Mariano Cano
163eb7029c
Refactor cloudkms signer to return an error on the constructor.
4 years ago
Mariano Cano
cae08bff80
Validate that the signer can get the public key.
4 years ago
max furman
f88f58440f
add //nolint for new 1.16 deprecation warnings
...
- dsa
- pem.DecryptPEMBlock
4 years ago
Mariano Cano
2ba4e37530
Add URI support to configure yubikeys.
4 years ago
Mariano Cano
4c562160fc
Fix typo.
4 years ago
Mariano Cano
4bec2b04ec
Add support for retired key management slots on yubikey.
...
Fixes #461
4 years ago
Mariano Cano
a947779795
Add uri support initializing cloudkms.
4 years ago
Mariano Cano
4902e45729
Add URI support initializing an awskms.
4 years ago
Mariano Cano
1ddddb6bc7
Permit linting and testing without CGO support.
...
Use CGO for testing and building in travis.
Fixes #471
4 years ago
Mariano Cano
d03c088ab7
Add test cases for uris with only the schema.
4 years ago
Mariano Cano
f6cbd9dc88
Fix typos.
4 years ago
Mariano Cano
ebaeae9008
Avoid closing pkcs#11 context twice.
4 years ago
Mariano Cano
f425a81d36
Enforce the use of id and label when generating objects.
4 years ago
Mariano Cano
dd6a43ad13
Add fake implementation of pkcs11 key manager without cgo.
...
This allows other binaries to import pkcs11 directly even if they
are compiled without cgo.
4 years ago
Mariano Cano
3fdab93ab8
Add missing file.
4 years ago
Mariano Cano
a8260a3289
Add missing test.
4 years ago
Mariano Cano
41eff69fb3
Fix linting errors.
4 years ago
Mariano Cano
128d07f148
Use new GetEncoded method.
4 years ago
Mariano Cano
b28db61d5d
Add missing close causing panic with softhsm2.
4 years ago
Mariano Cano
a74fc7a0b2
Remove unnecessary methods and add missing tests.
4 years ago
Mariano Cano
50e9018a44
Fix missing return.
4 years ago
Mariano Cano
84a3c8c984
Rename nitrokey initialization to opensc.
4 years ago
Mariano Cano
b7afc92758
Complete tests.
4 years ago
Mariano Cano
3a479cb0e8
Add support for nitrokey.
4 years ago
Mariano Cano
e78d45a060
Add benchmarks for signing operations.
4 years ago
Mariano Cano
673675fa89
Convert pkcs11 tests to use tags.
4 years ago
Mariano Cano
6c113542c8
Fix ecdsa signature verification test.
4 years ago
Mariano Cano
35bf9b787e
Implement ecdsa.VerifyASN1 to be compatible with go < 1.15
4 years ago
Mariano Cano
d9da150a5f
Fix test.
4 years ago
Mariano Cano
294f84b8d4
Add initial set of unit tests for pkcs11 kms.
4 years ago
Mariano Cano
a6c784d5dd
Add missing pkcs11 package.
4 years ago
Mariano Cano
8dca652bc7
Add support for PKCS #11 KMS.
...
The implementation works with YubiHSM2. Unit tests are still pending.
Fixes #301
4 years ago
Mariano Cano
ccc403cf89
Fix comments, and return an error instead of fatal.
4 years ago
Anton Lundin
3e6137110b
Add support for using ssh-agent as a KMS
...
This adds a new KMS, SSHAgentKMS, which is a KMS to provide signing keys
for issuing ssh certificates signed by a key managed by a ssh-agent. It
uses the golang.org/x/crypto package to get a native Go implementation
to talk to a ssh-agent.
This was primarly written to be able to use gpg-agent to provide the
keys stored in a YubiKeys openpgp interface, but can be used for other
setups like proxying a ssh-agent over network.
That way the signing key for ssh certificates can be kept in a
"sign-only" hsm.
This code was written for my employer Intinor AB, but for simplicity
sake gifted to me to contribute upstream.
Signed-off-by: Anton Lundin <glance@acc.umu.se>
4 years ago
Mariano Cano
40d0596b71
Use smallstep/cli-utils instead of smallstep/cli
4 years ago
Mariano Cano
f100b2d0e3
Make the YubiKey management key configurable.
...
With this change the default management key is not required as the
user is able to set its own.
Fixes #323
4 years ago
Pierre Laden
692f7692a2
fix #2 indentation
4 years ago
Pierre Laden
290d5ee979
fix gofmt complain
4 years ago
Pierre Laden
179e793f1a
- provide PINpolicy always to piv-go to avoid trying to use attestation cert, which we might not have
...
- bump piv-go version to 1.6.0
4 years ago
Mariano Cano
d30a95236d
Use always go.step.sm/crypto
4 years ago
Mariano Cano
ddb4ca7a74
Move load of kms to main package.
...
With this change packages that import the authority won't load by
default all the supported kms with all its dependencies.
Fixes #228
4 years ago
Mariano Cano
6c9cd7050c
Add test with query strings.
4 years ago
Mariano Cano
dfe8e11e44
Remove anchor from link.
4 years ago
Mariano Cano
7104588fcb
Fix linter error.
4 years ago
Mariano Cano
aaf71ce66a
Add unit tests for awskms.
4 years ago
Mariano Cano
d4cb9f4ac7
Define an interface for kms operations.
...
This interface will be used for unit testing.
4 years ago
Mariano Cano
82fb96588e
Fix unit tests.
4 years ago
Mariano Cano
c32abb76cd
Add initial implementation to support AWS KMS.
4 years ago
Mariano Cano
b0f768a3fb
Add implementation of URIs for KMS.
...
Implementation is based on the PKCS #11 URI Scheme RFC
https://tools.ietf.org/html/rfc7512
4 years ago
Mariano Cano
012a4734bf
Add better messaging when yubikey is not detected.
4 years ago
Mariano Cano
7d61c0003c
Enable softkms and cloudkms.
4 years ago
Mariano Cano
63e36ecd7a
Refactor the initialization of KeyManagers.
4 years ago
Mariano Cano
029483463b
Remove extra +build statement.
4 years ago
Mariano Cano
677e99793e
Create alternative yubikey file when cgo is not enabled.
...
This yubikey will always fail.
4 years ago
Mariano Cano
6868190fff
Add initial support for yubikey.
4 years ago
Mariano Cano
1138cc4207
Retry CloudKMS GetPublicKey.
...
On HSM keys are not generated instantly and the GetPublicKey fails
with a FailedPrecondition error. This change will retry GetPublicKey
if this happens.
5 years ago
Mariano Cano
5c8c741fab
Fix linting issues.
5 years ago
Mariano Cano
dd5a96a42e
Fix typo.
5 years ago
Mariano Cano
b724f5a338
Fix typos.
5 years ago
Mariano Cano
6987a46b76
Skip test on travis.
5 years ago
Mariano Cano
b11bbd5728
Fix typo.
5 years ago
Mariano Cano
cff346e7fd
Skip test on travis, it won't fail because they have access to the KMS.
5 years ago
Mariano Cano
fa8116497c
Make Signer public and add contructor NewCloudKMS.
5 years ago
Mariano Cano
5d5ee68d88
Make GCP client public to facilitate extensibility.
5 years ago
Mariano Cano
dff498f17f
Add tests for cloudkms.
5 years ago
Mariano Cano
264179cda3
Add tests for kms and kms/apiv1 packages.
5 years ago
Mariano Cano
c250c6ad91
Add unit tests for softkms.
5 years ago
Mariano Cano
a773977a81
Fix interface change.
5 years ago
Mariano Cano
927a3b3a86
Return crypto.PublicKey on kms.GetPublicKey.
5 years ago
Mariano Cano
a9c2db8f98
Add close method and fix types in softkms.
5 years ago
Mariano Cano
a3128a26bb
Add Close method to the key manager interface.
5 years ago
Mariano Cano
e60beeb7fc
Make cloudkms more robust.
...
* Automatically create key rings if needed.
* User CryptoKeyVersions if needed.
* Add support to close the client.
* Add new pareters to CreateKey responses to make things easier.
5 years ago
Mariano Cano
3f8de17a40
Cleanup types and add initial support for the options required for PKCS11.
5 years ago
Mariano Cano
d13754166a
Add support for cloudkms and softkms.
5 years ago