Commit Graph

75 Commits (335435decfd395879f6f087f1a919ec371d5f1fb)

Author SHA1 Message Date
Max 8ead310d24
Merge pull request #485 from smallstep/max/actions
Convert to github actions
3 years ago
Mariano Cano 163eb7029c Refactor cloudkms signer to return an error on the constructor. 3 years ago
Mariano Cano cae08bff80 Validate that the signer can get the public key. 3 years ago
max furman f88f58440f add //nolint for new 1.16 deprecation warnings
- dsa
- pem.DecryptPEMBlock
3 years ago
Mariano Cano 2ba4e37530 Add URI support to configure yubikeys. 3 years ago
Mariano Cano 4c562160fc Fix typo. 3 years ago
Mariano Cano 4bec2b04ec Add support for retired key management slots on yubikey.
Fixes #461
3 years ago
Mariano Cano a947779795 Add uri support initializing cloudkms. 3 years ago
Mariano Cano 4902e45729 Add URI support initializing an awskms. 3 years ago
Mariano Cano 1ddddb6bc7 Permit linting and testing without CGO support.
Use CGO for testing and building in travis.
Fixes #471
3 years ago
Mariano Cano d03c088ab7 Add test cases for uris with only the schema. 3 years ago
Mariano Cano f6cbd9dc88 Fix typos. 3 years ago
Mariano Cano ebaeae9008 Avoid closing pkcs#11 context twice. 3 years ago
Mariano Cano f425a81d36 Enforce the use of id and label when generating objects. 3 years ago
Mariano Cano dd6a43ad13 Add fake implementation of pkcs11 key manager without cgo.
This allows other binaries to import pkcs11 directly even if they
are compiled without cgo.
3 years ago
Mariano Cano 3fdab93ab8 Add missing file. 3 years ago
Mariano Cano a8260a3289 Add missing test. 3 years ago
Mariano Cano 41eff69fb3 Fix linting errors. 3 years ago
Mariano Cano 128d07f148 Use new GetEncoded method. 3 years ago
Mariano Cano b28db61d5d Add missing close causing panic with softhsm2. 3 years ago
Mariano Cano a74fc7a0b2 Remove unnecessary methods and add missing tests. 3 years ago
Mariano Cano 50e9018a44 Fix missing return. 3 years ago
Mariano Cano 84a3c8c984 Rename nitrokey initialization to opensc. 3 years ago
Mariano Cano b7afc92758 Complete tests. 3 years ago
Mariano Cano 3a479cb0e8 Add support for nitrokey. 3 years ago
Mariano Cano e78d45a060 Add benchmarks for signing operations. 3 years ago
Mariano Cano 673675fa89 Convert pkcs11 tests to use tags. 3 years ago
Mariano Cano 6c113542c8 Fix ecdsa signature verification test. 3 years ago
Mariano Cano 35bf9b787e Implement ecdsa.VerifyASN1 to be compatible with go < 1.15 3 years ago
Mariano Cano d9da150a5f Fix test. 3 years ago
Mariano Cano 294f84b8d4 Add initial set of unit tests for pkcs11 kms. 3 years ago
Mariano Cano a6c784d5dd Add missing pkcs11 package. 3 years ago
Mariano Cano 8dca652bc7 Add support for PKCS #11 KMS.
The implementation works with YubiHSM2. Unit tests are still pending.

Fixes #301
3 years ago
Mariano Cano ccc403cf89 Fix comments, and return an error instead of fatal. 4 years ago
Anton Lundin 3e6137110b Add support for using ssh-agent as a KMS
This adds a new KMS, SSHAgentKMS, which is a KMS to provide signing keys
for issuing ssh certificates signed by a key managed by a ssh-agent. It
uses the golang.org/x/crypto package to get a native Go implementation
to talk to a ssh-agent.

This was primarly written to be able to use gpg-agent to provide the
keys stored in a YubiKeys openpgp interface, but can be used for other
setups like proxying a ssh-agent over network.

That way the signing key for ssh certificates can be kept in a
"sign-only" hsm.

This code was written for my employer Intinor AB, but for simplicity
sake gifted to me to contribute upstream.

Signed-off-by: Anton Lundin <glance@acc.umu.se>
4 years ago
Mariano Cano 40d0596b71 Use smallstep/cli-utils instead of smallstep/cli 4 years ago
Mariano Cano f100b2d0e3 Make the YubiKey management key configurable.
With this change the default management key is not required as the
user is able to set its own.

Fixes #323
4 years ago
Pierre Laden 692f7692a2 fix #2 indentation 4 years ago
Pierre Laden 290d5ee979 fix gofmt complain 4 years ago
Pierre Laden 179e793f1a - provide PINpolicy always to piv-go to avoid trying to use attestation cert, which we might not have
- bump piv-go version to 1.6.0
4 years ago
Mariano Cano d30a95236d Use always go.step.sm/crypto 4 years ago
Mariano Cano ddb4ca7a74 Move load of kms to main package.
With this change packages that import the authority won't load by
default all the supported kms with all its dependencies.

Fixes #228
4 years ago
Mariano Cano 6c9cd7050c Add test with query strings. 4 years ago
Mariano Cano dfe8e11e44 Remove anchor from link. 4 years ago
Mariano Cano 7104588fcb Fix linter error. 4 years ago
Mariano Cano aaf71ce66a Add unit tests for awskms. 4 years ago
Mariano Cano d4cb9f4ac7 Define an interface for kms operations.
This interface will be used for unit testing.
4 years ago
Mariano Cano 82fb96588e Fix unit tests. 4 years ago
Mariano Cano c32abb76cd Add initial implementation to support AWS KMS. 4 years ago
Mariano Cano b0f768a3fb Add implementation of URIs for KMS.
Implementation is based on the PKCS #11 URI Scheme RFC
https://tools.ietf.org/html/rfc7512
4 years ago