@andrewheberle/serverless-ssh-ca 0.21.0 → 0.23.0

package/src/krl.ts

@@ -1,5 +1,5 @@
-import type { AlgorithmPart, PrivateKey } from "sshpk"
-import { toFixedWidth } from "./sshsig/sig_parser.js"
+import type { PrivateKey } from "./ssh/keys.js"
+import { createSigner } from "./ssh/signer.js"
 
 // ── Constants ────────────────────────────────────────────────────────────────
 
@@ -59,32 +59,6 @@ function encodeSection(sectionType: number, data: Uint8Array): Uint8Array {
     return concat(new Uint8Array([sectionType]), encodeString(data))
 }
 
-// ── CA public-key extraction ─────────────────────────────────────────────────
-
-/**
- * Extract the SSH wire-format public key bytes from an sshpk PrivateKey.
- *
- * sshpk's "ssh" format produces a string like:
- *   ssh-ed25519 AAAA...base64... [comment]
- *
- * The base64 blob *is* the SSH wire encoding of the public key, so we just
- * decode it.  This works for both Ed25519 and ECDSA keys.
- */
-function caKeyWireBytes(caKey: PrivateKey): Uint8Array {
-    const sshString = caKey.toPublic().toString("ssh")
-    // Format: "<type> <base64> [<comment>]"  — we want the second token.
-    const base64 = sshString.trim().split(/\s+/)[1]
-    if (!base64) {
-        throw new Error("Unexpected sshpk 'ssh' format output: " + sshString)
-    }
-    const binary = atob(base64)
-    const bytes = new Uint8Array(binary.length)
-    for (let i = 0; i < binary.length; i++) {
-        bytes[i] = binary.charCodeAt(i)
-    }
-    return bytes
-}
-
 // ── Constants ────────────────────────────────────────────────────────────────
 
 const SSHSIG_MAGIC = new TextEncoder().encode("SSHSIG")
@@ -92,156 +66,6 @@ const SIG_VERSION = 1
 const NAMESPACE = "krl@com.github.serverless-ssh-ca.andrewheberle"
 const HASH_ALGORITHM = "sha512"
 
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-/**
- * Get the raw bytes of a named part of an sshpk key.
- */
-function keyPart(key: PrivateKey, name: AlgorithmPart): Uint8Array {
-    const part = key.parts.find((p) => p.name === name)
-    if (part === undefined) {
-        throw new Error(`Missing ${name} part in ${key.type} key`)
-    }
-    return part.data
-}
-
-/**
- * Base64url-encode bytes without padding, as used for JWK values.
- */
-function base64url(bytes: Uint8Array): string {
-    let binary = ""
-    for (const byte of bytes) {
-        binary += String.fromCharCode(byte)
-    }
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
-}
-
-/**
- * Import an sshpk PrivateKey into a WebCrypto CryptoKey.
- * Supports Ed25519 and ECDSA (P-256 / P-384 / P-521).
- */
-async function importPrivateKey(caKey: PrivateKey): Promise<{
-    cryptoKey: CryptoKey
-    sigAlgo: string // SSH signature algorithm name
-    webCryptoAlgo: Parameters<SubtleCrypto["sign"]>[0]
-}> {
-    const type = caKey.type // "ed25519" | "ecdsa" | etc.
-    const curve = (caKey as unknown as { curve?: string }).curve
-
-    if (type === "ed25519") {
-        // import from the raw key parts as a JWK rather than via sshpk's PKCS#8
-        // output, which drops a leading zero byte from the seed (about 1 key in
-        // 512) and is then rejected by WebCrypto
-        const seed = keyPart(caKey, "k")
-        const publicKey = keyPart(caKey, "A")
-        if (seed.length !== 32 || publicKey.length !== 32) {
-            throw new Error(`Unexpected Ed25519 key part lengths: k=${seed.length} A=${publicKey.length}`)
-        }
-        const cryptoKey = await crypto.subtle.importKey(
-            "jwk",
-            { kty: "OKP", crv: "Ed25519", d: base64url(seed), x: base64url(publicKey) },
-            { name: "Ed25519" },
-            false,
-            ["sign"],
-        )
-        return {
-            cryptoKey,
-            sigAlgo: "ssh-ed25519",
-            webCryptoAlgo: { name: "Ed25519" },
-        }
-    } else if (type === "ecdsa") {
-        let namedCurve: string
-        let sigAlgo: string
-        let hash: string
-        let size: number // bytes in each coordinate and the private key
-
-        if (curve === "nistp256") {
-            namedCurve = "P-256"
-            sigAlgo = "ecdsa-sha2-nistp256"
-            hash = "SHA-256"
-            size = 32
-        } else if (curve === "nistp384") {
-            namedCurve = "P-384"
-            sigAlgo = "ecdsa-sha2-nistp384"
-            hash = "SHA-384"
-            size = 48
-        } else if (curve === "nistp521") {
-            namedCurve = "P-521"
-            sigAlgo = "ecdsa-sha2-nistp521"
-            hash = "SHA-512"
-            size = 66
-        } else {
-            throw new Error(`Unsupported ECDSA curve: ${curve}`)
-        }
-
-        // import from the raw key parts as a JWK rather than via sshpk's PKCS#8
-        // output, which drops leading zero bytes from the private key so it is
-        // shorter than RFC 5915 requires (about half of P-521 keys)
-        const point = keyPart(caKey, "Q")
-        if (point.length !== 1 + size * 2 || point[0] !== 0x04) {
-            throw new Error(`Unexpected ECDSA public key encoding for ${curve}`)
-        }
-        // d is an SSH mpint, so may be short or have a leading sign byte
-        const d = toFixedWidth(keyPart(caKey, "d"), size)
-        const cryptoKey = await crypto.subtle.importKey(
-            "jwk",
-            {
-                kty: "EC",
-                crv: namedCurve,
-                d: base64url(d),
-                x: base64url(point.subarray(1, 1 + size)),
-                y: base64url(point.subarray(1 + size)),
-            },
-            { name: "ECDSA", namedCurve },
-            false,
-            ["sign"],
-        )
-        return {
-            cryptoKey,
-            sigAlgo,
-            webCryptoAlgo: { name: "ECDSA", hash: { name: hash } },
-        }
-    } else {
-        throw new Error(`Unsupported key type: ${type}`)
-    }
-}
-
-/**
- * Convert a WebCrypto ECDSA signature (IEEE P1363: raw r||s) to the SSH wire
- * encoding: string(algo) + string(mpint(r) + mpint(s)).
- *
- * SSH mpints are big-endian, with a leading 0x00 byte if the high bit is set.
- */
-function p1363ToSshEcdsaSig(
-    p1363: Uint8Array,
-    sigAlgo: string,
-): Uint8Array {
-    const half = p1363.length / 2
-    const r = p1363.slice(0, half)
-    const s = p1363.slice(half)
-
-    function encodeMpint(n: Uint8Array): Uint8Array {
-        // Strip leading zero bytes, then re-pad if high bit set.
-        let start = 0
-        while (start < n.length - 1 && n[start] === 0) start++
-        const trimmed = n.slice(start)
-        const padded =
-            trimmed[0]! & 0x80 ? concat(new Uint8Array([0x00]), trimmed) : trimmed
-        return encodeString(padded)
-    }
-
-    const innerSig = concat(encodeMpint(r), encodeMpint(s))
-    return concat(encodeString(sigAlgo), encodeString(innerSig))
-}
-
-/**
- * Wrap an Ed25519 WebCrypto signature into SSH wire encoding:
- * string(algo) + string(sig_bytes)
- */
-function wrapEd25519Sig(sig: Uint8Array): Uint8Array {
-    return concat(encodeString("ssh-ed25519"), encodeString(sig))
-}
-
 /**
  * Base64-encode bytes and wrap in SSH signature armor at 76 chars per line.
  */
@@ -298,6 +122,29 @@ export class KRLBuilder {
         return this
     }
 
+    /**
+     * Return a hex encoded SHA-256 digest of the content of the KRL.
+     *
+     * The digest covers the CA public key and the revoked serials and key IDs,
+     * but not the order they were added in or the header, so it only changes
+     * when the set of revoked certificates or the CA does.
+     */
+    async digest(): Promise<string> {
+        const serials = [...this._serials].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
+        const keyIds = [...this._keyIds].sort()
+
+        const content = concat(
+            encodeString(this._caKey.publicKey.blob),
+            encodeUint32(serials.length),
+            ...serials.map(encodeUint64),
+            encodeUint32(keyIds.length),
+            ...keyIds.map((id) => encodeString(id)),
+        )
+
+        const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", content))
+        return Array.from(hash, (b) => b.toString(16).padStart(2, "0")).join("")
+    }
+
     /**
      * Generate the binary KRL
      *
@@ -352,7 +199,7 @@ export class KRLBuilder {
         //   <one or more cert sub-sections>
         //
         const certSectionData = concat(
-            encodeString(caKeyWireBytes(this._caKey)), // ca_key
+            encodeString(this._caKey.publicKey.blob), // ca_key
             encodeString(""), // reserved
             ...certSubSections
         )
@@ -386,7 +233,7 @@ export class KRLBuilder {
         } else {
             krl = this._krl
         }
-        const { cryptoKey, sigAlgo, webCryptoAlgo } = await importPrivateKey(this._caKey)
+        const signer = await createSigner(this._caKey)
 
         // 1. Hash the KRL bytes with SHA-512.
         const krlHash = new Uint8Array(
@@ -408,18 +255,10 @@ export class KRLBuilder {
             encodeString(krlHash),
         )
 
-        // 3. Sign the blob.
-        const rawSig = new Uint8Array(
-            await crypto.subtle.sign(webCryptoAlgo, cryptoKey, signedData),
-        )
-
-        // 4. Encode the signature into SSH wire format.
-        const sshSig =
-            sigAlgo === "ssh-ed25519"
-                ? wrapEd25519Sig(rawSig)
-                : p1363ToSshEcdsaSig(rawSig, sigAlgo)
+        // 3. Sign the blob, which returns the signature in SSH wire format.
+        const sshSig = await signer.sign(signedData)
 
-        // 5. Assemble the outer SSHSIG blob.
+        // 4. Assemble the outer SSHSIG blob.
         //
         //   byte[6]  "SSHSIG"
         //   uint32   SIG_VERSION (1)
@@ -428,18 +267,17 @@ export class KRLBuilder {
         //   string   reserved  (empty)
         //   string   hash_algorithm
         //   string   signature
-        const publicKeyWire = caKeyWireBytes(this._caKey)
         const sigBlob = concat(
             SSHSIG_MAGIC,
             encodeUint32(SIG_VERSION),
-            encodeString(publicKeyWire),
+            encodeString(signer.publicKey),
             encodeString(NAMESPACE),
             encodeString(""),      // reserved
             encodeString(HASH_ALGORITHM),
             encodeString(sshSig),
         )
 
-        // 6. Armor and return.
+        // 5. Armor and return.
         return armorSignature(sigBlob)
     }
 }

package/src/proof.ts

@@ -1,16 +1,34 @@
 import { ms } from "itty-time"
-import sshpk from "sshpk"
-import type { Fingerprint, Key } from "sshpk"
+import { KeyParseError, PublicKey } from "./ssh/keys.js"
 import { verify } from "./sshsig/index.js"
 import { parse } from "./sshsig/sig_parser.js"
 import { Sig } from "./sshsig/sig.js"
 import { group, Logger, LogLevel } from "@andrewheberle/ts-slog"
 
-// sshpk is CommonJS and Node's ESM loader cannot detect most of its named exports, so values are taken from the default import
-const { FingerprintFormatError, parseFingerprint, parseKey } = sshpk
+// a SHA256 fingerprint as shown by ssh-keygen -l, which is unpadded base64
+const FingerprintFormat = /^SHA256:[A-Za-z0-9+/]{43}$/
 
 export const Namespace = "proof-of-possession@com.github.serverless-ssh-ca.andrewheberle"
 
+/**
+ * The namespace used for proofs of possession that are bound to a request,
+ * kept separate from {@link Namespace} so a proof made for one form can never
+ * be accepted as the other.
+ */
+export const RequestNamespace = "request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle"
+
+/**
+ * Returns the request a proof of possession is bound to, which is appended to
+ * the signed data as `${timestamp}.${fingerprint}.${binding}`.
+ *
+ * @param method The HTTP method of the request, for example "DELETE"
+ * @param path The path of the request with any parameters filled in, for example "/api/v4/user/certificates/123"
+ * @returns The request binding, for example "DELETE /api/v4/user/certificates/123"
+ */
+export const requestBinding = (method: string, path: string): string => {
+	return `${method.toUpperCase()} ${path}`
+}
+
 export class PossessionParseError extends Error {
 	constructor(message: string, cause?: unknown) {
 		super(message)
@@ -38,9 +56,10 @@ export class PossessionParseError extends Error {
  */
 export class ProofOfPossession {
 	readonly timestamp: number
-	readonly fingerprint: Fingerprint
+	/** The SHA256 fingerprint of the key, for example "SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs" */
+	readonly fingerprint: string
 	readonly signature: Sig
-	readonly signaturePubkey: Key
+	readonly signaturePubkey: PublicKey
 	readonly logger: Logger
 	private readonly data: string
 
@@ -69,10 +88,9 @@ constructor(proof: string, options?: { from?: number, logger?: Logger, skew?: nu
 			throw new PossessionParseError("timestamp was from the future")
 		}
 		try {
-			// parse fingerprint
-			const fingerprint = parseFingerprint(fingerprintString!)
-			if (fingerprint === undefined) {
-				throw new PossessionParseError("fingerprint did not parse")
+			// check fingerprint
+			if (!FingerprintFormat.test(fingerprintString!)) {
+				throw new PossessionParseError("proof of possession fingerprint was an invalid format")
 			}
 
 			// convert siganture from base64
@@ -86,26 +104,26 @@ constructor(proof: string, options?: { from?: number, logger?: Logger, skew?: nu
 				throw new PossessionParseError("proof of possession signature could not be parsed", err)
 			}
 
-			this.fingerprint = fingerprint
+			this.fingerprint = fingerprintString!
 			this.data = `${timestamp}.${fingerprintString}`
-			this.signaturePubkey = parseKey(this.signature.publickey.toString())
+			this.signaturePubkey = PublicKey.parse(this.signature.publickey.toString())
 
 			// ensure the provided fingerprint matches the signature public key
-			if (!this.fingerprint.matches(this.signaturePubkey)) {
+			if (this.fingerprint !== this.signaturePubkey.fingerprint()) {
 				throw new PossessionParseError("proof of possession fingerprint does not match signature public key")
 			}
 
 			this.logger.debug("constructor completed",
 				...group("this",
 					"timestamp", this.timestamp,
-					"fingerprint", this.fingerprint.toString("base64"),
-					"signaturePubkey.fingerprint()", this.signaturePubkey.fingerprint().toString("base64"),
+					"fingerprint", this.fingerprint,
+					"signaturePubkey.fingerprint()", this.signaturePubkey.fingerprint(),
 				),
 			)
 		} catch (err) {
 			switch (true) {
-				case (err instanceof FingerprintFormatError):
-					throw new PossessionParseError("proof of possession fingerprint was an invalid format", err)
+				case (err instanceof KeyParseError):
+					throw new PossessionParseError(`proof of possession signature key could not be used: ${err.message}`, err)
 				default:
 					throw err
 			}
@@ -120,26 +138,42 @@ constructor(proof: string, options?: { from?: number, logger?: Logger, skew?: nu
 		return await verify(this.signature, this.data, { namespace: namespace || Namespace })
 	}
 
+	/**
+	 * Verifies the proof was made for a specific request, so it cannot be
+	 * replayed against another endpoint or with other path parameters (such
+	 * as a different certificate serial).
+	 *
+	 * The signed data is `${timestamp}.${fingerprint}.${METHOD} ${path}` using
+	 * the {@link RequestNamespace} namespace.
+	 *
+	 * @param method The HTTP method of the request
+	 * @param path The path of the request with any parameters filled in
+	 * @returns true if signature is valid for the request, false otherwise
+	 */
+	async verifyRequest(method: string, path: string): Promise<boolean> {
+		return await verify(this.signature, `${this.data}.${requestBinding(method, path)}`, { namespace: RequestNamespace })
+	}
+
 	/**
 	 *
 	 * @param keys array of keys to verify finterprint against
 	 * @returns true if the proof of possession fingerprint matches any of the provided keys, false otherwise
 	 */
-	matches(key: Key): boolean
-	matches(...keys: Key[]): boolean
+	matches(key: PublicKey): boolean
+	matches(...keys: PublicKey[]): boolean
 
-	matches(...keys: Key[]): boolean {
+	matches(...keys: PublicKey[]): boolean {
 		this.logger.debug("matches() called", "in", "ProofOfPossession", "keys", keys.length)
 		try {
 			for (const key of keys) {
 				// confirm proof of possession fingerprint matches keys
-				this.logger.debug("this.fingerprint.matches()", "in", "ProofOfPossession", "fingerprint", this.fingerprint.toString("base64"), "key", key.toString("ssh"))
-				if (!this.fingerprint.matches(key))
+				this.logger.debug("comparing fingerprint", "in", "ProofOfPossession", "fingerprint", this.fingerprint, "key", key.toString())
+				if (this.fingerprint !== key.fingerprint())
 					return false
 
 				// also confirm key used to sign proof of possession matches
-				this.logger.debug("this.signaturePubkey.fingerprint().matches()", "in", "ProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint().toString("base64"), "key", key.toString("ssh"))
-				if (!this.signaturePubkey.fingerprint().matches(key))
+				this.logger.debug("comparing signature public key", "in", "ProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint(), "key", key.toString())
+				if (!this.signaturePubkey.equals(key))
 					return false
 			}
 			this.logger.debug("matches() completed", "in", "ProofOfPossession", "keys", keys.length)
@@ -163,10 +197,10 @@ export class PossessionMatchError extends Error {
 }
 
 export class RenewalProofOfPossession extends ProofOfPossession {
-	override matches(key: Key): never
-	override matches(...keys: Key[]): boolean
+	override matches(key: PublicKey): never
+	override matches(...keys: PublicKey[]): boolean
 
-	override matches(...keys: Key[]): boolean {
+	override matches(...keys: PublicKey[]): boolean {
 		this.logger.debug("matches() called", "in", "RenewalProofOfPossession", "keys", keys.length)
 		if (keys.length === 1) {
 			throw new PossessionMatchError("must verify both public key and certificate")
@@ -174,11 +208,11 @@ export class RenewalProofOfPossession extends ProofOfPossession {
 
 		try {
 			for (const key of keys) {
-				this.logger.debug("this.fingerprint.matches()", "in", "RenewalProofOfPossession", "fingerprint", this.fingerprint.toString("base64"), "key", key.toString("ssh"))
-				if (!this.fingerprint.matches(key))
+				this.logger.debug("comparing fingerprint", "in", "RenewalProofOfPossession", "fingerprint", this.fingerprint, "key", key.toString())
+				if (this.fingerprint !== key.fingerprint())
 					return false
-				this.logger.debug("this.signaturePubkey.fingerprint().matches()", "in", "RenewalProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint().toString("base64"), "key", key.toString("ssh"))
-				if (!this.signaturePubkey.fingerprint().matches(key))
+				this.logger.debug("comparing signature public key", "in", "RenewalProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint(), "key", key.toString())
+				if (!this.signaturePubkey.equals(key))
 					return false
 			}
 			this.logger.debug("matches() completed", "in", "RenewalProofOfPossession", "keys", keys.length)

package/src/router.ts

@@ -1,6 +1,7 @@
 import { fromHono } from "chanfana"
 import { Hono, type Context } from "hono"
 import { createApi as apiv3 } from "./api/v3/index.js"
+import { BasePath as v4BasePath, createApi as apiv4 } from "./api/v4/index.js"
 import { HTTPException } from "hono/http-exception"
 import { logger } from "./logger.js"
 import type { SshCaBindings } from "./types.js"
@@ -24,7 +25,7 @@ export const createApp = (env: SshCaBindings) => {
 		schema: {
 			info: {
 				title: "Serverless SSH CA API",
-				version: "3.0.0"
+				version: "4.0.0"
 			},
 		}
 	})
@@ -36,6 +37,7 @@ export const createApp = (env: SshCaBindings) => {
     })
 
     app.route("/api/v3", apiv3(env))
+    app.route(v4BasePath, apiv4(env))
 
     return app
 }