7ad90d10b3
Refactor initialization of SCEP authority
3 years ago
8ead310d24
Merge pull request #485 from smallstep/max/actions
...
Convert to github actions
3 years ago
163eb7029c
Refactor cloudkms signer to return an error on the constructor.
3 years ago
cae08bff80
Validate that the signer can get the public key.
3 years ago
f88f58440f
add //nolint for new 1.16 deprecation warnings
...
- dsa
- pem.DecryptPEMBlock
3 years ago
2ba4e37530
Add URI support to configure yubikeys.
3 years ago
4c562160fc
Fix typo.
3 years ago
4bec2b04ec
Add support for retired key management slots on yubikey.
...
Fixes #461
3 years ago
a947779795
Add uri support initializing cloudkms.
3 years ago
4902e45729
Add URI support initializing an awskms.
3 years ago
1ddddb6bc7
Permit linting and testing without CGO support.
...
Use CGO for testing and building in travis.
Fixes #471
3 years ago
d03c088ab7
Add test cases for uris with only the schema.
3 years ago
f6cbd9dc88
Fix typos.
3 years ago
ebaeae9008
Avoid closing pkcs#11 context twice.
3 years ago
f425a81d36
Enforce the use of id and label when generating objects.
3 years ago
dd6a43ad13
Add fake implementation of pkcs11 key manager without cgo.
...
This allows other binaries to import pkcs11 directly even if they
are compiled without cgo.
3 years ago
3fdab93ab8
Add missing file.
3 years ago
a8260a3289
Add missing test.
3 years ago
41eff69fb3
Fix linting errors.
3 years ago
128d07f148
Use new GetEncoded method.
3 years ago
b28db61d5d
Add missing close causing panic with softhsm2.
3 years ago
a74fc7a0b2
Remove unnecessary methods and add missing tests.
3 years ago
50e9018a44
Fix missing return.
3 years ago
84a3c8c984
Rename nitrokey initialization to opensc.
3 years ago
b7afc92758
Complete tests.
3 years ago
3a479cb0e8
Add support for nitrokey.
3 years ago
e78d45a060
Add benchmarks for signing operations.
3 years ago
673675fa89
Convert pkcs11 tests to use tags.
3 years ago
6c113542c8
Fix ecdsa signature verification test.
3 years ago
35bf9b787e
Implement ecdsa.VerifyASN1 to be compatible with go < 1.15
3 years ago
d9da150a5f
Fix test.
3 years ago
294f84b8d4
Add initial set of unit tests for pkcs11 kms.
3 years ago
a6c784d5dd
Add missing pkcs11 package.
3 years ago
8dca652bc7
Add support for PKCS #11 KMS.
...
The implementation works with YubiHSM2. Unit tests are still pending.
Fixes #301
3 years ago
ccc403cf89
Fix comments, and return an error instead of fatal.
4 years ago
3e6137110b
Add support for using ssh-agent as a KMS
...
This adds a new KMS, SSHAgentKMS, which is a KMS to provide signing keys
for issuing ssh certificates signed by a key managed by a ssh-agent. It
uses the golang.org/x/crypto package to get a native Go implementation
to talk to a ssh-agent.
This was primarly written to be able to use gpg-agent to provide the
keys stored in a YubiKeys openpgp interface, but can be used for other
setups like proxying a ssh-agent over network.
That way the signing key for ssh certificates can be kept in a
"sign-only" hsm.
This code was written for my employer Intinor AB, but for simplicity
sake gifted to me to contribute upstream.
Signed-off-by: Anton Lundin <glance@acc.umu.se>
4 years ago
40d0596b71
Use smallstep/cli-utils instead of smallstep/cli
4 years ago
f100b2d0e3
Make the YubiKey management key configurable.
...
With this change the default management key is not required as the
user is able to set its own.
Fixes #323
4 years ago
692f7692a2
fix #2 indentation
4 years ago
290d5ee979
fix gofmt complain
4 years ago
179e793f1a
- provide PINpolicy always to piv-go to avoid trying to use attestation cert, which we might not have
...
- bump piv-go version to 1.6.0
4 years ago
d30a95236d
Use always go.step.sm/crypto
4 years ago
ddb4ca7a74
Move load of kms to main package.
...
With this change packages that import the authority won't load by
default all the supported kms with all its dependencies.
Fixes #228
4 years ago
6c9cd7050c
Add test with query strings.
4 years ago
dfe8e11e44
Remove anchor from link.
4 years ago
7104588fcb
Fix linter error.
4 years ago
aaf71ce66a
Add unit tests for awskms.
4 years ago
d4cb9f4ac7
Define an interface for kms operations.
...
This interface will be used for unit testing.
4 years ago
82fb96588e
Fix unit tests.
4 years ago
c32abb76cd
Add initial implementation to support AWS KMS.
4 years ago
b0f768a3fb
Add implementation of URIs for KMS.
...
Implementation is based on the PKCS #11 URI Scheme RFC
https://tools.ietf.org/html/rfc7512
4 years ago
012a4734bf
Add better messaging when yubikey is not detected.
4 years ago
7d61c0003c
Enable softkms and cloudkms.
4 years ago
63e36ecd7a
Refactor the initialization of KeyManagers.
4 years ago
029483463b
Remove extra +build statement.
4 years ago
677e99793e
Create alternative yubikey file when cgo is not enabled.
...
This yubikey will always fail.
4 years ago
6868190fff
Add initial support for yubikey.
4 years ago
1138cc4207
Retry CloudKMS GetPublicKey.
...
On HSM keys are not generated instantly and the GetPublicKey fails
with a FailedPrecondition error. This change will retry GetPublicKey
if this happens.
4 years ago
5c8c741fab
Fix linting issues.
4 years ago
dd5a96a42e
Fix typo.
4 years ago
b724f5a338
Fix typos.
4 years ago
6987a46b76
Skip test on travis.
4 years ago
b11bbd5728
Fix typo.
4 years ago
cff346e7fd
Skip test on travis, it won't fail because they have access to the KMS.
4 years ago
fa8116497c
Make Signer public and add contructor NewCloudKMS.
4 years ago
5d5ee68d88
Make GCP client public to facilitate extensibility.
4 years ago
dff498f17f
Add tests for cloudkms.
5 years ago
264179cda3
Add tests for kms and kms/apiv1 packages.
5 years ago
c250c6ad91
Add unit tests for softkms.
5 years ago
a773977a81
Fix interface change.
5 years ago
927a3b3a86
Return crypto.PublicKey on kms.GetPublicKey.
5 years ago
a9c2db8f98
Add close method and fix types in softkms.
5 years ago
a3128a26bb
Add Close method to the key manager interface.
5 years ago
e60beeb7fc
Make cloudkms more robust.
...
* Automatically create key rings if needed.
* User CryptoKeyVersions if needed.
* Add support to close the client.
* Add new pareters to CreateKey responses to make things easier.
5 years ago
3f8de17a40
Cleanup types and add initial support for the options required for PKCS11.
5 years ago
d13754166a
Add support for cloudkms and softkms.
5 years ago
Herman Slatman
Max
Mariano Cano
Mariano Cano
Anton Lundin
Pierre Laden