2024-01-01 19:58:21 +00:00
|
|
|
// Copyright 2018-2024 the Deno authors. All rights reserved. MIT license.
|
2023-01-13 07:51:32 +00:00
|
|
|
|
2021-12-13 17:45:08 +00:00
|
|
|
use deno_core::error::AnyError;
|
2023-09-13 15:54:19 +00:00
|
|
|
use deno_core::op2;
|
2023-08-23 23:03:05 +00:00
|
|
|
use deno_core::unsync::spawn_blocking;
|
2023-06-22 21:37:56 +00:00
|
|
|
use deno_core::ToJsBuffer;
|
2021-12-13 17:45:08 +00:00
|
|
|
use elliptic_curve::rand_core::OsRng;
|
|
|
|
use num_traits::FromPrimitive;
|
2021-12-18 21:14:42 +00:00
|
|
|
use once_cell::sync::Lazy;
|
2021-12-13 17:45:08 +00:00
|
|
|
use ring::rand::SecureRandom;
|
|
|
|
use ring::signature::EcdsaKeyPair;
|
2022-06-20 11:23:57 +00:00
|
|
|
use rsa::pkcs1::EncodeRsaPrivateKey;
|
2021-12-13 17:45:08 +00:00
|
|
|
use rsa::BigUint;
|
|
|
|
use rsa::RsaPrivateKey;
|
|
|
|
use serde::Deserialize;
|
|
|
|
|
2023-01-13 07:51:32 +00:00
|
|
|
use crate::shared::*;
|
|
|
|
|
2021-12-13 17:45:08 +00:00
|
|
|
// Allowlist for RSA public exponents.
|
2021-12-18 21:14:42 +00:00
|
|
|
static PUB_EXPONENT_1: Lazy<BigUint> =
|
|
|
|
Lazy::new(|| BigUint::from_u64(3).unwrap());
|
|
|
|
static PUB_EXPONENT_2: Lazy<BigUint> =
|
|
|
|
Lazy::new(|| BigUint::from_u64(65537).unwrap());
|
2021-12-13 17:45:08 +00:00
|
|
|
|
|
|
|
#[derive(Deserialize)]
|
|
|
|
#[serde(rename_all = "camelCase", tag = "algorithm")]
|
|
|
|
pub enum GenerateKeyOptions {
|
|
|
|
#[serde(rename = "RSA", rename_all = "camelCase")]
|
|
|
|
Rsa {
|
|
|
|
modulus_length: u32,
|
|
|
|
#[serde(with = "serde_bytes")]
|
|
|
|
public_exponent: Vec<u8>,
|
|
|
|
},
|
|
|
|
#[serde(rename = "EC", rename_all = "camelCase")]
|
|
|
|
Ec { named_curve: EcNamedCurve },
|
|
|
|
#[serde(rename = "AES", rename_all = "camelCase")]
|
|
|
|
Aes { length: usize },
|
|
|
|
#[serde(rename = "HMAC", rename_all = "camelCase")]
|
|
|
|
Hmac {
|
|
|
|
hash: ShaHash,
|
|
|
|
length: Option<usize>,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2023-09-13 15:54:19 +00:00
|
|
|
#[op2(async)]
|
|
|
|
#[serde]
|
2021-12-13 17:45:08 +00:00
|
|
|
pub async fn op_crypto_generate_key(
|
2023-09-13 15:54:19 +00:00
|
|
|
#[serde] opts: GenerateKeyOptions,
|
2023-06-22 21:37:56 +00:00
|
|
|
) -> Result<ToJsBuffer, AnyError> {
|
2021-12-13 17:45:08 +00:00
|
|
|
let fun = || match opts {
|
|
|
|
GenerateKeyOptions::Rsa {
|
|
|
|
modulus_length,
|
|
|
|
public_exponent,
|
|
|
|
} => generate_key_rsa(modulus_length, &public_exponent),
|
|
|
|
GenerateKeyOptions::Ec { named_curve } => generate_key_ec(named_curve),
|
|
|
|
GenerateKeyOptions::Aes { length } => generate_key_aes(length),
|
|
|
|
GenerateKeyOptions::Hmac { hash, length } => {
|
|
|
|
generate_key_hmac(hash, length)
|
|
|
|
}
|
|
|
|
};
|
2023-05-14 21:40:01 +00:00
|
|
|
let buf = spawn_blocking(fun).await.unwrap()?;
|
2021-12-13 17:45:08 +00:00
|
|
|
Ok(buf.into())
|
|
|
|
}
|
|
|
|
|
|
|
|
fn generate_key_rsa(
|
|
|
|
modulus_length: u32,
|
|
|
|
public_exponent: &[u8],
|
|
|
|
) -> Result<Vec<u8>, AnyError> {
|
|
|
|
let exponent = BigUint::from_bytes_be(public_exponent);
|
|
|
|
if exponent != *PUB_EXPONENT_1 && exponent != *PUB_EXPONENT_2 {
|
|
|
|
return Err(operation_error("Bad public exponent"));
|
|
|
|
}
|
|
|
|
|
|
|
|
let mut rng = OsRng;
|
|
|
|
|
|
|
|
let private_key =
|
|
|
|
RsaPrivateKey::new_with_exp(&mut rng, modulus_length as usize, &exponent)
|
|
|
|
.map_err(|_| operation_error("Failed to generate RSA key"))?;
|
|
|
|
|
|
|
|
let private_key = private_key
|
|
|
|
.to_pkcs1_der()
|
|
|
|
.map_err(|_| operation_error("Failed to serialize RSA key"))?;
|
|
|
|
|
2022-06-20 11:23:57 +00:00
|
|
|
Ok(private_key.as_bytes().to_vec())
|
2021-12-13 17:45:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
fn generate_key_ec(named_curve: EcNamedCurve) -> Result<Vec<u8>, AnyError> {
|
|
|
|
let curve = match named_curve {
|
|
|
|
EcNamedCurve::P256 => &ring::signature::ECDSA_P256_SHA256_FIXED_SIGNING,
|
|
|
|
EcNamedCurve::P384 => &ring::signature::ECDSA_P384_SHA384_FIXED_SIGNING,
|
2021-12-16 16:28:43 +00:00
|
|
|
_ => return Err(not_supported_error("Unsupported named curve")),
|
2021-12-13 17:45:08 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
let rng = ring::rand::SystemRandom::new();
|
|
|
|
|
|
|
|
let pkcs8 = EcdsaKeyPair::generate_pkcs8(curve, &rng)
|
|
|
|
.map_err(|_| operation_error("Failed to generate EC key"))?;
|
|
|
|
|
|
|
|
Ok(pkcs8.as_ref().to_vec())
|
|
|
|
}
|
|
|
|
|
|
|
|
fn generate_key_aes(length: usize) -> Result<Vec<u8>, AnyError> {
|
|
|
|
if length % 8 != 0 || length > 256 {
|
|
|
|
return Err(operation_error("Invalid AES key length"));
|
|
|
|
}
|
|
|
|
|
|
|
|
let mut key = vec![0u8; length / 8];
|
|
|
|
let rng = ring::rand::SystemRandom::new();
|
|
|
|
rng
|
|
|
|
.fill(&mut key)
|
|
|
|
.map_err(|_| operation_error("Failed to generate key"))?;
|
|
|
|
|
|
|
|
Ok(key)
|
|
|
|
}
|
|
|
|
|
|
|
|
fn generate_key_hmac(
|
|
|
|
hash: ShaHash,
|
|
|
|
length: Option<usize>,
|
|
|
|
) -> Result<Vec<u8>, AnyError> {
|
|
|
|
let hash = match hash {
|
|
|
|
ShaHash::Sha1 => &ring::hmac::HMAC_SHA1_FOR_LEGACY_USE_ONLY,
|
|
|
|
ShaHash::Sha256 => &ring::hmac::HMAC_SHA256,
|
|
|
|
ShaHash::Sha384 => &ring::hmac::HMAC_SHA384,
|
|
|
|
ShaHash::Sha512 => &ring::hmac::HMAC_SHA512,
|
|
|
|
};
|
|
|
|
|
|
|
|
let length = if let Some(length) = length {
|
|
|
|
if length % 8 != 0 {
|
|
|
|
return Err(operation_error("Invalid HMAC key length"));
|
|
|
|
}
|
|
|
|
|
|
|
|
let length = length / 8;
|
|
|
|
if length > ring::digest::MAX_BLOCK_LEN {
|
|
|
|
return Err(operation_error("Invalid HMAC key length"));
|
|
|
|
}
|
|
|
|
|
|
|
|
length
|
|
|
|
} else {
|
2023-10-27 21:15:09 +00:00
|
|
|
hash.digest_algorithm().block_len()
|
2021-12-13 17:45:08 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
let rng = ring::rand::SystemRandom::new();
|
|
|
|
let mut key = vec![0u8; length];
|
|
|
|
rng
|
|
|
|
.fill(&mut key)
|
|
|
|
.map_err(|_| operation_error("Failed to generate key"))?;
|
|
|
|
|
|
|
|
Ok(key)
|
|
|
|
}
|