ndndsec: avoid Node.js Crypto for PKCS#1 and SEC#1

Author: yoursunny

pkg/keychain/src/algo/ecdsa.ts

@@ -3,34 +3,32 @@ import { asBufferSource, assert, fromHex, toHex } from "@ndn/util";
 import * as asn1 from "@yoursunny/asn1";
 
 import type { CryptoAlgorithm, SigningAlgorithm } from "../key/mod";
-import { assertSpkiAlgorithm } from "./impl-spki";
+import { assertSpkiAlgorithm, toPkcs8 } from "./impl-asn1";
 
 const SignVerifyParams: EcdsaParams = { name: "ECDSA", hash: "SHA-256" };
 
 function makeGenParams(curve: EcCurve): EcKeyGenParams & EcKeyImportParams {
   return { name: "ECDSA", namedCurve: curve };
 }
 
-const PointSizes = {
-  "P-256": 32,
-  "P-384": 48,
-  "P-521": 66,
+const EcPublicKeyOid = "2A8648CE3D0201"; // 1.2.840.10045.2.1
+
+const NamedCurveInfo = {
+  "P-256": [32, "2A8648CE3D030107"], // 1.2.840.10045.3.1.7
+  "P-384": [48, "2B81040022"], // 1.3.132.0.34
+  "P-521": [66, "2B81040023"], // 1.3.132.0.35
 } as const;
 
-const NamedCurveOids: Record<string, EcCurve> = {
-  "2A8648CE3D030107": "P-256", // 1.2.840.10045.3.1.7
-  "2B81040022": "P-384", // 1.3.132.0.34
-  "2B81040023": "P-521", // 1.3.132.0.35
-};
+const NamedCurveOids: Record<string, EcCurve> = Object.fromEntries(Object.entries(NamedCurveInfo).map(([curve, [,oid]]) => [oid, curve as EcCurve]));
 
-export type EcCurve = keyof typeof PointSizes;
+export type EcCurve = keyof typeof NamedCurveInfo;
 export namespace EcCurve {
   export const Default: EcCurve = "P-256";
-  export const Choices = Object.keys(PointSizes) as readonly EcCurve[];
+  export const Choices = Object.keys(NamedCurveInfo) as readonly EcCurve[];
 
   /** Detect EcCurve from SubjectPublicKeyInfo. */
   export function detectFromSpki(der: asn1.ElementBuffer): EcCurve {
-    assertSpkiAlgorithm(der, "ECDSA", "2A8648CE3D0201"); // 1.2.840.10045.2.1
+    assertSpkiAlgorithm(der, "ECDSA", EcPublicKeyOid);
 
     // SubjectPublicKeyInfo.algorithm.parameter
     const ecp = der.children?.[0]?.children?.[1];
@@ -51,6 +49,26 @@ function toUintHex(array: Uint8Array): string {
   return toHex(array.subarray(msb));
 }
 
+function stripSec1Parameters(input: Uint8Array): Uint8Array {
+  // https://datatracker.ietf.org/doc/html/rfc5915#section-3
+  // Delete ECParameters field from SEC#1 data.
+  const sec1 = asn1.parseVerbose(input);
+  let index: number;
+  if (sec1.children && (index = sec1.children.findIndex((child) => child.type === 160)) >= 0) {
+    sec1.children.splice(index, 1);
+  }
+  return asn1.pack(sec1);
+}
+
+function loadPkcs8(pkcs8: Uint8Array, spki: Uint8Array, curve: EcCurve, extractable: boolean) {
+  const params = makeGenParams(curve);
+  return Promise.all([
+    params, // eslint-disable-line @typescript-eslint/await-thenable
+    crypto.subtle.importKey("pkcs8", asBufferSource(pkcs8), params, extractable, ECDSA.keyUsages.private),
+    crypto.subtle.importKey("spki", asBufferSource(spki), params, true, ECDSA.keyUsages.public),
+  ]);
+}
+
 /** Sha256WithEcdsa signing algorithm. */
 export const ECDSA: SigningAlgorithm<ECDSA.Info, true, ECDSA.GenParams> = {
   uuid: "a81b3696-65e5-4f4c-bb45-14125472321b",
@@ -60,18 +78,25 @@ export const ECDSA: SigningAlgorithm<ECDSA.Info, true, ECDSA.GenParams> = {
     public: ["verify"],
   },
 
-  async cryptoGenerate({ curve, importPkcs8 }: ECDSA.GenParams, extractable: boolean) {
+  async cryptoGenerate({ curve, importPkcs8, importSec1 }: ECDSA.GenParams, extractable: boolean) {
     let params: ReturnType<typeof makeGenParams>;
     let privateKey: CryptoKey;
     let publicKey: CryptoKey;
     if (importPkcs8) {
       const [pkcs8, spki] = importPkcs8;
       curve ??= EcCurve.detectFromSpki(asn1.parseVerbose(spki));
-      params = makeGenParams(curve);
-      [privateKey, publicKey] = await Promise.all([
-        crypto.subtle.importKey("pkcs8", asBufferSource(pkcs8), params, extractable, this.keyUsages.private),
-        crypto.subtle.importKey("spki", asBufferSource(spki), params, true, this.keyUsages.public),
-      ]);
+      [params, privateKey, publicKey] = await loadPkcs8(pkcs8, spki, curve, extractable);
+    } else if (importSec1) {
+      const [sec1, spki] = importSec1;
+      curve ??= EcCurve.detectFromSpki(asn1.parseVerbose(spki));
+      const pkcs8 = toPkcs8(
+        [
+          asn1.Any("06", EcPublicKeyOid), // OID
+          asn1.Any("06", NamedCurveInfo[curve][1]),
+        ],
+        stripSec1Parameters(sec1),
+      );
+      [params, privateKey, publicKey] = await loadPkcs8(pkcs8, spki, curve, extractable);
     } else {
       curve ??= EcCurve.Default;
       params = makeGenParams(curve);
@@ -105,7 +130,7 @@ export const ECDSA: SigningAlgorithm<ECDSA.Info, true, ECDSA.GenParams> = {
   makeLLSign({ privateKey, info: { curve } }: CryptoAlgorithm.PrivateKey<ECDSA.Info>) {
     return async (input) => {
       const raw = await crypto.subtle.sign(SignVerifyParams, privateKey, asBufferSource(input));
-      const pointSize = PointSizes[curve];
+      const pointSize = NamedCurveInfo[curve][0];
       return fromHex(asn1.Any(
         "30",
         asn1.UInt(toUintHex(new Uint8Array(raw, 0, pointSize))),
@@ -116,7 +141,7 @@ export const ECDSA: SigningAlgorithm<ECDSA.Info, true, ECDSA.GenParams> = {
 
   makeLLVerify({ publicKey, info: { curve } }: CryptoAlgorithm.PublicKey<ECDSA.Info>) {
     return async (input, sig) => {
-      const pointSize = PointSizes[curve];
+      const pointSize = NamedCurveInfo[curve][0];
 
       const der = asn1.parseVerbose(sig);
       const r = der.children?.[0]?.value;
@@ -153,6 +178,14 @@ export namespace ECDSA {
      * If {@link curve} is also specified, it must match the SPKI public key.
      */
     importPkcs8?: [pkcs8: Uint8Array, spki: Uint8Array];
+
+    /**
+     * Import SEC#1 private key and SPKI public key instead of generating.
+     *
+     * If {@link curve} is also specified, it must match the SPKI public key.
+     * If {@link importPkcs8} is also specified, this field is ignored.
+     */
+    importSec1?: [sec1: Uint8Array, spki: Uint8Array];
   }
 
   export interface Info {

pkg/keychain/src/algo/ed.ts

@@ -4,7 +4,7 @@ import type * as asn1 from "@yoursunny/asn1";
 import { Ed25519Algorithm, ponyfillEd25519 } from "@yoursunny/webcrypto-ed25519";
 
 import type { CryptoAlgorithm, SigningAlgorithm } from "../key/mod";
-import { assertSpkiAlgorithm } from "./impl-spki";
+import { assertSpkiAlgorithm } from "./impl-asn1";
 
 const subtle = ponyfillEd25519();
 

pkg/keychain/src/algo/impl-asn1.ts

@@ -0,0 +1,35 @@
+import { fromHex, toHex } from "@ndn/util";
+import * as asn1 from "@yoursunny/asn1";
+
+/**
+ * Require SubjectPublicKeyInfo.algorithm.algorithm to have specific OID.
+ * @param der - SubjectPublicKeyInfo.
+ * @param algoName - Textual algorithm name.
+ * @param oid - OID hex string (upper case).
+ */
+export function assertSpkiAlgorithm(der: asn1.ElementBuffer, algoName: string, oid: string): void {
+  const algo = der.children?.[0]?.children?.[0];
+  if (algo?.type === 0x06 && algo.value && toHex(algo.value) === oid) {
+    return;
+  }
+  throw new Error(`not ${algoName} public key`);
+}
+
+/**
+ * Convert to ASN.1 PrivateKeyInfo (PKCS#8) format.
+ * @param privateKeyAlgorithm - AlgorithmIdentifier elements.
+ * @param privateKey - Value of private key.
+ * @returns PKCS#8 buffer.
+ */
+export function toPkcs8(privateKeyAlgorithm: string[], privateKey: Uint8Array): Uint8Array {
+  // https://datatracker.ietf.org/doc/html/rfc5208#section-5
+  return fromHex(asn1.Any(
+    "30", // PrivateKeyInfo
+    asn1.UInt("00"), // Version 0
+    asn1.Any( // PrivateKeyAlgorithmIdentifier
+      "30",
+      ...privateKeyAlgorithm,
+    ),
+    asn1.Any("04", toHex(privateKey)), // PrivateKey
+  ));
+}

pkg/keychain/src/algo/impl-spki.ts

@@ -1,10 +1,12 @@
 import { asBufferSource } from "@ndn/util";
-import type * as asn1 from "@yoursunny/asn1";
+import * as asn1 from "@yoursunny/asn1";
 
 import type { CryptoAlgorithm } from "../key/mod";
-import { assertSpkiAlgorithm } from "./impl-spki";
+import { assertSpkiAlgorithm, toPkcs8 } from "./impl-asn1";
 import type { RSA } from "./rsa";
 
+const RsaOid = "2A864886F70D010101"; // 1.2.840.113549.1.1.1
+
 export type RsaModulusLength = (typeof RsaModulusLength.Choices)[number];
 export namespace RsaModulusLength {
   export const Default: RsaModulusLength = 2048;
@@ -26,15 +28,21 @@ export abstract class RsaCommon implements CryptoAlgorithm<{}, true, RSA.GenPara
   protected readonly importParams: RsaHashedImportParams;
   protected readonly genParams: RsaHashedKeyGenParams;
 
-  async cryptoGenerate({ modulusLength = RsaModulusLength.Default, importPkcs8 }: RSA.GenParams, extractable: boolean) {
+  async cryptoGenerate({ modulusLength = RsaModulusLength.Default, importPkcs8, importPkcs1 }: RSA.GenParams, extractable: boolean) {
     let privateKey: CryptoKey;
     let publicKey: CryptoKey;
     if (importPkcs8) {
-      const [pkcs8, spki] = importPkcs8;
-      [privateKey, publicKey] = await Promise.all([
-        crypto.subtle.importKey("pkcs8", asBufferSource(pkcs8), this.importParams, extractable, this.keyUsages.private),
-        crypto.subtle.importKey("spki", asBufferSource(spki), this.importParams, true, this.keyUsages.public),
-      ]);
+      [privateKey, publicKey] = await this.importPkcs8(...importPkcs8, extractable);
+    } else if (importPkcs1) {
+      const [pkcs1, spki] = importPkcs1;
+      const pkcs8 = toPkcs8(
+        [
+          asn1.Any("06", RsaOid), // OID
+          asn1.Any("05"), // Parameters NULL
+        ],
+        pkcs1,
+      );
+      [privateKey, publicKey] = await this.importPkcs8(pkcs8, spki, extractable);
     } else {
       const genParams: RsaHashedKeyGenParams = {
         ...this.genParams,
@@ -56,8 +64,15 @@ export abstract class RsaCommon implements CryptoAlgorithm<{}, true, RSA.GenPara
     };
   }
 
+  private importPkcs8(pkcs8: Uint8Array, spki: Uint8Array, extractable: boolean) {
+    return Promise.all([
+      crypto.subtle.importKey("pkcs8", asBufferSource(pkcs8), this.importParams, extractable, this.keyUsages.private),
+      crypto.subtle.importKey("spki", asBufferSource(spki), this.importParams, true, this.keyUsages.public),
+    ]);
+  }
+
   public async importSpki(spki: Uint8Array, der: asn1.ElementBuffer) {
-    assertSpkiAlgorithm(der, "RSA", "2A864886F70D010101"); // 1.2.840.113549.1.1.1
+    assertSpkiAlgorithm(der, "RSA", RsaOid);
     const key = await crypto.subtle.importKey("spki", asBufferSource(spki), this.importParams, true, this.keyUsages.public);
     return {
       publicKey: key,

pkg/keychain/src/algo/rsa-common.ts

@@ -35,5 +35,12 @@ export namespace RSA {
 
     /** Import PKCS#8 private key and SPKI public key instead of generating. */
     importPkcs8?: [pkcs8: Uint8Array, spki: Uint8Array];
+
+    /**
+     * Import PKCS#1 private key and SPKI public key instead of generating.
+     *
+     * If {@link importPkcs8} is also specified, this field is ignored.
+     */
+    importPkcs1?: [pkcs1: Uint8Array, spki: Uint8Array];
   }
 }

pkg/keychain/src/algo/rsa.ts

@@ -6,7 +6,7 @@ import { StoreBase, type StoreProvider } from "./store-base";
 
 /** KV store of named key pairs. */
 export class KeyStore extends StoreBase<KeyStore.StoredKey> {
-  constructor(provider: StoreProvider<KeyStore.StoredKey>, algoList: readonly CryptoAlgorithm[]) {
+  constructor(provider: StoreProvider<KeyStore.StoredKey>, public readonly algoList: readonly CryptoAlgorithm[]) {
     super(provider);
     this.loader = new KeyStore.Loader(false, algoList);
   }

pkg/keychain/src/store/key-store.ts

@@ -14,7 +14,7 @@ export abstract class KeyChainExternal extends KeyChainSerialized {
   private cached?: KeyChain;
 
   protected constructor(
-      protected readonly algoList: readonly CryptoAlgorithm[],
+      public readonly algoList: readonly CryptoAlgorithm[],
       public override readonly needJwk = true,
   ) {
     super();

pkg/keychain/src/store/keychain-external.ts

@@ -13,6 +13,9 @@ import { openStores } from "./stores_node";
 
 /** Storage of own private keys and certificates. */
 export abstract class KeyChain {
+  /** Retrieve the algorithm list used to construct this KeyChain. */
+  public abstract readonly algoList: readonly CryptoAlgorithm[];
+
   /** Return whether `.insertKey()` method expects JsonWebKey instead of CryptoKey. */
   public abstract readonly needJwk: boolean;
 
@@ -283,6 +286,8 @@ class KeyChainImpl extends KeyChainSerialized {
     super();
   }
 
+  public override get algoList() { return this.keys.algoList; }
+
   public override get needJwk() { return !this.keys.canSClone; }
 
   protected override async sListKeys(prefix: Name): Promise<Name[]> {

pkg/keychain/src/store/keychain.ts

@@ -9,4 +9,3 @@ This package implements basic support for [NDNd keychain](https://github.com/nam
 `parseCert` function loads certificate file generated by `ndnsec sec sign-cert` command.
 
 `UnencryptedPrivateKey` type, returned by `parseKey`, allows importing the key pair into NDNts keychain.
-This only works in Node.js, because Web Crypto API does not support PKCS#1 or SEC1 private key formats.