Add support for more key types

client/register.go

@@ -3,6 +3,7 @@ package client
 import (
 	"bytes"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"net/url"
@@ -37,7 +38,11 @@ func RegisterKey(baseUrl *url.URL, key string, userId string) (string, error) {
 		return "", err
 	}
 
-	keyId := string(out[:])
+	bodyContent := string(out[:])
 
-	return keyId, nil
+	if resp.StatusCode >= 300 {
+		return "", fmt.Errorf("bad status: %d - %s", resp.StatusCode, bodyContent)
+	}
+
+	return bodyContent, nil
 }

ecdsa

@@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
+1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQQl8nqmx9kQiMeVUceyDaSx7UGOVNxJ
+2ZZehRHZxrnYEj3aYBw9FjFuMwDLsPYhe2b6Blz/+LsMlVxJNlCAazudAAAAqJWu9DKVrv
+QyAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCXyeqbH2RCIx5VR
+x7INpLHtQY5U3EnZll6FEdnGudgSPdpgHD0WMW4zAMuw9iF7ZvoGXP/4uwyVXEk2UIBrO5
+0AAAAgXFjJ/LBbKff2oeiOpzrnuhbXL2731pCneA5IrvJLChMAAAAMamFtaWVAYXRoZW5h
+AQIDBA==
+-----END OPENSSH PRIVATE KEY-----

ecdsa.pub

@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCXyeqbH2RCIx5VRx7INpLHtQY5U3EnZll6FEdnGudgSPdpgHD0WMW4zAMuw9iF7ZvoGXP/4uwyVXEk2UIBrO50= jamie@athena

keydirectory/in_memory_directory.go

@@ -28,7 +28,7 @@ func (dir inMemoryDirectory) GetKey(ctx context.Context, keyId string, _ string)
 	return entry.toAlg()
 }
 
-func (dir inMemoryDirectory) RegisterKey(key crypto.PublicKey, alg string, userId string) (string, error) {
+func (dir inMemoryDirectory) RegisterKey(key crypto.PublicKey, userId string) (string, error) {
 	keyId, err := generateKeyId()
 
 	if err != nil {
@@ -36,7 +36,6 @@ func (dir inMemoryDirectory) RegisterKey(key crypto.PublicKey, alg string, userI
 	}
 
 	dir.records[keyId] = keyEntry{
-		Alg:       alg,
 		PublicKey: key,
 		UserId:    userId,
 	}

keydirectory/keyentry.go

@@ -2,15 +2,19 @@ package keydirectory
 
 import (
 	"crypto"
+	"crypto/ecdsa"
 	"crypto/ed25519"
+	"crypto/rsa"
 	"fmt"
+	"reflect"
 
+	"github.com/common-fate/httpsig/alg_ecdsa"
 	"github.com/common-fate/httpsig/alg_ed25519"
+	"github.com/common-fate/httpsig/alg_rsa"
 	"github.com/common-fate/httpsig/verifier"
 )
 
 type keyEntry struct {
-	Alg       string
 	PublicKey crypto.PublicKey
 	UserId    string
 }
@@ -19,14 +23,24 @@ func (k keyEntry) toAlg() (verifier.Algorithm, error) {
 	var alg verifier.Algorithm
 	var err error
 
-	switch k.Alg {
-	case "ed25519":
+	switch k.PublicKey.(type) {
+	case ed25519.PublicKey:
 		alg = alg_ed25519.Ed25519{
 			PublicKey: k.PublicKey.(ed25519.PublicKey),
 			Attrs:     k.UserId,
 		}
+	case *rsa.PublicKey:
+		alg = alg_rsa.RSAPKCS256{
+			PublicKey: k.PublicKey.(*rsa.PublicKey),
+			Attrs:     k.UserId,
+		}
+	case *ecdsa.PublicKey:
+		alg = alg_ecdsa.P256{
+			PublicKey: k.PublicKey.(*ecdsa.PublicKey),
+			Attrs:     k.UserId,
+		}
 	default:
-		err = fmt.Errorf("unknown algoritm: %s", k.Alg)
+		err = fmt.Errorf("unknown key type: %s", reflect.TypeOf(k.PublicKey))
 	}
 
 	return alg, err

keydirectory/registration.go

@@ -8,5 +8,5 @@ import (
 
 type RegistrationDirectory interface {
 	verifier.KeyDirectory
-	RegisterKey(key crypto.PublicKey, alg string, userId string) (string, error)
+	RegisterKey(key crypto.PublicKey, userId string) (string, error)
 }

keydirectory/sqlite.go

@@ -3,9 +3,8 @@ package keydirectory
 import (
 	"context"
 	"crypto"
-	"crypto/ed25519"
+	"crypto/x509"
 	"database/sql"
-	"fmt"
 
 	"github.com/common-fate/httpsig/verifier"
 	_ "github.com/mattn/go-sqlite3"
@@ -40,7 +39,7 @@ func InitSqlite(dbPath string) (*dbWrapper, error) {
 func (dir *dbWrapper) GetKey(ctx context.Context, keyId string, _ string) (verifier.Algorithm, error) {
 	db := dir.db
 
-	query := "select userId, alg, publicKey from keys where keyId = ?"
+	query := "select userId, publicKey from keys where keyId = ?"
 
 	stmt, err := db.Prepare(query)
 
@@ -51,28 +50,23 @@ func (dir *dbWrapper) GetKey(ctx context.Context, keyId string, _ string) (verif
 	defer stmt.Close()
 
 	var userId string
-	var alg string
 	var keyBytes []byte
 
 	row := stmt.QueryRow(keyId)
 
-	err = row.Scan(&userId, &alg, &keyBytes)
+	err = row.Scan(&userId, &keyBytes)
 
 	if err != nil {
 		return nil, err
 	}
 
-	var publicKey crypto.PublicKey
+	publicKey, err := x509.ParsePKIXPublicKey(keyBytes)
 
-	switch alg {
-	case "ed25519":
-		publicKey = ed25519.PublicKey(keyBytes)
-	default:
-		return nil, fmt.Errorf("unknown algorithm: %s", alg)
+	if err != nil {
+		return nil, err
 	}
 
 	keyEntry := keyEntry{
-		Alg:       alg,
 		UserId:    userId,
 		PublicKey: publicKey,
 	}
@@ -80,7 +74,7 @@ func (dir *dbWrapper) GetKey(ctx context.Context, keyId string, _ string) (verif
 	return keyEntry.toAlg()
 }
 
-func (dir *dbWrapper) RegisterKey(key crypto.PublicKey, alg string, userId string) (string, error) {
+func (dir *dbWrapper) RegisterKey(key crypto.PublicKey, userId string) (string, error) {
 	db := dir.db
 
 	keyId, err := generateKeyId()
@@ -89,18 +83,15 @@ func (dir *dbWrapper) RegisterKey(key crypto.PublicKey, alg string, userId strin
 		return "", err
 	}
 
-	stmt := "insert into keys(keyId, userId, alg, publicKey) values (?, ?, ?, ?)"
+	stmt := "insert into keys(keyId, userId, publicKey) values (?, ?, ?)"
 
-	var keyBytes []byte
+	keyBytes, err := x509.MarshalPKIXPublicKey(key)
 
-	switch alg {
-	case "ed25519":
-		keyBytes = []byte(key.(ed25519.PublicKey))
-	default:
-		return "", fmt.Errorf("unknown algorithm: %s", alg)
+	if err != nil {
+		return "", err
 	}
 
-	_, err = db.Exec(stmt, keyId, userId, alg, keyBytes)
+	_, err = db.Exec(stmt, keyId, userId, keyBytes)
 
 	if err != nil {
 		return "", err

rsa

@@ -0,0 +1,38 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAYEAuuE3B3FyhjNnvkfDQEn7t6E97spa4tTNKDsGUWHtVk090I4v8wXu
+yM+fTiuU6ReSQEDGERUkyL/kS6yt7dL78GR5ApPB2LglcoKUTt34wwCaa7aapNHQ6Q5Gjy
+Fs16NCCAd7kJLpAf6ixpptkLzChCmSYWQ7fZgSafkcnXYhlAxT11drXGFNEopMbL2hLyxt
++C83hFiqKmBY6KyANXyiANjRcHq3Zcn/1NR0AfB5nfkdjjK6X5sNCShvlX91X4iV6BHfnQ
+QSJmV4DGdmasBD27dpZA5MkomL6lRu8RbDMB4zCbhy6AGEX1epN1CtNmPi0raV5ifHGHbF
+qY/BgolwQmYyZgvvtACzp2EEPEV1QMre//i+XIU3BhQUM9v8TtnvrXR1lII04nCdeaCwLb
+Uu1NHp4BdAJgmBHiPdMoWSB91K1JDfsK07Rtvrtvu20Va+9mPLcQZAFqYa0zv0Rc/ubT++
+2WScs+51tbpprBBY3zUeO9KMNc2m0FMmIlW8hyfJAAAFiCusRwcrrEcHAAAAB3NzaC1yc2
+EAAAGBALrhNwdxcoYzZ75Hw0BJ+7ehPe7KWuLUzSg7BlFh7VZNPdCOL/MF7sjPn04rlOkX
+kkBAxhEVJMi/5Eusre3S+/BkeQKTwdi4JXKClE7d+MMAmmu2mqTR0OkORo8hbNejQggHe5
+CS6QH+osaabZC8woQpkmFkO32YEmn5HJ12IZQMU9dXa1xhTRKKTGy9oS8sbfgvN4RYqipg
+WOisgDV8ogDY0XB6t2XJ/9TUdAHweZ35HY4yul+bDQkob5V/dV+IlegR350EEiZleAxnZm
+rAQ9u3aWQOTJKJi+pUbvEWwzAeMwm4cugBhF9XqTdQrTZj4tK2leYnxxh2xamPwYKJcEJm
+MmYL77QAs6dhBDxFdUDK3v/4vlyFNwYUFDPb/E7Z7610dZSCNOJwnXmgsC21LtTR6eAXQC
+YJgR4j3TKFkgfdStSQ37CtO0bb67b7ttFWvvZjy3EGQBamGtM79EXP7m0/vtlknLPudbW6
+aawQWN81HjvSjDXNptBTJiJVvIcnyQAAAAMBAAEAAAGACoshUSyv4u1siXpABFUIPBx/Q4
+UsKocKCh6GZToKq2dROP6EqwfnKHI6US05SgtX54MgCZ+xQxg8d56G85eHOlFY2HHgqmr9
+ReAjIO36Fnpmu/QB9pGV4Ug6Z+HhY6sk0xIlAQug1Ml6goz86IEV0mIMDa2bg6L8SvlQiX
+u8Oj+VzVzzxDMDJ6wg0rPCL8iobauwTKm59AkaiwoMc7gT5ctVyaxKw5XpdqcD4oYgPm7r
+IXYwOKulSSJ8ZSlbRGgOwGDPfTindH3rZ9r14P3XRCIaK9RtFSV4TowVwrlMW73fnCWe51
+T1xK5TEopue7k30viR/JTO0CUnxcHBeQy4xc1TT+ojNnSg/QbN77rLLVG/v7ezYRqDUFM2
+mEymtpNuS8uXh4TFwlUi89kROYLmRsarUvVChO1p2pRuUuVjSAz33Oqe68EmT32n44L0eC
+lV2owKy3a0CWg+VKERrDV6O17Qv5b9FPWKgWn8kY2mUvDJ49oyMzHl6aWAVoEctp9nAAAA
+wGmKkmMv2BavrJPH3u31PN8uAJFXGXPtS2PxhrXPYfNfT878zNCtHJ7jWaJ3758oVMxZKn
+gpM/i6sKKKyCWHgI7DRTSEKCYT8541iAcG46UZxx0YtvX7cNYsLgYiNv8KWIaIi2qGlvH3
+x2pxfQczdXYkMDwXn2O16TPpj5cKr8nxLL/qGSrKRvQIaN2v5d0yiQkIrT8pJnnSZ0H98F
+j5ZCkL4624lg3qtilihoE68bUXUo3IPrEL/yHA5CLItKofCwAAAMEA5xEmu0Te3kXoLk3o
+wi/oMNcAcl3PFH3s2xWqhySWzBQ0jx+V9vPZPmEJNsnY/wAcA2f0uQr7i8Fi5gGFQXZYm3
+P7mnMtrNpA7DJM8UzR7FDwx8JENF24fY2dVkdT26BPNLAhNooc53251AO88iS8RAiWNrlG
+TWZTyM/TWXZHbW+5Fu8P6f8BLQAu/2EV71YumfxbhrlqyhKRDI8hA5qxvKTdhE93I7wt31
+QoMxbmsWrqHgqbGInhNsxhDmzdNzI7AAAAwQDPC3aEVm8gSWM52LRS1aU7hQgxCJla1dQG
+HRAIY3AQ8JhAJV+7TRTpXEfOBM1Z7K/7w5Jz/V6KdebxAc8VIYF6SDtZJzO91xuNZbEg5P
+tAeOMk5kK2X1a73KJPbBW5LZaxng3gj9b13f6vRSdlgzz2+4QVVbQukFwsAmGd0E8bmuPl
+r6uKKdfhS34MDFCzEuAyuzBkDT1sIObNrMULxzDKtCSi4y5cH1jWidgglF63oYEqjJGByd
+/fJi/N/BrWycsAAAAMamFtaWVAYXRoZW5hAQIDBAUGBw==
+-----END OPENSSH PRIVATE KEY-----

rsa.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC64TcHcXKGM2e+R8NASfu3oT3uylri1M0oOwZRYe1WTT3Qji/zBe7Iz59OK5TpF5JAQMYRFSTIv+RLrK3t0vvwZHkCk8HYuCVygpRO3fjDAJprtpqk0dDpDkaPIWzXo0IIB3uQkukB/qLGmm2QvMKEKZJhZDt9mBJp+RyddiGUDFPXV2tcYU0SikxsvaEvLG34LzeEWKoqYFjorIA1fKIA2NFwerdlyf/U1HQB8Hmd+R2OMrpfmw0JKG+Vf3VfiJXoEd+dBBImZXgMZ2ZqwEPbt2lkDkySiYvqVG7xFsMwHjMJuHLoAYRfV6k3UK02Y+LStpXmJ8cYdsWpj8GCiXBCZjJmC++0ALOnYQQ8RXVAyt7/+L5chTcGFBQz2/xO2e+tdHWUgjTicJ15oLAttS7U0engF0AmCYEeI90yhZIH3UrUkN+wrTtG2+u2+7bRVr72Y8txBkAWphrTO/RFz+5tP77ZZJyz7nW1ummsEFjfNR470ow1zabQUyYiVbyHJ8k= jamie@athena

server/server.go

@@ -77,22 +77,25 @@ func getRegistrationHandler(keyDir keydirectory.RegistrationDirectory) http.Hand
 		err := json.NewDecoder(r.Body).Decode(&request)
 
 		if err != nil {
+			fmt.Println(err)
 			http.Error(w, fmt.Sprintf("Bad request - %s", err), 400)
 			return
 		}
 
-		key, alg, err := parsePublicKey(request.Key)
+		key, err := parsePublicKey(request.Key)
 
 		if err != nil {
+			fmt.Println(err)
 			http.Error(w, fmt.Sprintf("Bad request - %s", err), 400)
 			return
 		}
 
-		fmt.Printf("Registering %s key for %s\n", alg, request.UserId)
+		fmt.Printf("Registering key for %s\n", request.UserId)
 
-		keyId, err := keyDir.RegisterKey(key, alg, request.UserId)
+		keyId, err := keyDir.RegisterKey(key, request.UserId)
 
 		if err != nil {
+			fmt.Println(err)
 			http.Error(w, fmt.Sprintf("Server error - %s", err), 500)
 			return
 		}
@@ -103,15 +106,12 @@ func getRegistrationHandler(keyDir keydirectory.RegistrationDirectory) http.Hand
 	return http.HandlerFunc(handler)
 }
 
-func parsePublicKey(input string) (crypto.PublicKey, string, error) {
+func parsePublicKey(input string) (crypto.PublicKey, error) {
 	pk, _, _, _, err := ssh.ParseAuthorizedKey([]byte(input))
 
-	var alg string
-
-	switch pk.Type() {
-	case "ssh-ed25519":
-		alg = "ed25519"
+	if err != nil {
+		return nil, err
 	}
 
-	return pk.(ssh.CryptoPublicKey).CryptoPublicKey(), alg, err
+	return pk.(ssh.CryptoPublicKey).CryptoPublicKey(), err
 }

testkey2

@@ -1,7 +0,0 @@
------BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-QyNTUxOQAAACAVBfVj2Gf8IBbU9G8nYz9Y6UQRcjdocl3CD0GKhIAt5wAAAJA3GdxYNxnc
-WAAAAAtzc2gtZWQyNTUxOQAAACAVBfVj2Gf8IBbU9G8nYz9Y6UQRcjdocl3CD0GKhIAt5w
-AAAECcClGiCCayTB0yRGxnn3R26heCf966qN+YAISC4dCMERUF9WPYZ/wgFtT0bydjP1jp
-RBFyN2hyXcIPQYqEgC3nAAAADGphbWllQGF0aGVuYQE=
------END OPENSSH PRIVATE KEY-----

testkey2.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUF9WPYZ/wgFtT0bydjP1jpRBFyN2hyXcIPQYqEgC3n jamie@athena