-
Notifications
You must be signed in to change notification settings - Fork 35
/
crypto.go
142 lines (123 loc) · 3.33 KB
/
crypto.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
package gold
import (
"crypto"
"crypto/rand"
"crypto/rsa"
"crypto/x509"
"encoding/pem"
"errors"
"fmt"
"math/big"
"strconv"
)
// Signer creates signatures that verify against a public key.
type Signer interface {
Sign(data []byte) ([]byte, error)
}
// Verifier verifies signatures against a public key.
type Verifier interface {
Verify(data []byte, sig []byte) error
}
type rsaPubKey struct {
*rsa.PublicKey
}
type rsaPrivKey struct {
*rsa.PrivateKey
}
// ParseRSAPublicKeyNE parses a modulus and exponent and returns a new verifier object
func ParseRSAPublicKeyNE(keyT, keyN, keyE string) (Verifier, error) {
if len(keyN) == 0 && len(keyE) == 0 {
return nil, errors.New("No modulus and/or exponent provided")
}
intN := new(big.Int)
intN.SetString(keyN, 16)
intE, err := strconv.ParseInt(keyE, 10, 0)
if err != nil {
return nil, err
}
var rawkey interface{}
switch keyT {
case "RSAPublicKey":
rawkey = &rsa.PublicKey{
N: intN,
E: int(intE),
}
default:
return nil, fmt.Errorf("Unsupported key type %q", keyT)
}
return newVerifierFromKey(rawkey)
}
// ParseRSAPublicKey parses an RSA public key and returns a new verifier object
func ParseRSAPublicKey(key *rsa.PublicKey) (Verifier, error) {
return newVerifierFromKey(key)
}
// ParseRSAPrivateKey parses an RSA private key and returns a new signer object
func ParseRSAPrivateKey(key *rsa.PrivateKey) (Signer, error) {
return newSignerFromKey(key)
}
// ParseRSAPublicPEMKey parses a PEM encoded private key and returns a new verifier object
func ParseRSAPublicPEMKey(pemBytes []byte) (Verifier, error) {
block, _ := pem.Decode(pemBytes)
if block == nil {
return nil, errors.New("No key found")
}
var rawkey interface{}
switch block.Type {
case "RSA PUBLIC KEY", "PUBLIC KEY":
rsa, err := x509.ParsePKIXPublicKey(block.Bytes)
if err != nil {
return nil, err
}
rawkey = rsa
default:
return nil, fmt.Errorf("Unsupported key type %q", block.Type)
}
return newVerifierFromKey(rawkey)
}
// ParseRSAPrivatePEMKey parses a PEM encoded private key and returns a Signer.
func ParseRSAPrivatePEMKey(pemBytes []byte) (Signer, error) {
block, _ := pem.Decode(pemBytes)
if block == nil {
return nil, errors.New("No key found or could not decode PEM key")
}
var rawkey interface{}
switch block.Type {
case "RSA PRIVATE KEY", "PRIVATE KEY":
rsa, err := x509.ParsePKCS1PrivateKey(block.Bytes)
if err != nil {
return nil, err
}
rawkey = rsa
default:
return nil, fmt.Errorf("Unsupported key type %q", block.Type)
}
return newSignerFromKey(rawkey)
}
func newSignerFromKey(k interface{}) (Signer, error) {
var sKey Signer
switch t := k.(type) {
case *rsa.PrivateKey:
sKey = &rsaPrivKey{t}
default:
return nil, fmt.Errorf("Unsupported key type %T", k)
}
return sKey, nil
}
func newVerifierFromKey(k interface{}) (Verifier, error) {
var vKey Verifier
switch t := k.(type) {
case *rsa.PublicKey:
vKey = &rsaPubKey{t}
default:
return nil, fmt.Errorf("Unsupported key type %T", k)
}
return vKey, nil
}
// Sign signs data with rsa-sha256
func (r *rsaPrivKey) Sign(data []byte) ([]byte, error) {
return rsa.SignPKCS1v15(rand.Reader, r.PrivateKey, crypto.SHA1, data)
}
// Verify verifies the message using a rsa-sha256 signature
func (r *rsaPubKey) Verify(message []byte, sig []byte) error {
return rsa.VerifyPKCS1v15(r.PublicKey, crypto.SHA1, message, sig)
}