func (node *nodeImpl) getTLSCertificateFromTLSCA(id, affiliation string) (interface{}, []byte, error) {
node.log.Info("getTLSCertificate...")
priv, err := utils.NewECDSAKey()
if err != nil {
node.log.Error("Failed generating key: %s", err)
return nil, nil, err
}
uuid, err := util.GenerateUUID()
if err != nil {
node.log.Error("Failed generating uuid: %s", err)
return nil, nil, err
}
// Prepare the request
pubraw, _ := x509.MarshalPKIXPublicKey(&priv.PublicKey)
now := time.Now()
timestamp := google_protobuf.Timestamp{int64(now.Second()), int32(now.Nanosecond())}
req := &obcca.TLSCertCreateReq{
×tamp,
&obcca.Identity{Id: id + "-" + uuid},
&obcca.Password{Pw: ""},
&obcca.PublicKey{
Type: obcca.CryptoType_ECDSA,
Key: pubraw,
}, nil}
rawreq, _ := proto.Marshal(req)
r, s, err := ecdsa.Sign(rand.Reader, priv, utils.Hash(rawreq))
if err != nil {
panic(err)
}
R, _ := r.MarshalText()
S, _ := s.MarshalText()
req.Sig = &obcca.Signature{obcca.CryptoType_ECDSA, R, S}
pbCert, err := node.callTLSCACreateCertificate(context.Background(), req)
if err != nil {
node.log.Error("Failed requesting tls certificate: %s", err)
return nil, nil, err
}
node.log.Info("Verifing tls certificate...")
tlsCert, err := utils.DERToX509Certificate(pbCert.Cert)
certPK := tlsCert.PublicKey.(*ecdsa.PublicKey)
utils.VerifySignCapability(priv, certPK)
node.log.Info("Verifing tls certificate...done!")
return priv, pbCert.Cert, nil
}
func BenchmarkSign(b *testing.B) {
b.StopTimer()
b.ResetTimer()
//b.Logf("#iterations %d\n", b.N)
signKey, _ := utils.NewECDSAKey()
hash := make([]byte, 48)
for i := 0; i < b.N; i++ {
rand.Read(hash)
b.StartTimer()
utils.ECDSASign(signKey, hash)
b.StopTimer()
}
}
func BenchmarkVerify(b *testing.B) {
b.StopTimer()
b.ResetTimer()
//b.Logf("#iterations %d\n", b.N)
signKey, _ := utils.NewECDSAKey()
verKey := signKey.PublicKey
hash := make([]byte, 48)
for i := 0; i < b.N; i++ {
rand.Read(hash)
sigma, _ := utils.ECDSASign(signKey, hash)
b.StartTimer()
utils.ECDSAVerify(&verKey, hash, sigma)
b.StopTimer()
}
}
func (node *nodeImpl) getEnrollmentCertificateFromECA(id, pw string) (interface{}, []byte, []byte, error) {
priv, err := utils.NewECDSAKey()
if err != nil {
node.log.Error("Failed generating key [%s].", err.Error())
return nil, nil, nil, err
}
// Prepare the request
pubraw, _ := x509.MarshalPKIXPublicKey(&priv.PublicKey)
req := &obcca.ECertCreateReq{
Ts: &protobuf.Timestamp{Seconds: time.Now().Unix(), Nanos: 0},
Id: &obcca.Identity{Id: id},
Pw: &obcca.Password{Pw: pw},
Pub: &obcca.PublicKey{Type: obcca.CryptoType_ECDSA, Key: pubraw},
Sig: nil}
rawreq, _ := proto.Marshal(req)
r, s, err := ecdsa.Sign(rand.Reader, priv, utils.Hash(rawreq))
if err != nil {
node.log.Error("Failed signing request [%s].", err.Error())
return nil, nil, nil, err
}
R, _ := r.MarshalText()
S, _ := s.MarshalText()
req.Sig = &obcca.Signature{obcca.CryptoType_ECDSA, R, S}
pbCert, key, err := node.callECACreateCertificate(context.Background(), req)
if err != nil {
node.log.Error("Failed requesting enrollment certificate [%s].", err.Error())
return nil, nil, nil, err
}
node.log.Debug("Enrollment certificate hash [%s].", utils.EncodeBase64(utils.Hash(pbCert.Cert)))
// Verify pbCert.Cert
return priv, pbCert.Cert, key, nil
}
func requestTLSCertificate(t *testing.T) {
var opts []grpc.DialOption
creds, err := credentials.NewClientTLSFromFile(viper.GetString("server.tls.certfile"), "tlsca")
if err != nil {
t.Logf("Failed creating credentials for TLS-CA client: %s", err)
t.Fail()
}
opts = append(opts, grpc.WithTransportCredentials(creds))
sockP, err := grpc.Dial(viper.GetString("peer.pki.tlsca.paddr"), opts...)
if err != nil {
t.Logf("Failed dialing in: %s", err)
t.Fail()
}
defer sockP.Close()
tlscaP := obcca.NewTLSCAPClient(sockP)
// Prepare the request
id := "peer"
priv, err := utils.NewECDSAKey()
if err != nil {
t.Logf("Failed generating key: %s", err)
t.Fail()
}
uuid, err := util.GenerateUUID()
if err != nil {
t.Logf("Failed generating uuid: %s", err)
t.Fail()
}
pubraw, _ := x509.MarshalPKIXPublicKey(&priv.PublicKey)
now := time.Now()
timestamp := google_protobuf.Timestamp{int64(now.Second()), int32(now.Nanosecond())}
req := &obcca.TLSCertCreateReq{
×tamp,
&obcca.Identity{Id: id + "-" + uuid},
&obcca.PublicKey{
Type: obcca.CryptoType_ECDSA,
Key: pubraw,
}, nil}
rawreq, _ := proto.Marshal(req)
r, s, err := ecdsa.Sign(rand.Reader, priv, utils.Hash(rawreq))
if err != nil {
t.Logf("Failed signing the request: %s", err)
t.Fail()
}
R, _ := r.MarshalText()
S, _ := s.MarshalText()
req.Sig = &obcca.Signature{obcca.CryptoType_ECDSA, R, S}
resp, err := tlscaP.CreateCertificate(context.Background(), req)
if err != nil {
t.Logf("Failed requesting tls certificate: %s", err)
t.Fail()
}
storePrivateKeyInClear("tls_peer.priv", priv, t)
storeCert("tls_peer.cert", resp.Cert.Cert, t)
storeCert("tls_peer.ca", resp.RootCert.Cert, t)
}
func (node *nodeImpl) getEnrollmentCertificateFromECA(id, pw string) (interface{}, []byte, []byte, error) {
// Get a new ECA Client
sock, ecaP, err := node.getECAClient()
defer sock.Close()
// Run the protocol
signPriv, err := utils.NewECDSAKey()
if err != nil {
node.log.Error("Failed generating ECDSA key [%s].", err.Error())
return nil, nil, nil, err
}
signPub, err := x509.MarshalPKIXPublicKey(&signPriv.PublicKey)
if err != nil {
node.log.Error("Failed mashalling ECDSA key [%s].", err.Error())
return nil, nil, nil, err
}
encPriv, err := utils.NewECDSAKey()
if err != nil {
node.log.Error("Failed generating Encryption key [%s].", err.Error())
return nil, nil, nil, err
}
encPub, err := x509.MarshalPKIXPublicKey(&encPriv.PublicKey)
if err != nil {
node.log.Error("Failed marshalling Encryption key [%s].", err.Error())
return nil, nil, nil, err
}
req := &obcca.ECertCreateReq{&protobuf.Timestamp{Seconds: time.Now().Unix(), Nanos: 0},
&obcca.Identity{id},
&obcca.Token{Tok: []byte(pw)},
&obcca.PublicKey{obcca.CryptoType_ECDSA, signPub},
&obcca.PublicKey{obcca.CryptoType_ECDSA, encPub},
nil}
resp, err := ecaP.CreateCertificatePair(context.Background(), req)
if err != nil {
node.log.Error("Failed invoking CreateCertficatePair [%s].", err.Error())
return nil, nil, nil, err
}
//out, err := rsa.DecryptPKCS1v15(rand.Reader, encPriv, resp.Tok.Tok)
spi := ecies.NewSPI()
eciesKey, err := spi.NewPrivateKey(nil, encPriv)
if err != nil {
node.log.Error("Failed parsing decrypting key [%s].", err.Error())
return nil, nil, nil, err
}
ecies, err := spi.NewAsymmetricCipherFromPublicKey(eciesKey)
if err != nil {
node.log.Error("Failed creating asymmetrinc cipher [%s].", err.Error())
return nil, nil, nil, err
}
out, err := ecies.Process(resp.Tok.Tok)
if err != nil {
node.log.Error("Failed decrypting toke [%s].", err.Error())
return nil, nil, nil, err
}
req.Tok.Tok = out
req.Sig = nil
hash := utils.NewHash()
raw, _ := proto.Marshal(req)
hash.Write(raw)
r, s, err := ecdsa.Sign(rand.Reader, signPriv, hash.Sum(nil))
if err != nil {
node.log.Error("Failed signing [%s].", err.Error())
return nil, nil, nil, err
}
R, _ := r.MarshalText()
S, _ := s.MarshalText()
req.Sig = &obcca.Signature{obcca.CryptoType_ECDSA, R, S}
resp, err = ecaP.CreateCertificatePair(context.Background(), req)
if err != nil {
node.log.Error("Failed invoking CreateCertificatePair [%s].", err.Error())
return nil, nil, nil, err
}
// Verify response
// Verify cert for signing
node.log.Debug("Enrollment certificate for signing [%s]", utils.EncodeBase64(utils.Hash(resp.Certs.Sign)))
x509SignCert, err := utils.DERToX509Certificate(resp.Certs.Sign)
if err != nil {
node.log.Error("Failed parsing signing enrollment certificate for signing: [%s]", err)
return nil, nil, nil, err
}
_, err = utils.GetCriticalExtension(x509SignCert, ECertSubjectRole)
if err != nil {
node.log.Error("Failed parsing ECertSubjectRole in enrollment certificate for signing: [%s]", err)
return nil, nil, nil, err
}
err = utils.CheckCertAgainstSKAndRoot(x509SignCert, signPriv, node.ecaCertPool)
if err != nil {
node.log.Error("Failed checking signing enrollment certificate for signing: [%s]", err)
return nil, nil, nil, err
}
// Verify cert for encrypting
node.log.Debug("Enrollment certificate for encrypting [%s]", utils.EncodeBase64(utils.Hash(resp.Certs.Enc)))
x509EncCert, err := utils.DERToX509Certificate(resp.Certs.Enc)
if err != nil {
node.log.Error("Failed parsing signing enrollment certificate for encrypting: [%s]", err)
return nil, nil, nil, err
}
_, err = utils.GetCriticalExtension(x509EncCert, ECertSubjectRole)
if err != nil {
node.log.Error("Failed parsing ECertSubjectRole in enrollment certificate for encrypting: [%s]", err)
return nil, nil, nil, err
}
err = utils.CheckCertAgainstSKAndRoot(x509EncCert, encPriv, node.ecaCertPool)
if err != nil {
node.log.Error("Failed checking signing enrollment certificate for encrypting: [%s]", err)
return nil, nil, nil, err
}
// END
return signPriv, resp.Certs.Sign, resp.Chain.Tok, nil
}