func (m *DeviceManager) doGenerateDeviceKey(t *state.Task, _ *tomb.Tomb) error {
st := t.State()
st.Lock()
defer st.Unlock()
device, err := auth.Device(st)
if err != nil {
return err
}
if device.KeyID != "" {
// nothing to do
return nil
}
keyPair, err := rsa.GenerateKey(rand.Reader, keyLength)
if err != nil {
return fmt.Errorf("cannot generate device key pair: %v", err)
}
privKey := asserts.RSAPrivateKey(keyPair)
err = m.keypairMgr.Put(privKey)
if err != nil {
return fmt.Errorf("cannot store device key pair: %v", err)
}
device.KeyID = privKey.PublicKey().ID()
err = auth.SetDevice(st, device)
if err != nil {
return err
}
t.SetStatus(state.DoneStatus)
return nil
}
// GenerateKey generates a private/public key pair of the given bits. It panics on error.
func GenerateKey(bits int) (asserts.PrivateKey, *rsa.PrivateKey) {
priv, err := rsa.GenerateKey(rand.Reader, bits)
if err != nil {
panic(fmt.Errorf("failed to create private key: %v", err))
}
return asserts.RSAPrivateKey(priv), priv
}
func privateKeyToAssertsKey(key []byte) (asserts.PrivateKey, string, error) {
const errorInvalidKey = "error-invalid-key"
// Validate the signing-key
block, err := armor.Decode(bytes.NewReader(key))
if err != nil {
return nil, errorInvalidKey, err
}
pkt, err := packet.Read(block.Body)
if err != nil {
return nil, errorInvalidKey, err
}
privk, ok := pkt.(*packet.PrivateKey)
if !ok {
return nil, errorInvalidKey, errors.New("Not a private key")
}
if _, ok := privk.PrivateKey.(*rsa.PrivateKey); !ok {
return nil, errorInvalidKey, errors.New("Not an RSA private key")
}
return asserts.RSAPrivateKey(privk.PrivateKey.(*rsa.PrivateKey)), "", nil
}
// ReadPrivKey reads a PGP private key (either armored or simply base64 encoded). It panics on error.
func ReadPrivKey(pk string) (asserts.PrivateKey, *rsa.PrivateKey) {
rd := bytes.NewReader([]byte(pk))
blk, err := armor.Decode(rd)
var body io.Reader
if err == nil {
body = blk.Body
} else {
rd.Seek(0, 0)
// try unarmored
body = base64.NewDecoder(base64.StdEncoding, rd)
}
pkt, err := packet.Read(body)
if err != nil {
panic(err)
}
pkPkt := pkt.(*packet.PrivateKey)
rsaPrivKey, ok := pkPkt.PrivateKey.(*rsa.PrivateKey)
if !ok {
panic("not a RSA key")
}
return asserts.RSAPrivateKey(rsaPrivKey), rsaPrivKey
}