Skip to content

Commit 3fff9fb

Browse files
schomatisschomatis
committed
feat(cmds): add PEM/PKCS8 for key import/export
1 parent 8cfc889 commit 3fff9fb

File tree

2 files changed

+188
-30
lines changed

2 files changed

+188
-30
lines changed

‎core/commands/keystore.go

+152-11
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ package commands
22

33
import (
44
"bytes"
5+
"crypto/ed25519"
6+
"crypto/rand"
7+
"crypto/x509"
8+
"encoding/pem"
59
"fmt"
610
"io"
711
"io/ioutil"
@@ -135,6 +139,15 @@ var keyGenCmd = &cmds.Command{
135139
Type: KeyOutput{},
136140
}
137141

142+
const (
143+
// Key format options used both for importing and exporting.
144+
keyFormatOptionName = "format"
145+
keyFormatPemEncryptedOption = "pem-pkcs8-encrypted"
146+
keyFormatPemCleartextOption = "pem-pkcs8-cleartext"
147+
keyFormatLibp2pCleartextOption = "libp2p-protobuf-cleartext"
148+
keyEncryptionPasswordOptionName = "password"
149+
)
150+
138151
var keyExportCmd = &cmds.Command{
139152
Helptext: cmds.HelpText{
140153
Tagline: "Export a keypair",
@@ -150,6 +163,10 @@ path can be specified with '--output=<path>' or '-o=<path>'.
150163
},
151164
Options: []cmds.Option{
152165
cmds.StringOption(outputOptionName, "o", "The path where the output should be stored."),
166+
cmds.StringOption(keyFormatOptionName, "f", "The format of the exported private key.").WithDefault(keyFormatLibp2pCleartextOption),
167+
cmds.StringOption(keyEncryptionPasswordOptionName, "p", "The password to encrypt the exported key with (for the encrypted variant only)."),
168+
// FIXME(BLOCKING): change default to keyFormatPemEncryptedOption once it
169+
// is implemented and the sharness tests (if any) are adapted.
153170
},
154171
NoRemote: true,
155172
Run: func(req *cmds.Request, res cmds.ResponseEmitter, env cmds.Environment) error {
@@ -186,12 +203,38 @@ path can be specified with '--output=<path>' or '-o=<path>'.
186203
return fmt.Errorf("key with name '%s' doesn't exist", name)
187204
}
188205

189-
encoded, err := crypto.MarshalPrivateKey(sk)
190-
if err != nil {
191-
return err
206+
exportFormat, _ := req.Options[keyFormatOptionName].(string)
207+
var formattedKey []byte
208+
switch exportFormat {
209+
case keyFormatPemEncryptedOption, keyFormatPemCleartextOption:
210+
stdKey, err := crypto.PrivKeyToStdKey(sk)
211+
if err != nil {
212+
return fmt.Errorf("converting libp2p private key to std Go key: %w", err)
213+
214+
}
215+
// For some reason the ed25519.PrivateKey does not use pointer
216+
// receivers, so we need to convert it for MarshalPKCS8PrivateKey.
217+
// (We should probably change this upstream in PrivKeyToStdKey).
218+
if ed25519KeyPointer, ok := stdKey.(*ed25519.PrivateKey); ok {
219+
stdKey = *ed25519KeyPointer
220+
}
221+
// This function supports a restricted list of public key algorithms,
222+
// but we generate and use only the RSA and ed25519 types that are on that list.
223+
formattedKey, err = x509.MarshalPKCS8PrivateKey(stdKey)
224+
if err != nil {
225+
return fmt.Errorf("marshalling key to PKCS8 format: %w", err)
226+
}
227+
228+
case keyFormatLibp2pCleartextOption:
229+
formattedKey, err = crypto.MarshalPrivateKey(sk)
230+
if err != nil {
231+
return err
232+
}
233+
default:
234+
return fmt.Errorf("unrecognized export format: %s", exportFormat)
192235
}
193236

194-
return res.Emit(bytes.NewReader(encoded))
237+
return res.Emit(bytes.NewReader(formattedKey))
195238
},
196239
PostRun: cmds.PostRunMap{
197240
cmds.CLI: func(res cmds.Response, re cmds.ResponseEmitter) error {
@@ -208,8 +251,16 @@ path can be specified with '--output=<path>' or '-o=<path>'.
208251
}
209252

210253
outPath, _ := req.Options[outputOptionName].(string)
254+
exportFormat, _ := req.Options[keyFormatOptionName].(string)
211255
if outPath == "" {
212-
trimmed := strings.TrimRight(fmt.Sprintf("%s.key", req.Arguments[0]), "/")
256+
var fileExtension string
257+
switch exportFormat {
258+
case keyFormatPemEncryptedOption, keyFormatPemCleartextOption:
259+
fileExtension = "pem"
260+
case keyFormatLibp2pCleartextOption:
261+
fileExtension = "key"
262+
}
263+
trimmed := strings.TrimRight(fmt.Sprintf("%s.%s", req.Arguments[0], fileExtension), "/")
213264
_, outPath = filepath.Split(trimmed)
214265
outPath = filepath.Clean(outPath)
215266
}
@@ -221,9 +272,46 @@ path can be specified with '--output=<path>' or '-o=<path>'.
221272
}
222273
defer file.Close()
223274

224-
_, err = io.Copy(file, outReader)
225-
if err != nil {
226-
return err
275+
switch exportFormat {
276+
case keyFormatPemEncryptedOption, keyFormatPemCleartextOption:
277+
privKeyBytes, err := ioutil.ReadAll(outReader)
278+
if err != nil {
279+
return err
280+
}
281+
282+
var pemBlock *pem.Block
283+
if exportFormat == keyFormatPemEncryptedOption {
284+
keyEncPassword, ok := req.Options[keyEncryptionPasswordOptionName].(string)
285+
if !ok {
286+
return fmt.Errorf("missing password to encrypt the key with, set it with --%s",
287+
keyEncryptionPasswordOptionName)
288+
}
289+
// FIXME(BLOCKING): Using deprecated security function.
290+
pemBlock, err = x509.EncryptPEMBlock(rand.Reader,
291+
"ENCRYPTED PRIVATE KEY",
292+
privKeyBytes,
293+
[]byte(keyEncPassword),
294+
x509.PEMCipherAES256)
295+
if err != nil {
296+
return fmt.Errorf("encrypting PEM block: %w", err)
297+
}
298+
} else { // cleartext
299+
pemBlock = &pem.Block{
300+
Type: "PRIVATE KEY",
301+
Bytes: privKeyBytes,
302+
}
303+
}
304+
305+
err = pem.Encode(file, pemBlock)
306+
if err != nil {
307+
return fmt.Errorf("encoding PEM block: %w", err)
308+
}
309+
310+
case keyFormatLibp2pCleartextOption:
311+
_, err = io.Copy(file, outReader)
312+
if err != nil {
313+
return err
314+
}
227315
}
228316

229317
return nil
@@ -237,6 +325,9 @@ var keyImportCmd = &cmds.Command{
237325
},
238326
Options: []cmds.Option{
239327
ke.OptionIPNSBase,
328+
cmds.StringOption(keyFormatOptionName, "f", "The format of the private key to import.").WithDefault(keyFormatLibp2pCleartextOption),
329+
// FIXME: Attempt to figure out the import format.
330+
cmds.StringOption(keyEncryptionPasswordOptionName, "p", "The password to decrypt the imported key with (for the encrypted variant only)."),
240331
},
241332
Arguments: []cmds.Argument{
242333
cmds.StringArg("name", true, false, "name to associate with key in keychain"),
@@ -265,9 +356,59 @@ var keyImportCmd = &cmds.Command{
265356
return err
266357
}
267358

268-
sk, err := crypto.UnmarshalPrivateKey(data)
269-
if err != nil {
270-
return err
359+
importFormat, _ := req.Options[keyFormatOptionName].(string)
360+
var sk crypto.PrivKey
361+
switch importFormat {
362+
case keyFormatPemEncryptedOption, keyFormatPemCleartextOption:
363+
pemBlock, rest := pem.Decode(data)
364+
if pemBlock == nil {
365+
return fmt.Errorf("PEM block not found in input data:\n%s", rest)
366+
}
367+
368+
if pemBlock.Type != "PRIVATE KEY" && pemBlock.Type != "ENCRYPTED PRIVATE KEY" {
369+
return fmt.Errorf("expected [ENCRYPTED] PRIVATE KEY type in PEM block but got: %s", pemBlock.Type)
370+
}
371+
372+
var privKeyBytes []byte
373+
if importFormat == keyFormatPemEncryptedOption {
374+
keyDecPassword, ok := req.Options[keyEncryptionPasswordOptionName].(string)
375+
if !ok {
376+
return fmt.Errorf("missing password to decrypt the key with, set it with --%s",
377+
keyEncryptionPasswordOptionName)
378+
}
379+
privKeyBytes, err = x509.DecryptPEMBlock(pemBlock,
380+
[]byte(keyDecPassword))
381+
if err != nil {
382+
return fmt.Errorf("decrypting PEM block: %w", err)
383+
}
384+
} else { // cleartext
385+
privKeyBytes = pemBlock.Bytes
386+
}
387+
388+
stdKey, err := x509.ParsePKCS8PrivateKey(privKeyBytes)
389+
if err != nil {
390+
return fmt.Errorf("parsing PKCS8 format: %w", err)
391+
}
392+
393+
// In case ed25519.PrivateKey is returned we need the pointer for
394+
// conversion to libp2p (see export command for more details).
395+
if ed25519KeyPointer, ok := stdKey.(ed25519.PrivateKey); ok {
396+
stdKey = &ed25519KeyPointer
397+
}
398+
399+
sk, _, err = crypto.KeyPairFromStdKey(stdKey)
400+
if err != nil {
401+
return fmt.Errorf("converting std Go key to libp2p key : %w", err)
402+
403+
}
404+
case keyFormatLibp2pCleartextOption:
405+
sk, err = crypto.UnmarshalPrivateKey(data)
406+
if err != nil {
407+
return err
408+
}
409+
410+
default:
411+
return fmt.Errorf("unrecognized import format: %s", importFormat)
271412
}
272413

273414
cfgRoot, err := cmdenv.GetConfigRoot(env)

‎test/sharness/t0165-keystore.sh

+36-19
Original file line numberDiff line numberDiff line change
@@ -63,24 +63,14 @@ ipfs key rm key_ed25519
6363
echo $rsahash > rsa_key_id
6464
'
6565

66+
test_key_import_export_all_formats rsa_key
67+
6668
test_expect_success "create a new ed25519 key" '
6769
edhash=$(ipfs key gen generated_ed25519_key --type=ed25519)
6870
echo $edhash > ed25519_key_id
6971
'
7072

71-
test_expect_success "export and import rsa key" '
72-
ipfs key export generated_rsa_key &&
73-
ipfs key rm generated_rsa_key &&
74-
ipfs key import generated_rsa_key generated_rsa_key.key > roundtrip_rsa_key_id &&
75-
test_cmp rsa_key_id roundtrip_rsa_key_id
76-
'
77-
78-
test_expect_success "export and import ed25519 key" '
79-
ipfs key export generated_ed25519_key &&
80-
ipfs key rm generated_ed25519_key &&
81-
ipfs key import generated_ed25519_key generated_ed25519_key.key > roundtrip_ed25519_key_id &&
82-
test_cmp ed25519_key_id roundtrip_ed25519_key_id
83-
'
73+
test_key_import_export_all_formats ed25519_key
8474

8575
test_expect_success "test export file option" '
8676
ipfs key export generated_rsa_key -o=named_rsa_export_file &&
@@ -176,15 +166,13 @@ ipfs key rm key_ed25519
176166
'
177167

178168
# export works directly on the keystore present in IPFS_PATH
179-
test_expect_success "export and import ed25519 key while daemon is running" '
180-
edhash=$(ipfs key gen exported_ed25519_key --type=ed25519)
169+
test_expect_success "prepare ed25519 key while daemon is running" '
170+
edhash=$(ipfs key gen generated_ed25519_key --type=ed25519)
181171
echo $edhash > ed25519_key_id
182-
ipfs key export exported_ed25519_key &&
183-
ipfs key rm exported_ed25519_key &&
184-
ipfs key import exported_ed25519_key exported_ed25519_key.key > roundtrip_ed25519_key_id &&
185-
test_cmp ed25519_key_id roundtrip_ed25519_key_id
186172
'
187173

174+
test_key_import_export_all_formats ed25519_key
175+
188176
test_expect_success "key export over HTTP /api/v0/key/export is not possible" '
189177
ipfs key gen nohttpexporttest_key --type=ed25519 &&
190178
curl -X POST -sI "http://$API_ADDR/api/v0/key/export&arg=nohttpexporttest_key" | grep -q "^HTTP/1.1 404 Not Found"
@@ -214,6 +202,35 @@ test_check_ed25519_sk() {
214202
}
215203
}
216204

205+
test_key_import_export_all_formats() {
206+
KEY_NAME=$1
207+
test_key_import_export $KEY_NAME pem-pkcs8-cleartext
208+
test_key_import_export $KEY_NAME pem-pkcs8-encrypted
209+
test_key_import_export $KEY_NAME libp2p-protobuf-cleartext
210+
}
211+
212+
test_key_import_export() {
213+
local KEY_NAME FORMAT
214+
KEY_NAME=$1
215+
FORMAT=$2
216+
ORIG_KEY="generated_$KEY_NAME"
217+
if [ $FORMAT == "pem-pkcs8-encrypted" ]; then
218+
KEY_PASSWORD="--password=fake-test-password"
219+
fi
220+
if [ $FORMAT == "libp2p-protobuf-cleartext" ]; then
221+
FILE_EXT="key"
222+
else
223+
FILE_EXT="pem"
224+
fi
225+
226+
test_expect_success "export and import $KEY_NAME with format $FORMAT" '
227+
ipfs key export $ORIG_KEY --format=$FORMAT $KEY_PASSWORD &&
228+
ipfs key rm $ORIG_KEY &&
229+
ipfs key import $ORIG_KEY $ORIG_KEY.$FILE_EXT --format=$FORMAT $KEY_PASSWORD > imported_key_id &&
230+
test_cmp ${KEY_NAME}_id imported_key_id
231+
'
232+
}
233+
217234
test_key_cmd
218235

219236
test_done

0 commit comments

Comments
 (0)