myca 0.1.0

TLS certificate chain generator.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136

use std::fmt::Display;

#[derive(Debug)]
pub enum KeyGenerationError {
    Unspecified(ring::error::Unspecified),
    UnsupportedAlgorithm,
    RcgenError(rcgen::RcgenError),
    Pkcs8Error(rsa::pkcs8::Error),
    RsaError(rsa::Error),
}

impl Display for KeyGenerationError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            KeyGenerationError::Unspecified(u) => write!(f, "{}", u),
            KeyGenerationError::UnsupportedAlgorithm => write!(f, ""),
            KeyGenerationError::RcgenError(e) => write!(f, "{}", e),
            KeyGenerationError::Pkcs8Error(e) => write!(f, "{}", e),
            KeyGenerationError::RsaError(e) => write!(f, "{}", e),
        }
    }
}

impl std::error::Error for KeyGenerationError {}

impl From<rcgen::RcgenError> for KeyGenerationError {
    fn from(err: rcgen::RcgenError) -> Self {
        KeyGenerationError::RcgenError(err)
    }
}
impl From<ring::error::Unspecified> for KeyGenerationError {
    fn from(err: ring::error::Unspecified) -> Self {
        KeyGenerationError::Unspecified(err)
    }
}
impl From<rsa::pkcs8::Error> for KeyGenerationError {
    fn from(err: rsa::pkcs8::Error) -> Self {
        KeyGenerationError::Pkcs8Error(err)
    }
}
impl From<rsa::Error> for KeyGenerationError {
    fn from(err: rsa::Error) -> Self {
        KeyGenerationError::RsaError(err)
    }
}
pub struct Signature<'a> {
    pub alg: &'a rcgen::SignatureAlgorithm,
    pub key_pair: rcgen::KeyPair,
}

impl Signature<'_> {
    pub fn new(s: &str) -> Result<Self, KeyGenerationError> {
        match s.to_lowercase().as_str() {
            "pkcs_rsa_sha256" => Self::pkcs_rsa_sha256(),
            //     "PKCS_RSA_SHA384"
            // 	"PKCS_RSA_SHA512"
            // 	"PKCS_RSA_PSS_SHA256"
            "pkcs_ecdsa_p256_sha256" => Self::pkcs_ecdsa_p256_sha256(),
            // 	"PKCS_ECDSA_P384_SHA384"
            "pkcs_ed25519" => Self::pkcs_ed25519(),
            &_ => Err(KeyGenerationError::UnsupportedAlgorithm),
        }
    }
    pub fn pkcs_ed25519() -> Result<Self, KeyGenerationError> {
        use ring::signature::Ed25519KeyPair;

        let rng = ring::rand::SystemRandom::new();
        let alg = &rcgen::PKCS_ECDSA_P256_SHA256;
        #[rustfmt::skip]
        let pkcs8_bytes = Ed25519KeyPair::generate_pkcs8(&rng)?;

        let key_pair = rcgen::KeyPair::try_from(pkcs8_bytes.as_ref())?;

        Ok(Self { alg, key_pair })
    }

    pub fn pkcs_rsa_sha256() -> Result<Self, KeyGenerationError> {
        use rand::rngs::OsRng;
        use rsa::{pkcs8::EncodePrivateKey, RsaPrivateKey};

        let alg = &rcgen::PKCS_RSA_SHA256;
        // TODO review if ring::rand::SystemRandom should/can be used here
        let mut rng = OsRng;
        let bits = 2048;
        let private_key = RsaPrivateKey::new(&mut rng, bits)?;
        let private_key_der = private_key.to_pkcs8_der()?;
        let key_pair = rcgen::KeyPair::try_from(private_key_der.as_bytes())?;

        Ok(Self { alg, key_pair })
    }
    pub fn pkcs_ecdsa_p256_sha256() -> Result<Self, KeyGenerationError> {
        use ring::signature::EcdsaKeyPair;
        use ring::signature::ECDSA_P256_SHA256_ASN1_SIGNING;

        let rng = ring::rand::SystemRandom::new();
        let alg = &rcgen::PKCS_ECDSA_P256_SHA256;
        #[rustfmt::skip]
        let pkcs8_bytes = EcdsaKeyPair::generate_pkcs8(&ECDSA_P256_SHA256_ASN1_SIGNING, &rng)?;

        let key_pair = rcgen::KeyPair::try_from(pkcs8_bytes.as_ref())?;

        Ok(Self { alg, key_pair })
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn signature_pkcs_ed25519() -> crate::Result<()> {
        let sig = Signature::new("pkcs_ed25519")?;
        assert_eq!(format!("{:?}", sig.alg), "PKCS_ECDSA_P256_SHA256");
        assert_eq!(format!("{:?}", sig.key_pair.algorithm()), "PKCS_ED25519");
        Ok(())
    }

    #[test]
    fn signature_pkcs_ecdsa_p256_sha256() -> crate::Result<()> {
        let sig = Signature::new("PKCS_ECDSA_P256_SHA256")?;
        assert_eq!(format!("{:?}", sig.alg), "PKCS_ECDSA_P256_SHA256");
        assert_eq!(
            format!("{:?}", sig.key_pair.algorithm()),
            "PKCS_ECDSA_P256_SHA256"
        );
        Ok(())
    }

    #[test]
    fn signature_pkcs_rsa_sha256() -> crate::Result<()> {
        let sig = Signature::new("PKCS_RSA_SHA256")?;
        assert_eq!(format!("{:?}", sig.alg), "PKCS_RSA_SHA256");
        assert_eq!(format!("{:?}", sig.key_pair.algorithm()), "PKCS_RSA_SHA256");
        Ok(())
    }
}