Filippo Valsorda
fcc990c556
RFC 8332, Section 2 sets up two overlapping namespaces: public key formats and public key algorithms. * The formats are what we currently have KeyAlgo constants for, and they appear in PublicKey.Type. * The algorithms are the set of both KeyAlgo and SigAlgo constants, and they appear in Signature.Format (amongst other places). This is incoherent, because that means Signature.Format can be both a KeyAlgo (like KeyAlgoECDSA256) or a SigAlgo (like SigAlgoRSASHA2256). One solution would be to duplicate all the KeyAlgo constants into the SigAlgo namespace, but that would be confusing because applications are currently using KeyAlgos where they'd be supposed to use the new SigAlgos (while we can't deprecate the KeyAlgos because they are still necessary for the PublicKey.Type namespace). Instead, drop the separate namespaces, and use KeyAlgos throughout. There are simply some KeyAlgos that can't be a PublicKey.Type. Take the opportunity to fix the stuttering SHA22565/SHA2512 names. It's totally ok to call those hashes SHA-256 and SHA-512 without the family infix. For golang/go#49952 Change-Id: Ia1fce3912a7e60aa70a88f75ed311be331fd19d5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392354 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
72 lines
2.3 KiB
Go
72 lines
2.3 KiB
Go
// Copyright 2014 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
// IMPLEMENTATION NOTE: To avoid a package loop, this file is in three places:
|
|
// ssh/, ssh/agent, and ssh/test/. It should be kept in sync across all three
|
|
// instances.
|
|
|
|
package ssh
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"fmt"
|
|
|
|
"golang.org/x/crypto/ssh/testdata"
|
|
)
|
|
|
|
var (
|
|
testPrivateKeys map[string]interface{}
|
|
testSigners map[string]Signer
|
|
testPublicKeys map[string]PublicKey
|
|
)
|
|
|
|
func init() {
|
|
var err error
|
|
|
|
n := len(testdata.PEMBytes)
|
|
testPrivateKeys = make(map[string]interface{}, n)
|
|
testSigners = make(map[string]Signer, n)
|
|
testPublicKeys = make(map[string]PublicKey, n)
|
|
for t, k := range testdata.PEMBytes {
|
|
testPrivateKeys[t], err = ParseRawPrivateKey(k)
|
|
if err != nil {
|
|
panic(fmt.Sprintf("Unable to parse test key %s: %v", t, err))
|
|
}
|
|
testSigners[t], err = NewSignerFromKey(testPrivateKeys[t])
|
|
if v, ok := testSigners[t].(*rsaSigner); ok {
|
|
switch t {
|
|
case "rsa-sha2-256":
|
|
testSigners[t] = &rsaSigner{v, KeyAlgoRSASHA256}
|
|
case "rsa-sha2-512":
|
|
testSigners[t] = &rsaSigner{v, KeyAlgoRSASHA512}
|
|
}
|
|
}
|
|
if err != nil {
|
|
panic(fmt.Sprintf("Unable to create signer for test key %s: %v", t, err))
|
|
}
|
|
testPublicKeys[t] = testSigners[t].PublicKey()
|
|
}
|
|
|
|
// Create a cert and sign it for use in tests.
|
|
testCert := &Certificate{
|
|
Nonce: []byte{}, // To pass reflect.DeepEqual after marshal & parse, this must be non-nil
|
|
ValidPrincipals: []string{"gopher1", "gopher2"}, // increases test coverage
|
|
ValidAfter: 0, // unix epoch
|
|
ValidBefore: CertTimeInfinity, // The end of currently representable time.
|
|
Reserved: []byte{}, // To pass reflect.DeepEqual after marshal & parse, this must be non-nil
|
|
Key: testPublicKeys["ecdsa"],
|
|
SignatureKey: testPublicKeys["rsa"],
|
|
Permissions: Permissions{
|
|
CriticalOptions: map[string]string{},
|
|
Extensions: map[string]string{},
|
|
},
|
|
}
|
|
testCert.SignCert(rand.Reader, testSigners["rsa"])
|
|
testPrivateKeys["cert"] = testPrivateKeys["ecdsa"]
|
|
testSigners["cert"], err = NewCertSigner(testCert, testSigners["ecdsa"])
|
|
if err != nil {
|
|
panic(fmt.Sprintf("Unable to create certificate signer: %v", err))
|
|
}
|
|
}
|