pretix / pretix-passbook

Support for Apple Wallet/Passbook files in pretix
https://pretix.eu
Other
27 stars 20 forks source link

Validate PEM Format for RSA Private Key #47

Open tromboman opened 2 years ago

tromboman commented 2 years ago

According to RFC 7468 PKIX Textual Encodings (Chapter 10/11) the Textual Encoding of Private Key Info use the "PRIVATE KEY" label. Encrypted Private Key Info use the "ENCRYPTED PRIVATE KEY" label. So the key file can also start/end with the following lines

-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----

or

-----BEGIN ENCRYPTED PRIVATE KEY-----
...
-----END ENCRYPTED PRIVATE KEY-----

depending on the application, which creates the key file.

For example, the openssl application with the genpkey command creates PEM files with the aforementioned labels. Also the openssl req command with the -newkey rsa:2048 option creates this kind of label. According to the man page, the openssl genrsa command is superseded by genpkey for the generation of RSA Private Keys.

Therefore, it might be a good idea to replace

 openssl genrsa -out $CERT_NAME.key 2048

by

 openssl genpkey -out $CERT_NAME.key -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:2048

in the README.rst

https://github.com/pretix/pretix-passbook/blob/28bd14e54e987a78b81af14f6cef51a9e72c800e/pretix_passbook/forms.py#L18

https://github.com/pretix/pretix-passbook/blob/28bd14e54e987a78b81af14f6cef51a9e72c800e/README.rst#L45