-
Notifications
You must be signed in to change notification settings - Fork 139
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add explicit support for identities stored on hardware keys (like Yub…
…ikey). Since Apple no longer support enumerating certificates stored on hardware keys in the Keychain Access application, this PR explicitly tries enumerate certificates stored in the "signature" slot for hardware keys that support PIV applets. Implementation details: - The hardware key PIN is prompted for at the beginning to make sure we don't interfere with the output git expects while signing - To make this as easy as possible, this PR adds a new struct called `PivIdentity` which implements `certstore.Identity` interface - The `PivIdentity` struct has an open handle to a `*piv.Yubikey` and needs to be closed properly when done using it
- Loading branch information
Showing
5 changed files
with
130 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,112 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "crypto" | ||
| "crypto/x509" | ||
| "fmt" | ||
| "github.com/github/certstore" | ||
| "github.com/go-piv/piv-go/piv" | ||
| "github.com/pkg/errors" | ||
| "golang.org/x/term" | ||
| "io" | ||
| ) | ||
|
|
||
| // PivIdentities enumerates identities stored in the signature slot inside hardware keys | ||
| func PivIdentities() ([]PivIdentity, error) { | ||
| cards, err := piv.Cards() | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| var identities []PivIdentity | ||
| for _, card := range cards { | ||
| yk, err := piv.Open(card) | ||
| if err != nil { | ||
| continue | ||
| } | ||
| cert, err := yk.Certificate(piv.SlotSignature) | ||
| if err != nil { | ||
| continue | ||
| } | ||
| if cert != nil { | ||
| pin := promptHardwareKeyPin(card) | ||
| ident := PivIdentity{card: card, pin: pin, yk: yk} | ||
| identities = append(identities, ident) | ||
| } | ||
| } | ||
| return identities, nil | ||
| } | ||
|
|
||
| // PivIdentity is an entity identity stored in a hardware key PIV applet | ||
| type PivIdentity struct { | ||
| card string | ||
| pin string | ||
| yk *piv.YubiKey | ||
| } | ||
|
|
||
| var _ certstore.Identity = (*PivIdentity)(nil) | ||
| var _ crypto.Signer = (*PivIdentity)(nil) | ||
|
|
||
| // Certificate implements the certstore.Identity interface | ||
| func (ident *PivIdentity) Certificate() (*x509.Certificate, error) { | ||
| return ident.yk.Certificate(piv.SlotSignature) | ||
| } | ||
|
|
||
| // CertificateChain implements the certstore.Identity interface | ||
| func (ident *PivIdentity) CertificateChain() ([]*x509.Certificate, error) { | ||
| return []*x509.Certificate{}, nil | ||
| } | ||
|
|
||
| // Signer implements the certstore.Identity interface | ||
| func (ident *PivIdentity) Signer() (crypto.Signer, error) { | ||
| return ident, nil | ||
| } | ||
|
|
||
| // Delete implements the certstore.Identity interface | ||
| func (ident *PivIdentity) Delete() error { | ||
| panic("deleting identities on PIV applet is not supported") | ||
| } | ||
|
|
||
| // Close implements the certstore.Identity interface | ||
| func (ident *PivIdentity) Close() { | ||
| _ = ident.yk.Close() | ||
| } | ||
|
|
||
| // Public implements the crypto.Signer interface | ||
| func (ident *PivIdentity) Public() crypto.PublicKey { | ||
| cert, err := ident.Certificate() | ||
| if err != nil { | ||
| return nil | ||
| } | ||
| return cert.PublicKey | ||
| } | ||
|
|
||
| // Sign implements the crypto.Signer interface | ||
| func (ident *PivIdentity) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) { | ||
| fmt.Printf("Touch \"%v\" now to sign\n", ident.card) | ||
| private, err := ident.yk.PrivateKey(piv.SlotSignature, ident.Public(), piv.KeyAuth{PIN: ident.pin}) | ||
| if err != nil { | ||
| return nil, errors.Wrap(err, "failed to get private key for signing") | ||
| } | ||
| switch private.(type) { | ||
| case *piv.ECDSAPrivateKey: | ||
| return private.(*piv.ECDSAPrivateKey).Sign(rand, digest, opts) | ||
| default: | ||
| return nil, fmt.Errorf("invalid key type") | ||
| } | ||
| } | ||
|
|
||
| func promptHardwareKeyPin(name string) string { | ||
| fmt.Printf("enter PIN for hardware key \"%v\" (press enetr for default):\n", name) | ||
| pin, err := term.ReadPassword(0) | ||
| var hardwareKeyPin string | ||
| if err != nil { | ||
| hardwareKeyPin = piv.DefaultPIN | ||
| } else { | ||
| if len(pin) > 0 { | ||
| hardwareKeyPin = string(pin) | ||
| } else { | ||
| hardwareKeyPin = piv.DefaultPIN | ||
| } | ||
| } | ||
| return hardwareKeyPin | ||
| } |