Skip to content

Commit fd65d17

Browse files
DennisDyalloDennisDyallo
committed
Revert "wip: Add support for Ed25519 in PIV sample code"
This reverts commit 87a29b0
1 parent 85a8319 commit fd65d17

File tree

7 files changed

+16
-149
lines changed

7 files changed

+16
-149
lines changed

‎Yubico.YubiKey/examples/PivSampleCode/Converters/KeyConverter.Pem.cs

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,6 @@ public static PivPrivateKey GetPivPrivateKeyFromPem(char[] pemKeyString)
8181
// of the ECDsa object.
8282
public static AsymmetricAlgorithm GetDotNetFromPem(char[] pemKeyString, bool isPrivate)
8383
{
84-
8584
byte[] encodedKey = Array.Empty<byte>();
8685
var rsaParams = new RSAParameters();
8786
var eccParams = new ECParameters();

‎Yubico.YubiKey/examples/PivSampleCode/DotNetOperations/PublicKeyOperations.cs

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,6 @@
1414

1515
using System;
1616
using System.Security.Cryptography;
17-
using Org.BouncyCastle.Crypto.Parameters;
18-
using Org.BouncyCastle.Crypto.Signers;
1917
using Yubico.YubiKey.Piv;
2018

2119
namespace Yubico.YubiKey.Sample.PivSampleCode
@@ -50,24 +48,6 @@ public static bool SampleVerifySignature(
5048
throw new ArgumentNullException(nameof(publicKey));
5149
}
5250

53-
if (publicKey.Algorithm is PivAlgorithm.EccEd25519)
54-
{
55-
// Create Ed25519 public key parameters
56-
var withoutPivHeader = publicKey.YubiKeyEncodedPublicKey.Span[2..];
57-
var ed25519key = new Ed25519PublicKeyParameters(withoutPivHeader);
58-
59-
// Verify the signature
60-
var verifier = new Ed25519Signer();
61-
verifier.Init(false, ed25519key); // false indicates verification mode
62-
verifier.BlockUpdate(dataToVerify, 0, dataToVerify.Length);
63-
64-
bool isValid = verifier.VerifySignature(signature);
65-
66-
Console.WriteLine($"Signature (Base64): {Convert.ToBase64String(signature)}");
67-
isVerified = isValid;
68-
return isVerified;
69-
}
70-
7151
using var asymObject = KeyConverter.GetDotNetFromPivPublicKey(publicKey);
7252

7353
// The algorithm is either RSA or ECC, otherwise the KeyConverter

‎Yubico.YubiKey/examples/PivSampleCode/KeyCollector/SampleKeyCollector.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@ public static byte[] CollectValue(string defaultValueString, string name)
168168
SampleMenu.WriteMessage(MessageType.Title, 0, "Enter D for default value (" + defaultValueString + ")");
169169
char[] collectedValue = SampleMenu.ReadResponse(out int _);
170170

171-
if (collectedValue.Length == 1 && (collectedValue[0] == 'D' || collectedValue[0] == 'd'))
171+
if (collectedValue.Length == 1 && collectedValue[0] == 'D')
172172
{
173173
return defaultValueString switch
174174
{

‎Yubico.YubiKey/examples/PivSampleCode/PivSampleCode.csproj

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,4 @@ limitations under the License. -->
3030
<ProjectReference Include="..\SharedSampleCode\SharedSampleCode.csproj" />
3131
</ItemGroup>
3232

33-
<ItemGroup>
34-
<PackageReference Include="BouncyCastle.Cryptography" Version="2.5.1" />
35-
</ItemGroup>
36-
3733
</Project>

‎Yubico.YubiKey/examples/PivSampleCode/Run/PivSampleRun.Operations.cs

Lines changed: 8 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
using System.Linq;
1717
using System.Security.Cryptography;
1818
using System.Security.Cryptography.X509Certificates;
19-
using Yubico.YubiKey.Cryptography;
2019
using Yubico.YubiKey.Piv;
2120
using Yubico.YubiKey.Sample.SharedCode;
2221

@@ -249,32 +248,19 @@ public bool RunImportPrivateKey()
249248
return RunInvalidEntry();
250249
}
251250

252-
if (!GetPemPrivateKey(algorithm, out string pemPrivateKey))
253-
{
254-
return false;
255-
}
256-
257-
if (!GetPemPublicKey(algorithm, out string pemPublicKey))
251+
if (!GetPemPrivateKey(algorithm, out string pemKey))
258252
{
259253
return false;
260254
}
261255

262-
// var pivPrivateKey = KeyConverter.GetPivPrivateKeyFromPem(pemKey.ToCharArray());
263-
// var pivPublicKey = KeyConverter.GetPivPublicKeyFromPem(pemKey.ToCharArray());
264-
265-
var base64PrivateKey = GetBytesFromPem(pemPrivateKey);
266-
var privateKeyParameters = Curve25519PrivateKeyParameters.CreateFromPkcs8(base64PrivateKey);
267-
268-
var base64PublicKey = GetBytesFromPem(pemPublicKey);
269-
var publicKeyParameters = Curve25519PublicKeyParameters.CreateFromPkcs8(base64PublicKey);
256+
var pivPrivateKey = KeyConverter.GetPivPrivateKeyFromPem(pemKey.ToCharArray());
257+
var pivPublicKey = KeyConverter.GetPivPublicKeyFromPem(pemKey.ToCharArray());
270258

271259
if (KeyPairs.RunImportPrivateKey(
272260
_yubiKeyChosen,
273261
_keyCollector.SampleKeyCollectorDelegate,
274-
privateKeyParameters,
275-
publicKeyParameters,
276-
// pivPrivateKey,
277-
// pivPublicKey,
262+
pivPrivateKey,
263+
pivPublicKey,
278264
slotNumber,
279265
pinPolicy,
280266
touchPolicy,
@@ -287,7 +273,7 @@ public bool RunImportPrivateKey()
287273

288274
return false;
289275
}
290-
276+
291277
public static bool WriteImportCertMessage()
292278
{
293279
SampleMenu.WriteMessage(MessageType.Title, 0, "See the items/code for BuildSelfSignedCert and BuildCert");
@@ -317,19 +303,10 @@ public bool RunSignData()
317303
// This sample code will use SHA-384 for EccP384, and SHA-256
318304
// for all other algorithms.
319305
var hashAlgorithm = HashAlgorithmName.SHA384;
320-
321-
if (signSlotContents.Algorithm == PivAlgorithm.EccEd25519)
306+
if (signSlotContents.Algorithm != PivAlgorithm.EccP384)
322307
{
323-
hashAlgorithm = HashAlgorithmName.SHA512;
308+
hashAlgorithm = HashAlgorithmName.SHA256;
324309
}
325-
else
326-
{
327-
if (signSlotContents.Algorithm != PivAlgorithm.EccP384)
328-
{
329-
hashAlgorithm = HashAlgorithmName.SHA256;
330-
}
331-
}
332-
333310

334311
byte[] dataToSign = GetArbitraryDataToSign();
335312

@@ -937,90 +914,18 @@ private static bool GetPemPrivateKey(PivAlgorithm algorithm, out string pemKey)
937914
"3tD+iq9lgB+8QNDJP6C6KginR3H1jMNRPMvaNrQC/VBpse+1Z1t5pvo=\n" +
938915
"-----END PRIVATE KEY-----";
939916
break;
940-
941-
942-
case PivAlgorithm.EccEd25519:
943-
pemKey = "-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VwBCIEIDuLFRxirWSFqyiMTPB65M4sWI+smRcCdyMEL8RtN7ib\n-----END PRIVATE KEY-----";
944-
break;
945-
946-
case PivAlgorithm.EccX25519:
947-
pemKey =
948-
"-----BEGIN PRIVATE KEY-----\n" +
949-
"MC4CAQAwBQYDK2VuBCIEIGCCufpem+pMrhHcQwUvrUxh0KQ9zrNjuAVxM/E4d5hN\n" +
950-
"-----END PRIVATE KEY-----";
951-
break;
952917
}
953918

954919
return true;
955920
}
956921

957-
private static bool GetPemPublicKey(
958-
PivAlgorithm algorithm,
959-
out string pemKey)
960-
{
961-
pemKey = null;
962-
963-
switch (algorithm)
964-
{
965-
default:
966-
return false;
967-
968-
case PivAlgorithm.Rsa1024:
969-
case PivAlgorithm.Rsa2048:
970-
case PivAlgorithm.EccP256:
971-
case PivAlgorithm.EccP384:
972-
break;
973-
974-
case PivAlgorithm.EccEd25519:
975-
pemKey ="-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAvvmMviNf0LdUmfr5dVNZQaC79t3Ga7xTaD62d+icCtE=\n-----END PUBLIC KEY-----";
976-
break;
977-
978-
case PivAlgorithm.EccX25519:
979-
pemKey =
980-
"-----BEGIN PUBLIC KEY-----\n" +
981-
"MCowBQYDK2VuAyEAyZ3Gl2lM1X9SVyAFjGi5skd28d9mQtJW1uf/zlrIhCU=\n" +
982-
"-----END PUBLIC KEY-----\n";
983-
break;
984-
}
985-
986-
return true;
987-
}
988922
private static byte[] GetArbitraryDataToSign()
989923
{
990924
string arbitraryData = "To demonstrate how to sign data we need data to sign. " +
991925
"For this sample code, it doesn't really matter what the data is, " +
992926
"so just return some arbitrary data.";
993-
994-
arbitraryData = "Hello, Ed25519!";
995-
996927

997928
return System.Text.Encoding.ASCII.GetBytes(arbitraryData);
998929
}
999-
1000-
private static byte[] GetBytesFromPem(
1001-
string pemData)
1002-
{
1003-
var base64 = StripPemHeaderFooter(pemData);
1004-
return Convert.FromBase64String(base64);
1005-
}
1006-
1007-
private static string StripPemHeaderFooter(
1008-
string pemData)
1009-
{
1010-
var base64 = pemData
1011-
.Replace("-----BEGIN PUBLIC KEY-----", "")
1012-
.Replace("-----END PUBLIC KEY-----", "")
1013-
.Replace("-----BEGIN PRIVATE KEY-----", "")
1014-
.Replace("-----END PRIVATE KEY-----", "")
1015-
.Replace("-----BEGIN EC PRIVATE KEY-----", "")
1016-
.Replace("-----END EC PRIVATE KEY-----", "")
1017-
.Replace("-----BEGIN CERTIFICATE-----", "")
1018-
.Replace("-----END CERTIFICATE-----", "")
1019-
.Replace("-----BEGIN CERTIFICATE REQUEST-----", "")
1020-
.Replace("-----END CERTIFICATE REQUEST-----", "")
1021-
.Replace("\n", "")
1022-
.Trim();
1023-
return base64;
1024-
}
1025930
}
1026931
}

‎Yubico.YubiKey/examples/PivSampleCode/YubiKeyOperations/KeyPairs.cs

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414

1515
using System;
1616
using System.Security.Cryptography.X509Certificates;
17-
using Yubico.YubiKey.Cryptography;
1817
using Yubico.YubiKey.Piv;
1918

2019
namespace Yubico.YubiKey.Sample.PivSampleCode
@@ -55,10 +54,8 @@ public static bool RunGenerateKeyPair(
5554
public static bool RunImportPrivateKey(
5655
IYubiKeyDevice yubiKey,
5756
Func<KeyEntryData, bool> KeyCollectorDelegate,
58-
// PivPrivateKey privateKey,
59-
// PivPublicKey publicKey,
60-
IPrivateKeyParameters privateKey,
61-
IPublicKeyParameters publicKey,
57+
PivPrivateKey privateKey,
58+
PivPublicKey publicKey,
6259
byte slotNumber,
6360
PivPinPolicy pinPolicy,
6461
PivTouchPolicy touchPolicy,
@@ -85,13 +82,13 @@ public static bool RunImportPrivateKey(
8582
// The Import method does not need the public key, so we're
8683
// building it with no public key. If you want, you can add the
8784
// public key.
88-
slotContents = new SamplePivSlotContents
85+
slotContents = new SamplePivSlotContents()
8986
{
9087
SlotNumber = slotNumber,
91-
Algorithm = privateKey.KeyType.GetPivAlgorithm(),
88+
Algorithm = privateKey.Algorithm,
9289
PinPolicy = pinPolicy,
9390
TouchPolicy = touchPolicy,
94-
PublicKey = PivPublicKey.Create(publicKey.ToPivEncodedPublicKey(), publicKey.KeyType.GetPivAlgorithm()),
91+
PublicKey = PivPublicKey.Create(publicKey.YubiKeyEncodedPublicKey),
9592
};
9693
}
9794

‎Yubico.YubiKey/examples/PivSampleCode/YubiKeyOperations/PrivateKeyOperations.cs

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -42,19 +42,9 @@ public static bool RunSignData(
4242
int keySizeBits = keyAlgorithm.KeySizeBits();
4343

4444
// Before signing the data, we need to digest it.
45-
byte[] digest = dataToSign;
46-
if (keyAlgorithm == PivAlgorithm.EccEd25519)
47-
{
48-
using (var pivSession = new PivSession(yubiKey))
49-
{
50-
pivSession.KeyCollector = KeyCollectorDelegate;
51-
signature = pivSession.Sign(slotNumber, digest);
52-
}
53-
54-
return true;
55-
}
45+
byte[] digest = MessageDigestOperations.ComputeMessageDigest(dataToSign, hashAlgorithm);
5646

57-
if (keyAlgorithm.IsEcc() && keyAlgorithm!= PivAlgorithm.EccEd25519)
47+
if (keyAlgorithm.IsEcc())
5848
{
5949
// If the key is ECC, the digested data must be exactly the key
6050
// size. For example, if the key is EccP384, then the digest

0 commit comments

Comments
 (0)