Compare commits
No commits in common. "master" and "v0.1.1" have entirely different histories.
219
README.md
219
README.md
@ -1,224 +1,55 @@
|
||||
[Eckles.js](https://git.coolaj86.com/coolaj86/eckles.js)
|
||||
eckles.js
|
||||
=========
|
||||
|
||||
A [Root](https://therootcompany.com) Project.
|
||||
Built for [ACME.js](https://git.coolaj86.com/coolaj86/acme.js)
|
||||
and [Greenlock.js](https://git.coolaj86.com/coolaj86/greenlock.js)
|
||||
ECDSA tools. Lightweight. Zero Dependencies. Universal compatibility.
|
||||
|
||||
| < 600 lines of code | 3kb gzipped | 10kb minified | 17kb with comments |
|
||||
> I _just_ cleaned up the PEM-to-JWK functionality enough to publish.
|
||||
> I also have the JWK-to-PEM functionality _mostly_ built, but not enough to publish.
|
||||
|
||||
ECDSA (elliptic curve) tools. Lightweight. Zero Dependencies. Universal compatibility.
|
||||
|
||||
* [x] Fast and Easy EC Key Generation
|
||||
* [x] PEM-to-JWK
|
||||
* [x] JWK-to-PEM
|
||||
* [x] JWK thumbprint
|
||||
* [x] SSH "pub" format
|
||||
* [x] CLI
|
||||
* See [Eckles CLI](https://git.coolaj86.com/coolaj86/eckles-cli.js)
|
||||
* [ ] RSA
|
||||
* **Need RSA tools?** Check out [Rasha.js](https://git.coolaj86.com/coolaj86/rasha.js)
|
||||
|
||||
## Install
|
||||
|
||||
For node.js:
|
||||
|
||||
```bash
|
||||
npm install --save eckles
|
||||
```
|
||||
|
||||
CLI:
|
||||
|
||||
```bash
|
||||
npm install -g eckles
|
||||
```
|
||||
|
||||
See [Eckles CLI](https://git.coolaj86.com/coolaj86/eckles-cli.js)
|
||||
|
||||
## Generate EC (ECDSA/ECDH) Key
|
||||
|
||||
Achieves the *fastest possible key generation* using node's native EC bindings to OpenSSL,
|
||||
then converts to JWK for ease-of-use.
|
||||
* P-256 (prime256v1, secp256r1)
|
||||
* P-384 (secp384r1)
|
||||
* PKCS#8
|
||||
* SEC1/X9.62
|
||||
* PEM-to-JWK
|
||||
|
||||
```js
|
||||
Eckles.generate({ format: 'jwk' }).then(function (keypair) {
|
||||
console.log(keypair.private);
|
||||
console.log(keypair.public);
|
||||
});
|
||||
```
|
||||
var eckles = require('eckles');
|
||||
var pem = require('fs').readFileSync('./fixtures/privkey-ec-p256.sec1.pem', 'ascii')
|
||||
|
||||
**options**
|
||||
|
||||
* `format` defaults to `'jwk'`
|
||||
* `'sec1'` (traditional)
|
||||
* `'pkcs8'`
|
||||
* `'ssh'`
|
||||
* `encoding` defaults to `'json'`
|
||||
* `'pem'` (type + DER.toString('base64'))
|
||||
* `'der'`
|
||||
|
||||
**advanced options**
|
||||
|
||||
* `namedCurve` defaults to `'P-256'`
|
||||
* `P-384` is also supported
|
||||
* larger keys have not been implemented
|
||||
* A) because they're a senseless waste
|
||||
* B) they have similar, but slightly different formats
|
||||
|
||||
## PEM-to-JWK
|
||||
|
||||
* [x] SEC1/X9.62, PKCS#8, SPKI/PKIX
|
||||
* [x] P-256 (prime256v1, secp256r1), P-384 (secp384r1)
|
||||
* [x] SSH (RFC4716), (RFC 4716/SSH2)
|
||||
|
||||
```js
|
||||
var Eckles = require('eckles');
|
||||
var pem = require('fs')
|
||||
.readFileSync('./node_modles/eckles/fixtures/privkey-ec-p256.sec1.pem', 'ascii');
|
||||
|
||||
Eckles.import({ pem: pem }).then(function (jwk) {
|
||||
eckles.import({ pem: pem }).then(function (jwk) {
|
||||
console.log(jwk);
|
||||
});
|
||||
```
|
||||
|
||||
```js
|
||||
{
|
||||
/*
|
||||
{
|
||||
"kty": "EC",
|
||||
"crv": "P-256",
|
||||
"d": "iYydo27aNGO9DBUWeGEPD8oNi1LZDqfxPmQlieLBjVQ",
|
||||
"x": "IT1SWLxsacPiE5Z16jkopAn8_-85rMjgyCokrnjDft4",
|
||||
"y": "mP2JwOAOdMmXuwpxbKng3KZz27mz-nKWIlXJ3rzSGMo"
|
||||
}
|
||||
}
|
||||
*/
|
||||
});
|
||||
```
|
||||
|
||||
## JWK-to-PEM
|
||||
|
||||
* [x] SEC1/X9.62, PKCS#8, SPKI/PKIX
|
||||
* [x] P-256 (prime256v1, secp256r1), P-384 (secp384r1)
|
||||
* [x] SSH (RFC4716), (RFC 4716/SSH2)
|
||||
|
||||
<!--
|
||||
```js
|
||||
var Eckles = require('eckles');
|
||||
var jwk = require('eckles/fixtures/privkey-ec-p256.jwk.json');
|
||||
|
||||
Eckles.export({ jwk: jwk }).then(function (pem) {
|
||||
// PEM in SEC1 (x9.62) format
|
||||
eckles.export({ jwk: jwk }).then(function (pem) {
|
||||
// PEM in pkcs#8 format
|
||||
console.log(pem);
|
||||
});
|
||||
```
|
||||
|
||||
```
|
||||
-----BEGIN EC PRIVATE KEY-----
|
||||
MHcCAQEEIImMnaNu2jRjvQwVFnhhDw/KDYtS2Q6n8T5kJYniwY1UoAoGCCqGSM49
|
||||
AwEHoUQDQgAEIT1SWLxsacPiE5Z16jkopAn8/+85rMjgyCokrnjDft6Y/YnA4A50
|
||||
yZe7CnFsqeDcpnPbubP6cpYiVcnevNIYyg==
|
||||
-----END EC PRIVATE KEY-----
|
||||
```
|
||||
|
||||
### Advanced Options
|
||||
|
||||
`format: 'pkcs8'`:
|
||||
|
||||
The default output format is `sec1`/`x9.62` (EC-specific format) is used for private keys.
|
||||
Use `format: 'pkcs8'` to output in PKCS#8 format instead.
|
||||
|
||||
```js
|
||||
Eckles.export({ jwk: jwk, format: 'pkcs8' }).then(function (pem) {
|
||||
// PEM in PKCS#8 format
|
||||
eckles.exportSEC1(jwk).then(function (pem) {
|
||||
// PEM in sec1 (x9.62) format
|
||||
console.log(pem);
|
||||
});
|
||||
```
|
||||
-->
|
||||
|
||||
```
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgiYydo27aNGO9DBUW
|
||||
eGEPD8oNi1LZDqfxPmQlieLBjVShRANCAAQhPVJYvGxpw+ITlnXqOSikCfz/7zms
|
||||
yODIKiSueMN+3pj9icDgDnTJl7sKcWyp4Nymc9u5s/pyliJVyd680hjK
|
||||
-----END PRIVATE KEY-----
|
||||
```
|
||||
|
||||
`format: 'ssh'`:
|
||||
|
||||
Although SSH uses SEC1 for private keys, it uses ts own special non-ASN1 format
|
||||
(affectionately known as rfc4716) for public keys. I got curious and then decided
|
||||
to add this format as well.
|
||||
|
||||
To get the same format as you
|
||||
would get with `ssh-keygen`, pass `ssh` as the format option:
|
||||
|
||||
```js
|
||||
Eckles.export({ jwk: jwk, format: 'ssh' }).then(function (pub) {
|
||||
// Special SSH2 Public Key format (RFC 4716)
|
||||
console.log(pub);
|
||||
});
|
||||
```
|
||||
|
||||
```
|
||||
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCE9Uli8bGnD4hOWdeo5KKQJ/P/vOazI4MgqJK54w37emP2JwOAOdMmXuwpxbKng3KZz27mz+nKWIlXJ3rzSGMo= P-256@localhost
|
||||
```
|
||||
|
||||
`public: 'true'`:
|
||||
|
||||
If a private key is used as input, a private key will be output.
|
||||
|
||||
If you'd like to output a public key instead you can pass `public: true` or `format: 'spki'`.
|
||||
|
||||
```js
|
||||
Eckles.export({ jwk: jwk, public: true }).then(function (pem) {
|
||||
// PEM in SPKI/PKIX format
|
||||
console.log(pem);
|
||||
});
|
||||
```
|
||||
|
||||
```
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIT1SWLxsacPiE5Z16jkopAn8/+85
|
||||
rMjgyCokrnjDft6Y/YnA4A50yZe7CnFsqeDcpnPbubP6cpYiVcnevNIYyg==
|
||||
-----END PUBLIC KEY-----
|
||||
```
|
||||
|
||||
## JWK Thumbprint
|
||||
|
||||
```js
|
||||
Eckles.thumbprint({ jwk: jwk }).then(function (thumbprint) {
|
||||
console.log(thumbprint);
|
||||
});
|
||||
```
|
||||
|
||||
Testing
|
||||
-------
|
||||
|
||||
All cases are tested in `test.sh`.
|
||||
|
||||
You can compare these keys to the ones that you get from OpenSSL, ssh-keygen, and WebCrypto:
|
||||
|
||||
```bash
|
||||
# Generate EC P-256 Keypair
|
||||
openssl ecparam -genkey -name prime256v1 -noout -out ./privkey-ec-p256.sec1.pem
|
||||
|
||||
# Export Public-only EC Key (as SPKI)
|
||||
openssl ec -in ./privkey-ec-p256.sec1.pem -pubout -out ./pub-ec-p256.spki.pem
|
||||
|
||||
# Convert SEC1 (traditional) EC Keypair to PKCS8 format
|
||||
openssl pkcs8 -topk8 -nocrypt -in ./privkey-ec-p256.sec1.pem -out ./privkey-ec-p256.pkcs8.pem
|
||||
|
||||
# Convert EC public key to SSH format
|
||||
ssh-keygen -f ./pub-ec-p256.spki.pem -i -mPKCS8 > ./pub-ec-p256.ssh.pub
|
||||
```
|
||||
|
||||
Goals of this project
|
||||
Goals
|
||||
-----
|
||||
|
||||
* Zero Dependencies
|
||||
* Focused support for P-256 and P-384, which are already universally supported.
|
||||
* Convert both ways
|
||||
* Browser support as well (TODO)
|
||||
* OpenSSL, ssh-keygen, and WebCrypto compatibility
|
||||
|
||||
Legal
|
||||
-----
|
||||
|
||||
[Eckles.js](https://git.coolaj86.com/coolaj86/eckles.js) |
|
||||
MPL-2.0 |
|
||||
[Terms of Use](https://therootcompany.com/legal/#terms) |
|
||||
[Privacy Policy](https://therootcompany.com/legal/#privacy)
|
||||
* Browser support as well
|
||||
|
||||
@ -2,69 +2,13 @@
|
||||
'use strict';
|
||||
|
||||
var fs = require('fs');
|
||||
var Eckles = require('../index.js');
|
||||
var eckles = require('../index.js');
|
||||
|
||||
var infile = process.argv[2];
|
||||
var format = process.argv[3];
|
||||
//var outfile = process.argv[3];
|
||||
|
||||
if (!infile) {
|
||||
infile = 'jwk';
|
||||
}
|
||||
var keypem = fs.readFileSync(infile, 'ascii');
|
||||
|
||||
if (-1 !== [ 'jwk', 'pem', 'json', 'der', 'sec1', 'pkcs8', 'spki', 'ssh' ].indexOf(infile)) {
|
||||
console.log("Generating new key...");
|
||||
Eckles.generate({
|
||||
format: infile
|
||||
, namedCurve: format === 'P-384' ? 'P-384' : 'P-256'
|
||||
, encoding: format === 'der' ? 'der' : 'pem'
|
||||
}).then(function (key) {
|
||||
if ('der' === infile || 'der' === format) {
|
||||
key.private = key.private.toString('binary');
|
||||
key.public = key.public.toString('binary');
|
||||
}
|
||||
console.log(key.private);
|
||||
console.log(key.public);
|
||||
}).catch(function (err) {
|
||||
console.error(err);
|
||||
process.exit(1);
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
var key = fs.readFileSync(infile, 'ascii');
|
||||
|
||||
try {
|
||||
key = JSON.parse(key);
|
||||
} catch(e) {
|
||||
// ignore
|
||||
}
|
||||
|
||||
var thumbprint = ('thumbprint' === format);
|
||||
if (thumbprint) {
|
||||
format = 'public';
|
||||
}
|
||||
|
||||
if ('string' === typeof key) {
|
||||
if (thumbprint) {
|
||||
Eckles.thumbprint({ pem: key }).then(console.log);
|
||||
return;
|
||||
}
|
||||
var pub = (-1 !== [ 'public', 'spki', 'pkix' ].indexOf(format));
|
||||
Eckles.import({ pem: key, public: (pub || format) }).then(function (jwk) {
|
||||
eckles.import({ pem: keypem }).then(function (jwk) {
|
||||
console.log(JSON.stringify(jwk, null, 2));
|
||||
}).catch(function (err) {
|
||||
console.error(err);
|
||||
process.exit(1);
|
||||
});
|
||||
} else {
|
||||
if (thumbprint) {
|
||||
Eckles.thumbprint({ jwk: key }).then(console.log);
|
||||
return;
|
||||
}
|
||||
Eckles.export({ jwk: key, format: format }).then(function (pem) {
|
||||
console.log(pem);
|
||||
}).catch(function (err) {
|
||||
console.error(err);
|
||||
process.exit(2);
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
@ -1,7 +0,0 @@
|
||||
{
|
||||
"kty": "EC",
|
||||
"crv": "P-256",
|
||||
"d": "iYydo27aNGO9DBUWeGEPD8oNi1LZDqfxPmQlieLBjVQ",
|
||||
"x": "IT1SWLxsacPiE5Z16jkopAn8_-85rMjgyCokrnjDft4",
|
||||
"y": "mP2JwOAOdMmXuwpxbKng3KZz27mz-nKWIlXJ3rzSGMo"
|
||||
}
|
||||
@ -1,5 +1,5 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
-----BEGIN EC PRIVATE KEY-----
|
||||
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgiYydo27aNGO9DBUW
|
||||
eGEPD8oNi1LZDqfxPmQlieLBjVShRANCAAQhPVJYvGxpw+ITlnXqOSikCfz/7zms
|
||||
yODIKiSueMN+3pj9icDgDnTJl7sKcWyp4Nymc9u5s/pyliJVyd680hjK
|
||||
-----END PRIVATE KEY-----
|
||||
-----END EC PRIVATE KEY-----
|
||||
|
||||
@ -1,7 +0,0 @@
|
||||
{
|
||||
"kty": "EC",
|
||||
"crv": "P-384",
|
||||
"d": "XlyuCEWSTTS8U79O_Mz05z18vh4kb10szvu_7pdXuGWV6lfEyPExyUYWsA6A2kdV",
|
||||
"x": "2zEU0bKCa7ejKLIJ8oPGnLhqhxyiv4_w38K2a0SPC6dsSd9_glNJ8lcqv0sff5Gb",
|
||||
"y": "VD4jnu83S6scn6_TeAj3EZOREGbOs6dzoVpaugn-XQMMyC9O4VLbDDFGBZTJlMsb"
|
||||
}
|
||||
@ -1,6 +1,6 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
-----BEGIN EC PRIVATE KEY-----
|
||||
MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBeXK4IRZJNNLxTv078
|
||||
zPTnPXy+HiRvXSzO+7/ul1e4ZZXqV8TI8THJRhawDoDaR1WhZANiAATbMRTRsoJr
|
||||
t6Mosgnyg8acuGqHHKK/j/DfwrZrRI8Lp2xJ33+CU0nyVyq/Sx9/kZtUPiOe7zdL
|
||||
qxyfr9N4CPcRk5EQZs6zp3OhWlq6Cf5dAwzIL07hUtsMMUYFlMmUyxs=
|
||||
-----END PRIVATE KEY-----
|
||||
-----END EC PRIVATE KEY-----
|
||||
|
||||
@ -1,6 +0,0 @@
|
||||
{
|
||||
"kty": "EC",
|
||||
"crv": "P-256",
|
||||
"x": "IT1SWLxsacPiE5Z16jkopAn8_-85rMjgyCokrnjDft4",
|
||||
"y": "mP2JwOAOdMmXuwpxbKng3KZz27mz-nKWIlXJ3rzSGMo"
|
||||
}
|
||||
@ -1 +0,0 @@
|
||||
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCE9Uli8bGnD4hOWdeo5KKQJ/P/vOazI4MgqJK54w37emP2JwOAOdMmXuwpxbKng3KZz27mz+nKWIlXJ3rzSGMo= P-256@localhost
|
||||
@ -1,6 +0,0 @@
|
||||
{
|
||||
"kty": "EC",
|
||||
"crv": "P-384",
|
||||
"x": "2zEU0bKCa7ejKLIJ8oPGnLhqhxyiv4_w38K2a0SPC6dsSd9_glNJ8lcqv0sff5Gb",
|
||||
"y": "VD4jnu83S6scn6_TeAj3EZOREGbOs6dzoVpaugn-XQMMyC9O4VLbDDFGBZTJlMsb"
|
||||
}
|
||||
@ -1 +0,0 @@
|
||||
ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBNsxFNGygmu3oyiyCfKDxpy4aoccor+P8N/CtmtEjwunbEnff4JTSfJXKr9LH3+Rm1Q+I57vN0urHJ+v03gI9xGTkRBmzrOnc6FaWroJ/l0DDMgvTuFS2wwxRgWUyZTLGw== P-384@localhost
|
||||
61
lib/asn1.js
61
lib/asn1.js
@ -1,61 +0,0 @@
|
||||
'use strict';
|
||||
|
||||
var Enc = require('./encoding.js');
|
||||
|
||||
//
|
||||
// A dumbed-down, minimal ASN.1 packer
|
||||
//
|
||||
|
||||
// Almost every ASN.1 type that's important for CSR
|
||||
// can be represented generically with only a few rules.
|
||||
var ASN1 = module.exports = function ASN1(/*type, hexstrings...*/) {
|
||||
var args = Array.prototype.slice.call(arguments);
|
||||
var typ = args.shift();
|
||||
var str = args.join('').replace(/\s+/g, '').toLowerCase();
|
||||
var len = (str.length/2);
|
||||
var lenlen = 0;
|
||||
var hex = typ;
|
||||
|
||||
// We can't have an odd number of hex chars
|
||||
if (len !== Math.round(len)) {
|
||||
throw new Error("invalid hex");
|
||||
}
|
||||
|
||||
// The first byte of any ASN.1 sequence is the type (Sequence, Integer, etc)
|
||||
// The second byte is either the size of the value, or the size of its size
|
||||
|
||||
// 1. If the second byte is < 0x80 (128) it is considered the size
|
||||
// 2. If it is > 0x80 then it describes the number of bytes of the size
|
||||
// ex: 0x82 means the next 2 bytes describe the size of the value
|
||||
// 3. The special case of exactly 0x80 is "indefinite" length (to end-of-file)
|
||||
|
||||
if (len > 127) {
|
||||
lenlen += 1;
|
||||
while (len > 255) {
|
||||
lenlen += 1;
|
||||
len = len >> 8;
|
||||
}
|
||||
}
|
||||
|
||||
if (lenlen) { hex += Enc.numToHex(0x80 + lenlen); }
|
||||
return hex + Enc.numToHex(str.length/2) + str;
|
||||
};
|
||||
|
||||
// The Integer type has some special rules
|
||||
ASN1.UInt = function UINT() {
|
||||
var str = Array.prototype.slice.call(arguments).join('');
|
||||
var first = parseInt(str.slice(0, 2), 16);
|
||||
|
||||
// If the first byte is 0x80 or greater, the number is considered negative
|
||||
// Therefore we add a '00' prefix if the 0x80 bit is set
|
||||
if (0x80 & first) { str = '00' + str; }
|
||||
|
||||
return ASN1('02', str);
|
||||
};
|
||||
|
||||
// The Bit String type also has a special rule
|
||||
ASN1.BitStr = function BITSTR() {
|
||||
var str = Array.prototype.slice.call(arguments).join('');
|
||||
// '00' is a mask of how many bits of the next byte to ignore
|
||||
return ASN1('03', '00' + str);
|
||||
};
|
||||
365
lib/eckles.js
365
lib/eckles.js
@ -1,11 +1,6 @@
|
||||
'use strict';
|
||||
|
||||
var EC = module.exports;
|
||||
|
||||
var Enc = require('./encoding.js');
|
||||
var PEM = require('./pem.js');
|
||||
var SSH = require('./ssh.js');
|
||||
var x509 = require('./x509.js');
|
||||
var Hex = {};
|
||||
|
||||
// 1.2.840.10045.3.1.7
|
||||
// prime256v1 (ANSI X9.62 named elliptic curve)
|
||||
@ -14,97 +9,184 @@ var OBJ_ID_EC = '06 08 2A8648CE3D030107'.replace(/\s+/g, '').toLowerCase();
|
||||
// secp384r1 (SECG (Certicom) named elliptic curve)
|
||||
var OBJ_ID_EC_384 = '06 05 2B81040022'.replace(/\s+/g, '').toLowerCase();
|
||||
|
||||
|
||||
// The one good thing that came from the b***kchain hysteria: good EC documentation
|
||||
// https://davidederosa.com/basic-blockchain-programming/elliptic-curve-keys/
|
||||
|
||||
/*global Promise*/
|
||||
EC.generate = function (opts) {
|
||||
return Promise.resolve().then(function () {
|
||||
var typ = 'ec';
|
||||
var format = opts.format;
|
||||
var encoding = opts.encoding;
|
||||
var priv;
|
||||
var pub = 'spki';
|
||||
|
||||
if (!format) {
|
||||
format = 'jwk';
|
||||
}
|
||||
if (-1 !== [ 'spki', 'pkcs8', 'ssh' ].indexOf(format)) {
|
||||
format = 'pkcs8';
|
||||
}
|
||||
|
||||
if ('pem' === format) {
|
||||
format = 'sec1';
|
||||
encoding = 'pem';
|
||||
} else if ('der' === format) {
|
||||
format = 'sec1';
|
||||
encoding = 'der';
|
||||
}
|
||||
|
||||
if ('jwk' === format || 'json' === format) {
|
||||
format = 'jwk';
|
||||
encoding = 'json';
|
||||
} else {
|
||||
priv = format;
|
||||
}
|
||||
|
||||
if (!encoding) {
|
||||
encoding = 'pem';
|
||||
}
|
||||
|
||||
if (priv) {
|
||||
priv = { type: priv, format: encoding };
|
||||
pub = { type: pub, format: encoding };
|
||||
} else {
|
||||
// jwk
|
||||
priv = { type: 'sec1', format: 'pem' };
|
||||
pub = { type: 'spki', format: 'pem' };
|
||||
}
|
||||
|
||||
return new Promise(function (resolve, reject) {
|
||||
return require('crypto').generateKeyPair(typ, {
|
||||
namedCurve: opts.crv || opts.namedCurve || 'P-256'
|
||||
, privateKeyEncoding: priv
|
||||
, publicKeyEncoding: pub
|
||||
}, function (err, pubkey, privkey) {
|
||||
if (err) { reject(err); }
|
||||
resolve({
|
||||
private: privkey
|
||||
, public: pubkey
|
||||
});
|
||||
});
|
||||
}).then(function (keypair) {
|
||||
if ('jwk' === format) {
|
||||
return {
|
||||
private: EC.importSync({ pem: keypair.private, format: priv.type })
|
||||
, public: EC.importSync({ pem: keypair.public, format: pub.type, public: true })
|
||||
};
|
||||
}
|
||||
|
||||
if ('ssh' !== opts.format) {
|
||||
return keypair;
|
||||
}
|
||||
|
||||
return {
|
||||
private: keypair.private
|
||||
, public: EC.exportSync({ jwk: EC.importSync({
|
||||
pem: keypair.public, format: format, public: true
|
||||
}), format: opts.format, public: true })
|
||||
};
|
||||
});
|
||||
});
|
||||
var PEM = {};
|
||||
PEM._toUrlSafeBase64 = function (u8) {
|
||||
//console.log('Len:', u8.byteLength);
|
||||
return Buffer.from(u8).toString('base64')
|
||||
.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
|
||||
};
|
||||
|
||||
EC.importSync = function importEcSync(opts) {
|
||||
if (!opts || !opts.pem || 'string' !== typeof opts.pem) {
|
||||
throw new Error("must pass { pem: pem } as a string");
|
||||
function toHex(ab) {
|
||||
var hex = [];
|
||||
var u8 = new Uint8Array(ab);
|
||||
var size = u8.byteLength;
|
||||
var i;
|
||||
var h;
|
||||
for (i = 0; i < size; i += 1) {
|
||||
h = u8[i].toString(16);
|
||||
if (2 === h.length) {
|
||||
hex.push(h);
|
||||
} else {
|
||||
hex.push('0' + h);
|
||||
}
|
||||
if (0 === opts.pem.indexOf('ecdsa-sha2-')) {
|
||||
return SSH.parseSsh(opts.pem);
|
||||
}
|
||||
return hex.join('').replace(/\s+/g, '').toLowerCase();
|
||||
}
|
||||
Hex.fromAB = toHex;
|
||||
|
||||
function parsePem(pem) {
|
||||
var typ;
|
||||
var pub;
|
||||
var crv;
|
||||
var der = Buffer.from(pem.split(/\n/).filter(function (line, i) {
|
||||
if (0 === i) {
|
||||
if (/ PUBLIC /.test(line)) {
|
||||
pub = true;
|
||||
} else if (/ PRIVATE /.test(line)) {
|
||||
pub = false;
|
||||
}
|
||||
if (/ EC/.test(line)) {
|
||||
typ = 'EC';
|
||||
}
|
||||
}
|
||||
return !/---/.test(line);
|
||||
}).join(''), 'base64');
|
||||
|
||||
if (!typ || 'EC' === typ) {
|
||||
var hex = toHex(der);
|
||||
if (-1 !== hex.indexOf(OBJ_ID_EC)) {
|
||||
typ = 'EC';
|
||||
crv = 'P-256';
|
||||
} else if (-1 !== hex.indexOf(OBJ_ID_EC_384)) {
|
||||
typ = 'EC';
|
||||
crv = 'P-384';
|
||||
} else {
|
||||
// TODO support P-384 as well (but probably nothing else)
|
||||
console.warn("unsupported ec curve");
|
||||
}
|
||||
}
|
||||
|
||||
return { typ: typ, pub: pub, der: der, crv: crv };
|
||||
}
|
||||
|
||||
function parseEcOnlyPrivkey(u8, jwk) {
|
||||
var index = 7;
|
||||
var len = 32;
|
||||
var olen = OBJ_ID_EC.length/2;
|
||||
|
||||
if ("P-384" === jwk.crv) {
|
||||
olen = OBJ_ID_EC_384.length/2;
|
||||
index = 8;
|
||||
len = 48;
|
||||
}
|
||||
if (len !== u8[index - 1]) {
|
||||
throw new Error("Unexpected bitlength " + len);
|
||||
}
|
||||
|
||||
// private part is d
|
||||
var d = u8.slice(index, index + len);
|
||||
// compression bit index
|
||||
var ci = index + len + 2 + olen + 2 + 3;
|
||||
var c = u8[ci];
|
||||
var x, y;
|
||||
|
||||
if (0x04 === c) {
|
||||
y = u8.slice(ci + 1 + len, ci + 1 + len + len);
|
||||
} else if (0x02 !== c) {
|
||||
throw new Error("not a supported EC private key");
|
||||
}
|
||||
x = u8.slice(ci + 1, ci + 1 + len);
|
||||
|
||||
return {
|
||||
kty: jwk.kty
|
||||
, crv: jwk.crv
|
||||
, d: PEM._toUrlSafeBase64(d)
|
||||
//, dh: d
|
||||
, x: PEM._toUrlSafeBase64(x)
|
||||
//, xh: x
|
||||
, y: PEM._toUrlSafeBase64(y)
|
||||
//, yh: y
|
||||
};
|
||||
}
|
||||
function parseEcPkcs8Privkey(u8, jwk) {
|
||||
var index = 24 + (OBJ_ID_EC.length/2);
|
||||
var len = 32;
|
||||
if ("P-384" === jwk.crv) {
|
||||
index = 24 + (OBJ_ID_EC_384.length/2) + 2;
|
||||
len = 48;
|
||||
}
|
||||
|
||||
//console.log(index, u8.slice(index));
|
||||
if (0x04 !== u8[index]) {
|
||||
//console.log(jwk);
|
||||
throw new Error("privkey not found");
|
||||
}
|
||||
var d = u8.slice(index+2, index+2+len);
|
||||
var ci = index+2+len+5;
|
||||
var xi = ci+1;
|
||||
var x = u8.slice(xi, xi + len);
|
||||
var yi = xi+len;
|
||||
var y;
|
||||
if (0x04 === u8[ci]) {
|
||||
y = u8.slice(yi, yi + len);
|
||||
} else if (0x02 !== u8[ci]) {
|
||||
throw new Error("invalid compression bit (expected 0x04 or 0x02)");
|
||||
}
|
||||
|
||||
return {
|
||||
kty: jwk.kty
|
||||
, crv: jwk.crv
|
||||
, d: PEM._toUrlSafeBase64(d)
|
||||
//, dh: d
|
||||
, x: PEM._toUrlSafeBase64(x)
|
||||
//, xh: x
|
||||
, y: PEM._toUrlSafeBase64(y)
|
||||
//, yh: y
|
||||
};
|
||||
}
|
||||
function parseEcPub(u8, jwk) {
|
||||
var ci = 16 + OBJ_ID_EC.length/2;
|
||||
var len = 32;
|
||||
|
||||
if ("P-384" === jwk.crv) {
|
||||
ci = 16 + OBJ_ID_EC_384.length/2;
|
||||
len = 48;
|
||||
}
|
||||
|
||||
var c = u8[ci];
|
||||
var xi = ci + 1;
|
||||
var x = u8.slice(xi, xi + len);
|
||||
var yi = xi + len;
|
||||
var y;
|
||||
if (0x04 === c) {
|
||||
y = u8.slice(yi, yi + len);
|
||||
} else if (0x02 !== c) {
|
||||
throw new Error("not a supported EC private key");
|
||||
}
|
||||
|
||||
return {
|
||||
kty: jwk.kty
|
||||
, crv: jwk.crv
|
||||
, x: PEM._toUrlSafeBase64(x)
|
||||
//, xh: x
|
||||
, y: PEM._toUrlSafeBase64(y)
|
||||
//, yh: y
|
||||
};
|
||||
}
|
||||
|
||||
/*global Promise*/
|
||||
function parseEcPrivkey(opts) {
|
||||
return Promise.resolve().then(function () {
|
||||
if (!opts || !opts.pem) {
|
||||
throw new Error("must pass { pem: pem }");
|
||||
}
|
||||
var pem = opts.pem;
|
||||
var u8 = PEM.parseBlock(pem).bytes;
|
||||
var hex = Enc.bufToHex(u8);
|
||||
var u8 = parsePem(pem).der;
|
||||
var hex = toHex(u8);
|
||||
var jwk = { kty: 'EC', crv: null, x: null, y: null };
|
||||
|
||||
//console.log();
|
||||
@ -114,15 +196,15 @@ EC.importSync = function importEcSync(opts) {
|
||||
// PKCS8
|
||||
if (0x02 === u8[3] && 0x30 === u8[6] && 0x06 === u8[8]) {
|
||||
//console.log("PKCS8", u8[3].toString(16), u8[6].toString(16), u8[8].toString(16));
|
||||
jwk = x509.parsePkcs8(u8, jwk);
|
||||
return parseEcPkcs8Privkey(u8, jwk);
|
||||
// EC-only
|
||||
} else if (0x02 === u8[2] && 0x04 === u8[5] && 0xA0 === u8[39]) {
|
||||
//console.log("EC---", u8[2].toString(16), u8[5].toString(16), u8[39].toString(16));
|
||||
jwk = x509.parseSec1(u8, jwk);
|
||||
return parseEcOnlyPrivkey(u8, jwk);
|
||||
// SPKI/PKIK (Public)
|
||||
} else if (0x30 === u8[2] && 0x06 === u8[4] && 0x06 === u8[13]) {
|
||||
//console.log("SPKI-", u8[2].toString(16), u8[4].toString(16), u8[13].toString(16));
|
||||
jwk = x509.parseSpki(u8, jwk);
|
||||
return parseEcPub(u8, jwk);
|
||||
// Error
|
||||
} else {
|
||||
//console.log("PKCS8", u8[3].toString(16), u8[6].toString(16), u8[8].toString(16));
|
||||
@ -136,15 +218,15 @@ EC.importSync = function importEcSync(opts) {
|
||||
// PKCS8
|
||||
if (0x02 === u8[3] && 0x30 === u8[6] && 0x06 === u8[8]) {
|
||||
//console.log("PKCS8", u8[3].toString(16), u8[6].toString(16), u8[8].toString(16));
|
||||
jwk = x509.parsePkcs8(u8, jwk);
|
||||
return parseEcPkcs8Privkey(u8, jwk);
|
||||
// EC-only
|
||||
} else if (0x02 === u8[3] && 0x04 === u8[6] && 0xA0 === u8[56]) {
|
||||
//console.log("EC---", u8[3].toString(16), u8[6].toString(16), u8[56].toString(16));
|
||||
jwk = x509.parseSec1(u8, jwk);
|
||||
return parseEcOnlyPrivkey(u8, jwk);
|
||||
// SPKI/PKIK (Public)
|
||||
} else if (0x30 === u8[2] && 0x06 === u8[4] && 0x06 === u8[13]) {
|
||||
//console.log("SPKI-", u8[2].toString(16), u8[4].toString(16), u8[13].toString(16));
|
||||
jwk = x509.parseSpki(u8, jwk);
|
||||
return parseEcPub(u8, jwk);
|
||||
// Error
|
||||
} else {
|
||||
//console.log("PKCS8", u8[3].toString(16), u8[6].toString(16), u8[8].toString(16));
|
||||
@ -155,96 +237,7 @@ EC.importSync = function importEcSync(opts) {
|
||||
} else {
|
||||
throw new Error("Supported key types are P-256 and P-384");
|
||||
}
|
||||
if (opts.public) {
|
||||
if (true !== opts.public) {
|
||||
throw new Error("options.public must be either `true` or `false` not ("
|
||||
+ typeof opts.public + ") '" + opts.public + "'");
|
||||
}
|
||||
delete jwk.d;
|
||||
}
|
||||
return jwk;
|
||||
};
|
||||
EC.parse = function parseEc(opts) {
|
||||
return Promise.resolve().then(function () {
|
||||
return EC.importSync(opts);
|
||||
});
|
||||
};
|
||||
EC.toJwk = EC.import = EC.parse;
|
||||
}
|
||||
|
||||
EC.exportSync = function (opts) {
|
||||
if (!opts || !opts.jwk || 'object' !== typeof opts.jwk) {
|
||||
throw new Error("must pass { jwk: jwk } as a JSON object");
|
||||
}
|
||||
var jwk = JSON.parse(JSON.stringify(opts.jwk));
|
||||
var format = opts.format;
|
||||
if (opts.public || -1 !== [ 'spki', 'pkix', 'ssh', 'rfc4716' ].indexOf(format)) {
|
||||
jwk.d = null;
|
||||
}
|
||||
if ('EC' !== jwk.kty) {
|
||||
throw new Error("options.jwk.kty must be 'EC' for EC keys");
|
||||
}
|
||||
if (!jwk.d) {
|
||||
if (!format || -1 !== [ 'spki', 'pkix' ].indexOf(format)) {
|
||||
format = 'spki';
|
||||
} else if (-1 !== [ 'ssh', 'rfc4716' ].indexOf(format)) {
|
||||
format = 'ssh';
|
||||
} else {
|
||||
throw new Error("options.format must be 'spki' or 'ssh' for public EC keys, not ("
|
||||
+ typeof format + ") " + format);
|
||||
}
|
||||
} else {
|
||||
if (!format || 'sec1' === format) {
|
||||
format = 'sec1';
|
||||
} else if ('pkcs8' !== format) {
|
||||
throw new Error("options.format must be 'sec1' or 'pkcs8' for private EC keys, not '" + format + "'");
|
||||
}
|
||||
}
|
||||
if (-1 === [ 'P-256', 'P-384' ].indexOf(jwk.crv)) {
|
||||
throw new Error("options.jwk.crv must be either P-256 or P-384 for EC keys, not '" + jwk.crv + "'");
|
||||
}
|
||||
if (!jwk.y) {
|
||||
throw new Error("options.jwk.y must be a urlsafe base64-encoded either P-256 or P-384");
|
||||
}
|
||||
|
||||
if ('sec1' === format) {
|
||||
return PEM.packBlock({ type: "EC PRIVATE KEY", bytes: x509.packSec1(jwk) });
|
||||
} else if ('pkcs8' === format) {
|
||||
return PEM.packBlock({ type: "PRIVATE KEY", bytes: x509.packPkcs8(jwk) });
|
||||
} else if (-1 !== [ 'spki', 'pkix' ].indexOf(format)) {
|
||||
return PEM.packBlock({ type: "PUBLIC KEY", bytes: x509.packSpki(jwk) });
|
||||
} else if (-1 !== [ 'ssh', 'rfc4716' ].indexOf(format)) {
|
||||
return SSH.packSsh(jwk);
|
||||
} else {
|
||||
throw new Error("Sanity Error: reached unreachable code block with format: " + format);
|
||||
}
|
||||
};
|
||||
EC.pack = function (opts) {
|
||||
return Promise.resolve().then(function () {
|
||||
return EC.exportSync(opts);
|
||||
});
|
||||
};
|
||||
|
||||
EC.__thumbprint = function (jwk) {
|
||||
var buf = require('crypto').createHash('sha256')
|
||||
// alphabetically sorted keys [ 'crv', 'kty', 'x', 'y' ]
|
||||
.update('{"crv":"' + jwk.crv + '","kty":"EC","x":"' + jwk.x + '","y":"' + jwk.y + '"}')
|
||||
.digest()
|
||||
;
|
||||
return Enc.bufToUrlBase64(buf);
|
||||
};
|
||||
|
||||
EC.thumbprint = function (opts) {
|
||||
return Promise.resolve().then(function () {
|
||||
var jwk;
|
||||
if ('EC' === opts.kty) {
|
||||
jwk = opts;
|
||||
} else if (opts.jwk) {
|
||||
jwk = opts.jwk;
|
||||
} else {
|
||||
jwk = EC.importSync(opts);
|
||||
}
|
||||
return EC.__thumbprint(jwk);
|
||||
});
|
||||
};
|
||||
|
||||
EC.toPem = EC.export = EC.pack;
|
||||
module.exports.import = parseEcPrivkey;
|
||||
|
||||
@ -1,42 +0,0 @@
|
||||
'use strict';
|
||||
|
||||
var Enc = module.exports;
|
||||
|
||||
Enc.base64ToBuf = function (str) {
|
||||
// node handles both base64 and urlBase64 equally
|
||||
return Buffer.from(str, 'base64');
|
||||
};
|
||||
|
||||
Enc.base64ToHex = function (b64) {
|
||||
return Enc.bufToHex(Enc.base64ToBuf(b64));
|
||||
};
|
||||
|
||||
Enc.bufToBase64 = function (u8) {
|
||||
// Ensure a node buffer, even if TypedArray
|
||||
return Buffer.from(u8).toString('base64');
|
||||
};
|
||||
|
||||
Enc.bufToHex = function (u8) {
|
||||
// Ensure a node buffer, even if TypedArray
|
||||
return Buffer.from(u8).toString('hex');
|
||||
};
|
||||
|
||||
Enc.bufToUrlBase64 = function (u8) {
|
||||
return Enc.bufToBase64(u8)
|
||||
.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
|
||||
};
|
||||
|
||||
Enc.hexToUint8 = function (hex) {
|
||||
// TODO: I don't remember why I chose Uint8Array over Buffer...
|
||||
var buf = Buffer.from(hex, 'hex');
|
||||
var ab = buf.buffer.slice(buf.offset, buf.offset + buf.byteLength);
|
||||
return new Uint8Array(ab);
|
||||
};
|
||||
|
||||
Enc.numToHex = function (d) {
|
||||
d = d.toString(16);
|
||||
if (d.length % 2) {
|
||||
return '0' + d;
|
||||
}
|
||||
return d;
|
||||
};
|
||||
@ -1,36 +0,0 @@
|
||||
// Copyright 2016-2018 AJ ONeal. All rights reserved
|
||||
/* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
||||
'use strict';
|
||||
|
||||
var curves = {
|
||||
"P-256": "prime256v1" // 65
|
||||
, "secp256r1": "prime256v1"
|
||||
, "P-384": "secp384r1" // 97
|
||||
, "P-521": "secp521r1" // 133
|
||||
};
|
||||
var crv = "P-256";
|
||||
var ecdh = require('crypto').createECDH(curves[crv] || crv);
|
||||
var keys = ecdh.generateKeys(null, 'uncompressed');
|
||||
console.log(keys.length);
|
||||
console.log(keys.toString('hex'));
|
||||
keys = keys.slice(1);
|
||||
var x = keys.slice(0, keys.byteLength / 2);
|
||||
var y = keys.slice(keys.byteLength / 2);
|
||||
while (0 === x[0]) { x = x.slice(1); }
|
||||
while (0 === y[0]) { y = y.slice(1); }
|
||||
console.log({
|
||||
kty: "EC"
|
||||
, crv: "P-XXX"
|
||||
, x: _toUrlBase64(x)
|
||||
, y: _toUrlBase64(y)
|
||||
});
|
||||
|
||||
function _toUrlBase64(buf) {
|
||||
return buf.toString('base64')
|
||||
.replace(/\+/g, "-")
|
||||
.replace(/\//g, "_")
|
||||
.replace(/=/g,"")
|
||||
;
|
||||
}
|
||||
@ -1,22 +0,0 @@
|
||||
// Copyright 2016-2018 AJ ONeal. All rights reserved
|
||||
/* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
||||
'use strict';
|
||||
|
||||
module.exports = function (crv) {
|
||||
var keypair = require('crypto').generateKeyPairSync(
|
||||
'ec'
|
||||
, { namedCurve: crv
|
||||
, privateKeyEncoding: { type: 'sec1', format: 'pem' }
|
||||
, publicKeyEncoding: { type: 'spki', format: 'pem' }
|
||||
}
|
||||
);
|
||||
var result = { privateKeyPem: keypair.privateKey.trim() };
|
||||
return result;
|
||||
};
|
||||
|
||||
if (require.main === module) {
|
||||
var keypair = module.exports('P-256');
|
||||
console.info(keypair.privateKeyPem);
|
||||
}
|
||||
28
lib/pem.js
28
lib/pem.js
@ -1,28 +0,0 @@
|
||||
'use strict';
|
||||
|
||||
var PEM = module.exports;
|
||||
var Enc = require('./encoding.js');
|
||||
|
||||
PEM.parseBlock = function pemToDer(pem) {
|
||||
var lines = pem.trim().split(/\n/);
|
||||
var end = lines.length - 1;
|
||||
var head = lines[0].match(/-----BEGIN (.*)-----/);
|
||||
var foot = lines[end].match(/-----END (.*)-----/);
|
||||
|
||||
if (head) {
|
||||
lines = lines.slice(1, end);
|
||||
head = head[1];
|
||||
if (head !== foot[1]) {
|
||||
throw new Error("headers and footers do not match");
|
||||
}
|
||||
}
|
||||
|
||||
return { type: head, bytes: Enc.base64ToBuf(lines.join('')) };
|
||||
};
|
||||
|
||||
PEM.packBlock = function (opts) {
|
||||
return '-----BEGIN ' + opts.type + '-----\n'
|
||||
+ Enc.bufToBase64(opts.bytes).match(/.{1,64}/g).join('\n') + '\n'
|
||||
+ '-----END ' + opts.type + '-----'
|
||||
;
|
||||
};
|
||||
55
lib/ssh.js
55
lib/ssh.js
@ -1,55 +0,0 @@
|
||||
'use strict';
|
||||
|
||||
var SSH = module.exports;
|
||||
var Enc = require('./encoding.js');
|
||||
|
||||
// 19 e c d s a - s h a 2 - n i s t p 2 5 6
|
||||
var SSH_EC_P256 = '00000013 65 63 64 73 61 2d 73 68 61 32 2d 6e 69 73 74 70 32 35 36'
|
||||
.replace(/\s+/g, '').toLowerCase();
|
||||
// 19 e c d s a - s h a 2 - n i s t p 3 8 4
|
||||
var SSH_EC_P384 = '00000013 65 63 64 73 61 2d 73 68 61 32 2d 6e 69 73 74 70 33 38 34'
|
||||
.replace(/\s+/g, '').toLowerCase();
|
||||
|
||||
SSH.parseSsh = function (pem) {
|
||||
var jwk = { kty: 'EC', crv: null, x: null, y: null };
|
||||
var b64 = pem.split(/\s+/g)[1];
|
||||
var buf = Buffer.from(b64, 'base64');
|
||||
var hex = Enc.bufToHex(buf);
|
||||
var index = 40;
|
||||
var len;
|
||||
if (0 === hex.indexOf(SSH_EC_P256)) {
|
||||
jwk.crv = 'P-256';
|
||||
len = 32;
|
||||
} else if (0 === hex.indexOf(SSH_EC_P384)) {
|
||||
jwk.crv = 'P-384';
|
||||
len = 48;
|
||||
}
|
||||
var x = buf.slice(index, index + len);
|
||||
var y = buf.slice(index + len, index + len + len);
|
||||
jwk.x = Enc.bufToUrlBase64(x);
|
||||
jwk.y = Enc.bufToUrlBase64(y);
|
||||
return jwk;
|
||||
};
|
||||
|
||||
|
||||
SSH.packSsh = function (jwk) {
|
||||
// Custom SSH format
|
||||
var typ = 'ecdsa-sha2-nistp256';
|
||||
var a = '32 35 36';
|
||||
var b = '41';
|
||||
var comment = jwk.crv + '@localhost';
|
||||
if ('P-256' !== jwk.crv) {
|
||||
typ = 'ecdsa-sha2-nistp384';
|
||||
a = '33 38 34';
|
||||
b = '61';
|
||||
}
|
||||
var x = Enc.base64ToHex(jwk.x);
|
||||
var y = Enc.base64ToHex(jwk.y);
|
||||
var ssh = Enc.hexToUint8(
|
||||
('00 00 00 13 65 63 64 73 61 2d 73 68 61 32 2d 6e 69 73 74 70'
|
||||
+ a + '00 00 00 08 6e 69 73 74 70' + a + '00 00 00' + b
|
||||
+ '04' + x + y).replace(/\s+/g, '').toLowerCase()
|
||||
);
|
||||
|
||||
return typ + ' ' + Enc.bufToBase64(ssh) + ' ' + comment;
|
||||
};
|
||||
170
lib/x509.js
170
lib/x509.js
@ -1,170 +0,0 @@
|
||||
'use strict';
|
||||
|
||||
var ASN1 = require('./asn1.js');
|
||||
var Enc = require('./encoding.js');
|
||||
var x509 = module.exports;
|
||||
|
||||
// 1.2.840.10045.3.1.7
|
||||
// prime256v1 (ANSI X9.62 named elliptic curve)
|
||||
var OBJ_ID_EC = '06 08 2A8648CE3D030107'.replace(/\s+/g, '').toLowerCase();
|
||||
// 1.3.132.0.34
|
||||
// secp384r1 (SECG (Certicom) named elliptic curve)
|
||||
var OBJ_ID_EC_384 = '06 05 2B81040022'.replace(/\s+/g, '').toLowerCase();
|
||||
// 1.2.840.10045.2.1
|
||||
// ecPublicKey (ANSI X9.62 public key type)
|
||||
var OBJ_ID_EC_PUB = '06 07 2A8648CE3D0201'.replace(/\s+/g, '').toLowerCase();
|
||||
|
||||
x509.parseSec1 = function parseEcOnlyPrivkey(u8, jwk) {
|
||||
var index = 7;
|
||||
var len = 32;
|
||||
var olen = OBJ_ID_EC.length/2;
|
||||
|
||||
if ("P-384" === jwk.crv) {
|
||||
olen = OBJ_ID_EC_384.length/2;
|
||||
index = 8;
|
||||
len = 48;
|
||||
}
|
||||
if (len !== u8[index - 1]) {
|
||||
throw new Error("Unexpected bitlength " + len);
|
||||
}
|
||||
|
||||
// private part is d
|
||||
var d = u8.slice(index, index + len);
|
||||
// compression bit index
|
||||
var ci = index + len + 2 + olen + 2 + 3;
|
||||
var c = u8[ci];
|
||||
var x, y;
|
||||
|
||||
if (0x04 === c) {
|
||||
y = u8.slice(ci + 1 + len, ci + 1 + len + len);
|
||||
} else if (0x02 !== c) {
|
||||
throw new Error("not a supported EC private key");
|
||||
}
|
||||
x = u8.slice(ci + 1, ci + 1 + len);
|
||||
|
||||
return {
|
||||
kty: jwk.kty
|
||||
, crv: jwk.crv
|
||||
, d: Enc.bufToUrlBase64(d)
|
||||
//, dh: Enc.bufToHex(d)
|
||||
, x: Enc.bufToUrlBase64(x)
|
||||
//, xh: Enc.bufToHex(x)
|
||||
, y: Enc.bufToUrlBase64(y)
|
||||
//, yh: Enc.bufToHex(y)
|
||||
};
|
||||
};
|
||||
|
||||
x509.parsePkcs8 = function parseEcPkcs8(u8, jwk) {
|
||||
var index = 24 + (OBJ_ID_EC.length/2);
|
||||
var len = 32;
|
||||
if ("P-384" === jwk.crv) {
|
||||
index = 24 + (OBJ_ID_EC_384.length/2) + 2;
|
||||
len = 48;
|
||||
}
|
||||
|
||||
//console.log(index, u8.slice(index));
|
||||
if (0x04 !== u8[index]) {
|
||||
//console.log(jwk);
|
||||
throw new Error("privkey not found");
|
||||
}
|
||||
var d = u8.slice(index+2, index+2+len);
|
||||
var ci = index+2+len+5;
|
||||
var xi = ci+1;
|
||||
var x = u8.slice(xi, xi + len);
|
||||
var yi = xi+len;
|
||||
var y;
|
||||
if (0x04 === u8[ci]) {
|
||||
y = u8.slice(yi, yi + len);
|
||||
} else if (0x02 !== u8[ci]) {
|
||||
throw new Error("invalid compression bit (expected 0x04 or 0x02)");
|
||||
}
|
||||
|
||||
return {
|
||||
kty: jwk.kty
|
||||
, crv: jwk.crv
|
||||
, d: Enc.bufToUrlBase64(d)
|
||||
//, dh: Enc.bufToHex(d)
|
||||
, x: Enc.bufToUrlBase64(x)
|
||||
//, xh: Enc.bufToHex(x)
|
||||
, y: Enc.bufToUrlBase64(y)
|
||||
//, yh: Enc.bufToHex(y)
|
||||
};
|
||||
};
|
||||
|
||||
x509.parseSpki = function parsePem(u8, jwk) {
|
||||
var ci = 16 + OBJ_ID_EC.length/2;
|
||||
var len = 32;
|
||||
|
||||
if ("P-384" === jwk.crv) {
|
||||
ci = 16 + OBJ_ID_EC_384.length/2;
|
||||
len = 48;
|
||||
}
|
||||
|
||||
var c = u8[ci];
|
||||
var xi = ci + 1;
|
||||
var x = u8.slice(xi, xi + len);
|
||||
var yi = xi + len;
|
||||
var y;
|
||||
if (0x04 === c) {
|
||||
y = u8.slice(yi, yi + len);
|
||||
} else if (0x02 !== c) {
|
||||
throw new Error("not a supported EC private key");
|
||||
}
|
||||
|
||||
return {
|
||||
kty: jwk.kty
|
||||
, crv: jwk.crv
|
||||
, x: Enc.bufToUrlBase64(x)
|
||||
//, xh: Enc.bufToHex(x)
|
||||
, y: Enc.bufToUrlBase64(y)
|
||||
//, yh: Enc.bufToHex(y)
|
||||
};
|
||||
};
|
||||
x509.parsePkix = x509.parseSpki;
|
||||
|
||||
x509.packSec1 = function (jwk) {
|
||||
var d = Enc.base64ToHex(jwk.d);
|
||||
var x = Enc.base64ToHex(jwk.x);
|
||||
var y = Enc.base64ToHex(jwk.y);
|
||||
var objId = ('P-256' === jwk.crv) ? OBJ_ID_EC : OBJ_ID_EC_384;
|
||||
return Enc.hexToUint8(
|
||||
ASN1('30'
|
||||
, ASN1.UInt('01')
|
||||
, ASN1('04', d)
|
||||
, ASN1('A0', objId)
|
||||
, ASN1('A1', ASN1.BitStr('04' + x + y)))
|
||||
);
|
||||
};
|
||||
x509.packPkcs8 = function (jwk) {
|
||||
var d = Enc.base64ToHex(jwk.d);
|
||||
var x = Enc.base64ToHex(jwk.x);
|
||||
var y = Enc.base64ToHex(jwk.y);
|
||||
var objId = ('P-256' === jwk.crv) ? OBJ_ID_EC : OBJ_ID_EC_384;
|
||||
return Enc.hexToUint8(
|
||||
ASN1('30'
|
||||
, ASN1.UInt('00')
|
||||
, ASN1('30'
|
||||
, OBJ_ID_EC_PUB
|
||||
, objId
|
||||
)
|
||||
, ASN1('04'
|
||||
, ASN1('30'
|
||||
, ASN1.UInt('01')
|
||||
, ASN1('04', d)
|
||||
, ASN1('A1', ASN1.BitStr('04' + x + y)))))
|
||||
);
|
||||
};
|
||||
x509.packSpki = function (jwk) {
|
||||
var x = Enc.base64ToHex(jwk.x);
|
||||
var y = Enc.base64ToHex(jwk.y);
|
||||
var objId = ('P-256' === jwk.crv) ? OBJ_ID_EC : OBJ_ID_EC_384;
|
||||
return Enc.hexToUint8(
|
||||
ASN1('30'
|
||||
, ASN1('30'
|
||||
, OBJ_ID_EC_PUB
|
||||
, objId
|
||||
)
|
||||
, ASN1.BitStr('04' + x + y))
|
||||
);
|
||||
};
|
||||
x509.packPkix = x509.packSpki;
|
||||
24
package.json
24
package.json
@ -1,23 +1,17 @@
|
||||
{
|
||||
"name": "eckles",
|
||||
"version": "1.4.0",
|
||||
"description": "💯 PEM-to-JWK and JWK-to-PEM (and SSH) for ECDSA keys in a lightweight, zero-dependency library focused on perfect universal compatibility.",
|
||||
"homepage": "https://git.coolaj86.com/coolaj86/eckles.js",
|
||||
"version": "0.1.1",
|
||||
"description": "A focused, zero-dependency library for perfect universal ECDSA P-256 (prime256v1, secp256r1) and P-384 (secp384r1) support.",
|
||||
"main": "index.js",
|
||||
"bin": {
|
||||
"eckles": "bin/eckles.js"
|
||||
},
|
||||
"files": [
|
||||
"bin",
|
||||
"fixtures",
|
||||
"lib"
|
||||
],
|
||||
"directories": {
|
||||
"lib": "lib"
|
||||
},
|
||||
"scripts": {
|
||||
"postinstall": "node lib/telemetry.js event:install",
|
||||
"test": "bash test.sh"
|
||||
"test": "echo \"Error: no test specified\" && exit 1"
|
||||
},
|
||||
"repository": {
|
||||
"type": "git",
|
||||
@ -25,16 +19,14 @@
|
||||
},
|
||||
"keywords": [
|
||||
"zero-dependency",
|
||||
"JWK-to-PEM",
|
||||
"PEM-to-JWK",
|
||||
"ECDSA",
|
||||
"EC",
|
||||
"SSH-to-JWK",
|
||||
"JWK-to-SSH",
|
||||
"ec",
|
||||
"ecdsa",
|
||||
"jwk",
|
||||
"pem",
|
||||
"p-256",
|
||||
"p-384",
|
||||
"prime256v1",
|
||||
"secp256r1",
|
||||
"p-384",
|
||||
"secp384r1"
|
||||
],
|
||||
"author": "AJ ONeal <coolaj86@gmail.com> (https://coolaj86.com/)",
|
||||
|
||||
141
test.sh
141
test.sh
@ -1,136 +1,15 @@
|
||||
#/bin/bash
|
||||
set -e
|
||||
|
||||
echo ""
|
||||
echo "Testing PEM-to-JWK P-256"
|
||||
node bin/eckles.js fixtures/privkey-ec-p256.sec1.pem \
|
||||
> fixtures/privkey-ec-p256.jwk.2
|
||||
diff fixtures/privkey-ec-p256.jwk.json fixtures/privkey-ec-p256.jwk.2
|
||||
node bin/eckles.js fixtures/privkey-ec-p256.pkcs8.pem \
|
||||
> fixtures/privkey-ec-p256.jwk.2
|
||||
diff fixtures/privkey-ec-p256.jwk.json fixtures/privkey-ec-p256.jwk.2
|
||||
node bin/eckles.js fixtures/pub-ec-p256.spki.pem \
|
||||
> fixtures/pub-ec-p256.jwk.2
|
||||
diff fixtures/pub-ec-p256.jwk.json fixtures/pub-ec-p256.jwk.2
|
||||
#
|
||||
node bin/eckles.js fixtures/pub-ec-p256.ssh.pub \
|
||||
> fixtures/pub-ec-p256.jwk.2
|
||||
diff fixtures/pub-ec-p256.jwk.2 fixtures/pub-ec-p256.jwk.2
|
||||
echo "PASS"
|
||||
|
||||
|
||||
echo ""
|
||||
echo "Testing PEM-to-JWK P-384"
|
||||
node bin/eckles.js fixtures/privkey-ec-p384.sec1.pem \
|
||||
> fixtures/privkey-ec-p384.jwk.2
|
||||
diff fixtures/privkey-ec-p384.jwk.json fixtures/privkey-ec-p384.jwk.2
|
||||
node bin/eckles.js fixtures/privkey-ec-p384.pkcs8.pem \
|
||||
> fixtures/privkey-ec-p384.jwk.2.2
|
||||
diff fixtures/privkey-ec-p384.jwk.json fixtures/privkey-ec-p384.jwk.2.2
|
||||
node bin/eckles.js fixtures/pub-ec-p384.spki.pem \
|
||||
> fixtures/pub-ec-p384.jwk.2
|
||||
diff fixtures/pub-ec-p384.jwk.json fixtures/pub-ec-p384.jwk.2
|
||||
#
|
||||
node bin/eckles.js fixtures/pub-ec-p384.ssh.pub \
|
||||
> fixtures/pub-ec-p384.jwk.2
|
||||
diff fixtures/pub-ec-p384.jwk.2 fixtures/pub-ec-p384.jwk.2
|
||||
echo "PASS"
|
||||
|
||||
|
||||
echo ""
|
||||
echo "Testing JWK-to-PEM P-256"
|
||||
node bin/eckles.js fixtures/privkey-ec-p256.jwk.json sec1 \
|
||||
> fixtures/privkey-ec-p256.sec1.pem.2
|
||||
diff fixtures/privkey-ec-p256.sec1.pem fixtures/privkey-ec-p256.sec1.pem.2
|
||||
#
|
||||
node bin/eckles.js fixtures/privkey-ec-p256.jwk.json pkcs8 \
|
||||
> fixtures/privkey-ec-p256.pkcs8.pem.2
|
||||
diff fixtures/privkey-ec-p256.pkcs8.pem fixtures/privkey-ec-p256.pkcs8.pem.2
|
||||
#
|
||||
node bin/eckles.js fixtures/pub-ec-p256.jwk.json spki \
|
||||
> fixtures/pub-ec-p256.spki.pem.2
|
||||
diff fixtures/pub-ec-p256.spki.pem fixtures/pub-ec-p256.spki.pem.2
|
||||
# ssh-keygen -f fixtures/pub-ec-p256.spki.pem -i -mPKCS8 > fixtures/pub-ec-p256.ssh.pub
|
||||
node bin/eckles.js fixtures/pub-ec-p256.jwk.json ssh \
|
||||
> fixtures/pub-ec-p256.ssh.pub.2
|
||||
diff fixtures/pub-ec-p256.ssh.pub fixtures/pub-ec-p256.ssh.pub.2
|
||||
echo "PASS"
|
||||
|
||||
|
||||
echo ""
|
||||
echo "Testing JWK-to-PEM P-384"
|
||||
node bin/eckles.js fixtures/privkey-ec-p384.jwk.json sec1 \
|
||||
> fixtures/privkey-ec-p384.sec1.pem.2
|
||||
diff fixtures/privkey-ec-p384.sec1.pem fixtures/privkey-ec-p384.sec1.pem.2
|
||||
#
|
||||
node bin/eckles.js fixtures/privkey-ec-p384.jwk.json pkcs8 \
|
||||
> fixtures/privkey-ec-p384.pkcs8.pem.2
|
||||
diff fixtures/privkey-ec-p384.pkcs8.pem fixtures/privkey-ec-p384.pkcs8.pem.2
|
||||
#
|
||||
node bin/eckles.js fixtures/pub-ec-p384.jwk.json spki \
|
||||
> fixtures/pub-ec-p384.spki.pem.2
|
||||
diff fixtures/pub-ec-p384.spki.pem fixtures/pub-ec-p384.spki.pem.2
|
||||
# ssh-keygen -f fixtures/pub-ec-p384.spki.pem -i -mPKCS8 > fixtures/pub-ec-p384.ssh.pub
|
||||
node bin/eckles.js fixtures/pub-ec-p384.jwk.json ssh \
|
||||
> fixtures/pub-ec-p384.ssh.pub.2
|
||||
diff fixtures/pub-ec-p384.ssh.pub fixtures/pub-ec-p384.ssh.pub.2
|
||||
echo "PASS"
|
||||
|
||||
|
||||
rm fixtures/*.2
|
||||
|
||||
|
||||
echo ""
|
||||
echo "Testing freshly generated keypair"
|
||||
# Generate EC P-256 Keypair
|
||||
openssl ecparam -genkey -name prime256v1 -noout -out ./privkey-ec-p256.sec1.pem
|
||||
# Export Public-only EC Key (as SPKI)
|
||||
openssl ec -in ./privkey-ec-p256.sec1.pem -pubout -out ./pub-ec-p256.spki.pem
|
||||
# Convert SEC1 (traditional) EC Keypair to PKCS8 format
|
||||
openssl pkcs8 -topk8 -nocrypt -in ./privkey-ec-p256.sec1.pem -out ./privkey-ec-p256.pkcs8.pem
|
||||
# Convert EC public key to SSH format
|
||||
sshpub=$(ssh-keygen -f ./pub-ec-p256.spki.pem -i -mPKCS8)
|
||||
echo "$sshpub P-256@localhost" > ./pub-ec-p256.ssh.pub
|
||||
#
|
||||
node bin/eckles.js ./privkey-ec-p256.sec1.pem > ./privkey-ec-p256.jwk.json
|
||||
node bin/eckles.js ./privkey-ec-p256.jwk.json sec1 > ./privkey-ec-p256.sec1.pem.2
|
||||
diff ./privkey-ec-p256.sec1.pem ./privkey-ec-p256.sec1.pem.2
|
||||
#
|
||||
node bin/eckles.js ./privkey-ec-p256.pkcs8.pem > ./privkey-ec-p256.jwk.json
|
||||
node bin/eckles.js ./privkey-ec-p256.jwk.json pkcs8 > ./privkey-ec-p256.pkcs8.pem.2
|
||||
diff ./privkey-ec-p256.pkcs8.pem ./privkey-ec-p256.pkcs8.pem.2
|
||||
#
|
||||
node bin/eckles.js ./pub-ec-p256.spki.pem > ./pub-ec-p256.jwk.json
|
||||
node bin/eckles.js ./pub-ec-p256.jwk.json spki > ./pub-ec-p256.spki.pem.2
|
||||
diff ./pub-ec-p256.spki.pem ./pub-ec-p256.spki.pem.2
|
||||
#
|
||||
node bin/eckles.js ./pub-ec-p256.ssh.pub > ./pub-ec-p256.jwk.json
|
||||
node bin/eckles.js ./pub-ec-p256.jwk.json ssh > ./pub-ec-p256.ssh.pub.2
|
||||
diff ./pub-ec-p256.ssh.pub ./pub-ec-p256.ssh.pub.2
|
||||
echo "PASS"
|
||||
|
||||
echo ""
|
||||
echo "Testing key generation"
|
||||
node bin/eckles.js jwk > /dev/null
|
||||
node bin/eckles.js jwk P-384 > /dev/null
|
||||
node bin/eckles.js sec1 > /dev/null
|
||||
node bin/eckles.js pkcs8 > /dev/null
|
||||
node bin/eckles.js ssh #> /dev/null
|
||||
echo "PASS"
|
||||
|
||||
echo ""
|
||||
echo "Testing Thumbprints"
|
||||
node bin/eckles.js ./fixtures/privkey-ec-p256.sec1.pem thumbprint
|
||||
node bin/eckles.js ./fixtures/pub-ec-p256.jwk.json thumbprint
|
||||
echo "PASS"
|
||||
|
||||
rm *.2
|
||||
|
||||
|
||||
echo ""
|
||||
echo ""
|
||||
echo "PASSED:"
|
||||
echo "• All inputs produced valid outputs"
|
||||
echo "• All outputs matched known-good values"
|
||||
echo "• Generated keys in each format (sec1, pkcs8, jwk, ssh)"
|
||||
node bin/eckles.js fixtures/privkey-ec-p256.sec1.pem
|
||||
node bin/eckles.js fixtures/privkey-ec-p256.pkcs8.pem
|
||||
node bin/eckles.js fixtures/pub-ec-p256.spki.pem
|
||||
|
||||
echo ""
|
||||
echo ""
|
||||
node bin/eckles.js fixtures/privkey-ec-p384.sec1.pem
|
||||
node bin/eckles.js fixtures/privkey-ec-p384.pkcs8.pem
|
||||
node bin/eckles.js fixtures/pub-ec-p384.spki.pem
|
||||
|
||||
echo ""
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user