1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
package main
import (
"crypto/elliptic"
"flag"
"fmt"
"io"
"os"
"git.zero-knowledge.org/gibheer/pki"
)
const (
// Lower boundary limit for RSA private keys
RsaLowerLength = 1024
// Upper boundary limit for RSA private keys
RsaUpperLength = 65536
)
var (
// the possible ecdsa curves allowed to be used
ecdsaCurves = map[uint]elliptic.Curve{
224: elliptic.P224(),
256: elliptic.P256(),
384: elliptic.P384(),
521: elliptic.P521(),
}
)
func CreatePrivateKey(args []string) error {
fs := flag.NewFlagSet("pkiadm create-private-key", flag.ExitOnError)
fs.Usage = func() {
fmt.Fprintf(os.Stderr, "The length depends on the key type. Possible values are:\n")
fmt.Fprintf(os.Stderr, " * ed25519 - 256\n")
fmt.Fprintf(os.Stderr, " * ecdsa - 224, 256, 384, 521\n")
fmt.Fprintf(os.Stderr, " * rsa - from %d up to %d\n", RsaLowerLength, RsaUpperLength)
fmt.Fprintf(os.Stderr, "Usage of %s %s:\n", COMMAND, "create-private")
fs.PrintDefaults()
}
flagType := fs.String("type", "ed25519", "the type of the private key (ed25519, ecdsa, rsa)")
flagLength := fs.Uint("length", 256, "the bit length for the private key")
flagOutput := fs.String("output", "stdout", "write private key to file")
fs.Parse(args)
var err error
var out io.WriteCloser
if *flagOutput == "stdout" {
out = os.Stdout
} else {
out, err = os.OpenFile(*flagOutput, os.O_WRONLY|os.O_CREATE|os.O_EXCL|os.O_SYNC, 0600)
if err != nil {
return err
}
}
defer out.Close()
var pk pki.Pemmer
switch *flagType {
case "ed25519":
if *flagLength != 256 {
return fmt.Errorf("ed25519 only supports bit length of 256")
}
pk, err = pki.NewPrivateKeyEd25519()
case "ecdsa":
if curve, found := ecdsaCurves[*flagLength]; !found {
return fmt.Errorf("unknown bit length for ecdsa")
} else {
pk, err = pki.NewPrivateKeyEcdsa(curve)
}
case "rsa":
if RsaLowerLength > *flagLength || *flagLength > RsaUpperLength {
return fmt.Errorf("bit length outside of range for rsa")
}
pk, err = pki.NewPrivateKeyRsa(int(*flagLength))
default:
return fmt.Errorf("unknown private key type")
}
return writePem(pk, out)
}
|
