Compare commits
No commits in common. "master" and "v1.2.7" have entirely different histories.
18
README.md
18
README.md
@ -51,7 +51,6 @@ return Keypairs.export({ jwk: pair.private, format: 'pkcs8' }).then(function (pe
|
||||
```
|
||||
// PEM to JWK
|
||||
return Keypairs.import({ pem: pem }).then(function (jwk) {
|
||||
console.log(jwk);
|
||||
});
|
||||
```
|
||||
|
||||
@ -165,22 +164,9 @@ Options
|
||||
}
|
||||
```
|
||||
|
||||
#### Keypairs.publish({ jwk: jwk, exp: '3d', use: 'sig' })
|
||||
#### Keypairs.publish({ jwk: jwk })
|
||||
|
||||
Promises a public key that adheres to the OIDC and Auth0 spec (plus expiry), suitable to be published to a JWKs URL:
|
||||
|
||||
```
|
||||
{ "kty": "EC"
|
||||
, "crv": "P-256"
|
||||
, "x": "..."
|
||||
, "y": "..."
|
||||
, "kid": "..."
|
||||
, "use": "sig"
|
||||
, "exp": 1552074208
|
||||
}
|
||||
```
|
||||
|
||||
In particular this adds "use" and "exp".
|
||||
**Synchronously** strips a key of its private parts and returns the public version.
|
||||
|
||||
#### Keypairs.thumbprint({ jwk: jwk })
|
||||
|
||||
|
||||
136
keypairs.js
136
keypairs.js
@ -10,19 +10,10 @@ var Keypairs = module.exports;
|
||||
Keypairs.generate = function (opts) {
|
||||
opts = opts || {};
|
||||
var kty = opts.kty || opts.type;
|
||||
var p;
|
||||
if ('RSA' === kty) {
|
||||
p = Rasha.generate(opts);
|
||||
} else {
|
||||
p = Eckles.generate(opts);
|
||||
return Rasha.generate(opts);
|
||||
}
|
||||
return p.then(function (pair) {
|
||||
return Keypairs.thumbprint({ jwk: pair.public }).then(function (thumb) {
|
||||
pair.private.kid = thumb; // maybe not the same id on the private key?
|
||||
pair.public.kid = thumb;
|
||||
return pair;
|
||||
});
|
||||
});
|
||||
return Eckles.generate(opts);
|
||||
};
|
||||
|
||||
Keypairs.parse = function (opts) {
|
||||
@ -33,26 +24,22 @@ Keypairs.parse = function (opts) {
|
||||
var pem;
|
||||
var p;
|
||||
|
||||
if (!opts.key || !opts.key.kty) {
|
||||
try {
|
||||
jwk = JSON.parse(opts.key);
|
||||
p = Keypairs.export({ jwk: jwk }).catch(function (e) {
|
||||
pem = opts.key;
|
||||
err = new Error("Not a valid jwk '" + JSON.stringify(jwk) + "':" + e.message);
|
||||
err.code = "EINVALID";
|
||||
return Promise.reject(err);
|
||||
}).then(function () {
|
||||
return jwk;
|
||||
});
|
||||
} catch(e) {
|
||||
p = Keypairs.import({ pem: opts.key }).catch(function (e) {
|
||||
err = new Error("Could not parse key (type " + typeof opts.key + ") '" + opts.key + "': " + e.message);
|
||||
err.code = "EPARSE";
|
||||
return Promise.reject(err);
|
||||
});
|
||||
}
|
||||
} else {
|
||||
p = Promise.resolve(opts.key);
|
||||
try {
|
||||
jwk = JSON.parse(opts.key);
|
||||
p = Keypairs.export({ jwk: jwk }).catch(function (e) {
|
||||
pem = opts.key;
|
||||
err = new Error("Not a valid jwk '" + JSON.stringify(jwk) + "':" + e.message);
|
||||
err.code = "EINVALID";
|
||||
return Promise.reject(err);
|
||||
}).then(function () {
|
||||
return jwk;
|
||||
});
|
||||
} catch(e) {
|
||||
p = Keypairs.import({ pem: opts.key }).catch(function (e) {
|
||||
err = new Error("Could not parse key (type " + typeof opts.key + ") '" + opts.key + "': " + e.message);
|
||||
err.code = "EPARSE";
|
||||
return Promise.reject(err);
|
||||
});
|
||||
}
|
||||
|
||||
return p.then(function (jwk) {
|
||||
@ -87,11 +74,6 @@ Keypairs.parseOrGenerate = function (opts) {
|
||||
Keypairs.import = function (opts) {
|
||||
return Eckles.import(opts).catch(function () {
|
||||
return Rasha.import(opts);
|
||||
}).then(function (jwk) {
|
||||
return Keypairs.thumbprint({ jwk: jwk }).then(function (thumb) {
|
||||
jwk.kid = thumb;
|
||||
return jwk;
|
||||
});
|
||||
});
|
||||
};
|
||||
|
||||
@ -111,7 +93,6 @@ Keypairs.neuter = Keypairs._neuter = function (opts) {
|
||||
// trying to find the best balance of an immutable copy with custom attributes
|
||||
var jwk = {};
|
||||
Object.keys(opts.jwk).forEach(function (k) {
|
||||
if ('undefined' === typeof opts.jwk[k]) { return; }
|
||||
// ignore RSA and EC private parts
|
||||
if (-1 !== ['d', 'p', 'q', 'dp', 'dq', 'qi'].indexOf(k)) { return; }
|
||||
jwk[k] = JSON.parse(JSON.stringify(opts.jwk[k]));
|
||||
@ -130,7 +111,7 @@ Keypairs.publish = function (opts) {
|
||||
} else {
|
||||
if (opts.exp) { jwk.exp = setTime(opts.exp); }
|
||||
else if (opts.expiresIn) { jwk.exp = Math.round(Date.now()/1000) + opts.expiresIn; }
|
||||
else if (opts.expiresAt) { jwk.exp = opts.expiresAt; }
|
||||
else { jwk.exp = opts.expiresAt; }
|
||||
}
|
||||
if (!jwk.use && false !== jwk.use) { jwk.use = "sig"; }
|
||||
|
||||
@ -154,9 +135,9 @@ Keypairs.signJwt = function (opts) {
|
||||
var header = opts.header || {};
|
||||
var claims = JSON.parse(JSON.stringify(opts.claims || {}));
|
||||
header.typ = 'JWT';
|
||||
|
||||
if (!header.kid) { header.kid = thumb; }
|
||||
if (!header.alg && opts.alg) { header.alg = opts.alg; }
|
||||
if (!header.kid) {
|
||||
header.kid = thumb;
|
||||
}
|
||||
if (!claims.iat && (false === claims.iat || false === opts.iat)) {
|
||||
claims.iat = undefined;
|
||||
} else if (!claims.iat) {
|
||||
@ -197,7 +178,7 @@ Keypairs.signJws = function (opts) {
|
||||
if (!opts.jwk) {
|
||||
throw new Error("opts.jwk must exist and must declare 'typ'");
|
||||
}
|
||||
return ('RSA' === opts.jwk.kty) ? "RS256" : "ES256";
|
||||
return ('RSA' === opts.jwk.typ) ? "RS256" : "ES256";
|
||||
}
|
||||
|
||||
function sign(pem) {
|
||||
@ -229,21 +210,13 @@ Keypairs.signJws = function (opts) {
|
||||
}
|
||||
|
||||
// node specifies RSA-SHAxxx even whet it's actually ecdsa (it's all encoded x509 shasums anyway)
|
||||
var nodeAlg = "SHA" + (((protect||header).alg||'').replace(/^[^\d]+/, '')||'256');
|
||||
var nodeAlg = "RSA-SHA" + (((protect||header).alg||'').replace(/^[^\d]+/, '')||'256');
|
||||
var protected64 = Enc.strToUrlBase64(protectedHeader);
|
||||
var payload64 = Enc.bufToUrlBase64(payload);
|
||||
var binsig = require('crypto')
|
||||
var sig = require('crypto')
|
||||
.createSign(nodeAlg)
|
||||
.update(protect ? (protected64 + "." + payload64) : payload64)
|
||||
.sign(pem)
|
||||
;
|
||||
if ('EC' === opts.jwk.kty) {
|
||||
// ECDSA JWT signatures differ from "normal" ECDSA signatures
|
||||
// https://tools.ietf.org/html/rfc7518#section-3.4
|
||||
binsig = ecdsaAsn1SigToJoseSig(binsig);
|
||||
}
|
||||
|
||||
var sig = binsig.toString('base64')
|
||||
.sign(pem, 'base64')
|
||||
.replace(/\+/g, '-')
|
||||
.replace(/\//g, '_')
|
||||
.replace(/=/g, '')
|
||||
@ -257,41 +230,6 @@ Keypairs.signJws = function (opts) {
|
||||
};
|
||||
}
|
||||
|
||||
function ecdsaAsn1SigToJoseSig(binsig) {
|
||||
// should have asn1 sequence header of 0x30
|
||||
if (0x30 !== binsig[0]) { throw new Error("Impossible EC SHA head marker"); }
|
||||
var index = 2; // first ecdsa "R" header byte
|
||||
var len = binsig[1];
|
||||
var lenlen = 0;
|
||||
// Seek length of length if length is greater than 127 (i.e. two 512-bit / 64-byte R and S values)
|
||||
if (0x80 & len) {
|
||||
lenlen = len - 0x80; // should be exactly 1
|
||||
len = binsig[2]; // should be <= 130 (two 64-bit SHA-512s, plus padding)
|
||||
index += lenlen;
|
||||
}
|
||||
// should be of BigInt type
|
||||
if (0x02 !== binsig[index]) { throw new Error("Impossible EC SHA R marker"); }
|
||||
index += 1;
|
||||
|
||||
var rlen = binsig[index];
|
||||
var bits = 32;
|
||||
if (rlen > 49) {
|
||||
bits = 64;
|
||||
} else if (rlen > 33) {
|
||||
bits = 48;
|
||||
}
|
||||
var r = binsig.slice(index + 1, index + 1 + rlen).toString('hex');
|
||||
var slen = binsig[index + 1 + rlen + 1]; // skip header and read length
|
||||
var s = binsig.slice(index + 1 + rlen + 1 + 1).toString('hex');
|
||||
if (2 *slen !== s.length) { throw new Error("Impossible EC SHA S length"); }
|
||||
// There may be one byte of padding on either
|
||||
while (r.length < 2*bits) { r = '00' + r; }
|
||||
while (s.length < 2*bits) { s = '00' + s; }
|
||||
if (2*(bits+1) === r.length) { r = r.slice(2); }
|
||||
if (2*(bits+1) === s.length) { s = s.slice(2); }
|
||||
return Buffer.concat([Buffer.from(r, 'hex'), Buffer.from(s, 'hex')]);
|
||||
}
|
||||
|
||||
if (opts.pem && opts.jwk) {
|
||||
return sign(opts.pem);
|
||||
} else {
|
||||
@ -342,25 +280,3 @@ Enc.bufToUrlBase64 = function (buf) {
|
||||
return Buffer.from(buf).toString('base64')
|
||||
.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
|
||||
};
|
||||
|
||||
// For 'rsa-compat' module only
|
||||
// PLEASE do not use these sync methods, they are deprecated
|
||||
Keypairs._importSync = function (opts) {
|
||||
try {
|
||||
return Eckles.importSync(opts);
|
||||
} catch(e) {
|
||||
try {
|
||||
return Rasha.importSync(opts);
|
||||
} catch(e) {
|
||||
console.error("options.pem does not appear to be a valid RSA or ECDSA public or private key");
|
||||
}
|
||||
}
|
||||
};
|
||||
// PLEASE do not use these, they are deprecated
|
||||
Keypairs._exportSync = function (opts) {
|
||||
if ('RSA' === opts.jwk.kty) {
|
||||
return Rasha.exportSync(opts);
|
||||
} else {
|
||||
return Eckles.exportSync(opts);
|
||||
}
|
||||
};
|
||||
|
||||
10
package.json
10
package.json
@ -1,7 +1,7 @@
|
||||
{
|
||||
"name": "keypairs",
|
||||
"version": "1.2.14",
|
||||
"description": "Lightweight RSA/ECDSA keypair generation and JWK <-> PEM using node's native RSA and ECDSA support",
|
||||
"version": "1.2.7",
|
||||
"description": "Lightweight RSA/ECDSA keypair generation and JWK <-> PEM",
|
||||
"main": "keypairs.js",
|
||||
"files": [
|
||||
"bin/keypairs.js"
|
||||
@ -21,11 +21,7 @@
|
||||
"RSA",
|
||||
"ECDSA",
|
||||
"PEM",
|
||||
"JWK",
|
||||
"keypair",
|
||||
"crypto",
|
||||
"sign",
|
||||
"verify"
|
||||
"JWK"
|
||||
],
|
||||
"author": "AJ ONeal <coolaj86@gmail.com> (https://coolaj86.com/)",
|
||||
"license": "MPL-2.0",
|
||||
|
||||
3
test.js
3
test.js
@ -1,7 +1,6 @@
|
||||
var Keypairs = require('./');
|
||||
|
||||
/* global Promise*/
|
||||
console.info("This SHOULD result in an error message:");
|
||||
Keypairs.parseOrGenerate({ key: '' }).then(function (pair) {
|
||||
// should NOT have any warning output
|
||||
if (!pair.private || !pair.public) {
|
||||
@ -91,7 +90,7 @@ Keypairs.parseOrGenerate({ key: '' }).then(function (pair) {
|
||||
if ('NOERR' === e.code) { throw e; }
|
||||
return true;
|
||||
})
|
||||
, Keypairs.signJwt({ jwk: pair.private, alg: 'ES512', iss: 'https://example.com/', exp: '1h' }).then(function (jwt) {
|
||||
, Keypairs.signJwt({ jwk: pair.private, iss: 'https://example.com/', exp: '1h' }).then(function (jwt) {
|
||||
var parts = jwt.split('.');
|
||||
var now = Math.round(Date.now()/1000);
|
||||
var token = {
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user