Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend certificate functions to handle non-RSA keys + add support for ed25519 keys #270

Merged
merged 7 commits into from
Dec 11, 2020

Conversation

misberner
Copy link
Contributor

@misberner misberner commented Dec 6, 2020

This PR:

  • adds support for Ed25519 keys in the genPrivateKey function. Note: This has been removed because it fails the go1.12 CI tests. While Ed25519 support is available in Go 1.12 via golang.org/x/crypto/ed25519, the x509.MarshalPKCS8PrivateKey does not support ed25519 keys and implementing it manually is reasonably complex. Before I do this, I would like to clarify whether the Go 1.12 tests are relevant at all given that the go.mod file actually specifies a minimum Go version of 1.13.
  • adds support for non-RSA keys in the buildCustomCert function (in line with what Go supports, ECDSA and Ed25519 keys instead of just RSA keys)
  • adds ...WithKey variants for the genCA, genSignedCert, genSelfSignedCert functions, that take as an additional parameter a PEM-encoded private key (any private key generated with genPrivateKey and an algorithm other than "dsa" works) to be used for the certificate
  • adds a clarification to the documentation that the genCA, genSignedCert, and genSelfSignedCert functions use 2048-bit RSA keys.

The main motivation is to allow generating certificates with ECDSA or Ed25519 keys, which are much faster both in terms of key usage at runtime, as well as key generation time.

Malte Isberner added 7 commits December 3, 2020 20:00
wip

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
Copy link
Member

@technosophos technosophos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks great

@misberner
Copy link
Contributor Author

@technosophos thanks for the review! Do you have an opinion on the Go 1.12/ed25519 issue?

@mattfarina
Copy link
Member

@misberner I think it makes sense to drop 1.12 support and add testing for 1.15. 1.12 has not been supported by Go in 10 months. I can do that in a follow-up.

@mattfarina mattfarina merged commit 39e4d5d into Masterminds:master Dec 11, 2020
@mattfarina
Copy link
Member

The PR for that is at #272

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants