lordwelch/sshrimp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Account for invalid RSA key type from google kms and validate signature

Browse Source
This commit is contained in:
lordwelch 2020-08-07 14:45:12 -07:00
parent 6a43060cce
commit 72834083a2
1 changed files with 21 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
internal/signer/gcp.go
View File

@ -3,6 +3,7 @@ package signer
import ( import (
"context" "context"
"crypto" "crypto"
"crypto/rsa"
"crypto/x509" "crypto/x509"
"encoding/pem" "encoding/pem"
"fmt" "fmt"
@ -12,7 +13,7 @@ import (
kmspb "google.golang.org/genproto/googleapis/cloud/kms/v1" kmspb "google.golang.org/genproto/googleapis/cloud/kms/v1"
) )
// KMSSigner a GCP asymetric crypto signer // GCPSigner a GCP asymetric crypto signer
type GCPSigner struct { type GCPSigner struct {
crypto.Signer crypto.Signer
ctx context.Context ctx context.Context
@ -37,12 +38,21 @@ func NewGCPSSigner(key string) *GCPSigner {
// Public returns the public key from KMS // Public returns the public key from KMS
func (s *GCPSigner) Public() crypto.PublicKey { func (s *GCPSigner) Public() crypto.PublicKey {
response, err := s.client.GetPublicKey(s.ctx, &kmspb.GetPublicKeyRequest{ response, err := s.client.GetPublicKey(s.ctx, &kmspb.GetPublicKeyRequest{
Name: s.key, Name: s.key,
}) })
if err != nil { if err != nil {
fmt.Printf(err.Error()) fmt.Println(err.Error())
return nil
}
switch response.GetAlgorithm() {
case kmspb.CryptoKeyVersion_RSA_SIGN_PKCS1_2048_SHA256,
kmspb.CryptoKeyVersion_RSA_SIGN_PKCS1_3072_SHA256,
kmspb.CryptoKeyVersion_RSA_SIGN_PKCS1_4096_SHA256,
kmspb.CryptoKeyVersion_RSA_SIGN_PKCS1_4096_SHA512:
// awesome
default:
fmt.Println("crypto key has the wrong algorithm, must be rsa with PKCS1 padding")
return nil return nil
} }
@ -84,6 +94,12 @@ func (s *GCPSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts)
if err != nil { if err != nil {
return nil, err return nil, err
} }
sig := response.GetSignature()
return response.GetSignature(), nil pubKey := s.Public()
rKey := pubKey.(*rsa.PublicKey)
err = rsa.VerifyPKCS1v15(rKey, crypto.SHA256, digest, sig)
if err != nil {
return nil, err
}
return sig, nil
} }