Pem->PEM

Author: JackDoan

cert/cert.go

@@ -59,7 +59,7 @@ type Certificate interface {
 	PublicKey() []byte
 
 	// PublicKeyPem is the value of PublicKey marshalled to PEM
-	PublicKeyPem() []byte
+	PublicKeyPEM() []byte
 
 	// Curve identifies which curve was used for the PublicKey and Signature.
 	Curve() Curve

cert/cert_v1.go

@@ -83,7 +83,7 @@ func (c *certificateV1) PublicKey() []byte {
 	return c.details.publicKey
 }
 
-func (c *certificateV1) PublicKeyPem() []byte {
+func (c *certificateV1) PublicKeyPEM() []byte {
 	return marshalCertPublicKeyToPEM(c)
 }
 

cert/cert_v1_test.go

@@ -86,13 +86,13 @@ func TestCertificateV1_PublicKeyPem(t *testing.T) {
 	assert.Equal(t, Version1, nc.Version())
 	assert.Equal(t, Curve_CURVE25519, nc.Curve())
 	pubPem := "-----BEGIN NEBULA X25519 PUBLIC KEY-----\nMTIzNDU2Nzg5MGFiY2VkZmdoaWoxMjM0NTY3ODkwYWI=\n-----END NEBULA X25519 PUBLIC KEY-----\n"
-	assert.Equal(t, string(nc.PublicKeyPem()), pubPem)
+	assert.Equal(t, string(nc.PublicKeyPEM()), pubPem)
 	assert.False(t, nc.IsCA())
 
 	nc.details.isCA = true
 	assert.Equal(t, Curve_CURVE25519, nc.Curve())
 	pubPem = "-----BEGIN NEBULA ED25519 PUBLIC KEY-----\nMTIzNDU2Nzg5MGFiY2VkZmdoaWoxMjM0NTY3ODkwYWI=\n-----END NEBULA ED25519 PUBLIC KEY-----\n"
-	assert.Equal(t, string(nc.PublicKeyPem()), pubPem)
+	assert.Equal(t, string(nc.PublicKeyPEM()), pubPem)
 	assert.True(t, nc.IsCA())
 
 	pubP256KeyPem := []byte(`-----BEGIN NEBULA P256 PUBLIC KEY-----
@@ -105,12 +105,12 @@ AAAAAAAAAAAAAAAAAAAAAAA=
 	nc.details.curve = Curve_P256
 	nc.details.publicKey = pubP256Key
 	assert.Equal(t, Curve_P256, nc.Curve())
-	assert.Equal(t, string(nc.PublicKeyPem()), string(pubP256KeyPem))
+	assert.Equal(t, string(nc.PublicKeyPEM()), string(pubP256KeyPem))
 	assert.True(t, nc.IsCA())
 
 	nc.details.isCA = false
 	assert.Equal(t, Curve_P256, nc.Curve())
-	assert.Equal(t, string(nc.PublicKeyPem()), string(pubP256KeyPem))
+	assert.Equal(t, string(nc.PublicKeyPEM()), string(pubP256KeyPem))
 	assert.False(t, nc.IsCA())
 }
 

cert/cert_v2.go

@@ -114,7 +114,7 @@ func (c *certificateV2) PublicKey() []byte {
 	return c.publicKey
 }
 
-func (c *certificateV2) PublicKeyPem() []byte {
+func (c *certificateV2) PublicKeyPEM() []byte {
 	return marshalCertPublicKeyToPEM(c)
 }
 

cert/cert_v2_test.go

@@ -100,13 +100,13 @@ func TestCertificateV2_PublicKeyPem(t *testing.T) {
 	assert.Equal(t, Version2, nc.Version())
 	assert.Equal(t, Curve_CURVE25519, nc.Curve())
 	pubPem := "-----BEGIN NEBULA X25519 PUBLIC KEY-----\nMTIzNDU2Nzg5MGFiY2VkZmdoaWoxMjM0NTY3ODkwYWI=\n-----END NEBULA X25519 PUBLIC KEY-----\n"
-	assert.Equal(t, string(nc.PublicKeyPem()), pubPem)
+	assert.Equal(t, string(nc.PublicKeyPEM()), pubPem)
 	assert.False(t, nc.IsCA())
 
 	nc.details.isCA = true
 	assert.Equal(t, Curve_CURVE25519, nc.Curve())
 	pubPem = "-----BEGIN NEBULA ED25519 PUBLIC KEY-----\nMTIzNDU2Nzg5MGFiY2VkZmdoaWoxMjM0NTY3ODkwYWI=\n-----END NEBULA ED25519 PUBLIC KEY-----\n"
-	assert.Equal(t, string(nc.PublicKeyPem()), pubPem)
+	assert.Equal(t, string(nc.PublicKeyPEM()), pubPem)
 	assert.True(t, nc.IsCA())
 
 	pubP256KeyPem := []byte(`-----BEGIN NEBULA P256 PUBLIC KEY-----
@@ -119,12 +119,12 @@ AAAAAAAAAAAAAAAAAAAAAAA=
 	nc.curve = Curve_P256
 	nc.publicKey = pubP256Key
 	assert.Equal(t, Curve_P256, nc.Curve())
-	assert.Equal(t, string(nc.PublicKeyPem()), string(pubP256KeyPem))
+	assert.Equal(t, string(nc.PublicKeyPEM()), string(pubP256KeyPem))
 	assert.True(t, nc.IsCA())
 
 	nc.details.isCA = false
 	assert.Equal(t, Curve_P256, nc.Curve())
-	assert.Equal(t, string(nc.PublicKeyPem()), string(pubP256KeyPem))
+	assert.Equal(t, string(nc.PublicKeyPEM()), string(pubP256KeyPem))
 	assert.False(t, nc.IsCA())
 }
 

cert/pem.go

@@ -7,22 +7,26 @@ import (
 	"golang.org/x/crypto/ed25519"
 )
 
-const (
-	CertificateBanner                = "NEBULA CERTIFICATE"
-	CertificateV2Banner              = "NEBULA CERTIFICATE V2"
-	X25519PrivateKeyBanner           = "NEBULA X25519 PRIVATE KEY"
-	X25519PublicKeyBanner            = "NEBULA X25519 PUBLIC KEY"
-	EncryptedEd25519PrivateKeyBanner = "NEBULA ED25519 ENCRYPTED PRIVATE KEY"
-	Ed25519PrivateKeyBanner          = "NEBULA ED25519 PRIVATE KEY"
-	Ed25519PublicKeyBanner           = "NEBULA ED25519 PUBLIC KEY"
-
-	P256PrivateKeyBanner               = "NEBULA P256 PRIVATE KEY"
-	P256PublicKeyBanner                = "NEBULA P256 PUBLIC KEY"
+const ( //cert banners
+	CertificateBanner   = "NEBULA CERTIFICATE"
+	CertificateV2Banner = "NEBULA CERTIFICATE V2"
+)
+
+const ( //key-agreement-key banners
+	X25519PrivateKeyBanner = "NEBULA X25519 PRIVATE KEY"
+	X25519PublicKeyBanner  = "NEBULA X25519 PUBLIC KEY"
+	P256PrivateKeyBanner   = "NEBULA P256 PRIVATE KEY"
+	P256PublicKeyBanner    = "NEBULA P256 PUBLIC KEY"
+)
+
+/* including "ECDSA" in the P256 banners is a clue that these keys should be used only for signing */
+const ( //signing key banners
 	EncryptedECDSAP256PrivateKeyBanner = "NEBULA ECDSA P256 ENCRYPTED PRIVATE KEY"
 	ECDSAP256PrivateKeyBanner          = "NEBULA ECDSA P256 PRIVATE KEY"
-
-	// Deprecated: oldP256PublicKeyBanner is in use some places still
-	oldP256PublicKeyBanner = "NEBULA ECDSA P256 PUBLIC KEY"
+	ECDSAP256PublicKeyBanner           = "NEBULA ECDSA P256 PUBLIC KEY"
+	EncryptedEd25519PrivateKeyBanner   = "NEBULA ED25519 ENCRYPTED PRIVATE KEY"
+	Ed25519PrivateKeyBanner            = "NEBULA ED25519 PRIVATE KEY"
+	Ed25519PublicKeyBanner             = "NEBULA ED25519 PUBLIC KEY"
 )
 
 // UnmarshalCertificateFromPEM will try to unmarshal the first pem block in a byte array, returning any non consumed
@@ -55,24 +59,32 @@ func UnmarshalCertificateFromPEM(b []byte) (Certificate, []byte, error) {
 }
 
 func marshalCertPublicKeyToPEM(c Certificate) []byte {
-	switch c.Curve() {
+	if c.IsCA() {
+		return MarshalSigningPublicKeyToPEM(c.Curve(), c.PublicKey())
+	} else {
+		return MarshalPublicKeyToPEM(c.Curve(), c.PublicKey())
+	}
+}
+
+// MarshalPublicKeyToPEM returns a PEM representation of a public key used for ECDH.
+// if your public key came from a certificate, prefer Certificate.PublicKeyPEM() if possible, to avoid mistakes!
+func MarshalPublicKeyToPEM(curve Curve, b []byte) []byte {
+	switch curve {
 	case Curve_CURVE25519:
-		if c.IsCA() {
-			return pem.EncodeToMemory(&pem.Block{Type: Ed25519PublicKeyBanner, Bytes: c.PublicKey()})
-		} else {
-			return pem.EncodeToMemory(&pem.Block{Type: X25519PublicKeyBanner, Bytes: c.PublicKey()})
-		}
+		return pem.EncodeToMemory(&pem.Block{Type: X25519PublicKeyBanner, Bytes: b})
 	case Curve_P256:
-		return MarshalPublicKeyToPEM(Curve_P256, c.PublicKey())
+		return pem.EncodeToMemory(&pem.Block{Type: P256PublicKeyBanner, Bytes: b})
 	default:
 		return nil
 	}
 }
 
-func MarshalPublicKeyToPEM(curve Curve, b []byte) []byte {
+// MarshalSigningPublicKeyToPEM returns a PEM representation of a public key used for signing.
+// if your public key came from a certificate, prefer Certificate.PublicKeyPEM() if possible, to avoid mistakes!
+func MarshalSigningPublicKeyToPEM(curve Curve, b []byte) []byte {
 	switch curve {
 	case Curve_CURVE25519:
-		return pem.EncodeToMemory(&pem.Block{Type: X25519PublicKeyBanner, Bytes: b})
+		return pem.EncodeToMemory(&pem.Block{Type: Ed25519PublicKeyBanner, Bytes: b})
 	case Curve_P256:
 		return pem.EncodeToMemory(&pem.Block{Type: P256PublicKeyBanner, Bytes: b})
 	default:
@@ -91,7 +103,7 @@ func UnmarshalPublicKeyFromPEM(b []byte) ([]byte, []byte, Curve, error) {
 	case X25519PublicKeyBanner, Ed25519PublicKeyBanner:
 		expectedLen = 32
 		curve = Curve_CURVE25519
-	case P256PublicKeyBanner, oldP256PublicKeyBanner:
+	case P256PublicKeyBanner, ECDSAP256PublicKeyBanner:
 		// Uncompressed
 		expectedLen = 65
 		curve = Curve_P256

connection_manager_test.go

@@ -446,7 +446,7 @@ func (d *dummyCert) PublicKey() []byte {
 	return d.publicKey
 }
 
-func (d *dummyCert) PublicKeyPem() []byte {
+func (d *dummyCert) PublicKeyPEM() []byte {
 	return cert.MarshalPublicKeyToPEM(d.curve, d.publicKey)
 }