x: null, y: null };
|
|
||||||
|
|
||||||
//console.log();
|
|
||||||
if (-1 !== hex.indexOf(OBJ_ID_EC)) {
|
|
||||||
jwk.crv = "P-256";
|
|
||||||
|
|
||||||
// PKCS8
|
|
||||||
if (0x02 === u8[3] && 0x30 === u8[6] && 0x06 === u8[8]) {
|
|
||||||
//console.log("PKCS8", u8[3].toString(16), u8[6].toString(16), u8[8].toString(16));
|
|
||||||
jwk = x509.parsePkcs8(u8, jwk);
|
|
||||||
// EC-only
|
|
||||||
} else if (0x02 === u8[2] && 0x04 === u8[5] && 0xA0 === u8[39]) {
|
|
||||||
//console.log("EC---", u8[2].toString(16), u8[5].toString(16), u8[39].toString(16));
|
|
||||||
jwk = x509.parseSec1(u8, jwk);
|
|
||||||
// SPKI/PKIK (Public)
|
|
||||||
} else if (0x30 === u8[2] && 0x06 === u8[4] && 0x06 === u8[13]) {
|
|
||||||
//console.log("SPKI-", u8[2].toString(16), u8[4].toString(16), u8[13].toString(16));
|
|
||||||
jwk = x509.parseSpki(u8, jwk);
|
|
||||||
// Error
|
|
||||||
} else {
|
} else {
|
||||||
//console.log("PKCS8", u8[3].toString(16), u8[6].toString(16), u8[8].toString(16));
|
throw new Error("Supported key types are P-256 and P-384");
|
||||||
//console.log("EC---", u8[2].toString(16), u8[5].toString(16), u8[39].toString(16));
|
|
||||||
//console.log("SPKI-", u8[2].toString(16), u8[4].toString(16), u8[13].toString(16));
|
|
||||||
throw new Error("unrecognized key format");
|
|
||||||
}
|
}
|
||||||
} else if (-1 !== hex.indexOf(OBJ_ID_EC_384)) {
|
|
||||||
jwk.crv = "P-384";
|
|
||||||
|
|
||||||
// PKCS8
|
|
||||||
if (0x02 === u8[3] && 0x30 === u8[6] && 0x06 === u8[8]) {
|
|
||||||
//console.log("PKCS8", u8[3].toString(16), u8[6].toString(16), u8[8].toString(16));
|
|
||||||
jwk = x509.parsePkcs8(u8, jwk);
|
|
||||||
// EC-only
|
|
||||||
} else if (0x02 === u8[3] && 0x04 === u8[6] && 0xA0 === u8[56]) {
|
|
||||||
//console.log("EC---", u8[3].toString(16), u8[6].toString(16), u8[56].toString(16));
|
|
||||||
jwk = x509.parseSec1(u8, jwk);
|
|
||||||
// SPKI/PKIK (Public)
|
|
||||||
} else if (0x30 === u8[2] && 0x06 === u8[4] && 0x06 === u8[13]) {
|
|
||||||
//console.log("SPKI-", u8[2].toString(16), u8[4].toString(16), u8[13].toString(16));
|
|
||||||
jwk = x509.parseSpki(u8, jwk);
|
|
||||||
// Error
|
|
||||||
} else {
|
|
||||||
//console.log("PKCS8", u8[3].toString(16), u8[6].toString(16), u8[8].toString(16));
|
|
||||||
//console.log("EC---", u8[3].toString(16), u8[6].toString(16), u8[56].toString(16));
|
|
||||||
//console.log("SPKI-", u8[2].toString(16), u8[4].toString(16), u8[13].toString(16));
|
|
||||||
throw new Error("unrecognized key format");
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
throw new Error("Supported key types are P-256 and P-384");
|
|
||||||
}
|
|
||||||
if (opts.public) {
|
|
||||||
if (true !== opts.public) {
|
|
||||||
throw new Error("options.public must be either `true` or `false` not ("
|
|
||||||
+ typeof opts.public + ") '" + opts.public + "'");
|
|
||||||
}
|
|
||||||
delete jwk.d;
|
|
||||||
}
|
|
||||||
return jwk;
|
|
||||||
};
|
|
||||||
EC.parse = function parseEc(opts) {
|
|
||||||
return Promise.resolve().then(function () {
|
|
||||||
return EC.importSync(opts);
|
|
||||||
});
|
});
|
||||||
};
|
}
|
||||||
EC.toJwk = EC.import = EC.parse;
|
|
||||||
|
|
||||||
EC.exportSync = function (opts) {
|
module.exports.import = parseEcPrivkey;
|
||||||
if (!opts || !opts.jwk || 'object' !== typeof opts.jwk) {
|
|
||||||
throw new Error("must pass { jwk: jwk } as a JSON object");
|
|
||||||
}
|
|
||||||
var jwk = JSON.parse(JSON.stringify(opts.jwk));
|
|
||||||
var format = opts.format;
|
|
||||||
if (opts.public || -1 !== [ 'spki', 'pkix', 'ssh', 'rfc4716' ].indexOf(format)) {
|
|
||||||
jwk.d = null;
|
|
||||||
}
|
|
||||||
if ('EC' !== jwk.kty) {
|
|
||||||
throw new Error("options.jwk.kty must be 'EC' for EC keys");
|
|
||||||
}
|
|
||||||
if (!jwk.d) {
|
|
||||||
if (!format || -1 !== [ 'spki', 'pkix' ].indexOf(format)) {
|
|
||||||
format = 'spki';
|
|
||||||
} else if (-1 !== [ 'ssh', 'rfc4716' ].indexOf(format)) {
|
|
||||||
format = 'ssh';
|
|
||||||
} else {
|
|
||||||
throw new Error("options.format must be 'spki' or 'ssh' for public EC keys, not ("
|
|
||||||
+ typeof format + ") " + format);
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
if (!format || 'sec1' === format) {
|
|
||||||
format = 'sec1';
|
|
||||||
} else if ('pkcs8' !== format) {
|
|
||||||
throw new Error("options.format must be 'sec1' or 'pkcs8' for private EC keys, not '" + format + "'");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (-1 === [ 'P-256', 'P-384' ].indexOf(jwk.crv)) {
|
|
||||||
throw new Error("options.jwk.crv must be either P-256 or P-384 for EC keys, not '" + jwk.crv + "'");
|
|
||||||
}
|
|
||||||
if (!jwk.y) {
|
|
||||||
throw new Error("options.jwk.y must be a urlsafe base64-encoded either P-256 or P-384");
|
|
||||||
}
|
|
||||||
|
|
||||||
if ('sec1' === format) {
|
|
||||||
return PEM.packBlock({ type: "EC PRIVATE KEY", bytes: x509.packSec1(jwk) });
|
|
||||||
} else if ('pkcs8' === format) {
|
|
||||||
return PEM.packBlock({ type: "PRIVATE KEY", bytes: x509.packPkcs8(jwk) });
|
|
||||||
} else if (-1 !== [ 'spki', 'pkix' ].indexOf(format)) {
|
|
||||||
return PEM.packBlock({ type: "PUBLIC KEY", bytes: x509.packSpki(jwk) });
|
|
||||||
} else if (-1 !== [ 'ssh', 'rfc4716' ].indexOf(format)) {
|
|
||||||
return SSH.packSsh(jwk);
|
|
||||||
} else {
|
|
||||||
throw new Error("Sanity Error: reached unreachable code block with format: " + format);
|
|
||||||
}
|
|
||||||
};
|
|
||||||
EC.pack = function (opts) {
|
|
||||||
return Promise.resolve().then(function () {
|
|
||||||
return EC.exportSync(opts);
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
EC.__thumbprint = function (jwk) {
|
|
||||||
var buf = require('crypto').createHash('sha256')
|
|
||||||
// alphabetically sorted keys [ 'crv', 'kty', 'x', 'y' ]
|
|
||||||
.update('{"crv":"' + jwk.crv + '","kty":"EC","x":"' + jwk.x + '","y":"' + jwk.y + '"}')
|
|
||||||
.digest()
|
|
||||||
;
|
|
||||||
return Enc.bufToUrlBase64(buf);
|
|
||||||
};
|
|
||||||
|
|
||||||
EC.thumbprint = function (opts) {
|
|
||||||
return Promise.resolve().then(function () {
|
|
||||||
var jwk;
|
|
||||||
if ('EC' === opts.kty) {
|
|
||||||
jwk = opts;
|
|
||||||
} else if (opts.jwk) {
|
|
||||||
jwk = opts.jwk;
|
|
||||||
} else {
|
|
||||||
jwk = EC.importSync(opts);
|
|
||||||
}
|
|
||||||
return EC.__thumbprint(jwk);
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
EC.toPem = EC.export = EC.pack;
|
|
||||||
|
|||||||
@ -1,42 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var Enc = module.exports;
|
|
||||||
|
|
||||||
Enc.base64ToBuf = function (str) {
|
|
||||||
// node handles both base64 and urlBase64 equally
|
|
||||||
return Buffer.from(str, 'base64');
|
|
||||||
};
|
|
||||||
|
|
||||||
Enc.base64ToHex = function (b64) {
|
|
||||||
return Enc.bufToHex(Enc.base64ToBuf(b64));
|
|
||||||
};
|
|
||||||
|
|
||||||
Enc.bufToBase64 = function (u8) {
|
|
||||||
// Ensure a node buffer, even if TypedArray
|
|
||||||
return Buffer.from(u8).toString('base64');
|
|
||||||
};
|
|
||||||
|
|
||||||
Enc.bufToHex = function (u8) {
|
|
||||||
// Ensure a node buffer, even if TypedArray
|
|
||||||
return Buffer.from(u8).toString('hex');
|
|
||||||
};
|
|
||||||
|
|
||||||
Enc.bufToUrlBase64 = function (u8) {
|
|
||||||
return Enc.bufToBase64(u8)
|
|
||||||
.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
|
|
||||||
};
|
|
||||||
|
|
||||||
Enc.hexToUint8 = function (hex) {
|
|
||||||
// TODO: I don't remember why I chose Uint8Array over Buffer...
|
|
||||||
var buf = Buffer.from(hex, 'hex');
|
|
||||||
var ab = buf.buffer.slice(buf.offset, buf.offset + buf.byteLength);
|
|
||||||
return new Uint8Array(ab);
|
|
||||||
};
|
|
||||||
|
|
||||||
Enc.numToHex = function (d) {
|
|
||||||
d = d.toString(16);
|
|
||||||
if (d.length % 2) {
|
|
||||||
return '0' + d;
|
|
||||||
}
|
|
||||||
return d;
|
|
||||||
};
|
|
||||||
@ -1,36 +0,0 @@
|
|||||||
// Copyright 2016-2018 AJ ONeal. All rights reserved
|
|
||||||
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
||||||
'use strict';
|
|
||||||
|
|
||||||
var curves = {
|
|
||||||
"P-256": "prime256v1" // 65
|
|
||||||
, "secp256r1": "prime256v1"
|
|
||||||
, "P-384": "secp384r1" // 97
|
|
||||||
, "P-521": "secp521r1" // 133
|
|
||||||
};
|
|
||||||
var crv = "P-256";
|
|
||||||
var ecdh = require('crypto').createECDH(curves[crv] || crv);
|
|
||||||
var keys = ecdh.generateKeys(null, 'uncompressed');
|
|
||||||
console.log(keys.length);
|
|
||||||
console.log(keys.toString('hex'));
|
|
||||||
keys = keys.slice(1);
|
|
||||||
var x = keys.slice(0, keys.byteLength / 2);
|
|
||||||
var y = keys.slice(keys.byteLength / 2);
|
|
||||||
while (0 === x[0]) { x = x.slice(1); }
|
|
||||||
while (0 === y[0]) { y = y.slice(1); }
|
|
||||||
console.log({
|
|
||||||
kty: "EC"
|
|
||||||
, crv: "P-XXX"
|
|
||||||
, x: _toUrlBase64(x)
|
|
||||||
, y: _toUrlBase64(y)
|
|
||||||
});
|
|
||||||
|
|
||||||
function _toUrlBase64(buf) {
|
|
||||||
return buf.toString('base64')
|
|
||||||
.replace(/\+/g, "-")
|
|
||||||
.replace(/\//g, "_")
|
|
||||||
.replace(/=/g,"")
|
|
||||||
;
|
|
||||||
}
|
|
||||||
@ -1,22 +0,0 @@
|
|||||||
// Copyright 2016-2018 AJ ONeal. All rights reserved
|
|
||||||
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
||||||
'use strict';
|
|
||||||
|
|
||||||
module.exports = function (crv) {
|
|
||||||
var keypair = require('crypto').generateKeyPairSync(
|
|
||||||
'ec'
|
|
||||||
, { namedCurve: crv
|
|
||||||
, privateKeyEncoding: { type: 'sec1', format: 'pem' }
|
|
||||||
, publicKeyEncoding: { type: 'spki', format: 'pem' }
|
|
||||||
}
|
|
||||||
);
|
|
||||||
var result = { privateKeyPem: keypair.privateKey.trim() };
|
|
||||||
return result;
|
|
||||||
};
|
|
||||||
|
|
||||||
if (require.main === module) {
|
|
||||||
var keypair = module.exports('P-256');
|
|
||||||
console.info(keypair.privateKeyPem);
|
|
||||||
}
|
|
||||||
28
lib/pem.js
28
lib/pem.js
@ -1,28 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var PEM = module.exports;
|
|
||||||
var Enc = require('./encoding.js');
|
|
||||||
|
|
||||||
PEM.parseBlock = function pemToDer(pem) {
|
|
||||||
var lines = pem.trim().split(/\n/);
|
|
||||||
var end = lines.length - 1;
|
|
||||||
var head = lines[0].match(/-----BEGIN (.*)-----/);
|
|
||||||
var foot = lines[end].match(/-----END (.*)-----/);
|
|
||||||
|
|
||||||
if (head) {
|
|
||||||
lines = lines.slice(1, end);
|
|
||||||
head = head[1];
|
|
||||||
if (head !== foot[1]) {
|
|
||||||
throw new Error("headers and footers do not match");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return { type: head, bytes: Enc.base64ToBuf(lines.join('')) };
|
|
||||||
};
|
|
||||||
|
|
||||||
PEM.packBlock = function (opts) {
|
|
||||||
return '-----BEGIN ' + opts.type + '-----\n'
|
|
||||||
+ Enc.bufToBase64(opts.bytes).match(/.{1,64}/g).join('\n') + '\n'
|
|
||||||
+ '-----END ' + opts.type + '-----'
|
|
||||||
;
|
|
||||||
};
|
|
||||||
55
lib/ssh.js
55
lib/ssh.js
@ -1,55 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var SSH = module.exports;
|
|
||||||
var Enc = require('./encoding.js');
|
|
||||||
|
|
||||||
// 19 e c d s a - s h a 2 - n i s t p 2 5 6
|
|
||||||
var SSH_EC_P256 = '00000013 65 63 64 73 61 2d 73 68 61 32 2d 6e 69 73 74 70 32 35 36'
|
|
||||||
.replace(/\s+/g, '').toLowerCase();
|
|
||||||
// 19 e c d s a - s h a 2 - n i s t p 3 8 4
|
|
||||||
var SSH_EC_P384 = '00000013 65 63 64 73 61 2d 73 68 61 32 2d 6e 69 73 74 70 33 38 34'
|
|
||||||
.replace(/\s+/g, '').toLowerCase();
|
|
||||||
|
|
||||||
SSH.parseSsh = function (pem) {
|
|
||||||
var jwk = { kty: 'EC', crv: null, x: null, y: null };
|
|
||||||
var b64 = pem.split(/\s+/g)[1];
|
|
||||||
var buf = Buffer.from(b64, 'base64');
|
|
||||||
var hex = Enc.bufToHex(buf);
|
|
||||||
var index = 40;
|
|
||||||
var len;
|
|
||||||
if (0 === hex.indexOf(SSH_EC_P256)) {
|
|
||||||
jwk.crv = 'P-256';
|
|
||||||
len = 32;
|
|
||||||
} else if (0 === hex.indexOf(SSH_EC_P384)) {
|
|
||||||
jwk.crv = 'P-384';
|
|
||||||
len = 48;
|
|
||||||
}
|
|
||||||
var x = buf.slice(index, index + len);
|
|
||||||
var y = buf.slice(index + len, index + len + len);
|
|
||||||
jwk.x = Enc.bufToUrlBase64(x);
|
|
||||||
jwk.y = Enc.bufToUrlBase64(y);
|
|
||||||
return jwk;
|
|
||||||
};
|
|
||||||
|
|
||||||
|
|
||||||
SSH.packSsh = function (jwk) {
|
|
||||||
// Custom SSH format
|
|
||||||
var typ = 'ecdsa-sha2-nistp256';
|
|
||||||
var a = '32 35 36';
|
|
||||||
var b = '41';
|
|
||||||
var comment = jwk.crv + '@localhost';
|
|
||||||
if ('P-256' !== jwk.crv) {
|
|
||||||
typ = 'ecdsa-sha2-nistp384';
|
|
||||||
a = '33 38 34';
|
|
||||||
b = '61';
|
|
||||||
}
|
|
||||||
var x = Enc.base64ToHex(jwk.x);
|
|
||||||
var y = Enc.base64ToHex(jwk.y);
|
|
||||||
var ssh = Enc.hexToUint8(
|
|
||||||
('00 00 00 13 65 63 64 73 61 2d 73 68 61 32 2d 6e 69 73 74 70'
|
|
||||||
+ a + '00 00 00 08 6e 69 73 74 70' + a + '00 00 00' + b
|
|
||||||
+ '04' + x + y).replace(/\s+/g, '').toLowerCase()
|
|
||||||
);
|
|
||||||
|
|
||||||
return typ + ' ' + Enc.bufToBase64(ssh) + ' ' + comment;
|
|
||||||
};
|
|
||||||
@ -32,28 +32,28 @@ function addCommunityMember(opts) {
|
|||||||
, method: 'POST'
|
, method: 'POST'
|
||||||
, headers: { 'Content-Type': 'application/json' }
|
, headers: { 'Content-Type': 'application/json' }
|
||||||
}, function (resp) {
|
}, function (resp) {
|
||||||
// let the data flow, so we can ignore it
|
// let the data flow, so we can ignore it
|
||||||
resp.on('data', function () {});
|
resp.on('data', function () {});
|
||||||
//resp.on('data', function (chunk) { console.log(chunk.toString()); });
|
//resp.on('data', function (chunk) { console.log(chunk.toString()); });
|
||||||
resp.on('error', function () { /*ignore*/ });
|
resp.on('error', function () { /*ignore*/ });
|
||||||
//resp.on('error', function (err) { console.error(err); });
|
//resp.on('error', function (err) { console.error(err); });
|
||||||
});
|
});
|
||||||
var obj = JSON.parse(JSON.stringify(data));
|
var obj = JSON.parse(JSON.stringify(data));
|
||||||
obj.action = 'updates';
|
obj.action = 'updates';
|
||||||
try {
|
try {
|
||||||
obj.ppid = ppid(obj.action);
|
obj.ppid = ppid(obj.action);
|
||||||
} catch(e) {
|
} catch(e) {
|
||||||
// ignore
|
// ignore
|
||||||
//console.error(e);
|
//console.error(e);
|
||||||
}
|
}
|
||||||
obj.name = opts.name || undefined;
|
obj.name = opts.name || undefined;
|
||||||
obj.address = opts.email;
|
obj.address = opts.email;
|
||||||
obj.community = 'node.js@therootcompany.com';
|
obj.community = 'node.js@therootcompany.com';
|
||||||
|
|
||||||
req.write(JSON.stringify(obj, 2, null));
|
req.write(JSON.stringify(obj, 2, null));
|
||||||
req.end();
|
req.end();
|
||||||
req.on('error', function () { /*ignore*/ });
|
req.on('error', function () { /*ignore*/ });
|
||||||
//req.on('error', function (err) { console.error(err); });
|
//req.on('error', function (err) { console.error(err); });
|
||||||
}, 50);
|
}, 50);
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -66,14 +66,14 @@ function ping(action) {
|
|||||||
, method: 'POST'
|
, method: 'POST'
|
||||||
, headers: { 'Content-Type': 'application/json' }
|
, headers: { 'Content-Type': 'application/json' }
|
||||||
}, function (resp) {
|
}, function (resp) {
|
||||||
// let the data flow, so we can ignore it
|
// let the data flow, so we can ignore it
|
||||||
resp.on('data', function () { });
|
resp.on('data', function () { });
|
||||||
//resp.on('data', function (chunk) { console.log(chunk.toString()); });
|
//resp.on('data', function (chunk) { console.log(chunk.toString()); });
|
||||||
resp.on('error', function () { /*ignore*/ });
|
resp.on('error', function () { /*ignore*/ });
|
||||||
//resp.on('error', function (err) { console.error(err); });
|
//resp.on('error', function (err) { console.error(err); });
|
||||||
});
|
});
|
||||||
var obj = JSON.parse(JSON.stringify(data));
|
var obj = JSON.parse(JSON.stringify(data));
|
||||||
obj.action = action;
|
obj.action = action;
|
||||||
try {
|
try {
|
||||||
obj.ppid = ppid(obj.action);
|
obj.ppid = ppid(obj.action);
|
||||||
} catch(e) {
|
} catch(e) {
|
||||||
@ -83,22 +83,22 @@ function ping(action) {
|
|||||||
|
|
||||||
req.write(JSON.stringify(obj, 2, null));
|
req.write(JSON.stringify(obj, 2, null));
|
||||||
req.end();
|
req.end();
|
||||||
req.on('error', function (/*e*/) { /*console.error('req.error', e);*/ });
|
req.on('error', function (/*e*/) { /*console.error('req.error', e);*/ });
|
||||||
}, 50);
|
}, 50);
|
||||||
}
|
}
|
||||||
|
|
||||||
// to help identify unique installs without getting
|
// to help identify unique installs without getting
|
||||||
// the personally identifiable info that we don't want
|
// the personally identifiable info that we don't want
|
||||||
function ppid(action) {
|
function ppid(action) {
|
||||||
var parts = [ action, data.package, data.version, data.node, data.arch, data.platform, data.release ];
|
var parts = [ action, data.package, data.version, data.node, data.arch, data.platform, data.release ];
|
||||||
var ifaces = os.networkInterfaces();
|
var ifaces = os.networkInterfaces();
|
||||||
Object.keys(ifaces).forEach(function (ifname) {
|
Object.keys(ifaces).forEach(function (ifname) {
|
||||||
if (/^en/.test(ifname) || /^eth/.test(ifname) || /^wl/.test(ifname)) {
|
if (/^en/.test(ifname) || /^eth/.test(ifname) || /^wl/.test(ifname)) {
|
||||||
if (ifaces[ifname] && ifaces[ifname].length) {
|
if (ifaces[ifname] && ifaces[ifname].length) {
|
||||||
parts.push(ifaces[ifname][0].mac);
|
parts.push(ifaces[ifname][0].mac);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
});
|
});
|
||||||
return crypto.createHash('sha1').update(parts.join(',')).digest('base64');
|
return crypto.createHash('sha1').update(parts.join(',')).digest('base64');
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -106,6 +106,6 @@ module.exports.ping = ping;
|
|||||||
module.exports.joinCommunity = addCommunityMember;
|
module.exports.joinCommunity = addCommunityMember;
|
||||||
|
|
||||||
if (require.main === module) {
|
if (require.main === module) {
|
||||||
ping('install');
|
ping('install');
|
||||||
//addCommunityMember({ name: "AJ ONeal", email: 'coolaj86@gmail.com' });
|
//addCommunityMember({ name: "AJ ONeal", email: 'coolaj86@gmail.com' });
|
||||||
}
|
}
|
||||||
|
|||||||
170
lib/x509.js
170
lib/x509.js
@ -1,170 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var ASN1 = require('./asn1.js');
|
|
||||||
var Enc = require('./encoding.js');
|
|
||||||
var x509 = module.exports;
|
|
||||||
|
|
||||||
// 1.2.840.10045.3.1.7
|
|
||||||
// prime256v1 (ANSI X9.62 named elliptic curve)
|
|
||||||
var OBJ_ID_EC = '06 08 2A8648CE3D030107'.replace(/\s+/g, '').toLowerCase();
|
|
||||||
// 1.3.132.0.34
|
|
||||||
// secp384r1 (SECG (Certicom) named elliptic curve)
|
|
||||||
var OBJ_ID_EC_384 = '06 05 2B81040022'.replace(/\s+/g, '').toLowerCase();
|
|
||||||
// 1.2.840.10045.2.1
|
|
||||||
// ecPublicKey (ANSI X9.62 public key type)
|
|
||||||
var OBJ_ID_EC_PUB = '06 07 2A8648CE3D0201'.replace(/\s+/g, '').toLowerCase();
|
|
||||||
|
|
||||||
x509.parseSec1 = function parseEcOnlyPrivkey(u8, jwk) {
|
|
||||||
var index = 7;
|
|
||||||
var len = 32;
|
|
||||||
var olen = OBJ_ID_EC.length/2;
|
|
||||||
|
|
||||||
if ("P-384" === jwk.crv) {
|
|
||||||
olen = OBJ_ID_EC_384.length/2;
|
|
||||||
index = 8;
|
|
||||||
len = 48;
|
|
||||||
}
|
|
||||||
if (len !== u8[index - 1]) {
|
|
||||||
throw new Error("Unexpected bitlength " + len);
|
|
||||||
}
|
|
||||||
|
|
||||||
// private part is d
|
|
||||||
var d = u8.slice(index, index + len);
|
|
||||||
// compression bit index
|
|
||||||
var ci = index + len + 2 + olen + 2 + 3;
|
|
||||||
var c = u8[ci];
|
|
||||||
var x, y;
|
|
||||||
|
|
||||||
if (0x04 === c) {
|
|
||||||
y = u8.slice(ci + 1 + len, ci + 1 + len + len);
|
|
||||||
} else if (0x02 !== c) {
|
|
||||||
throw new Error("not a supported EC private key");
|
|
||||||
}
|
|
||||||
x = u8.slice(ci + 1, ci + 1 + len);
|
|
||||||
|
|
||||||
return {
|
|
||||||
kty: jwk.kty
|
|
||||||
, crv: jwk.crv
|
|
||||||
, d: Enc.bufToUrlBase64(d)
|
|
||||||
//, dh: Enc.bufToHex(d)
|
|
||||||
, x: Enc.bufToUrlBase64(x)
|
|
||||||
//, xh: Enc.bufToHex(x)
|
|
||||||
, y: Enc.bufToUrlBase64(y)
|
|
||||||
//, yh: Enc.bufToHex(y)
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
x509.parsePkcs8 = function parseEcPkcs8(u8, jwk) {
|
|
||||||
var index = 24 + (OBJ_ID_EC.length/2);
|
|
||||||
var len = 32;
|
|
||||||
if ("P-384" === jwk.crv) {
|
|
||||||
index = 24 + (OBJ_ID_EC_384.length/2) + 2;
|
|
||||||
len = 48;
|
|
||||||
}
|
|
||||||
|
|
||||||
//console.log(index, u8.slice(index));
|
|
||||||
if (0x04 !== u8[index]) {
|
|
||||||
//console.log(jwk);
|
|
||||||
throw new Error("privkey not found");
|
|
||||||
}
|
|
||||||
var d = u8.slice(index+2, index+2+len);
|
|
||||||
var ci = index+2+len+5;
|
|
||||||
var xi = ci+1;
|
|
||||||
var x = u8.slice(xi, xi + len);
|
|
||||||
var yi = xi+len;
|
|
||||||
var y;
|
|
||||||
if (0x04 === u8[ci]) {
|
|
||||||
y = u8.slice(yi, yi + len);
|
|
||||||
} else if (0x02 !== u8[ci]) {
|
|
||||||
throw new Error("invalid compression bit (expected 0x04 or 0x02)");
|
|
||||||
}
|
|
||||||
|
|
||||||
return {
|
|
||||||
kty: jwk.kty
|
|
||||||
, crv: jwk.crv
|
|
||||||
, d: Enc.bufToUrlBase64(d)
|
|
||||||
//, dh: Enc.bufToHex(d)
|
|
||||||
, x: Enc.bufToUrlBase64(x)
|
|
||||||
//, xh: Enc.bufToHex(x)
|
|
||||||
, y: Enc.bufToUrlBase64(y)
|
|
||||||
//, yh: Enc.bufToHex(y)
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
x509.parseSpki = function parsePem(u8, jwk) {
|
|
||||||
var ci = 16 + OBJ_ID_EC.length/2;
|
|
||||||
var len = 32;
|
|
||||||
|
|
||||||
if ("P-384" === jwk.crv) {
|
|
||||||
ci = 16 + OBJ_ID_EC_384.length/2;
|
|
||||||
len = 48;
|
|
||||||
}
|
|
||||||
|
|
||||||
var c = u8[ci];
|
|
||||||
var xi = ci + 1;
|
|
||||||
var x = u8.slice(xi, xi + len);
|
|
||||||
var yi = xi + len;
|
|
||||||
var y;
|
|
||||||
if (0x04 === c) {
|
|
||||||
y = u8.slice(yi, yi + len);
|
|
||||||
} else if (0x02 !== c) {
|
|
||||||
throw new Error("not a supported EC private key");
|
|
||||||
}
|
|
||||||
|
|
||||||
return {
|
|
||||||
kty: jwk.kty
|
|
||||||
, crv: jwk.crv
|
|
||||||
, x: Enc.bufToUrlBase64(x)
|
|
||||||
//, xh: Enc.bufToHex(x)
|
|
||||||
, y: Enc.bufToUrlBase64(y)
|
|
||||||
//, yh: Enc.bufToHex(y)
|
|
||||||
};
|
|
||||||
};
|
|
||||||
x509.parsePkix = x509.parseSpki;
|
|
||||||
|
|
||||||
x509.packSec1 = function (jwk) {
|
|
||||||
var d = Enc.base64ToHex(jwk.d);
|
|
||||||
var x = Enc.base64ToHex(jwk.x);
|
|
||||||
var y = Enc.base64ToHex(jwk.y);
|
|
||||||
var objId = ('P-256' === jwk.crv) ? OBJ_ID_EC : OBJ_ID_EC_384;
|
|
||||||
return Enc.hexToUint8(
|
|
||||||
ASN1('30'
|
|
||||||
, ASN1.UInt('01')
|
|
||||||
, ASN1('04', d)
|
|
||||||
, ASN1('A0', objId)
|
|
||||||
, ASN1('A1', ASN1.BitStr('04' + x + y)))
|
|
||||||
);
|
|
||||||
};
|
|
||||||
x509.packPkcs8 = function (jwk) {
|
|
||||||
var d = Enc.base64ToHex(jwk.d);
|
|
||||||
var x = Enc.base64ToHex(jwk.x);
|
|
||||||
var y = Enc.base64ToHex(jwk.y);
|
|
||||||
var objId = ('P-256' === jwk.crv) ? OBJ_ID_EC : OBJ_ID_EC_384;
|
|
||||||
return Enc.hexToUint8(
|
|
||||||
ASN1('30'
|
|
||||||
, ASN1.UInt('00')
|
|
||||||
, ASN1('30'
|
|
||||||
, OBJ_ID_EC_PUB
|
|
||||||
, objId
|
|
||||||
)
|
|
||||||
, ASN1('04'
|
|
||||||
, ASN1('30'
|
|
||||||
, ASN1.UInt('01')
|
|
||||||
, ASN1('04', d)
|
|
||||||
, ASN1('A1', ASN1.BitStr('04' + x + y)))))
|
|
||||||
);
|
|
||||||
};
|
|
||||||
x509.packSpki = function (jwk) {
|
|
||||||
var x = Enc.base64ToHex(jwk.x);
|
|
||||||
var y = Enc.base64ToHex(jwk.y);
|
|
||||||
var objId = ('P-256' === jwk.crv) ? OBJ_ID_EC : OBJ_ID_EC_384;
|
|
||||||
return Enc.hexToUint8(
|
|
||||||
ASN1('30'
|
|
||||||
, ASN1('30'
|
|
||||||
, OBJ_ID_EC_PUB
|
|
||||||
, objId
|
|
||||||
)
|
|
||||||
, ASN1.BitStr('04' + x + y))
|
|
||||||
);
|
|
||||||
};
|
|
||||||
x509.packPkix = x509.packSpki;
|
|
||||||
24
package.json
24
package.json
@ -1,23 +1,17 @@
|
|||||||
{
|
{
|
||||||
"name": "eckles",
|
"name": "eckles",
|
||||||
"version": "1.4.0",
|
"version": "0.1.1",
|
||||||
"description": "💯 PEM-to-JWK and JWK-to-PEM (and SSH) for ECDSA keys in a lightweight, zero-dependency library focused on perfect universal compatibility.",
|
"description": "A focused, zero-dependency library for perfect universal ECDSA P-256 (prime256v1, secp256r1) and P-384 (secp384r1) support.",
|
||||||
"homepage": "https://git.coolaj86.com/coolaj86/eckles.js",
|
|
||||||
"main": "index.js",
|
"main": "index.js",
|
||||||
"bin": {
|
"bin": {
|
||||||
"eckles": "bin/eckles.js"
|
"eckles": "bin/eckles.js"
|
||||||
},
|
},
|
||||||
"files": [
|
|
||||||
"bin",
|
|
||||||
"fixtures",
|
|
||||||
"lib"
|
|
||||||
],
|
|
||||||
"directories": {
|
"directories": {
|
||||||
"lib": "lib"
|
"lib": "lib"
|
||||||
},
|
},
|
||||||
"scripts": {
|
"scripts": {
|
||||||
"postinstall": "node lib/telemetry.js event:install",
|
"postinstall": "node lib/telemetry.js event:install",
|
||||||
"test": "bash test.sh"
|
"test": "echo \"Error: no test specified\" && exit 1"
|
||||||
},
|
},
|
||||||
"repository": {
|
"repository": {
|
||||||
"type": "git",
|
"type": "git",
|
||||||
@ -25,16 +19,14 @@
|
|||||||
},
|
},
|
||||||
"keywords": [
|
"keywords": [
|
||||||
"zero-dependency",
|
"zero-dependency",
|
||||||
"JWK-to-PEM",
|
"ec",
|
||||||
"PEM-to-JWK",
|
"ecdsa",
|
||||||
"ECDSA",
|
"jwk",
|
||||||
"EC",
|
"pem",
|
||||||
"SSH-to-JWK",
|
|
||||||
"JWK-to-SSH",
|
|
||||||
"p-256",
|
"p-256",
|
||||||
|
"p-384",
|
||||||
"prime256v1",
|
"prime256v1",
|
||||||
"secp256r1",
|
"secp256r1",
|
||||||
"p-384",
|
|
||||||
"secp384r1"
|
"secp384r1"
|
||||||
],
|
],
|
||||||
"author": "AJ ONeal <coolaj86@gmail.com> (https://coolaj86.com/)",
|
"author": "AJ ONeal <coolaj86@gmail.com> (https://coolaj86.com/)",
|
||||||
|
|||||||
141
test.sh
141
test.sh
@ -1,136 +1,15 @@
|
|||||||
#/bin/bash
|
#/bin/bash
|
||||||
set -e
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "Testing PEM-to-JWK P-256"
|
|
||||||
node bin/eckles.js fixtures/privkey-ec-p256.sec1.pem \
|
|
||||||
> fixtures/privkey-ec-p256.jwk.2
|
|
||||||
diff fixtures/privkey-ec-p256.jwk.json fixtures/privkey-ec-p256.jwk.2
|
|
||||||
node bin/eckles.js fixtures/privkey-ec-p256.pkcs8.pem \
|
|
||||||
> fixtures/privkey-ec-p256.jwk.2
|
|
||||||
diff fixtures/privkey-ec-p256.jwk.json fixtures/privkey-ec-p256.jwk.2
|
|
||||||
node bin/eckles.js fixtures/pub-ec-p256.spki.pem \
|
|
||||||
> fixtures/pub-ec-p256.jwk.2
|
|
||||||
diff fixtures/pub-ec-p256.jwk.json fixtures/pub-ec-p256.jwk.2
|
|
||||||
#
|
|
||||||
node bin/eckles.js fixtures/pub-ec-p256.ssh.pub \
|
|
||||||
> fixtures/pub-ec-p256.jwk.2
|
|
||||||
diff fixtures/pub-ec-p256.jwk.2 fixtures/pub-ec-p256.jwk.2
|
|
||||||
echo "PASS"
|
|
||||||
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "Testing PEM-to-JWK P-384"
|
|
||||||
node bin/eckles.js fixtures/privkey-ec-p384.sec1.pem \
|
|
||||||
> fixtures/privkey-ec-p384.jwk.2
|
|
||||||
diff fixtures/privkey-ec-p384.jwk.json fixtures/privkey-ec-p384.jwk.2
|
|
||||||
node bin/eckles.js fixtures/privkey-ec-p384.pkcs8.pem \
|
|
||||||
> fixtures/privkey-ec-p384.jwk.2.2
|
|
||||||
diff fixtures/privkey-ec-p384.jwk.json fixtures/privkey-ec-p384.jwk.2.2
|
|
||||||
node bin/eckles.js fixtures/pub-ec-p384.spki.pem \
|
|
||||||
> fixtures/pub-ec-p384.jwk.2
|
|
||||||
diff fixtures/pub-ec-p384.jwk.json fixtures/pub-ec-p384.jwk.2
|
|
||||||
#
|
|
||||||
node bin/eckles.js fixtures/pub-ec-p384.ssh.pub \
|
|
||||||
> fixtures/pub-ec-p384.jwk.2
|
|
||||||
diff fixtures/pub-ec-p384.jwk.2 fixtures/pub-ec-p384.jwk.2
|
|
||||||
echo "PASS"
|
|
||||||
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "Testing JWK-to-PEM P-256"
|
|
||||||
node bin/eckles.js fixtures/privkey-ec-p256.jwk.json sec1 \
|
|
||||||
> fixtures/privkey-ec-p256.sec1.pem.2
|
|
||||||
diff fixtures/privkey-ec-p256.sec1.pem fixtures/privkey-ec-p256.sec1.pem.2
|
|
||||||
#
|
|
||||||
node bin/eckles.js fixtures/privkey-ec-p256.jwk.json pkcs8 \
|
|
||||||
> fixtures/privkey-ec-p256.pkcs8.pem.2
|
|
||||||
diff fixtures/privkey-ec-p256.pkcs8.pem fixtures/privkey-ec-p256.pkcs8.pem.2
|
|
||||||
#
|
|
||||||
node bin/eckles.js fixtures/pub-ec-p256.jwk.json spki \
|
|
||||||
> fixtures/pub-ec-p256.spki.pem.2
|
|
||||||
diff fixtures/pub-ec-p256.spki.pem fixtures/pub-ec-p256.spki.pem.2
|
|
||||||
# ssh-keygen -f fixtures/pub-ec-p256.spki.pem -i -mPKCS8 > fixtures/pub-ec-p256.ssh.pub
|
|
||||||
node bin/eckles.js fixtures/pub-ec-p256.jwk.json ssh \
|
|
||||||
> fixtures/pub-ec-p256.ssh.pub.2
|
|
||||||
diff fixtures/pub-ec-p256.ssh.pub fixtures/pub-ec-p256.ssh.pub.2
|
|
||||||
echo "PASS"
|
|
||||||
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "Testing JWK-to-PEM P-384"
|
|
||||||
node bin/eckles.js fixtures/privkey-ec-p384.jwk.json sec1 \
|
|
||||||
> fixtures/privkey-ec-p384.sec1.pem.2
|
|
||||||
diff fixtures/privkey-ec-p384.sec1.pem fixtures/privkey-ec-p384.sec1.pem.2
|
|
||||||
#
|
|
||||||
node bin/eckles.js fixtures/privkey-ec-p384.jwk.json pkcs8 \
|
|
||||||
> fixtures/privkey-ec-p384.pkcs8.pem.2
|
|
||||||
diff fixtures/privkey-ec-p384.pkcs8.pem fixtures/privkey-ec-p384.pkcs8.pem.2
|
|
||||||
#
|
|
||||||
node bin/eckles.js fixtures/pub-ec-p384.jwk.json spki \
|
|
||||||
> fixtures/pub-ec-p384.spki.pem.2
|
|
||||||
diff fixtures/pub-ec-p384.spki.pem fixtures/pub-ec-p384.spki.pem.2
|
|
||||||
# ssh-keygen -f fixtures/pub-ec-p384.spki.pem -i -mPKCS8 > fixtures/pub-ec-p384.ssh.pub
|
|
||||||
node bin/eckles.js fixtures/pub-ec-p384.jwk.json ssh \
|
|
||||||
> fixtures/pub-ec-p384.ssh.pub.2
|
|
||||||
diff fixtures/pub-ec-p384.ssh.pub fixtures/pub-ec-p384.ssh.pub.2
|
|
||||||
echo "PASS"
|
|
||||||
|
|
||||||
|
|
||||||
rm fixtures/*.2
|
|
||||||
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "Testing freshly generated keypair"
|
|
||||||
# Generate EC P-256 Keypair
|
|
||||||
openssl ecparam -genkey -name prime256v1 -noout -out ./privkey-ec-p256.sec1.pem
|
|
||||||
# Export Public-only EC Key (as SPKI)
|
|
||||||
openssl ec -in ./privkey-ec-p256.sec1.pem -pubout -out ./pub-ec-p256.spki.pem
|
|
||||||
# Convert SEC1 (traditional) EC Keypair to PKCS8 format
|
|
||||||
openssl pkcs8 -topk8 -nocrypt -in ./privkey-ec-p256.sec1.pem -out ./privkey-ec-p256.pkcs8.pem
|
|
||||||
# Convert EC public key to SSH format
|
|
||||||
sshpub=$(ssh-keygen -f ./pub-ec-p256.spki.pem -i -mPKCS8)
|
|
||||||
echo "$sshpub P-256@localhost" > ./pub-ec-p256.ssh.pub
|
|
||||||
#
|
|
||||||
node bin/eckles.js ./privkey-ec-p256.sec1.pem > ./privkey-ec-p256.jwk.json
|
|
||||||
node bin/eckles.js ./privkey-ec-p256.jwk.json sec1 > ./privkey-ec-p256.sec1.pem.2
|
|
||||||
diff ./privkey-ec-p256.sec1.pem ./privkey-ec-p256.sec1.pem.2
|
|
||||||
#
|
|
||||||
node bin/eckles.js ./privkey-ec-p256.pkcs8.pem > ./privkey-ec-p256.jwk.json
|
|
||||||
node bin/eckles.js ./privkey-ec-p256.jwk.json pkcs8 > ./privkey-ec-p256.pkcs8.pem.2
|
|
||||||
diff ./privkey-ec-p256.pkcs8.pem ./privkey-ec-p256.pkcs8.pem.2
|
|
||||||
#
|
|
||||||
node bin/eckles.js ./pub-ec-p256.spki.pem > ./pub-ec-p256.jwk.json
|
|
||||||
node bin/eckles.js ./pub-ec-p256.jwk.json spki > ./pub-ec-p256.spki.pem.2
|
|
||||||
diff ./pub-ec-p256.spki.pem ./pub-ec-p256.spki.pem.2
|
|
||||||
#
|
|
||||||
node bin/eckles.js ./pub-ec-p256.ssh.pub > ./pub-ec-p256.jwk.json
|
|
||||||
node bin/eckles.js ./pub-ec-p256.jwk.json ssh > ./pub-ec-p256.ssh.pub.2
|
|
||||||
diff ./pub-ec-p256.ssh.pub ./pub-ec-p256.ssh.pub.2
|
|
||||||
echo "PASS"
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "Testing key generation"
|
|
||||||
node bin/eckles.js jwk > /dev/null
|
|
||||||
node bin/eckles.js jwk P-384 > /dev/null
|
|
||||||
node bin/eckles.js sec1 > /dev/null
|
|
||||||
node bin/eckles.js pkcs8 > /dev/null
|
|
||||||
node bin/eckles.js ssh #> /dev/null
|
|
||||||
echo "PASS"
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "Testing Thumbprints"
|
|
||||||
node bin/eckles.js ./fixtures/privkey-ec-p256.sec1.pem thumbprint
|
|
||||||
node bin/eckles.js ./fixtures/pub-ec-p256.jwk.json thumbprint
|
|
||||||
echo "PASS"
|
|
||||||
|
|
||||||
rm *.2
|
|
||||||
|
|
||||||
|
|
||||||
echo ""
|
echo ""
|
||||||
echo ""
|
echo ""
|
||||||
echo "PASSED:"
|
node bin/eckles.js fixtures/privkey-ec-p256.sec1.pem
|
||||||
echo "• All inputs produced valid outputs"
|
node bin/eckles.js fixtures/privkey-ec-p256.pkcs8.pem
|
||||||
echo "• All outputs matched known-good values"
|
node bin/eckles.js fixtures/pub-ec-p256.spki.pem
|
||||||
echo "• Generated keys in each format (sec1, pkcs8, jwk, ssh)"
|
|
||||||
|
echo ""
|
||||||
|
echo ""
|
||||||
|
node bin/eckles.js fixtures/privkey-ec-p384.sec1.pem
|
||||||
|
node bin/eckles.js fixtures/privkey-ec-p384.pkcs8.pem
|
||||||
|
node bin/eckles.js fixtures/pub-ec-p384.spki.pem
|
||||||
|
|
||||||
echo ""
|
echo ""
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user