code review 117180043: crypto/tls: Support ECDSA keys in generate_cert.go

crypto/tls: Support ECDSA keys in generate_cert.go

[asimshankar, 2014-07-24 21:55:34]

Hello golang-codereviews@googlegroups.com (cc:
golang-codereviews@googlegroups.com),

I'd like you to review this change to
https://code.google.com/p/go

[bradfitz, 2014-07-24 22:18:58]

R=agl



On Thu, Jul 24, 2014 at 2:55 PM, <asimshankar@gmail.com> wrote:

> Reviewers: golang-codereviews,
>
> Message:
> Hello golang-codereviews@googlegroups.com (cc:
> golang-codereviews@googlegroups.com),
>
> I'd like you to review this change to
> https://code.google.com/p/go
>
>
> Description:
> crypto/tls: Support ECDSA keys in generate_cert.go
>
> Please review this at https://codereview.appspot.com/117180043/
>
> Affected files (+55, -8 lines):
>   M src/pkg/crypto/tls/generate_cert.go
>
>
> Index: src/pkg/crypto/tls/generate_cert.go
> ===================================================================
> --- a/src/pkg/crypto/tls/generate_cert.go
> +++ b/src/pkg/crypto/tls/generate_cert.go
> @@ -10,6 +10,8 @@
>  package main
>
>  import (
> +       "crypto/ecdsa"
> +       "crypto/elliptic"
>         "crypto/rand"
>         "crypto/rsa"
>         "crypto/x509"
> @@ -26,13 +28,42 @@
>  )
>
>  var (
> -       host      = flag.String("host", "", "Comma-separated hostnames and
> IPs to generate a certificate for")
> -       validFrom = flag.String("start-date", "", "Creation date formatted
> as Jan 1 15:04:05 2011")
> -       validFor  = flag.Duration("duration", 365*24*time.Hour, "Duration
> that certificate is valid for")
> -       isCA      = flag.Bool("ca", false, "whether this cert should be
> its own Certificate Authority")
> -       rsaBits   = flag.Int("rsa-bits", 2048, "Size of RSA key to
> generate")
> +       host       = flag.String("host", "", "Comma-separated hostnames
> and IPs to generate a certificate for")
> +       validFrom  = flag.String("start-date", "", "Creation date
> formatted as Jan 1 15:04:05 2011")
> +       validFor   = flag.Duration("duration", 365*24*time.Hour, "Duration
> that certificate is valid for")
> +       isCA       = flag.Bool("ca", false, "whether this cert should be
> its own Certificate Authority")
> +       rsaBits    = flag.Int("rsa-bits", 2048, "Size of RSA key to
> generate. Ignored if --ecdsa-curve is set")
> +       ecdsaCurve = flag.String("ecdsa-curve", "", "ECDSA curve to use to
> generate a key. Valid values are P224, P256, P384, P521")
>  )
>
> +func publicKey(priv interface{}) interface{} {
> +       switch k := priv.(type) {
> +       case *rsa.PrivateKey:
> +               return &k.PublicKey
> +       case *ecdsa.PrivateKey:
> +               return &k.PublicKey
> +       default:
> +               return nil
> +       }
> +
> +}
> +
> +func pemBlockForKey(priv interface{}) *pem.Block {
> +       switch k := priv.(type) {
> +       case *rsa.PrivateKey:
> +               return &pem.Block{Type: "RSA PRIVATE KEY", Bytes:
> x509.MarshalPKCS1PrivateKey(k)}
> +       case *ecdsa.PrivateKey:
> +               b, err := x509.MarshalECPrivateKey(k)
> +               if err != nil {
> +                       fmt.Fprintf(os.Stderr, "Unable to marshal ECDSA
> private key: %v", err)
> +                       os.Exit(2)
> +               }
> +               return &pem.Block{Type: "ECDSA PRIVATE KEY", Bytes: b}
> +       default:
> +               return nil
> +       }
> +}
> +
>  func main() {
>         flag.Parse()
>
> @@ -40,7 +71,23 @@
>                 log.Fatalf("Missing required --host parameter")
>         }
>
> -       priv, err := rsa.GenerateKey(rand.Reader, *rsaBits)
> +       var priv interface{}
> +       var err error
> +       switch *ecdsaCurve {
> +       case "":
> +               priv, err = rsa.GenerateKey(rand.Reader, *rsaBits)
> +       case "P224":
> +               priv, err = ecdsa.GenerateKey(elliptic.P224(),
> rand.Reader)
> +       case "P256":
> +               priv, err = ecdsa.GenerateKey(elliptic.P256(),
> rand.Reader)
> +       case "P384":
> +               priv, err = ecdsa.GenerateKey(elliptic.P384(),
> rand.Reader)
> +       case "P521":
> +               priv, err = ecdsa.GenerateKey(elliptic.P521(),
> rand.Reader)
> +       default:
> +               fmt.Fprintf(os.Stderr, "Unrecognized elliptic curve: %q",
> *ecdsaCurve)
> +               os.Exit(1)
> +       }
>         if err != nil {
>                 log.Fatalf("failed to generate private key: %s", err)
>         }
> @@ -91,7 +138,7 @@
>                 template.KeyUsage |= x509.KeyUsageCertSign
>         }
>
> -       derBytes, err := x509.CreateCertificate(rand.Reader, &template,
> &template, &priv.PublicKey, priv)
> +       derBytes, err := x509.CreateCertificate(rand.Reader, &template,
> &template, publicKey(priv), priv)
>         if err != nil {
>                 log.Fatalf("Failed to create certificate: %s", err)
>         }
> @@ -109,7 +156,7 @@
>                 log.Print("failed to open key.pem for writing:", err)
>                 return
>         }
> -       pem.Encode(keyOut, &pem.Block{Type: "RSA PRIVATE KEY", Bytes:
> x509.MarshalPKCS1PrivateKey(priv)})
> +       pem.Encode(keyOut, pemBlockForKey(priv))
>         keyOut.Close()
>         log.Print("written key.pem\n")
>  }
>
>
> --
> You received this message because you are subscribed to the Google Groups
> "golang-codereviews" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to golang-codereviews+unsubscribe@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
>

[agl1, 2014-07-24 22:30:34]

https://codereview.appspot.com/117180043/diff/20002/src/pkg/crypto/tls/genera...
File src/pkg/crypto/tls/generate_cert.go (right):

https://codereview.appspot.com/117180043/diff/20002/src/pkg/crypto/tls/genera...
src/pkg/crypto/tls/generate_cert.go:61: return &pem.Block{Type: "ECDSA PRIVATE
KEY", Bytes: b}
it's just "EC PRIVATE KEY"

[asimshankar, 2014-07-25 00:23:31]

https://codereview.appspot.com/117180043/diff/20002/src/pkg/crypto/tls/genera...
File src/pkg/crypto/tls/generate_cert.go (right):

https://codereview.appspot.com/117180043/diff/20002/src/pkg/crypto/tls/genera...
src/pkg/crypto/tls/generate_cert.go:61: return &pem.Block{Type: "ECDSA PRIVATE
KEY", Bytes: b}
On 2014/07/24 22:30:34, agl1 wrote:
> it's just "EC PRIVATE KEY"

Done.

[asimshankar, 2014-07-25 00:24:10]

Hello golang-codereviews@googlegroups.com, bradfitz@golang.org, agl@golang.org
(cc: golang-codereviews@googlegroups.com),

Please take another look.

[agl1, 2014-07-28 21:47:00]

*** Submitted as https://code.google.com/p/go/source/detail?r=f0b241ebf35c ***

crypto/tls: Support ECDSA keys in generate_cert.go

R=golang-codereviews, bradfitz, agl
CC=golang-codereviews
https://codereview.appspot.com/117180043

Committer: Adam Langley <agl@golang.org>