From f54b82bcc25fe4971d7abb26746b08f796435e97 Mon Sep 17 00:00:00 2001 From: Victor Lyuboslavsky Date: Thu, 19 Jun 2025 12:44:10 -0500 Subject: [PATCH 1/3] Add support for TPM-backed custom signer. --- signatures.go | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/signatures.go b/signatures.go index 8043e58..fe0fcac 100644 --- a/signatures.go +++ b/signatures.go @@ -97,8 +97,9 @@ func sign(hrr httpMessage, sp sigParameters) error { return fmt.Errorf("Invalid private key. Requires *ecdsa.PrivateKey") } case Algo_ECDSA_P384_SHA384: - if eccpk, ok := sp.PrivateKey.(*ecdsa.PrivateKey); ok { - msgHash := sha512.Sum384(base.base) + msgHash := sha512.Sum384(base.base) + switch eccpk := sp.PrivateKey.(type) { + case *ecdsa.PrivateKey: r, s, err := ecdsa.Sign(rand.Reader, eccpk, msgHash[:]) if err != nil { return newError(ErrInternal, "Failed to sign with ecdsa private key", err) @@ -107,8 +108,13 @@ func sign(hrr httpMessage, sp sigParameters) error { sigBytes = make([]byte, 96) r.FillBytes(sigBytes[0:48]) s.FillBytes(sigBytes[48:96]) - } else { - return fmt.Errorf("Invalid private key. Requires *ecdsa.PrivateKey") + case crypto.Signer: + sigBytes, err = eccpk.Sign(rand.Reader, msgHash[:], crypto.SHA384) + if err != nil { + return newError(ErrInternal, "Failed to sign with ecdsa custom signer", err) + } + default: + return fmt.Errorf("Invalid private key. Requires *ecdsa.PrivateKey or crypto.Signer") } case Algo_ED25519: if edpk, ok := sp.PrivateKey.(ed25519.PrivateKey); ok { From 4b8303547620633df3a32d3b7c2f8fa98d7a0293 Mon Sep 17 00:00:00 2001 From: Victor Lyuboslavsky Date: Thu, 19 Jun 2025 17:02:23 -0500 Subject: [PATCH 2/3] Add debug --- signatures.go | 1 + 1 file changed, 1 insertion(+) diff --git a/signatures.go b/signatures.go index fe0fcac..236cfed 100644 --- a/signatures.go +++ b/signatures.go @@ -97,6 +97,7 @@ func sign(hrr httpMessage, sp sigParameters) error { return fmt.Errorf("Invalid private key. Requires *ecdsa.PrivateKey") } case Algo_ECDSA_P384_SHA384: + fmt.Printf("We are hashing:%s\n", string(base.base)) msgHash := sha512.Sum384(base.base) switch eccpk := sp.PrivateKey.(type) { case *ecdsa.PrivateKey: From d07b43cd899d55dd8db52f6b814d91c276405a65 Mon Sep 17 00:00:00 2001 From: Victor Lyuboslavsky Date: Thu, 19 Jun 2025 17:47:26 -0500 Subject: [PATCH 3/3] Updating other signatures. --- signatures.go | 65 ++++++++++++++++++++++++++++++++++----------------- 1 file changed, 44 insertions(+), 21 deletions(-) diff --git a/signatures.go b/signatures.go index 236cfed..940f4f0 100644 --- a/signatures.go +++ b/signatures.go @@ -59,32 +59,45 @@ func sign(hrr httpMessage, sp sigParameters) error { switch sp.Algo { case Algo_RSA_PSS_SHA512: - if rsapk, ok := sp.PrivateKey.(*rsa.PrivateKey); ok { - msgHash := sha512.Sum512(base.base) - opts := &rsa.PSSOptions{ - SaltLength: 64, - Hash: crypto.SHA512, - } + msgHash := sha512.Sum512(base.base) + opts := &rsa.PSSOptions{ + SaltLength: 64, + Hash: crypto.SHA512, + } + switch rsapk := sp.PrivateKey.(type) { + case *rsa.PrivateKey: sigBytes, err = rsa.SignPSS(rand.Reader, rsapk, crypto.SHA512, msgHash[:], opts) if err != nil { return err } - } else { - return fmt.Errorf("Invalid private key. Requires rsa.PrivateKey: %T", sp.PrivateKey) + case crypto.Signer: + sigBytes, err = rsapk.Sign(rand.Reader, msgHash[:], crypto.SHA512) + if err != nil { + return err + } + default: + return fmt.Errorf("Invalid private key. Requires *rsa.PrivateKey or crypto.Signer: %T", sp.PrivateKey) } case Algo_RSA_v1_5_sha256: - if rsapk, ok := sp.PrivateKey.(*rsa.PrivateKey); ok { - msgHash := sha256.Sum256(base.base) + msgHash := sha256.Sum256(base.base) + switch rsapk := sp.PrivateKey.(type) { + case *rsa.PrivateKey: sigBytes, err = rsa.SignPKCS1v15(rand.Reader, rsapk, crypto.SHA256, msgHash[:]) if err != nil { return err } - } else { - return fmt.Errorf("Invalid private key. Requires rsa.PrivateKey: %T", sp.PrivateKey) + case crypto.Signer: + sigBytes, err = rsapk.Sign(rand.Reader, msgHash[:], crypto.SHA256) + if err != nil { + return err + } + default: + return fmt.Errorf("Invalid private key. Requires *rsa.PrivateKey or crypto.Signer: %T", sp.PrivateKey) } case Algo_ECDSA_P256_SHA256: - if eccpk, ok := sp.PrivateKey.(*ecdsa.PrivateKey); ok { - msgHash := sha256.Sum256(base.base) + msgHash := sha256.Sum256(base.base) + switch eccpk := sp.PrivateKey.(type) { + case *ecdsa.PrivateKey: r, s, err := ecdsa.Sign(rand.Reader, eccpk, msgHash[:]) if err != nil { return newError(ErrInternal, "Failed to sign with ecdsa private key", err) @@ -93,11 +106,15 @@ func sign(hrr httpMessage, sp sigParameters) error { sigBytes = make([]byte, 64) r.FillBytes(sigBytes[0:32]) s.FillBytes(sigBytes[32:64]) - } else { - return fmt.Errorf("Invalid private key. Requires *ecdsa.PrivateKey") + case crypto.Signer: + sigBytes, err = eccpk.Sign(rand.Reader, msgHash[:], crypto.SHA256) + if err != nil { + return newError(ErrInternal, "Failed to sign with ecdsa custom signer", err) + } + default: + return fmt.Errorf("Invalid private key. Requires *ecdsa.PrivateKey or crypto.Signer: %T", sp.PrivateKey) } case Algo_ECDSA_P384_SHA384: - fmt.Printf("We are hashing:%s\n", string(base.base)) msgHash := sha512.Sum384(base.base) switch eccpk := sp.PrivateKey.(type) { case *ecdsa.PrivateKey: @@ -115,13 +132,19 @@ func sign(hrr httpMessage, sp sigParameters) error { return newError(ErrInternal, "Failed to sign with ecdsa custom signer", err) } default: - return fmt.Errorf("Invalid private key. Requires *ecdsa.PrivateKey or crypto.Signer") + return fmt.Errorf("Invalid private key. Requires *ecdsa.PrivateKey or crypto.Signer: %T", sp.PrivateKey) } case Algo_ED25519: - if edpk, ok := sp.PrivateKey.(ed25519.PrivateKey); ok { + switch edpk := sp.PrivateKey.(type) { + case ed25519.PrivateKey: sigBytes = ed25519.Sign(edpk, base.base) - } else { - return fmt.Errorf("Invalid private key. Requires ed25519.PrivateKey") + case crypto.Signer: + sigBytes, err = edpk.Sign(rand.Reader, base.base, crypto.Hash(0)) + if err != nil { + return newError(ErrInternal, "Failed to sign with ed25519 custom signer", err) + } + default: + return fmt.Errorf("Invalid private key. Requires ed25519.PrivateKey or crypto.Signer: %T", sp.PrivateKey) } case Algo_HMAC_SHA256: if len(sp.Secret) == 0 {