-
Notifications
You must be signed in to change notification settings - Fork 167
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
PKey::EC does not follow API #29
Comments
To be clear, the #public_key method does exist, it just behaves completely differently from other public key methods. To make it work as expected, you have to do this: def real_public_key(k)
point = k.public_key
pub = OpenSSL::PKey::EC.new(point.group)
pub.public_key = point
pub
end |
is there community agreement on how to resolve this issue? Is anyone working on a fix? |
1ed0cf0 added PKey::EC.generate, and 5588865 added PKey::EC#private? and #public?. It's too late to change the behavior of PKey::EC#public_key, so I first though of adding a new method #public_pkey to every PKey classes, but I started wondering. I can't come up with any situations where PKey::PKey#public_key is useful, except when exporting to a PEM or DER string. If it is the only use case, isn't it better to add an option to PKey::PKey#to_der and #export, like this? ec_key.generate_key!
ec_key.to_der #=> PKCS#8 PrivateKeyInfo format
ec_key.to_der(format: :PUBKEY) #=> X.509 SubjectPublicKeyInfo format What do you think? |
Yes, the most common case is calling to_der and to_pem/export. I'm looking through my code to see if I have any other uses, but I think generating a key pair then exporting/saving it is the main use case. |
|
@cognitiveflux yes, if try to set the public key on a Certificate object to the result of EC#public_key, you get the following error:
However if you simply set the public key to the OpenSSL::PKey::EC object that contains the private key, it will do the right thing and only include the public key in the certificate. |
Thanks for that clarification! Which release should include 5588865? |
Add a new parameter "private_key_type" which defaults to "rsa" but can also be set to "ec" for ECDSA keys. Contains updated README and some spec tests for the type. Due to various bugs in ruby-openssl it is currently difficult to properly test EC keys (https://bugs.ruby-lang.org/issues/12348, ruby/openssl#29).
For making Certs and CSRs you need to supply an rsa = OpenSSL::PKey::RSA.generate 2048
dsa = OpenSSL::PKey::DSA.generate 2048
ec = OpenSSL::PKey::EC.generate "prime256v1"
cert = OpenSSL::X509::Certificate.new
cert.public_key = rsa.public_key
cert.public_key = dsa.public_key
cert.public_key = ec.public_key # in `public_key=': wrong argument (OpenSSL::PKey::EC::Point)! (Expected kind of OpenSSL::PKey::PKey) (TypeError)
req = OpenSSL::X509::Request.new
req.public_key = rsa.public_key
req.public_key = dsa.public_key
req.public_key = ec.public_key # in `public_key=': wrong argument (OpenSSL::PKey::EC::Point)! (Expected kind of OpenSSL::PKey::PKey) (TypeError) Using a module AcceptECPublicKey
def public_key= value
if OpenSSL::PKey::EC::Point === value
key = OpenSSL::PKey::EC.new value.group
key.public_key = value
value = key
end
super value
end
end
OpenSSL::X509::Certificate.prepend AcceptECPublicKey
OpenSSL::X509::Request.prepend AcceptECPublicKey We can also teach module QuackLikeAPKey
def to_pem; public_key.to_pem end
def to_der; public_key.to_der end
private
def public_key
key = OpenSSL::PKey::EC.new group
key.public_key = self
key
end
end
OpenSSL::PKey::EC::Point.prepend QuackLikeAPKey With these patches |
I forgot to close this issue. PKey::EC.generate, PKey::EC#private?, and #public? are part of our v2.0.0 release.
You can pass private key as-is as pointed out by @pzb. |
I still have this issue, when I try to set a certs public key:
|
Previously, the build_cert method in Puppet::TestCa needed special logic for the Eliptical Curve class: ruby/openssl#29 This issue was resolved in OpenSSL 2.0, which was released in 2016, meaning that all versions of Ruby that Puppet supports includes Ruby/OpenSSL >= 2.0. This commit removes special logic for EC in Puppet::TestCa.
Previously, the build_cert method in Puppet::TestCa needed special logic for the Eliptical Curve class: ruby/openssl#29 This issue was resolved in OpenSSL 2.0, which was released in 2016, meaning that all versions of Ruby that Puppet supports includes Ruby/OpenSSL >= 2.0. This commit removes special logic for EC in Puppet::TestCa.
Previously, the build_cert method in Puppet::TestCa needed special logic for the Eliptical Curve class: ruby/openssl#29 This issue was resolved in OpenSSL 2.0, which was released in 2016, meaning that all versions of Ruby that Puppet supports includes Ruby/OpenSSL >= 2.0. This commit removes special logic for EC in Puppet::TestCa.
Previously, the build_cert method in Puppet::TestCa needed special logic for the Eliptical Curve class: ruby/openssl#29 This issue was resolved in OpenSSL 2.0, which was released in 2016, meaning that all versions of Ruby that Puppet supports includes Ruby/OpenSSL >= 2.0. This commit removes special logic for EC in Puppet::TestCa.
Previously, the build_cert method in Puppet::TestCa needed special logic for the Eliptical Curve class: ruby/openssl#29 This issue was resolved in OpenSSL 2.0, which was released in 2016, meaning that all versions of Ruby that Puppet supports includes Ruby/OpenSSL >= 2.0. This commit removes special logic for EC in Puppet::TestCa.
Previously, the build_cert method in Puppet::TestCa needed special logic for the Eliptical Curve class: ruby/openssl#29 This issue was resolved in OpenSSL 2.0, which was released in 2016, meaning that all versions of Ruby that Puppet supports includes Ruby/OpenSSL >= 2.0. This commit removes special logic for EC in Puppet::TestCa.
Previously, the build_cert method in Puppet::TestCa needed special logic for the Eliptical Curve class: ruby/openssl#29 This issue was resolved in OpenSSL 2.0, which was released in 2016, meaning that all versions of Ruby that Puppet supports includes Ruby/OpenSSL >= 2.0. This commit removes special logic for EC in Puppet::TestCa.
Previously, the build_cert method in Puppet::TestCa needed special logic for the Eliptical Curve class: ruby/openssl#29 This issue was resolved in OpenSSL 2.0, which was released in 2016, meaning that all versions of Ruby that Puppet supports includes Ruby/OpenSSL >= 2.0. This commit removes special logic for EC in Puppet::TestCa.
ECC keys are weird in ruby, cf. ruby/openssl#29
ECC keys are weird in ruby, cf. ruby/openssl#29
There are four classes under OpenSSL::PKey: RSA, DSA, DH, and EC. Three of the four share a common API. EC is the outlier. I am routinely monkey patching EC to support the common API. Without this, you cannot use EC keys to sign certs.
The missing methods:
::generate
private?
public?
public_key
params
Almost all of these can be filled via monkey patching, so the fix can be in lib/ or in the C extension.
The text was updated successfully, but these errors were encountered: