search

PeculiarVentures / PKI.js

PKI.js is a pure JavaScript library implementing the formats that are used in PKI applications (signing, encryption, certificate requests, OCSP and TSP requests/responses). It is built on WebCrypto (Web Cryptography API) and requires no plug-ins.
http://pkijs.org
Other
1.3k stars 204 forks source link

Ensure we can decode, verify and create ed25519 certificates #257

Closed rmhrisk closed 3 years ago

rmhrisk commented 4 years ago

We can use Liner to get support for this algorithm

-----BEGIN CERTIFICATE-----
MIIBSDCB+6ADAgECAhR80ghysUdFKr7NLBSdOVVsEuPPuTAFBgMrZXAwEjEQMA4G
A1UEAwwHRWQyNTUxOTAeFw0yMDAxMTYwODUxNThaFw0yMTAxMTUwODUxNThaMBIx
EDAOBgNVBAMMB0VkMjU1MTkwKjAFBgMrZXADIQBziZ13v3Oqd6jsIR9j/KVOqzCP
VmlbLtfYEYNjL5p426NjMGEwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBQ0
W/US4CSVWokQkBn1+zd6SWS4qzAdBgNVHQ4EFgQUNFv1EuAklVqJEJAZ9fs3eklk
uKswDgYDVR0PAQH/BAQDAgGGMAUGAytlcANBAAvaeVIzGyXU7xH0GEg6Ru2/qJ0j
86JPBFLAHofCLqX99gVdE9GAPhP++NqQhn6KeQTQSFtnXC3DL3Zz63U6sgE=
-----END CERTIFICATE-----
TJKoury commented 3 years ago

I finally released that side project here that enables ed25519 certs.

rmhrisk commented 3 years ago

We also now support this: https://understandingwebpki.com/?cert=MIIBSDCB%2B6ADAgECAhR80ghysUdFKr7NLBSdOVVsEuPPuTAFBgMrZXAwEjEQMA4GA1UEAwwHRWQyNTUxOTAeFw0yMDAxMTYwODUxNThaFw0yMTAxMTUwODUxNThaMBIxEDAOBgNVBAMMB0VkMjU1MTkwKjAFBgMrZXADIQBziZ13v3Oqd6jsIR9j%2FKVOqzCPVmlbLtfYEYNjL5p426NjMGEwDwYDVR0TAQH%2FBAUwAwEB%2FzAfBgNVHSMEGDAWgBQ0W%2FUS4CSVWokQkBn1%2Bzd6SWS4qzAdBgNVHQ4EFgQUNFv1EuAklVqJEJAZ9fs3eklkuKswDgYDVR0PAQH%2FBAQDAgGGMAUGAytlcANBAAvaeVIzGyXU7xH0GEg6Ru2%2FqJ0j86JPBFLAHofCLqX99gVdE9GAPhP%2B%2BNqQhn6KeQTQSFtnXC3DL3Zz63U6sgE%3D

TJKoury commented 3 years ago

Very nice. Does it support secp256k1 as well?

rmhrisk commented 3 years ago

Yes.

https://understandingwebpki.com/?cert=MIIBfDCCASKgAwIBAgIJAOlLpHqkoFZOMAoGCCqGSM49BAMCMBwxDDAKBgNVBAoMA0JhcjEMMAoGA1UEAwwDRm9vMB4XDTE4MDgwOTAyNTIxN1oXDTI4MDgwNjAyNTIxN1owHDEMMAoGA1UECgwDQmFyMQwwCgYDVQQDDANGb28wVjAQBgcqhkjOPQIBBgUrgQQACgNCAAQWvVJ%2BHOjfOvb14bN1O3iWUl2vXVk9WWg77TC6FGiuXkKU6%2F1URakDoTfR%2FPXU87%2BU7VozOYA4%2FSW0yQKu9W4Uo1AwTjAdBgNVHQ4EFgQUFSBA%2Bz4N%2B%2F02OMZqIUKSwi9mBCUwHwYDVR0jBBgwFoAUFSBA%2Bz4N%2B%2F02OMZqIUKSwi9mBCUwDAYDVR0TBAUwAwEB%2FzAKBggqhkjOPQQDAgNIADBFAiBr11aPIg93TJN%2Fmjv%2BWlvygFcFMMlsUlWNHSbaXQB6SAIhAKA%2BIrhEeXJe6KQQqpTPp3mnNL2icaxSHp%2FAH5Jx7L1B

@microshine can comment on if the whole chain can be in these curves or just the leaf.

TJKoury commented 3 years ago

That’s awesome. I will definitely try it out.

TJKoury commented 3 years ago

How did you generate the certificate above? I keep getting errors:

link

rmhrisk commented 3 years ago

That was a cert I found on the internet that was supposedly created with OpenSSL..

You cert, at least according to the exception, has a ASN.1 encoding issue: image

I took a quick look : https://lapo.it/asn1js/#MIICJjCCAcygAwIBAgIBATAKBggqhkjOPQQDAjAeMRwwCQYDVQQGEwJSVTAPBgNVBAMeCABUAGUAcwB0MB4XDTE5MDIwMTA1MDAwMFoXDTIyMDIwMTA1MDAwMFowHjEcMAkGA1UEBhMCUlUwDwYDVQQDHggAVABlAHMAdDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABM_t5xXa6iAL8CVxEgn4FDSzSmx0TM5_qlrFjA0R0fGzHpEndOW0V7D0VEDnPxdd8KukGIHB8sN8X9nVK35bZ8yjgfowgfcwEgYDVR0TAQH_BAgwBgEB_wIBAzALBgNVHQ8EBAMCAAYwYwYDVR0lBFwwWgYEVR0lAAYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYIKwYBBQUHAwQGCCsGAQUFBwMIBggrBgEFBQcDCQYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDAXBgkrBgEEAYI3FAIECgwIY2VydFR5cGUwIwYJKwYBBAGCNxUCBBYEFAEBAQEBAQEBAQEBAQEBAQEBAQEBMBwGCSsGAQQBgjcVBwQPMA0GBSkBAQEBAgEKAgEUMBMGCSsGAQQBgjcVAQQGAgQAFAAKMAoGCCqGSM49BAMCA0gAMEUCIG1I4UBLxyZCVIxMi2-pU9C1kIxwuRRRFFu859Id-5pMAiEA-HlGQQTld5sYUvb9OTPa8aRS88pc6al9-pgKIdju9Ok

And I don't see why, though this cert has a lot of MSFT proprietary things; what issued it?

@microshine

rmhrisk commented 3 years ago

@microshine looked at your certificate and it appears the certificate template extension is not formed correctly:

We expect the certificate template to be:

CertificateTemplateName ::= UTF8String

But yours is:

CertificateTemplateName ::= SEQUENCE {
  Name            UTF8String
}

Our current interpretation seems to match https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/3aec3e50-511a-42f9-a5d5-240af503e470

TJKoury commented 3 years ago

I just generated it using the pki.js complex cert example, and it seems to work in OpenSSL.

I'll generate another one using OpenSSL and try it, sb.

TJKoury commented 3 years ago

Ok, I generated another one using my library (which uses OpenSSL directly), and it seems to work fine.

link.

Can you point me to an example using pki.js programmatically creating an ec cert? Things seem to have changed a bit since I submitted a pull request, my old examples aren't working.

rmhrisk commented 3 years ago

It is probably easier to create the certs using our higher-level library - https://github.com/PeculiarVentures/x509/

microshine commented 3 years ago

@TJKoury see example https://codesandbox.io/s/generate-cert-fjwfh

TJKoury commented 3 years ago

@microshine I did check that out. I'm still not able to generate a certificate with secp256k1, it does not seem to be supported here.

So it's able to read only, or is there something else I'm missing? Thanks for the help.

donskov commented 3 years ago

How did you generate the certificate above? I keep getting errors:

link

Error fixed. Please check again.

microshine commented 3 years ago

@TJKoury I'm working on it. I'll publish the new version of @peculiar/x509 in 30 minutes

microshine commented 3 years ago

Done. @TJKoury Please try https://codesandbox.io/s/generate-cert-fjwfh

TJKoury commented 3 years ago

@microshine You are a beast! Works like a charm.

TJKoury commented 3 years ago

@microshine In my quest to replace my library with this one, any easy method to import an EC private key and generate a public key from it? All the machinery is there in webcrypto, but the functionality does not seem to be exposed.

rmhrisk commented 3 years ago

@TJKoury would be best to file an issue with this question in the X509 repo.

TJKoury commented 3 years ago

@rmhrisk It's not really a certificate issue, perhaps one of the other crypto repos? Basically this code here:

import elliptic from "elliptic";

const getPublicFromPrivateHex = (privateHex, curve = "secp256k1", compressed = true) => {
  let ec = new elliptic.ec(curve);
  let key = ec.keyFromPrivate(privateHex, "hex");
  return key.getPublic(compressed, "hex");
};
rmhrisk commented 3 years ago

Just want to keep this repo for things related to PKI.js