Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BACK-2478: Add ECC Support To Main Setup (non HSM) #20

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

BACK-2478: Add ECC Support To Main Setup (non HSM) #20

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 60 additions & 11 deletions setup-cks-latest.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,24 @@ prompt () {
done
}

# ECC vs RSA Prompt
promptRsa () {
while true; do
read -p "Enter Key Type [RSA/ECC] (default RSA): " kt
# Default to RSA if input is empty
if [[ -z "$kt" ]]; then
return 0
fi

# Check user input
case $kt in
[Rr][Ss][Aa]* ) return 0;;
[Ee][Cc][Cc]* ) return 1;;
* ) echo "Please answer RSA or ECC.";;
esac
done
}

# Create Directory (prompt if exists to overwrite)
mkdirCheck () {
if [ -d "$1" ]; then
Expand Down Expand Up @@ -108,16 +126,43 @@ openssl req -x509 -newkey rsa:2048 -nodes -keyout ./ssl/${CKS_FQDN}.key -out ./s
cat ./ssl/${CKS_FQDN}.key `find ./ssl/ -type f \( -name "${CKS_FQDN}*.csr" -or -name "${CKS_FQDN}*.crt" \)` `find ./ssl/ -type f \( ! -name "${CKS_FQDN}*" -and ! -name "ssl.pem" \)` > ./ssl/ssl.pem
chmod 644 ./ssl/${CKS_FQDN}.key

# Generate RSA Key Pair
openssl genrsa -out ./keys/rsa_001.pem 2048
openssl rsa -in ./keys/rsa_001.pem -outform PEM -pubout -out ./keys/rsa_001.pub

FINGERPRINT=$(openssl rsa -in ./keys/rsa_001.pub -pubin -outform der | openssl dgst -sha256 -binary | base64)
FINGERPRINT=$(echo ${FINGERPRINT//[+]/-})
FINGERPRINT=$(echo ${FINGERPRINT//[\/]/_})
FINGERPRINT=$(echo ${FINGERPRINT//[=]/''})
chmod 644 ./keys/rsa_001.pem
chmod 644 ./keys/rsa_001.pub
# Generate ECC or RSA key pair based on user input
if promptRsa; then
KEY_TYPE="RSA"

# Set Key Path for RSA
PRIV_KEY_PATH="./keys/rsa_001.pem"
PUB_KEY_PATH="./keys/rsa_001.pub"
# Generate RSA Key Pair
openssl genrsa -out $PRIV_KEY_PATH 2048
openssl rsa -in $PRIV_KEY_PATH -outform PEM -pubout -out $PUB_KEY_PATH

FINGERPRINT=$(openssl rsa -in $PUB_KEY_PATH -pubin -outform der | openssl dgst -sha256 -binary | base64)
FINGERPRINT=$(echo ${FINGERPRINT//[+]/-})
FINGERPRINT=$(echo ${FINGERPRINT//[\/]/_})
FINGERPRINT=$(echo ${FINGERPRINT//[=]/''})

chmod 644 $PRIV_KEY_PATH
chmod 644 $PUB_KEY_PATH
else
KEY_TYPE="ECC"

# Set Key Path for ECC
PRIV_KEY_PATH="./keys/ecc_p256_001.pem"
PUB_KEY_PATH="./keys/ecc_p256_001.pub"

# Generate an ECC Key Pair
openssl ecparam -name prime256v1 -genkey -noout | openssl pkcs8 -topk8 -nocrypt -out $PRIV_KEY_PATH
openssl ec -in $PRIV_KEY_PATH -pubout -out $PUB_KEY_PATH

FINGERPRINT=$(openssl ec -in $PUB_KEY_PATH -pubin -outform der | openssl dgst -sha256 -binary | base64)
FINGERPRINT=$(echo ${FINGERPRINT//[+]/-})
FINGERPRINT=$(echo ${FINGERPRINT//[\/]/_})
FINGERPRINT=$(echo ${FINGERPRINT//[=]/''})

chmod 644 $PRIV_KEY_PATH
chmod 644 $PUB_KEY_PATH
fi

SECRET_B64_FINAL=""
TOKEN_ID=""
Expand Down Expand Up @@ -194,7 +239,11 @@ if [ "$HMAC_AUTH_ENABLED" = true ]; then
echo "$TOKEN_INFO" >> ./cks_info/token_info.json
fi

cp ./keys/rsa_001.pub ./cks_info/rsa_001.pub
if [ "$KEY_TYPE" = "ECC" ]; then
cp $PUB_KEY_PATH ./cks_info/ecc_p256_001.pub
else
cp $PUB_KEY_PATH ./cks_info/rsa_001.pub
fi

tar -zcvf send_to_virtru.tar.gz ./cks_info

Expand Down