Skip to content

Commit 3e1715a

Browse files
haydentherapperhaydentherapper
authored
Change values of Identity.Raw, add fingerprints (#1628)
* Change values of Identity.Raw, add fingerprints Raw now contains only PKIX public keys or DER encoded certificates. The keys are extracted from minisign, pgp, and TUF verifiers. Also added fingerprints for each verifier. Keys, certificates, and ed25519 keys from minisign are hex-encoded sha-256 digests of the raw key. SSH and PGP use their ecosystem-standard fingerprints. Signed-off-by: Hayden Blauzvern <[email protected]> * Fix lint Signed-off-by: Hayden Blauzvern <[email protected]> --------- Signed-off-by: Hayden Blauzvern <[email protected]>
1 parent c1e6614 commit 3e1715a

File tree

13 files changed

+221
-73
lines changed

13 files changed

+221
-73
lines changed

‎pkg/pki/identity/identity.go

+18-5
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,24 @@
1515
package identity
1616

1717
type Identity struct {
18-
// Types include: *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey,
19-
// *x509.Certificate, openpgp.EntityList, *minisign.PublicKey, ssh.PublicKey
18+
// Types include:
19+
// - *rsa.PublicKey
20+
// - *ecdsa.PublicKey
21+
// - ed25519.PublicKey
22+
// - *x509.Certificate
23+
// - openpgp.EntityList (golang.org/x/crypto/openpgp)
24+
// - *minisign.PublicKey (github.com/jedisct1/go-minisign)
25+
// - ssh.PublicKey (golang.org/x/crypto/ssh)
2026
Crypto any
21-
// Based on type of Crypto. Possible values include: PEM-encoded public key,
22-
// PEM-encoded certificate, canonicalized PGP public key, encoded Minisign
23-
// public key, encoded SSH public key
27+
// Raw key or certificate extracted from Crypto. Values include:
28+
// - PKIX ASN.1 DER-encoded public key
29+
// - ASN.1 DER-encoded certificate
2430
Raw []byte
31+
// For keys, certificates, and minisign, hex-encoded SHA-256 digest
32+
// of the public key or certificate
33+
// For SSH and PGP, Fingerprint is the standard for each ecosystem
34+
// For SSH, unpadded base-64 encoded SHA-256 digest of the key
35+
// For PGP, hex-encoded SHA-1 digest of a key, which can be either
36+
// a primary key or subkey
37+
Fingerprint string
2538
}

‎pkg/pki/minisign/minisign.go

+12-3
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,17 @@ package minisign
1717

1818
import (
1919
"bytes"
20+
"crypto/ed25519"
21+
"crypto/sha256"
2022
"encoding/base64"
23+
"encoding/hex"
2124
"fmt"
2225
"io"
2326
"strings"
2427

2528
minisign "github.com/jedisct1/go-minisign"
2629
"github.com/sigstore/rekor/pkg/pki/identity"
30+
"github.com/sigstore/sigstore/pkg/cryptoutils"
2731
sigsig "github.com/sigstore/sigstore/pkg/signature"
2832
"golang.org/x/crypto/blake2b"
2933
)
@@ -186,10 +190,15 @@ func (k PublicKey) Subjects() []string {
186190

187191
// Identities implements the pki.PublicKey interface
188192
func (k PublicKey) Identities() ([]identity.Identity, error) {
189-
// returns base64-encoded key (sig alg, key ID, and public key)
190-
key, err := k.CanonicalValue()
193+
// PKIX encode ed25519 public key
194+
pkixKey, err := cryptoutils.MarshalPublicKeyToDER(ed25519.PublicKey(k.key.PublicKey[:]))
191195
if err != nil {
192196
return nil, err
193197
}
194-
return []identity.Identity{{Crypto: k.key, Raw: key}}, nil
198+
digest := sha256.Sum256(pkixKey)
199+
return []identity.Identity{{
200+
Crypto: k.key,
201+
Raw: pkixKey,
202+
Fingerprint: hex.EncodeToString(digest[:]),
203+
}}, nil
195204
}

‎pkg/pki/minisign/minisign_test.go

+35-9
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
//
21
// Copyright 2021 The Sigstore Authors.
32
//
43
// Licensed under the Apache License, Version 2.0 (the "License");
@@ -17,6 +16,10 @@ package minisign
1716

1817
import (
1918
"bytes"
19+
"crypto/ed25519"
20+
"crypto/sha256"
21+
"crypto/x509"
22+
"encoding/hex"
2023
"errors"
2124
"io"
2225
"os"
@@ -25,6 +28,7 @@ import (
2528

2629
"github.com/google/go-cmp/cmp"
2730
minisign "github.com/jedisct1/go-minisign"
31+
"github.com/sigstore/sigstore/pkg/cryptoutils"
2832
"go.uber.org/goleak"
2933
)
3034

@@ -72,12 +76,23 @@ func TestReadPublicKey(t *testing.T) {
7276
if _, ok := ids[0].Crypto.(*minisign.PublicKey); !ok {
7377
t.Fatalf("key is of unexpected type, expected *minisign.PublicKey, got %v", reflect.TypeOf(ids[0].Crypto))
7478
}
75-
val, err := rawGot.CanonicalValue()
79+
expectedDer, err := cryptoutils.MarshalPublicKeyToDER(ed25519.PublicKey(rawBytes))
7680
if err != nil {
77-
t.Fatalf("error canonicalizing key: %v", err)
81+
t.Fatalf("unexpected error generating DER: %v", err)
82+
}
83+
if !reflect.DeepEqual(expectedDer, ids[0].Raw) {
84+
t.Errorf("raw keys are not equal")
85+
}
86+
edKey, _ := x509.ParsePKIXPublicKey(ids[0].Raw)
87+
if err := cryptoutils.EqualKeys(edKey, ed25519.PublicKey(rawBytes)); err != nil {
88+
t.Errorf("public keys did not match: %v", err)
89+
}
90+
if len(ids[0].Fingerprint) != 64 {
91+
t.Errorf("%v: fingerprint is not expected length of 64 (hex 32-byte sha256): %d", tc.caseDesc, len(ids[0].Fingerprint))
7892
}
79-
if !reflect.DeepEqual(val, ids[0].Raw) {
80-
t.Errorf("raw key and canonical value are not equal")
93+
digest := sha256.Sum256(expectedDer)
94+
if hex.EncodeToString(digest[:]) != ids[0].Fingerprint {
95+
t.Fatalf("fingerprints don't match")
8196
}
8297
})
8398
}
@@ -313,12 +328,23 @@ func TestCanonicalValuePublicKey(t *testing.T) {
313328
if _, ok := ids[0].Crypto.(*minisign.PublicKey); !ok {
314329
t.Fatalf("key is of unexpected type, expected *minisign.PublicKey, got %v", reflect.TypeOf(ids[0].Crypto))
315330
}
316-
val, err := outputKey.CanonicalValue()
331+
expectedDer, err := cryptoutils.MarshalPublicKeyToDER(ed25519.PublicKey(rt.key.PublicKey[:]))
317332
if err != nil {
318-
t.Fatalf("error canonicalizing key: %v", err)
333+
t.Fatalf("unexpected error generating DER: %v", err)
334+
}
335+
if !reflect.DeepEqual(expectedDer, ids[0].Raw) {
336+
t.Errorf("raw keys are not equal")
337+
}
338+
edKey, _ := x509.ParsePKIXPublicKey(ids[0].Raw)
339+
if err := cryptoutils.EqualKeys(edKey, ed25519.PublicKey(rt.key.PublicKey[:])); err != nil {
340+
t.Errorf("public keys did not match: %v", err)
341+
}
342+
if len(ids[0].Fingerprint) != 64 {
343+
t.Errorf("%v: fingerprint is not expected length of 64 (hex 32-byte sha256): %d", tc.caseDesc, len(ids[0].Fingerprint))
319344
}
320-
if !reflect.DeepEqual(val, ids[0].Raw) {
321-
t.Errorf("raw key and canonical value are not equal")
345+
digest := sha256.Sum256(expectedDer)
346+
if hex.EncodeToString(digest[:]) != ids[0].Fingerprint {
347+
t.Fatalf("fingerprints don't match")
322348
}
323349
}
324350
}

‎pkg/pki/pgp/pgp.go

+33-4
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ import (
1919
"bufio"
2020
"bytes"
2121
"context"
22+
"crypto/ecdsa"
23+
"crypto/ed25519"
24+
"crypto/rsa"
25+
"encoding/hex"
2226
"errors"
2327
"fmt"
2428
"io"
@@ -32,6 +36,7 @@ import (
3236
"golang.org/x/crypto/openpgp/packet" //nolint:staticcheck
3337

3438
"github.com/sigstore/rekor/pkg/pki/identity"
39+
"github.com/sigstore/sigstore/pkg/cryptoutils"
3540
sigsig "github.com/sigstore/sigstore/pkg/signature"
3641
)
3742

@@ -307,9 +312,33 @@ func (k PublicKey) Subjects() []string {
307312

308313
// Identities implements the pki.PublicKey interface
309314
func (k PublicKey) Identities() ([]identity.Identity, error) {
310-
key, err := k.CanonicalValue()
311-
if err != nil {
312-
return nil, err
315+
var ids []identity.Identity
316+
for _, entity := range k.key {
317+
var keys []*packet.PublicKey
318+
keys = append(keys, entity.PrimaryKey)
319+
for _, subKey := range entity.Subkeys {
320+
keys = append(keys, subKey.PublicKey)
321+
}
322+
for _, pk := range keys {
323+
pubKey := pk.PublicKey
324+
// Only process supported types. Will ignore DSA
325+
// and ElGamal keys.
326+
// TODO: For a V2 PGP type, enforce on upload
327+
switch pubKey.(type) {
328+
case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:
329+
default:
330+
continue
331+
}
332+
pkixKey, err := cryptoutils.MarshalPublicKeyToDER(pubKey)
333+
if err != nil {
334+
return nil, err
335+
}
336+
ids = append(ids, identity.Identity{
337+
Crypto: pubKey,
338+
Raw: pkixKey,
339+
Fingerprint: hex.EncodeToString(pk.Fingerprint[:]),
340+
})
341+
}
313342
}
314-
return []identity.Identity{{Crypto: k.key, Raw: key}}, nil
343+
return ids, nil
315344
}

‎pkg/pki/pgp/pgp_test.go

+10-10
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ import (
2727
"sort"
2828
"testing"
2929

30-
"github.com/sigstore/rekor/pkg/pki/identity"
3130
"go.uber.org/goleak"
3231
)
3332

@@ -348,17 +347,20 @@ func TestEmailAddresses(t *testing.T) {
348347
caseDesc string
349348
inputFile string
350349
subjects []string
350+
// number of keys in key ring
351+
// verified with gpg, ignoring DSA/ElGamal keys
352+
keys int
351353
}
352354

353355
var k PublicKey
354356
if len(k.Subjects()) != 0 {
355357
t.Errorf("Subjects for unitialized key should give empty slice")
356358
}
357359
tests := []test{
358-
{caseDesc: "Valid armored public key", inputFile: "testdata/valid_armored_public.pgp", subjects: []string{}},
359-
{caseDesc: "Valid armored public key with multiple subentries", inputFile: "testdata/valid_armored_complex_public.pgp", subjects: []string{"[email protected]", "[email protected]"}},
360-
{caseDesc: "Valid binary public key", inputFile: "testdata/valid_binary_public.pgp", subjects: []string{}},
361-
{caseDesc: "Valid binary public key with multiple subentries", inputFile: "testdata/valid_binary_complex_public.pgp", subjects: []string{"[email protected]", "[email protected]"}},
360+
{caseDesc: "Valid armored public key", inputFile: "testdata/valid_armored_public.pgp", subjects: []string{}, keys: 2},
361+
{caseDesc: "Valid armored public key with multiple subentries", inputFile: "testdata/valid_armored_complex_public.pgp", subjects: []string{"[email protected]", "[email protected]"}, keys: 4},
362+
{caseDesc: "Valid binary public key", inputFile: "testdata/valid_binary_public.pgp", subjects: []string{}, keys: 2},
363+
{caseDesc: "Valid binary public key with multiple subentries", inputFile: "testdata/valid_binary_complex_public.pgp", subjects: []string{"[email protected]", "[email protected]"}, keys: 4},
362364
}
363365

364366
for _, tc := range tests {
@@ -388,14 +390,12 @@ func TestEmailAddresses(t *testing.T) {
388390
t.Errorf("%v: Error getting subjects from keys length, got %v, expected %v", tc.caseDesc, len(subjects), len(tc.subjects))
389391
}
390392

391-
keyVal, _ := inputKey.CanonicalValue()
392-
expectedIDs := []identity.Identity{{Crypto: inputKey.key, Raw: keyVal}}
393393
ids, err := inputKey.Identities()
394394
if err != nil {
395-
t.Fatalf("unexpected error getting identities: %v", err)
395+
t.Fatalf("%v: unexpected error getting identities: %v", tc.caseDesc, err)
396396
}
397-
if !reflect.DeepEqual(ids, expectedIDs) {
398-
t.Errorf("identities are not equal")
397+
if len(ids) != tc.keys {
398+
t.Fatalf("%v: expected %d keys, got %d", tc.caseDesc, tc.keys, len(ids))
399399
}
400400
}
401401
}

‎pkg/pki/pkcs7/pkcs7.go

+14-8
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,10 @@ package pkcs7
1919
import (
2020
"bytes"
2121
"crypto"
22+
"crypto/sha256"
2223
"crypto/x509"
2324
"encoding/asn1"
25+
"encoding/hex"
2426
"encoding/pem"
2527
"errors"
2628
"fmt"
@@ -227,16 +229,20 @@ func (k PublicKey) Subjects() []string {
227229
// Identities implements the pki.PublicKey interface
228230
func (k PublicKey) Identities() ([]identity.Identity, error) {
229231
// pkcs7 structure may contain both a key and certificate chain
230-
pemCert, err := cryptoutils.MarshalCertificateToPEM(k.certs[0])
232+
pkixKey, err := cryptoutils.MarshalPublicKeyToDER(k.key)
231233
if err != nil {
232234
return nil, err
233235
}
234-
pemKey, err := cryptoutils.MarshalPublicKeyToPEM(k.key)
235-
if err != nil {
236-
return nil, err
237-
}
238-
return []identity.Identity{
239-
{Crypto: k.certs[0], Raw: pemCert},
240-
{Crypto: k.key, Raw: pemKey},
236+
keyDigest := sha256.Sum256(pkixKey)
237+
certDigest := sha256.Sum256(k.certs[0].Raw)
238+
return []identity.Identity{{
239+
Crypto: k.certs[0],
240+
Raw: k.certs[0].Raw,
241+
Fingerprint: hex.EncodeToString(certDigest[:]),
242+
}, {
243+
Crypto: k.key,
244+
Raw: pkixKey,
245+
Fingerprint: hex.EncodeToString(keyDigest[:]),
246+
},
241247
}, nil
242248
}

‎pkg/pki/pkcs7/pkcs7_test.go

+15-4
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,10 @@ package pkcs7
1919
import (
2020
"bytes"
2121
"crypto"
22+
"crypto/sha256"
2223
"crypto/x509"
2324
"encoding/base64"
25+
"encoding/hex"
2426
"net/url"
2527
"reflect"
2628
"sort"
@@ -496,22 +498,31 @@ A6ydFG8HXGWcnVVIVQ==
496498

497499
// compare certificate
498500
cert, _ := cryptoutils.UnmarshalCertificatesFromPEM([]byte(tt.identities[0]))
499-
expectedID := identity.Identity{Crypto: cert[0], Raw: []byte(tt.identities[0])}
501+
digest := sha256.Sum256(cert[0].Raw)
502+
expectedID := identity.Identity{Crypto: cert[0], Raw: cert[0].Raw, Fingerprint: hex.EncodeToString(digest[:])}
500503
if !ids[0].Crypto.(*x509.Certificate).Equal(expectedID.Crypto.(*x509.Certificate)) {
501504
t.Errorf("certificates did not match")
502505
}
503506
if !reflect.DeepEqual(ids[0].Raw, expectedID.Raw) {
504-
t.Errorf("raw identities did not match, expected %v, got %v", ids[0].Raw, string(expectedID.Raw))
507+
t.Errorf("raw identities did not match, expected %v, got %v", string(expectedID.Raw), ids[0].Raw)
508+
}
509+
if ids[0].Fingerprint != expectedID.Fingerprint {
510+
t.Fatalf("fingerprints did not match, expected %v, got %v", expectedID.Fingerprint, ids[0].Fingerprint)
505511
}
506512

507513
// compare public key
508514
key, _ := cryptoutils.UnmarshalPEMToPublicKey([]byte(tt.identities[1]))
509-
expectedID = identity.Identity{Crypto: key, Raw: []byte(tt.identities[1])}
515+
pkixKey, _ := cryptoutils.MarshalPublicKeyToDER(key)
516+
digest = sha256.Sum256(pkixKey)
517+
expectedID = identity.Identity{Crypto: key, Raw: pkixKey, Fingerprint: hex.EncodeToString(digest[:])}
510518
if err := cryptoutils.EqualKeys(expectedID.Crypto, ids[1].Crypto); err != nil {
511519
t.Errorf("%v: public keys did not match: %v", tt.name, err)
512520
}
513521
if !reflect.DeepEqual(ids[1].Raw, expectedID.Raw) {
514-
t.Errorf("%v: raw identities did not match", tt.name)
522+
t.Errorf("%v: raw key identities did not match", tt.name)
523+
}
524+
if ids[1].Fingerprint != expectedID.Fingerprint {
525+
t.Fatalf("key fingerprints did not match, expected %v, got %v", expectedID.Fingerprint, ids[1].Fingerprint)
515526
}
516527
})
517528
}

‎pkg/pki/ssh/ssh.go

+12-4
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,13 @@
1616
package ssh
1717

1818
import (
19-
"bytes"
2019
"fmt"
2120
"io"
2221
"net/http"
2322

2423
"github.com/asaskevich/govalidator"
2524
"github.com/sigstore/rekor/pkg/pki/identity"
25+
"github.com/sigstore/sigstore/pkg/cryptoutils"
2626
sigsig "github.com/sigstore/sigstore/pkg/signature"
2727
"golang.org/x/crypto/ssh"
2828
)
@@ -122,7 +122,15 @@ func (k PublicKey) Subjects() []string {
122122

123123
// Identities implements the pki.PublicKey interface
124124
func (k PublicKey) Identities() ([]identity.Identity, error) {
125-
// an authorized key format
126-
authorizedKey := bytes.TrimSpace(ssh.MarshalAuthorizedKey(k.key))
127-
return []identity.Identity{{Crypto: k.key, Raw: authorizedKey}}, nil
125+
key := k.key.(ssh.CryptoPublicKey).CryptoPublicKey()
126+
pkixKey, err := cryptoutils.MarshalPublicKeyToDER(key)
127+
if err != nil {
128+
return nil, err
129+
}
130+
fp := ssh.FingerprintSHA256(k.key)
131+
return []identity.Identity{{
132+
Crypto: k.key,
133+
Raw: pkixKey,
134+
Fingerprint: fp,
135+
}}, nil
128136
}

0 commit comments

Comments
 (0)