Skip to content

Commit 934f4df

Browse files
divarveldivarvel
committed
use prefixed versions for public & private key string representations
Public and Private keys are now using the following string format everywhere: `{algorithm}/{bytes}` `--key-algorithm` is now used when reading binary input, or to assert an algorithm when reading a key from a string.
1 parent a25ad9a commit 934f4df

File tree

4 files changed

+88
-47
lines changed

4 files changed

+88
-47
lines changed

‎src/cli.rs‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,11 @@ pub struct KeyPairCmd {
3636
#[clap(long, parse(from_os_str))]
3737
pub from_private_key_file: Option<PathBuf>,
3838
/// Read the private key raw bytes directly, with no hex decoding
39-
#[clap(long, requires("from-private-key-file"))]
39+
#[clap(
40+
long,
41+
requires("from-private-key-file"),
42+
conflicts_with("from-private-key")
43+
)]
4044
pub from_raw_private_key: bool,
4145
/// Only output the public part of the key pair
4246
#[clap(long, conflicts_with("only-private-key"))]
@@ -51,8 +55,8 @@ pub struct KeyPairCmd {
5155
#[clap(long, requires("only-private-key"))]
5256
pub raw_private_key_output: bool,
5357
/// Key algorithm: ed25519 (default) or secp256r1
54-
#[clap(long, default_value_t)]
55-
pub key_algorithm: Algorithm,
58+
#[clap(long)]
59+
pub key_algorithm: Option<Algorithm>,
5660
}
5761

5862
/// Generate a biscuit from a private key and an authority block
@@ -84,8 +88,8 @@ pub struct Generate {
8488
#[clap(long, conflicts_with = "private-key", requires = "private-key-file")]
8589
pub raw_private_key: bool,
8690
/// Key algorithm: ed25519 (default) or secp256r1
87-
#[clap(long, default_value_t)]
88-
pub key_algorithm: Algorithm,
91+
#[clap(long)]
92+
pub key_algorithm: Option<Algorithm>,
8993
/// The optional context string attached to the authority block
9094
#[clap(long)]
9195
pub context: Option<String>,
@@ -150,8 +154,8 @@ pub struct Inspect {
150154
#[clap(long, requires("public-key-file"), conflicts_with("public-key"))]
151155
pub raw_public_key: bool,
152156
/// Key algorithm: ed25519 (default) or secp256r1
153-
#[clap(long, default_value_t)]
154-
pub key_algorithm: Algorithm,
157+
#[clap(long)]
158+
pub key_algorithm: Option<Algorithm>,
155159
#[clap(flatten)]
156160
pub run_limits_args: common_args::RunLimitArgs,
157161
#[clap(flatten)]
@@ -228,8 +232,8 @@ pub struct GenerateThirdPartyBlock {
228232
#[clap(long, conflicts_with = "private-key", requires = "private-key-file")]
229233
pub raw_private_key: bool,
230234
/// Key algorithm: ed25519 (default) or secp256r1
231-
#[clap(long, default_value_t)]
232-
pub key_algorithm: Algorithm,
235+
#[clap(long)]
236+
pub key_algorithm: Option<Algorithm>,
233237
/// Output the block raw bytes directly, with no base64 encoding
234238
#[clap(long)]
235239
pub raw_output: bool,

‎src/input.rs‎

Lines changed: 66 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -270,44 +270,84 @@ fn read_authorizer_from_snapshot(
270270
Ok(builder)
271271
}
272272

273-
pub fn read_private_key_from(from: &KeyBytes, alg: Algorithm) -> Result<PrivateKey> {
274-
let bytes = match from {
275-
KeyBytes::FromStdin(KeyFormat::RawBytes) => read_stdin_bytes()?,
273+
pub fn read_private_key_from(from: &KeyBytes, alg: &Option<Algorithm>) -> Result<PrivateKey> {
274+
let key = match from {
275+
KeyBytes::FromStdin(KeyFormat::RawBytes) => {
276+
let bytes = read_stdin_bytes()?;
277+
PrivateKey::from_bytes(&bytes, alg.unwrap_or_default())
278+
.map_err(|e| ParseError("private key".to_string(), format!("{}", &e)))?
279+
}
276280
KeyBytes::FromStdin(KeyFormat::HexKey) => {
277-
hex::decode(read_stdin_string("hex-encoded private key")?)?
281+
let str = read_stdin_string("hex-encoded private key")?;
282+
str.parse()
283+
.map_err(|e| ParseError("private key".to_string(), format!("{}", &e)))?
278284
}
279285
KeyBytes::FromFile(KeyFormat::RawBytes, path) => {
280-
fs::read(path).map_err(|_| FileNotFound(path.clone()))?
286+
let bytes = fs::read(path).map_err(|_| FileNotFound(path.clone()))?;
287+
PrivateKey::from_bytes(&bytes, alg.unwrap_or_default())
288+
.map_err(|e| ParseError("private key".to_string(), format!("{}", &e)))?
281289
}
282-
KeyBytes::FromFile(KeyFormat::HexKey, path) => hex::decode(
283-
fs::read_to_string(path)
284-
.map_err(|_| FileNotFound(path.clone()))?
285-
.trim(),
286-
)?,
287-
KeyBytes::HexString(str) => hex::decode(str)?,
290+
KeyBytes::FromFile(KeyFormat::HexKey, path) => {
291+
let str = fs::read_to_string(path).map_err(|_| FileNotFound(path.clone()))?;
292+
str.parse()
293+
.map_err(|e| ParseError("private key".to_string(), format!("{}", &e)))?
294+
}
295+
KeyBytes::HexString(str) => str
296+
.parse()
297+
.map_err(|e| ParseError("private key".to_string(), format!("{}", &e)))?,
288298
};
289-
PrivateKey::from_bytes(&bytes, alg)
290-
.map_err(|e| ParseError("private key".to_string(), format!("{}", &e)).into())
299+
let key_alg = key.algorithm().into();
300+
301+
if let Some(a) = alg {
302+
if *a != key_alg {
303+
Err(std::io::Error::other(format!(
304+
"Inconsistent algorithm: key algorithm is {}, expected algorithm is {}",
305+
key_alg, a
306+
)))?
307+
}
308+
}
309+
310+
Ok(key)
291311
}
292312

293-
pub fn read_public_key_from(from: &KeyBytes, alg: Algorithm) -> Result<PublicKey> {
294-
let bytes = match from {
295-
KeyBytes::FromStdin(KeyFormat::RawBytes) => read_stdin_bytes()?,
313+
pub fn read_public_key_from(from: &KeyBytes, alg: &Option<Algorithm>) -> Result<PublicKey> {
314+
let key = match from {
315+
KeyBytes::FromStdin(KeyFormat::RawBytes) => {
316+
let bytes = read_stdin_bytes()?;
317+
PublicKey::from_bytes(&bytes, alg.unwrap_or_default())
318+
.map_err(|e| ParseError("public key".to_string(), format!("{}", &e)))?
319+
}
296320
KeyBytes::FromStdin(KeyFormat::HexKey) => {
297-
hex::decode(read_stdin_string("hex-encoded public key")?)?
321+
let str = read_stdin_string("hex-encoded public key")?;
322+
str.parse()
323+
.map_err(|e| ParseError("public key".to_string(), format!("{}", &e)))?
298324
}
299325
KeyBytes::FromFile(KeyFormat::RawBytes, path) => {
300-
fs::read(path).map_err(|_| FileNotFound(path.clone()))?
326+
let bytes = fs::read(path).map_err(|_| FileNotFound(path.clone()))?;
327+
PublicKey::from_bytes(&bytes, alg.unwrap_or_default())
328+
.map_err(|e| ParseError("public key".to_string(), format!("{}", &e)))?
301329
}
302-
KeyBytes::FromFile(KeyFormat::HexKey, path) => hex::decode(
303-
fs::read_to_string(path)
304-
.map_err(|_| FileNotFound(path.clone()))?
305-
.trim(),
306-
)?,
307-
KeyBytes::HexString(str) => hex::decode(str)?,
330+
KeyBytes::FromFile(KeyFormat::HexKey, path) => {
331+
let str = fs::read_to_string(path).map_err(|_| FileNotFound(path.clone()))?;
332+
str.parse()
333+
.map_err(|e| ParseError("public key".to_string(), format!("{}", &e)))?
334+
}
335+
KeyBytes::HexString(str) => str
336+
.parse()
337+
.map_err(|e| ParseError("public key".to_string(), format!("{}", &e)))?,
308338
};
309-
PublicKey::from_bytes(&bytes, alg)
310-
.map_err(|e| ParseError("public key".to_string(), format!("{}", &e)).into())
339+
let key_alg = key.algorithm().into();
340+
341+
if let Some(a) = alg {
342+
if *a != key_alg {
343+
Err(std::io::Error::other(format!(
344+
"Inconsistent algorithm: key algorithm is {}, expected algorithm is {}",
345+
key_alg, a
346+
)))?
347+
}
348+
}
349+
350+
Ok(key)
311351
}
312352

313353
pub fn read_biscuit_from(from: &BiscuitBytes) -> Result<UnverifiedBiscuit> {

‎src/inspect.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -487,7 +487,7 @@ pub fn handle_inspect_inner(inspect: &Inspect) -> Result<InspectionResults> {
487487
let query_result;
488488

489489
if let Some(key_from) = public_key_from {
490-
let key = read_public_key_from(&key_from, inspect.key_algorithm)?;
490+
let key = read_public_key_from(&key_from, &inspect.key_algorithm)?;
491491
let sig_result = biscuit.verify(key);
492492
signatures_check = Some(sig_result.is_ok());
493493

‎src/main.rs‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -62,15 +62,15 @@ fn handle_keypair(key_pair_cmd: &KeyPairCmd) -> Result<()> {
6262
};
6363

6464
let private_key: Option<PrivateKey> = if let Some(f) = private_key_from {
65-
Some(read_private_key_from(f, key_pair_cmd.key_algorithm)?)
65+
Some(read_private_key_from(f, &key_pair_cmd.key_algorithm)?)
6666
} else {
6767
None
6868
};
6969

7070
let key_pair = if let Some(private) = private_key {
7171
KeyPair::from(&private)
7272
} else {
73-
KeyPair::new_with_algorithm(key_pair_cmd.key_algorithm)
73+
KeyPair::new_with_algorithm(key_pair_cmd.key_algorithm.unwrap_or_default())
7474
};
7575

7676
match (
@@ -85,23 +85,20 @@ fn handle_keypair(key_pair_cmd: &KeyPairCmd) -> Result<()> {
8585
} else {
8686
println!("Generating a new random keypair");
8787
}
88-
println!(
89-
"Private key: {}",
90-
hex::encode(key_pair.private().to_bytes())
91-
);
92-
println!("Public key: {}", hex::encode(key_pair.public().to_bytes()));
88+
println!("Private key: {}", key_pair.private().to_prefixed_string());
89+
println!("Public key: {}", key_pair.public());
9390
}
9491
(true, true, false, false) => {
9592
let _ = io::stdout().write_all(&key_pair.private().to_bytes());
9693
}
9794
(true, false, false, false) => {
98-
println!("{}", hex::encode(key_pair.private().to_bytes()));
95+
println!("{}", key_pair.private().to_prefixed_string());
9996
}
10097
(false, false, true, true) => {
10198
let _ = io::stdout().write_all(&key_pair.public().to_bytes());
10299
}
103100
(false, false, true, false) => {
104-
println!("{}", hex::encode(key_pair.public().to_bytes()));
101+
println!("{}", key_pair.public());
105102
}
106103
// the other combinations are prevented by clap
107104
_ => unreachable!(),
@@ -128,7 +125,7 @@ fn handle_generate(generate: &Generate) -> Result<()> {
128125
// the other combinations are prevented by clap
129126
_ => unreachable!(),
130127
},
131-
generate.key_algorithm,
128+
&generate.key_algorithm,
132129
);
133130

134131
let root = KeyPair::from(&private_key?);
@@ -284,7 +281,7 @@ fn handle_generate_third_party_block(
284281
// the other combinations are prevented by clap
285282
_ => unreachable!(),
286283
},
287-
generate_third_party_block.key_algorithm,
284+
&generate_third_party_block.key_algorithm,
288285
);
289286

290287
let request = read_request_from(&request_from)?;

0 commit comments

Comments
 (0)