cert-to-cwt 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 3f30a9c6e0631d3daaca07bac5a27a9dc34bd4cb
+  data.tar.gz: e78ff0859be82052447ac491c072d78b5f217919
+SHA512:
+  metadata.gz: 9ff25fea72d4b4ae22172b72ccf3f739d2607d221ac855a498a24dabb00f2f8900cd7b8f33a49217a102ddb091b781f9f93c8d25d83e6600372059729f432a86
+  data.tar.gz: e1626c35abfbca01ad4d00157ce149add3330414ac5dee2ce532d6ed65709a3244f15f6814df534ad0fd18e23f08252887dba1da1df6f262e3a89b7c94b71f87

data/bin/cert-to-cwt.rb

@@ -0,0 +1,193 @@
+require 'asn1-pure.rb'
+require 'yaml'
+require 'time'
+require 'cbor-diagnostic'
+
+class String
+  def hexi
+    bytes.map{|x| "%02x" % x}.join
+  end
+  def hexs
+    bytes.map{|x| "%02x" % x}.join(" ")
+  end
+  def xeh
+    gsub(/\s/, "").chars.each_slice(2).map{ |x| Integer(x.join, 16).chr("BINARY") }.join
+  end
+end
+
+if ARGV[0] == "-b"
+  ARGV.shift
+  $binary = true
+end
+DUMPFILE = "dumped-cert.yml"
+if ARGV[0] == "-d"
+  ARGV.shift
+  $dump = true
+end
+if ARGV[0] == "-b"
+  ARGV.shift
+  $binary = true
+end
+f = ARGF.read.b
+
+def numbertobytes(n)            # doesn't work for 0
+  if n == 0
+    "".b
+  else
+    s = n.to_s(16)
+    s[0...0] = "0" if s.size.odd?
+    [s].pack("H*").b
+  end
+end
+fail unless numbertobytes(0) == ""
+fail unless numbertobytes(10) == "\x0A"
+fail unless numbertobytes(160) == "\xA0".b
+fail unless numbertobytes(1000) == "\x03\xE8".b
+
+def bitstringtobytes(s)
+  fail "bitstring #{s}" if s[0] != "\0"
+  s[1..-1]
+end
+
+def datetimeasn1(s)
+  Time.iso8601(s.sub(/\A(..)(..)(..)(..)(..)(..)Z\z/){"20#$1-#$2-#$3T#$4:#$5:#$6Z"}).to_i
+end
+
+OIDLOOKUP = Hash.new {|h, k| k}
+%w(
+2.5.4.3                              CN
+1.2.840.113549.1.9.1                 E
+2.5.4.11                             OU
+2.5.4.10                             O
+2.5.4.7                              L
+2.5.4.8                              ST
+2.5.4.6                              C
+0.9.2342.19200300.100.1.25           DC
+
+2.5.4.12                             TITLE
+0.9.2342.19200300.100.1.3            MAIL
+2.5.4.5                              SERIALNUMBER
+1.2.840.113549.1.9.2                 UNSTRUCTUREDNAME
+1.2.840.113549.1.9.8                 UNSTRUCTUREDADDRESS
+2.5.4.42                             GN
+2.5.4.4                              SN
+
+2.5.4.9                              STREET
+0.9.2342.19200300.100.1.1            UID
+).each_slice(2).map{ |x, y| OIDLOOKUP[x] = y}
+# middle group stolen from netscape certificate management system administrator guide
+# puts OIDLOOKUP.to_yaml
+
+def dntostring(dn)              # almost RFC 4514
+  sets = dn.fetch(:seq)
+  sets.map do |s|
+    g = s.fetch(:set)
+    g.map do |elt|
+      aname, aval = elt.fetch(:seq)
+      [OIDLOOKUP[aname], aval.values.first.gsub(/[ #"+,;<>\\]/){"\\#$&"}].join("=")
+    end.join("+")
+  end.join(",")
+end
+
+ALGLOOKUP = Hash.new {|h, k| k}
+%w(
+1.2.840.113549.1.1.11 sha256WithRSAEncryption
+1.2.840.113549.1.1.1  rsaEncryption
+).each_slice(2).map{ |x, y| ALGLOOKUP[x] = y.intern}
+
+SYMLOOKUP = Hash.new {|h, k| warn "label unknown for key :#{k}"; k}
+%w(
+iss   1
+sub   2
+aud   3
+exp   4
+nbf   5
+iat   6
+cti   7
+
+
+kty 1
+n -1
+e -2
+
+serial -100000
+pk -100001
+).each_slice(2).map{ |x, y| SYMLOOKUP[x.intern] = y.to_i}
+
+def desymbolicate(o)
+  case o
+  when Symbol
+    SYMLOOKUP[o]
+  when Hash
+    Hash[o.map {|k, v| [desymbolicate(k), desymbolicate(v)]}]
+  when Array
+    o.map {|x| desymbolicate(x)}
+  else
+    o
+  end
+end
+
+#  RFC 4514
+
+cert = ASN1.decode(f)
+claimset = {}
+if $dump
+  warn "Dumping cert as #{DUMPFILE}..."
+  File.write(DUMPFILE, cert.to_yaml)
+end
+tbs, sigalg, sigval = cert.fetch(:seq)
+ver, ser, sigalg1, iss, validity, sub, spki, *rest = tbs.fetch(:seq)
+fail [:ver, ver].inspect unless ver == {exp0: [2]}
+fail [:ser, set].inspect unless Integer === ser
+claimset[:serial] = ser
+fail [:alg, sigalg, sigalg1].inspect unless sigalg == sigalg1
+
+decoded_sigalg = ALGLOOKUP[sigalg.fetch(:seq).first]
+# p decoded_sigalg
+
+notbefore, notafter = validity.fetch(:seq).map{|x| datetimeasn1(x.fetch(:t))}
+# p [notbefore, notafter]
+claimset[:nbf] = notbefore
+claimset[:exp] = notafter
+
+claimset[:iss] = dntostring(iss)
+claimset[:sub] = dntostring(sub)
+
+pkalg, pkbits = spki.fetch(:seq)
+decoded_pkalg = ALGLOOKUP[pkalg.fetch(:seq).first]
+kk = bitstringtobytes(pkbits.fetch(:bits))
+case decoded_pkalg
+when  :rsaEncryption
+  kk = ASN1.decode(kk)
+  n, e = kk.fetch(:seq)
+  u = CBOR.encode(n)
+  claimset[:pk] = {kty: 3, n: numbertobytes(n), e: numbertobytes(e)}
+else
+  claimset[:pk] = [decoded_pkalg, kk] # TODO convert to COSE key
+end
+
+rest1 = rest.reduce({}, :merge)
+
+exp3 = rest1.delete(:exp3)
+puts [:rest1, rest1].to_yaml unless rest1 == {}
+
+exp3[0].fetch(:seq).each do |e3|
+  name, crit, val = e3.fetch(:seq)
+  if Hash === crit
+    val = crit
+    crit = false
+  end
+  val = val.fetch(:b)
+  # val = ASN1.decode(val)
+  claimset[name] = val          # er, ignoring crit right now
+end
+
+claimset = desymbolicate(claimset)
+
+claimset_cbor = claimset.to_cbor
+warn "CBOR size: #{claimset_cbor.size}"
+if $binary
+  print claimset_cbor
+else
+  puts CBOR.decode(claimset_cbor).cbor_diagnostic
+end

data/cert-to-cwt.gemspec

@@ -0,0 +1,19 @@
+Gem::Specification.new do |s|
+  s.name = "cert-to-cwt"
+  s.version = "0.0.1"
+  s.summary = "Convert an X.509 cert into a CWT claim set"
+  s.description = %q{cert-to-cwt is a highly experimental converter for X.509 certificates into CWT claim sets.}
+  s.author = "Carsten Bormann"
+  s.email = "cabo@tzi.org"
+  s.license = "Apache-2.0"
+  s.has_rdoc = false
+  s.files = Dir['lib/**/*.rb'] + %w(cert-to-cwt.gemspec) + Dir['bin/**/*.rb']
+  s.executables = Dir['bin/**/*.rb'].map {|x| File.basename(x)}
+  s.required_ruby_version = '>= 2.4.1'
+
+  s.require_paths = ["lib"]
+
+  s.add_development_dependency 'bundler', '~>1'
+  s.add_dependency 'cbor-diag'
+  s.add_dependency 'asn1-diag'
+end

metadata

@@ -0,0 +1,89 @@
+--- !ruby/object:Gem::Specification
+name: cert-to-cwt
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Carsten Bormann
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2017-08-21 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
+- !ruby/object:Gem::Dependency
+  name: cbor-diag
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: asn1-diag
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: cert-to-cwt is a highly experimental converter for X.509 certificates
+  into CWT claim sets.
+email: cabo@tzi.org
+executables:
+- cert-to-cwt.rb
+extensions: []
+extra_rdoc_files: []
+files:
+- bin/cert-to-cwt.rb
+- cert-to-cwt.gemspec
+homepage: 
+licenses:
+- Apache-2.0
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.4.1
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.6.11
+signing_key: 
+specification_version: 4
+summary: Convert an X.509 cert into a CWT claim set
+test_files: []