Add support for generating ed25519 keys and certs #1061

izolight · 2019-11-23T22:02:39Z

It is now possible to generate ed25519 keys and certificates by specifying ed25519 as algo in the json.
This should fix #926

codecov-io · 2019-11-24T11:56:36Z

Codecov Report

Merging #1061 into master will decrease coverage by 0.12%.
The diff coverage is 37.73%.

@@            Coverage Diff             @@
##           master    #1061      +/-   ##
==========================================
- Coverage   56.40%   56.28%   -0.13%     
==========================================
  Files          76       76              
  Lines        7256     7308      +52     
==========================================
+ Hits         4093     4113      +20     
- Misses       2697     2726      +29     
- Partials      466      469       +3

Impacted Files	Coverage Δ
bundler/bundle.go	`80.23% <0.00%> (-4.96%)`	⬇️
bundler/bundler.go	`78.50% <0.00%> (-0.72%)`	⬇️
helpers/derhelpers/derhelpers.go	`0.00% <ø> (ø)`
helpers/derhelpers/ed25519.go	`53.84% <ø> (ø)`
signer/signer.go	`23.38% <0.00%> (-0.24%)`	⬇️
transport/kp/key_provider.go	`31.25% <0.00%> (-2.71%)`	⬇️
initca/initca.go	`61.19% <33.33%> (-0.64%)`	⬇️
helpers/helpers.go	`72.91% <75.00%> (+0.04%)`	⬆️
csr/csr.go	`85.47% <81.25%> (-0.31%)`	⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ebe0199...6624bf1. Read the comment docs.

claucece · 2020-03-25T07:17:04Z

Hi @lgarofalo ! I'll review this tomorrow ;)

claucece

It might need some changes, as well as adding some other tests. @izolight if you want we can do it together...

bundler/bundle.go

bundler/bundler.go

csr/csr.go

initca/testdata/ca_csr_ed25519.json

scan/crypto/tls/generate_cert.go

transport/kp/key_provider.go

claucece · 2020-04-13T04:16:11Z

Hi @lgarofalo !

I'll go ahead and make these little changes so it can be merged ;)

claucece · 2020-04-16T08:57:07Z

Hi, @izolight ! I've created a new pull request with your changes, to fix some things. It is found here: #1097. Let me know if it is ok ;)

izolight · 2020-04-23T09:45:33Z

@claucece I've addressed some of your questions and updated the pr,
still a bit unsure about the type, maybe we should support PRIVATE KEY and Ed25519 PRIVATE KEY?

…ircl#109

underrun · 2022-05-20T22:58:05Z

any hope for this pr moving forward?

gitguardian · 2023-05-26T19:36:02Z

⚠️ GitGuardian has uncovered 4 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	Secret	Commit	Filename
-	Generic Private Key	`c639e67`	initca/testdata/5min-ed25519-key.pem	View secret
-	Generic Private Key	`cf7fb43`	initca/testdata/5min-ed25519-key.pem	View secret
-	Generic Private Key	`ad00b62`	initca/testdata/5min-ed25519-key.pem	View secret
-	Generic Private Key	`bca3df9`	initca/testdata/5min-ed25519-key.pem	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secrets safely. Learn here the best practices.
Revoke and rotate these secrets.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Our GitHub checks need improvements? Share your feedbacks!}

codecov-commenter · 2023-05-26T19:36:21Z

Codecov Report

Merging #1061 (b43f9a2) into master (c21e85d) will increase coverage by 3.29%.
The diff coverage is 33.84%.

❗ Current head b43f9a2 differs from pull request most recent head ecc0574. Consider uploading reports for the commit ecc0574 to get more accurate results

@@            Coverage Diff             @@
##           master    #1061      +/-   ##
==========================================
+ Coverage   52.94%   56.23%   +3.29%     
==========================================
  Files          76       76              
  Lines        9095     7350    -1745     
==========================================
- Hits         4815     4133     -682     
+ Misses       3813     2745    -1068     
- Partials      467      472       +5

Impacted Files	Coverage Δ
bundler/bundle.go	`80.23% <0.00%> (-4.15%)`	⬇️
helpers/derhelpers/derhelpers.go	`0.00% <ø> (ø)`
helpers/derhelpers/ed25519.go	`53.84% <ø> (+5.40%)`	⬆️
signer/signer.go	`22.81% <0.00%> (+2.66%)`	⬆️
transport/kp/key_provider.go	`30.89% <0.00%> (-0.90%)`	⬇️
bundler/bundler.go	`77.45% <8.33%> (+10.32%)`	⬆️
initca/initca.go	`61.19% <25.00%> (+3.16%)`	⬆️
helpers/helpers.go	`73.21% <75.00%> (+0.37%)`	⬆️
csr/csr.go	`84.83% <81.25%> (+8.44%)`	⬆️
errors/error.go	`73.07% <100.00%> (-0.30%)`	⬇️

... and 64 files with indirect coverage changes

izolight · 2023-05-26T20:26:21Z

merged changes from #1097

lukevalenta

Thanks for driving this PR forward! I left a few comments and requested changes, but overall this is looking good.

errors/error.go

initca/initca.go

initca/initca_test.go

claucece

Looks good. I agree with @lukevalenta .

I no longer work at Cloudflare, so I don't have time to check in depth these PRs, but happy to see this work move forward.

Co-authored-by: Luke Valenta <lvalenta@cloudflare.com>

lukevalenta · 2023-06-05T13:23:29Z

@nickysemenza this PR looks good to me but I lack permissions to approve. Would you be able to add this to your review queue?

adamacosta · 2023-12-12T21:28:55Z

Is this going to make a release sometime soon? It was confusing as hell to spend the last two hours wondering why I couldn't generate a ed25519 key when your csr.go file pretty clearly shows a case match on it, to see the original request for support was from five years ago, then to finally look at the date on this merge and the date of the last release and realize you haven't released since April.

I'm perfectly willing to build from main and give it a whirl, but man, maybe merge the website updates from three and a half years ago: #1095

Not a great experience to spend all this time digging through your source code because there's no documentation only to find out the source code doesn't actually match the latest release.

I know it's a free tool so honestly I apologize if this sounds harsh. Dealing with demanding jackasses on Github can be a pain, so honest to God, I've gotten a ton out of Cloudflare knowledge base material in general in the past and I really do appreciate it. This toolsuite is still a heck of a lot less inscrutable than openssl and at least the source code is very readable.

izolight added 3 commits November 23, 2019 22:50

add support for generating ed25519 keys and certs

e340753

add 5min ca testfiles

c639e67

only build for go1.13 as the ed25519 package is now part of std library

e4cf3d8

remove dependency on golang.org/x/crypto/ed25519

bb83c8c

claucece suggested changes Mar 26, 2020

View reviewed changes

izolight added 4 commits April 16, 2020 03:42

add support for generating ed25519 keys and certs

9a17a34

add 5min ca testfiles

cf7fb43

only build for go1.13 as the ed25519 package is now part of std library

79fa3b0

remove dependency on golang.org/x/crypto/ed25519

221d4ec

claucece mentioned this pull request Apr 16, 2020

Add support for generating ed25519 keys and certificates #1097

Closed

claucece and others added 4 commits April 21, 2020 04:42

Change string domain and format

626680c

typo

1d9e618

compare key and cert

751bf89

update comment and error to indicate support for ed25519

6624bf1

izolight and others added 11 commits April 23, 2020 11:46

update comments

b43f9a2

Change to use circl ed25519. This will fail due to issue cloudflare/c…

7f6b294

…ircl#109

Use circl only for signing

b8f9375

Update vendor

f1bf794

Update vendor to mod

259b11c

Remove go 1.12

35d039a

Only use c25519 for generation

887b6fc

Fix style

7dc5eca

Use circl library for all ed25519 key generation

4685a06

Run the tests with expired data

b4a68f6

Consistent naming

7aff46b

claucece added 5 commits May 16, 2020 01:51

Not using pointers

2725cfc

Fix 5min files

ad00b62

Use 25519 from stdlib

7d2779f

This package is vendored

acff4d8

Re add error line and mod tidy

21fb139

Merge branch 'claucece-ed25519cert' into ed25519

bca3df9

izolight force-pushed the ed25519 branch from b5fefe5 to bca3df9 Compare May 26, 2023 19:45

izolight added 3 commits May 26, 2023 21:55

Merge remote-tracking branch 'origin' into ed25519

c1cfc4c

remove unneeded todo as per cloudflare#1097 (comment)

58fc165

ignore key size for ed25519 as all keys are 256bit

fcceb3d

izolight requested a review from claucece May 26, 2023 20:27

izolight added 2 commits May 26, 2023 22:28

remove duplicate case from merge

dfcdcd0

add Ed25519 to error for supported keys

27e825e

lukevalenta suggested changes May 30, 2023

View reviewed changes

errors/error.go Outdated Show resolved Hide resolved

initca/initca.go Outdated Show resolved Hide resolved

initca/initca_test.go Outdated Show resolved Hide resolved

initca/initca_test.go Outdated Show resolved Hide resolved

claucece reviewed Jun 2, 2023

View reviewed changes

izolight and others added 5 commits June 2, 2023 21:33

Update errors/error.go

ed80075

Co-authored-by: Luke Valenta <lvalenta@cloudflare.com>

remove duplicate switch case

2b14670

correctly remove size param from ed25519 instead of ecdsa

6fdd6b4

remove unneeded test for ed25519 size

0c7066a

print config instead of error if test fails

ecc0574

nickysemenza merged commit 9a0778d into cloudflare:master Jun 12, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for generating ed25519 keys and certs #1061

Add support for generating ed25519 keys and certs #1061

izolight commented Nov 23, 2019

codecov-io commented Nov 24, 2019 •

edited

Loading

claucece commented Mar 25, 2020

claucece left a comment

claucece commented Apr 13, 2020

claucece commented Apr 16, 2020

izolight commented Apr 23, 2020

underrun commented May 20, 2022

gitguardian bot commented May 26, 2023 •

edited

Loading

codecov-commenter commented May 26, 2023 •

edited

Loading

izolight commented May 26, 2023

lukevalenta left a comment

claucece left a comment •

edited

Loading

lukevalenta commented Jun 5, 2023

adamacosta commented Dec 12, 2023

Add support for generating ed25519 keys and certs #1061

Add support for generating ed25519 keys and certs #1061

Conversation

izolight commented Nov 23, 2019

codecov-io commented Nov 24, 2019 • edited Loading

Codecov Report

claucece commented Mar 25, 2020

claucece left a comment

Choose a reason for hiding this comment

claucece commented Apr 13, 2020

claucece commented Apr 16, 2020

izolight commented Apr 23, 2020

underrun commented May 20, 2022

gitguardian bot commented May 26, 2023 • edited Loading

⚠️ GitGuardian has uncovered 4 secrets following the scan of your pull request.

codecov-commenter commented May 26, 2023 • edited Loading

Codecov Report

izolight commented May 26, 2023

lukevalenta left a comment

Choose a reason for hiding this comment

claucece left a comment • edited Loading

Choose a reason for hiding this comment

lukevalenta commented Jun 5, 2023

adamacosta commented Dec 12, 2023

codecov-io commented Nov 24, 2019 •

edited

Loading

gitguardian bot commented May 26, 2023 •

edited

Loading

codecov-commenter commented May 26, 2023 •

edited

Loading

claucece left a comment •

edited

Loading