diff options
author | Ludovic Courtès <ludo@gnu.org> | 2014-03-19 21:40:10 +0100 |
---|---|---|
committer | Ludovic Courtès <ludo@gnu.org> | 2014-03-19 21:40:10 +0100 |
commit | 32a1eb802519179eab8ff687e73f26edab28922f (patch) | |
tree | 53ea24d789fffa2a4968a96dcf0313713834b33a /guix/pk-crypto.scm | |
parent | 0f4139e97eaaf590c81f71fb42dff3d47ce60de3 (diff) | |
download | gnu-guix-32a1eb802519179eab8ff687e73f26edab28922f.tar gnu-guix-32a1eb802519179eab8ff687e73f26edab28922f.tar.gz |
pk-crypto: Use RFC6979 when signing with an ECC or DSA key.
* guix/pk-crypto.scm (bytevector->hash-data): Add #:key-type parameter.
Use the 'pkcs1' flag when KEY-TYPE is 'rsa', and 'rfc6979' when
KEY-TYPE is 'ecc' or 'dsa'.
(key-type): New procedure.
* guix/scripts/authenticate.scm (read-hash-data): Add 'key-type'
parameter. Pass it to 'bytevector->hash-data'. Adjust caller
accordingly.
* tests/pk-crypto.scm (%ecc-key-pair): New variable.
("key-type"): New test.
("sign + verify"): Pass #:key-type to 'bytevector->hash-data'.
("sign + verify, Ed25519"): New test.
Diffstat (limited to 'guix/pk-crypto.scm')
-rw-r--r-- | guix/pk-crypto.scm | 27 |
1 files changed, 22 insertions, 5 deletions
diff --git a/guix/pk-crypto.scm b/guix/pk-crypto.scm index 50f709418c..b9ab02861c 100644 --- a/guix/pk-crypto.scm +++ b/guix/pk-crypto.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright © 2013 Ludovic Courtès <ludo@gnu.org> +;;; Copyright © 2013, 2014 Ludovic Courtès <ludo@gnu.org> ;;; ;;; This file is part of GNU Guix. ;;; @@ -39,6 +39,7 @@ canonical-sexp-list? bytevector->hash-data hash-data->bytevector + key-type sign verify generate-key @@ -232,15 +233,31 @@ Return #f if that element does not exist, or if it's a list." "Return an s-expression representing NUMBER." (string->canonical-sexp (string-append "#" (number->string number 16) "#"))) -(define* (bytevector->hash-data bv #:optional (hash-algo "sha256")) +(define* (bytevector->hash-data bv + #:optional + (hash-algo "sha256") + #:key (key-type 'ecc)) "Given BV, a bytevector containing a hash, return an s-expression suitable -for use as the data for 'sign'." +for use as the data for 'sign'. KEY-TYPE must be a symbol: 'dsa, 'ecc, or +'rsa." (string->canonical-sexp - (format #f "(data (flags pkcs1) (hash \"~a\" #~a#))" + (format #f "(data (flags ~a) (hash \"~a\" #~a#))" + (case key-type + ((ecc dsa) "rfc6979") + ((rsa) "pkcs1") + (else (error "unknown key type" key-type))) hash-algo (bytevector->base16-string bv)))) -(define (hash-data->bytevector data) +(define (key-type sexp) + "Return a symbol denoting the type of key representing by SEXP--e.g., 'rsa', +'ecc'--or #f if SEXP does not denote a valid key." + (case (canonical-sexp-nth-data sexp 0) + ((public-key private-key) + (canonical-sexp-nth-data (canonical-sexp-nth sexp 1) 0)) + (else #f))) + +(define* (hash-data->bytevector data) "Return two values: the hash value (a bytevector), and the hash algorithm (a string) extracted from DATA, an sexp as returned by 'bytevector->hash-data'. Return #f if DATA does not conform." |