Add support for generating ed25519 keys and certificates #1097

claucece · 2020-04-16T08:54:41Z

This PR is WIP, and it is built upon: #1061 by @izolight .

@lgarofalo , I will be putting the new commits over here, so let me know if it is ok ;)

claucece · 2020-04-16T08:55:47Z

One of the things that this does is remove the go 1.12 as the built target, as the ed25519 package is part of std library...

armfazh · 2020-04-20T16:14:52Z

Have you considered to use CIRCL for ed signatures?

claucece · 2020-04-20T20:28:51Z

Oh, neat idea @armfazh ! I'll start playing with that ;)

claucece · 2020-04-21T09:18:39Z

On the same note @armfazh .. I think openssl also supports ed448, so maybe we can support here as well with your implementation?

claucece · 2020-04-21T09:39:12Z

So, several tests are missing and some needs to be checked for the ed algorithm:

TestBundleWithECDSAKeyMarshalJSON
TestGenerate
TestUbiquitousBundle
TestUbiquityBundleWithoutMetadata
TestForceBundleNoFallback
TestSHA2HomogeneityAgainstUbiquity

armfazh · 2020-04-22T00:14:15Z

I think openssl also supports ed448, so maybe we can support here as well with your implementation?

That is a great idea, let me know if the current CIRCL API needs changes. Happy to review concise PRs.

claucece · 2020-04-22T09:18:37Z

For sure! I'll finish this PR, and then create another one for ed448 @armfazh . Thanks so much!

claucece · 2020-04-30T07:34:01Z

I jumped into some interfaces conversion problems with using circl, as detailed on issue: cloudflare/circl#109 . Let's see if that can be modified and if not, I'll try something else ;)

claucece · 2020-04-30T07:37:42Z

This also should be taken into account: golang/go#20544

…ircl#109

claucece · 2020-04-30T16:01:32Z

So, @armfazh , I've been playing with different ideas but it does not seem like it will work with CIRCL: the 'CreateCertificate' from the X509 package only supports "The currently supported key types are *rsa.PublicKey, *ecdsa.PublicKey and ed25519.PublicKey" (https://golang.org/pkg/crypto/x509/#CreateCertificate), which forces to use the ed25519 from Golang, or do a "conversion" of some kind (which still will mean that package 25519 is needed, ruling out go 1.12). I'll finish this PR by switching back to Golang's ed25119; but I could maybe start an issue into Golang x/crypto libraries for support of ed448 (now that some applications like Privacy Pass will actually need it) and adding it to x509.

cc./ @alxdavids

armfazh · 2020-04-30T21:47:52Z

One can use circl for signature operations, while being compliant with stdlib types.
Take a look on claucece#1

claucece · 2020-05-01T10:30:15Z

Yes! @armfazh , just did the same! ;) It is sad that we will probably only be able to signing (with ed448, as well).. but well. I'll try to see if in the actual Golang libraries, ed448 can be implemented. I found this issue that mentions that it will be good to have ed448: https://github.com/golang/go/issues?q=is%3Aissue+is%3Aopen+ed448

claucece · 2020-05-13T07:43:07Z

So, @lgarofalo , as part of this PR, I realized that some of the data used for testing is expired, which shouldn't matter while testing as if not we will have to change the data every time that it gets expired. I added a small fix on the previous commit. Let me know if you think is ok ;)

codecov-commenter · 2020-05-22T05:21:08Z

Codecov Report

Merging #1097 into master will increase coverage by 0.19%.
The diff coverage is 50.00%.

@@            Coverage Diff             @@
##           master    #1097      +/-   ##
==========================================
+ Coverage   56.27%   56.47%   +0.19%     
==========================================
  Files          77       76       -1     
  Lines        7309     7354      +45     
==========================================
+ Hits         4113     4153      +40     
+ Misses       2727     2723       -4     
- Partials      469      478       +9

Impacted Files	Coverage Δ
bundler/bundle.go	`80.23% <0.00%> (-4.96%)`	⬇️
bundler/bundler.go	`77.97% <0.00%> (-1.25%)`	⬇️
helpers/derhelpers/ed25519.go	`53.84% <ø> (ø)`
signer/signer.go	`22.81% <0.00%> (-0.23%)`	⬇️
initca/initca.go	`60.86% <42.85%> (-0.97%)`	⬇️
transport/kp/key_provider.go	`40.33% <45.00%> (+6.38%)`	⬆️
helpers/helpers.go	`73.21% <75.00%> (+0.04%)`	⬆️
csr/csr.go	`84.83% <86.36%> (-0.26%)`	⬇️
helpers/derhelpers/derhelpers-legacy.go

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 6b49bea...21fb139. Read the comment docs.

claucece · 2020-05-22T08:46:20Z

@armfazh .. maybe you can help me on this (this current PR has lots of debugging, sorry for that): for some reason using the circl ed25519 fails on the s390x machines, and not on the 64 archs. Using the stdlib ed21559 works just fine. Any ideas?

armfazh · 2020-05-22T17:54:23Z

Let's do baby steps first, so we can make small incremental changes.
This PR is for integrating eddsa into cfssl (use stdlib first).
In another PR, we can make changes to replace stdlib with CIRCL.

In the meantime, we can check what makes circl to fail on s390x architecture.

claucece · 2020-05-22T21:00:30Z

Perfect @armfazh !

Then, I will:

close the PR with stdlib
make a PR/issue to track what is happening with eddsa in CIRCL at s390x
integrate eddsa with CIRCL here

Thanks so much!

claucece · 2020-05-23T08:53:14Z

Ok, this PR is basically done.

There is a small thing I found out: the tls package inside the scan folder, that is vendored, has not been update from stdlib in a while. Not sure if it is the best thing to do right now, but the latest version adds there the support for ed25519.

@armfazh @lgarofalo

lukevalenta · 2020-05-27T17:05:34Z

There is a small thing I found out: the tls package inside the scan folder, that is vendored, has not been update from stdlib in a while. Not sure if it is the best thing to do right now, but the latest version adds there the support for ed25519.

This should be addressed with #1101 (still a WIP).

claucece · 2020-05-29T04:37:09Z

Awesome @ltv511 ! I'll keep and eye on it and wait until that one is merged ;)

bwesterb · 2020-07-09T13:04:56Z

csr/csr.go

+	case ed25519.PrivateKey:
+		key, err = derhelpers.MarshalEd25519PrivateKey(priv)
+		if err != nil {
+


Is there a line missing here?

Oh, yes! I'll add it ;) Thanks for pointing it out!

armfazh · 2020-07-16T21:24:06Z

A small comment: run go mod tidy to remove the unused dependencies and update vendor folder.

claucece · 2020-07-22T07:25:47Z

Just did it @armfazh . I started a conversation on #1101 to see if I can chime in there. If there is no answer till Friday, I'll start doing it ;)

bwesterb · 2020-07-22T19:23:00Z

csr/csr.go

 	default:
 		panic("Generate should have failed to produce a valid key.")
 	}

-	csr, err = Generate(priv.(crypto.Signer), req)
+	csr, err = Generate(priv.(crypto.Signer), req) // TODO: solve


What is the problem the todo refers to?

Oh, this was a remanent of thinking how to change some x509 things..

bwesterb · 2020-07-22T22:01:11Z

transport/kp/key_provider.go

@@ -241,9 +244,30 @@ func (sp *StandardProvider) Generate(algo string, size int) (err error) {
 		}
 		sp.internal.keyPEM = pem.EncodeToMemory(p)

+		sp.internal.priv = priv
+	case "ed25519":
+		if size != (ed25519.PublicKeySize * 8) {


The size parameter doesn't refer to the actual size of the public key, does it?

Oh, yes.. this should probably refer to the private key size. I'll change this.

This is counterintuitively right. ed25519.PrivateKeySize accounts for both the public key (32 bytes) and the seed (32 bytes), totaling 64 bytes. ed25519.go

However, I do not see the point of specifying the key size, since ed25519 is always the same, as I know. I think the field size should be simply ignored when generating ed25519 keys.

centromere · 2022-10-07T11:39:46Z

Thank you for working on this. Is it ready to go?

lukevalenta · 2022-10-07T17:42:16Z

Thank you for working on this. Is it ready to go?

Looks like it's not quite ready to go. @claucece is no longer at Cloudflare, so we may need someone else to champion this PR.

johannww · 2022-11-30T22:48:50Z

I stumbled into this trying to support ed25519 in fabric-ca. I merged the current master branch with this pull request's branch https://github.com/johannww/cfssl. Everything compiles. The only test failing is the one on github.com/cloudflare/cfssl/bundler, but it is also failing in the current master branch. I generated an ed25519 key successfully.

It seems to work. I will leave some comments in the commit.

izolight · 2023-05-26T20:22:13Z

I merged this PRs changes and master into my original PR #1061
I've also addressed the last two open points on this MR in it.

nickysemenza · 2023-06-12T15:16:24Z

closing in favor of #1061

izolight added 4 commits April 16, 2020 03:42

add support for generating ed25519 keys and certs

9a17a34

add 5min ca testfiles

cf7fb43

only build for go1.13 as the ed25519 package is now part of std library

79fa3b0

remove dependency on golang.org/x/crypto/ed25519

221d4ec

claucece mentioned this pull request Apr 16, 2020

Add support for generating ed25519 keys and certs #1061

Merged

Change string domain and format

626680c

Change to use circl ed25519. This will fail due to issue cloudflare/c…

7f6b294

…ircl#109

Use circl only for signing

b8f9375

claucece added 3 commits May 1, 2020 05:43

Update vendor

f1bf794

Update vendor to mod

259b11c

Remove go 1.12

35d039a

claucece force-pushed the ed25519cert branch from 819f702 to 35d039a Compare May 6, 2020 02:52

claucece added 4 commits May 5, 2020 22:14

Only use c25519 for generation

887b6fc

Fix style

7dc5eca

Use circl library for all ed25519 key generation

4685a06

Run the tests with expired data

b4a68f6

Consistent naming

7aff46b

claucece added 2 commits May 16, 2020 01:51

Not using pointers

2725cfc

Fix 5min files

ad00b62

claucece force-pushed the ed25519cert branch from b0d60ca to f370f56 Compare May 22, 2020 05:11

claucece force-pushed the ed25519cert branch from 4ee9e0d to ad00b62 Compare May 22, 2020 21:14

claucece added 2 commits May 22, 2020 22:30

Use 25519 from stdlib

7d2779f

This package is vendored

acff4d8

armfazh requested review from cbroglie and lgarofalo May 27, 2020 02:58

cbroglie removed their request for review May 27, 2020 17:14

bwesterb reviewed Jul 9, 2020

View reviewed changes

Re add error line and mod tidy

21fb139

bwesterb reviewed Jul 22, 2020

View reviewed changes

izolight added a commit to izolight/cfssl that referenced this pull request May 26, 2023

remove unneeded todo as per cloudflare#1097 (comment)

58fc165

nickysemenza closed this Jun 12, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for generating ed25519 keys and certificates #1097

Add support for generating ed25519 keys and certificates #1097

claucece commented Apr 16, 2020

claucece commented Apr 16, 2020

armfazh commented Apr 20, 2020

claucece commented Apr 20, 2020

claucece commented Apr 21, 2020

claucece commented Apr 21, 2020

armfazh commented Apr 22, 2020

claucece commented Apr 22, 2020

claucece commented Apr 30, 2020

claucece commented Apr 30, 2020

claucece commented Apr 30, 2020

armfazh commented Apr 30, 2020

claucece commented May 1, 2020

claucece commented May 13, 2020

codecov-commenter commented May 22, 2020 •

edited

claucece commented May 22, 2020

armfazh commented May 22, 2020

claucece commented May 22, 2020

claucece commented May 23, 2020

lukevalenta commented May 27, 2020

claucece commented May 29, 2020

bwesterb Jul 9, 2020

claucece Jul 10, 2020

armfazh commented Jul 16, 2020

claucece commented Jul 22, 2020

bwesterb Jul 22, 2020

claucece Jul 23, 2020

bwesterb Jul 22, 2020

claucece Jul 23, 2020

johannww Nov 30, 2022

centromere commented Oct 7, 2022

lukevalenta commented Oct 7, 2022

johannww commented Nov 30, 2022 •

edited

izolight commented May 26, 2023

nickysemenza commented Jun 12, 2023

Add support for generating ed25519 keys and certificates #1097

Add support for generating ed25519 keys and certificates #1097

Conversation

claucece commented Apr 16, 2020

claucece commented Apr 16, 2020

armfazh commented Apr 20, 2020

claucece commented Apr 20, 2020

claucece commented Apr 21, 2020

claucece commented Apr 21, 2020

armfazh commented Apr 22, 2020

claucece commented Apr 22, 2020

claucece commented Apr 30, 2020

claucece commented Apr 30, 2020

claucece commented Apr 30, 2020

armfazh commented Apr 30, 2020

claucece commented May 1, 2020

claucece commented May 13, 2020

codecov-commenter commented May 22, 2020 • edited

Codecov Report

claucece commented May 22, 2020

armfazh commented May 22, 2020

claucece commented May 22, 2020

claucece commented May 23, 2020

lukevalenta commented May 27, 2020

claucece commented May 29, 2020

bwesterb Jul 9, 2020

Choose a reason for hiding this comment

claucece Jul 10, 2020

Choose a reason for hiding this comment

armfazh commented Jul 16, 2020

claucece commented Jul 22, 2020

bwesterb Jul 22, 2020

Choose a reason for hiding this comment

claucece Jul 23, 2020

Choose a reason for hiding this comment

bwesterb Jul 22, 2020

Choose a reason for hiding this comment

claucece Jul 23, 2020

Choose a reason for hiding this comment

johannww Nov 30, 2022

Choose a reason for hiding this comment

centromere commented Oct 7, 2022

lukevalenta commented Oct 7, 2022

johannww commented Nov 30, 2022 • edited

izolight commented May 26, 2023

nickysemenza commented Jun 12, 2023

codecov-commenter commented May 22, 2020 •

edited

johannww commented Nov 30, 2022 •

edited