@andrewheberle/serverless-ssh-ca 0.22.0 → 0.24.0

package/src/index.ts

@@ -1,8 +1,9 @@
 import type { ExecutionContext } from "hono"
 import { dbCleanup } from "./db/index.js"
-import { createApp } from "./router.js"
+import { createApp, type SshCaOptions } from "./router.js"
 import type { SshCaBindings } from "./types.js"
-export type { CaDatabase, CaDatabaseQueryResult, CaDatabaseResult, CaPreparedStatement, CaSecret, SshCaBindings } from "./types.js"
+export type { CaCache, CaDatabase, CaDatabaseQueryResult, CaDatabaseResult, CaPreparedStatement, CaRateLimiter, CaSecret, SshCaBindings } from "./types.js"
+export { cloudflareClientIp, type RateLimitKey, type SshCaOptions } from "./router.js"
 
 // the handlers the CA exposes, compatible with a Cloudflare Workers ExportedHandler
 type SshCaHandler = {
@@ -35,10 +36,11 @@ export interface SshCa {
  * the runtime on each request.
  *
  * @param env The bindings (configuration, database and private key) for the CA, see {@link SshCaBindings}
+ * @param options Options for the CA, such as the key requests are rate limited by, see {@link SshCaOptions}
  * @returns The CA's request handler and database cleanup task, see {@link SshCa}
  */
-export const createSshCa = (env: SshCaBindings): SshCa => {
-    const app = createApp(env)
+export const createSshCa = (env: SshCaBindings, options: SshCaOptions = {}): SshCa => {
+    const app = createApp(env, options)
 
     return {
         fetch: async (req: Request): Promise<Response> => await app.fetch(req, env),

package/src/krl.ts

@@ -1,5 +1,5 @@
-import type { AlgorithmPart, PrivateKey } from "sshpk"
-import { toFixedWidth } from "./sshsig/sig_parser.js"
+import type { PrivateKey } from "./ssh/keys.js"
+import { createSigner } from "./ssh/signer.js"
 
 // ── Constants ────────────────────────────────────────────────────────────────
 
@@ -59,32 +59,6 @@ function encodeSection(sectionType: number, data: Uint8Array): Uint8Array {
     return concat(new Uint8Array([sectionType]), encodeString(data))
 }
 
-// ── CA public-key extraction ─────────────────────────────────────────────────
-
-/**
- * Extract the SSH wire-format public key bytes from an sshpk PrivateKey.
- *
- * sshpk's "ssh" format produces a string like:
- *   ssh-ed25519 AAAA...base64... [comment]
- *
- * The base64 blob *is* the SSH wire encoding of the public key, so we just
- * decode it.  This works for both Ed25519 and ECDSA keys.
- */
-function caKeyWireBytes(caKey: PrivateKey): Uint8Array {
-    const sshString = caKey.toPublic().toString("ssh")
-    // Format: "<type> <base64> [<comment>]"  — we want the second token.
-    const base64 = sshString.trim().split(/\s+/)[1]
-    if (!base64) {
-        throw new Error("Unexpected sshpk 'ssh' format output: " + sshString)
-    }
-    const binary = atob(base64)
-    const bytes = new Uint8Array(binary.length)
-    for (let i = 0; i < binary.length; i++) {
-        bytes[i] = binary.charCodeAt(i)
-    }
-    return bytes
-}
-
 // ── Constants ────────────────────────────────────────────────────────────────
 
 const SSHSIG_MAGIC = new TextEncoder().encode("SSHSIG")
@@ -92,156 +66,6 @@ const SIG_VERSION = 1
 const NAMESPACE = "krl@com.github.serverless-ssh-ca.andrewheberle"
 const HASH_ALGORITHM = "sha512"
 
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-/**
- * Get the raw bytes of a named part of an sshpk key.
- */
-function keyPart(key: PrivateKey, name: AlgorithmPart): Uint8Array {
-    const part = key.parts.find((p) => p.name === name)
-    if (part === undefined) {
-        throw new Error(`Missing ${name} part in ${key.type} key`)
-    }
-    return part.data
-}
-
-/**
- * Base64url-encode bytes without padding, as used for JWK values.
- */
-function base64url(bytes: Uint8Array): string {
-    let binary = ""
-    for (const byte of bytes) {
-        binary += String.fromCharCode(byte)
-    }
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
-}
-
-/**
- * Import an sshpk PrivateKey into a WebCrypto CryptoKey.
- * Supports Ed25519 and ECDSA (P-256 / P-384 / P-521).
- */
-async function importPrivateKey(caKey: PrivateKey): Promise<{
-    cryptoKey: CryptoKey
-    sigAlgo: string // SSH signature algorithm name
-    webCryptoAlgo: Parameters<SubtleCrypto["sign"]>[0]
-}> {
-    const type = caKey.type // "ed25519" | "ecdsa" | etc.
-    const curve = (caKey as unknown as { curve?: string }).curve
-
-    if (type === "ed25519") {
-        // import from the raw key parts as a JWK rather than via sshpk's PKCS#8
-        // output, which drops a leading zero byte from the seed (about 1 key in
-        // 512) and is then rejected by WebCrypto
-        const seed = keyPart(caKey, "k")
-        const publicKey = keyPart(caKey, "A")
-        if (seed.length !== 32 || publicKey.length !== 32) {
-            throw new Error(`Unexpected Ed25519 key part lengths: k=${seed.length} A=${publicKey.length}`)
-        }
-        const cryptoKey = await crypto.subtle.importKey(
-            "jwk",
-            { kty: "OKP", crv: "Ed25519", d: base64url(seed), x: base64url(publicKey) },
-            { name: "Ed25519" },
-            false,
-            ["sign"],
-        )
-        return {
-            cryptoKey,
-            sigAlgo: "ssh-ed25519",
-            webCryptoAlgo: { name: "Ed25519" },
-        }
-    } else if (type === "ecdsa") {
-        let namedCurve: string
-        let sigAlgo: string
-        let hash: string
-        let size: number // bytes in each coordinate and the private key
-
-        if (curve === "nistp256") {
-            namedCurve = "P-256"
-            sigAlgo = "ecdsa-sha2-nistp256"
-            hash = "SHA-256"
-            size = 32
-        } else if (curve === "nistp384") {
-            namedCurve = "P-384"
-            sigAlgo = "ecdsa-sha2-nistp384"
-            hash = "SHA-384"
-            size = 48
-        } else if (curve === "nistp521") {
-            namedCurve = "P-521"
-            sigAlgo = "ecdsa-sha2-nistp521"
-            hash = "SHA-512"
-            size = 66
-        } else {
-            throw new Error(`Unsupported ECDSA curve: ${curve}`)
-        }
-
-        // import from the raw key parts as a JWK rather than via sshpk's PKCS#8
-        // output, which drops leading zero bytes from the private key so it is
-        // shorter than RFC 5915 requires (about half of P-521 keys)
-        const point = keyPart(caKey, "Q")
-        if (point.length !== 1 + size * 2 || point[0] !== 0x04) {
-            throw new Error(`Unexpected ECDSA public key encoding for ${curve}`)
-        }
-        // d is an SSH mpint, so may be short or have a leading sign byte
-        const d = toFixedWidth(keyPart(caKey, "d"), size)
-        const cryptoKey = await crypto.subtle.importKey(
-            "jwk",
-            {
-                kty: "EC",
-                crv: namedCurve,
-                d: base64url(d),
-                x: base64url(point.subarray(1, 1 + size)),
-                y: base64url(point.subarray(1 + size)),
-            },
-            { name: "ECDSA", namedCurve },
-            false,
-            ["sign"],
-        )
-        return {
-            cryptoKey,
-            sigAlgo,
-            webCryptoAlgo: { name: "ECDSA", hash: { name: hash } },
-        }
-    } else {
-        throw new Error(`Unsupported key type: ${type}`)
-    }
-}
-
-/**
- * Convert a WebCrypto ECDSA signature (IEEE P1363: raw r||s) to the SSH wire
- * encoding: string(algo) + string(mpint(r) + mpint(s)).
- *
- * SSH mpints are big-endian, with a leading 0x00 byte if the high bit is set.
- */
-function p1363ToSshEcdsaSig(
-    p1363: Uint8Array,
-    sigAlgo: string,
-): Uint8Array {
-    const half = p1363.length / 2
-    const r = p1363.slice(0, half)
-    const s = p1363.slice(half)
-
-    function encodeMpint(n: Uint8Array): Uint8Array {
-        // Strip leading zero bytes, then re-pad if high bit set.
-        let start = 0
-        while (start < n.length - 1 && n[start] === 0) start++
-        const trimmed = n.slice(start)
-        const padded =
-            trimmed[0]! & 0x80 ? concat(new Uint8Array([0x00]), trimmed) : trimmed
-        return encodeString(padded)
-    }
-
-    const innerSig = concat(encodeMpint(r), encodeMpint(s))
-    return concat(encodeString(sigAlgo), encodeString(innerSig))
-}
-
-/**
- * Wrap an Ed25519 WebCrypto signature into SSH wire encoding:
- * string(algo) + string(sig_bytes)
- */
-function wrapEd25519Sig(sig: Uint8Array): Uint8Array {
-    return concat(encodeString("ssh-ed25519"), encodeString(sig))
-}
-
 /**
  * Base64-encode bytes and wrap in SSH signature armor at 76 chars per line.
  */
@@ -310,7 +134,7 @@ export class KRLBuilder {
         const keyIds = [...this._keyIds].sort()
 
         const content = concat(
-            encodeString(caKeyWireBytes(this._caKey)),
+            encodeString(this._caKey.publicKey.blob),
             encodeUint32(serials.length),
             ...serials.map(encodeUint64),
             encodeUint32(keyIds.length),
@@ -326,14 +150,15 @@ export class KRLBuilder {
      *
      * @param krlVersion  Optional KRL version number (default: 1).
      * @param comment     Optional comment string embedded in the header.
+     * @param generatedAt Optional time the KRL was generated (default: now).
      */
-    generate(krlVersion: bigint = 1n, comment = ""): ArrayBuffer {
+    generate(krlVersion: bigint = 1n, comment = "", generatedAt?: Date): ArrayBuffer {
         if (this._krl !== null) {
             return this._krl
         }
 
         // ── Header ──────────────────────────────────────────────────────────────
-        const generatedDate = BigInt(Math.floor(Date.now() / 1000))
+        const generatedDate = BigInt(Math.floor((generatedAt?.getTime() ?? Date.now()) / 1000))
 
         const header = concat(
             encodeUint64(KRL_MAGIC),
@@ -375,7 +200,7 @@ export class KRLBuilder {
         //   <one or more cert sub-sections>
         //
         const certSectionData = concat(
-            encodeString(caKeyWireBytes(this._caKey)), // ca_key
+            encodeString(this._caKey.publicKey.blob), // ca_key
             encodeString(""), // reserved
             ...certSubSections
         )
@@ -409,7 +234,7 @@ export class KRLBuilder {
         } else {
             krl = this._krl
         }
-        const { cryptoKey, sigAlgo, webCryptoAlgo } = await importPrivateKey(this._caKey)
+        const signer = await createSigner(this._caKey)
 
         // 1. Hash the KRL bytes with SHA-512.
         const krlHash = new Uint8Array(
@@ -431,18 +256,10 @@ export class KRLBuilder {
             encodeString(krlHash),
         )
 
-        // 3. Sign the blob.
-        const rawSig = new Uint8Array(
-            await crypto.subtle.sign(webCryptoAlgo, cryptoKey, signedData),
-        )
-
-        // 4. Encode the signature into SSH wire format.
-        const sshSig =
-            sigAlgo === "ssh-ed25519"
-                ? wrapEd25519Sig(rawSig)
-                : p1363ToSshEcdsaSig(rawSig, sigAlgo)
+        // 3. Sign the blob, which returns the signature in SSH wire format.
+        const sshSig = await signer.sign(signedData)
 
-        // 5. Assemble the outer SSHSIG blob.
+        // 4. Assemble the outer SSHSIG blob.
         //
         //   byte[6]  "SSHSIG"
         //   uint32   SIG_VERSION (1)
@@ -451,18 +268,17 @@ export class KRLBuilder {
         //   string   reserved  (empty)
         //   string   hash_algorithm
         //   string   signature
-        const publicKeyWire = caKeyWireBytes(this._caKey)
         const sigBlob = concat(
             SSHSIG_MAGIC,
             encodeUint32(SIG_VERSION),
-            encodeString(publicKeyWire),
+            encodeString(signer.publicKey),
             encodeString(NAMESPACE),
             encodeString(""),      // reserved
             encodeString(HASH_ALGORITHM),
             encodeString(sshSig),
         )
 
-        // 6. Armor and return.
+        // 5. Armor and return.
         return armorSignature(sigBlob)
     }
 }

package/src/node/cache.ts

@@ -0,0 +1,62 @@
+import type { CaCache } from "../types.js"
+
+type Entry = {
+	value: string
+	/** When the entry expires in milliseconds since the Unix epoch, if it does */
+	expires: number | undefined
+}
+
+/**
+ * Create an in-memory cache for the `CACHE` binding, with the same shape as a
+ * Cloudflare Workers KV namespace (see {@link CaCache}).
+ *
+ * Entries are kept in memory by the process, so they are lost on restart and
+ * not shared between processes.
+ *
+ * @example
+ * ```ts
+ * const env = bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ *     CACHE: cacheInMemory(),
+ * })
+ * ```
+ *
+ * @returns A cache for the `CACHE` binding, see {@link CaCache}
+ */
+export const cacheInMemory = (): CaCache => {
+	const entries = new Map<string, Entry>()
+
+	const expired = (entry: Entry, now: number): boolean => entry.expires !== undefined && now >= entry.expires
+
+	return {
+		get: async (key: string): Promise<string | null> => {
+			const entry = entries.get(key)
+			if (entry === undefined) {
+				return null
+			}
+
+			if (expired(entry, Date.now())) {
+				entries.delete(key)
+				return null
+			}
+
+			return entry.value
+		},
+		put: async (key: string, value: string, options?: { expirationTtl?: number }): Promise<void> => {
+			const now = Date.now()
+
+			// remove entries that have expired, as they are not read again
+			for (const [k, entry] of entries) {
+				if (expired(entry, now)) {
+					entries.delete(k)
+				}
+			}
+
+			entries.set(key, {
+				value,
+				expires: options?.expirationTtl === undefined ? undefined : now + options.expirationTtl * 1000,
+			})
+		},
+	}
+}

package/src/node/env.ts

@@ -1,6 +1,6 @@
 import { seconds } from "itty-time"
 import z from "zod"
-import type { CaDatabase, CaSecret, SshCaBindings } from "../types.js"
+import type { CaCache, CaDatabase, CaRateLimiter, CaSecret, SshCaBindings } from "../types.js"
 
 const required = z.string().trim().min(1, { message: "must be set" })
 
@@ -32,7 +32,8 @@ export const EnvSchema = z.object({
 	SSH_HOST_CERTIFICATE_ALLOWED_ROLES: z.string().optional(),
 	ISSUER_DN: required,
 	JWT_JWKS_URL: z.url({ protocol: /^https?$/, message: "must be an http or https URL" }),
-	JWT_AUD: z.string().optional(),
+	JWT_AUD: required,
+	JWT_ACCESS_TOKEN_AUD: z.string().optional(),
 	JWT_ISSUER: required,
 	JWT_ALGORITHMS: required,
 	JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: required,
@@ -72,13 +73,13 @@ export class InvalidConfigurationError extends Error {
  * })
  * ```
  *
- * @param bindings The database and private key, see {@link CaDatabase} and {@link CaSecret}
+ * @param bindings The database, private key, optional rate limiter and optional cache, see {@link CaDatabase}, {@link CaSecret}, {@link CaRateLimiter} and {@link CaCache}
  * @param source The environment variables to read, `process.env` by default
  * @returns The bindings to pass to `createSshCa`
  * @throws {@link InvalidConfigurationError} if a variable is missing or invalid
  */
 export const bindingsFromEnv = (
-	bindings: { DB: CaDatabase, PRIVATE_KEY: CaSecret },
+	bindings: { DB: CaDatabase, PRIVATE_KEY: CaSecret, RATE_LIMITER?: CaRateLimiter, CACHE?: CaCache },
 	source: Record<string, string | undefined> = process.env,
 ): SshCaBindings => {
 	const result = EnvSchema.safeParse(source)
@@ -86,5 +87,5 @@ export const bindingsFromEnv = (
 		throw new InvalidConfigurationError(`invalid configuration:\n${z.prettifyError(result.error)}`)
 	}
 
-	return { ...result.data, DB: bindings.DB, PRIVATE_KEY: bindings.PRIVATE_KEY }
+	return { ...result.data, DB: bindings.DB, PRIVATE_KEY: bindings.PRIVATE_KEY, RATE_LIMITER: bindings.RATE_LIMITER, CACHE: bindings.CACHE }
 }

package/src/node/index.ts

@@ -16,6 +16,7 @@
  *
  * @packageDocumentation
  */
+export { cacheInMemory } from "./cache.js"
 export { bindingsFromEnv, EnvSchema, InvalidConfigurationError } from "./env.js"
 export type { CaEnv } from "./env.js"
 export { secretFromFile, secretFromString } from "./secret.js"

package/src/proof.ts

@@ -1,16 +1,34 @@
 import { ms } from "itty-time"
-import sshpk from "sshpk"
-import type { Fingerprint, Key } from "sshpk"
+import { KeyParseError, PublicKey } from "./ssh/keys.js"
 import { verify } from "./sshsig/index.js"
 import { parse } from "./sshsig/sig_parser.js"
 import { Sig } from "./sshsig/sig.js"
 import { group, Logger, LogLevel } from "@andrewheberle/ts-slog"
 
-// sshpk is CommonJS and Node's ESM loader cannot detect most of its named exports, so values are taken from the default import
-const { FingerprintFormatError, parseFingerprint, parseKey } = sshpk
+// a SHA256 fingerprint as shown by ssh-keygen -l, which is unpadded base64
+const FingerprintFormat = /^SHA256:[A-Za-z0-9+/]{43}$/
 
 export const Namespace = "proof-of-possession@com.github.serverless-ssh-ca.andrewheberle"
 
+/**
+ * The namespace used for proofs of possession that are bound to a request,
+ * kept separate from {@link Namespace} so a proof made for one form can never
+ * be accepted as the other.
+ */
+export const RequestNamespace = "request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle"
+
+/**
+ * Returns the request a proof of possession is bound to, which is appended to
+ * the signed data as `${timestamp}.${fingerprint}.${binding}`.
+ *
+ * @param method The HTTP method of the request, for example "DELETE"
+ * @param path The path of the request with any parameters filled in, for example "/api/v4/user/certificates/123"
+ * @returns The request binding, for example "DELETE /api/v4/user/certificates/123"
+ */
+export const requestBinding = (method: string, path: string): string => {
+	return `${method.toUpperCase()} ${path}`
+}
+
 export class PossessionParseError extends Error {
 	constructor(message: string, cause?: unknown) {
 		super(message)
@@ -38,9 +56,10 @@ export class PossessionParseError extends Error {
  */
 export class ProofOfPossession {
 	readonly timestamp: number
-	readonly fingerprint: Fingerprint
+	/** The SHA256 fingerprint of the key, for example "SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs" */
+	readonly fingerprint: string
 	readonly signature: Sig
-	readonly signaturePubkey: Key
+	readonly signaturePubkey: PublicKey
 	readonly logger: Logger
 	private readonly data: string
 
@@ -69,10 +88,9 @@ constructor(proof: string, options?: { from?: number, logger?: Logger, skew?: nu
 			throw new PossessionParseError("timestamp was from the future")
 		}
 		try {
-			// parse fingerprint
-			const fingerprint = parseFingerprint(fingerprintString!)
-			if (fingerprint === undefined) {
-				throw new PossessionParseError("fingerprint did not parse")
+			// check fingerprint
+			if (!FingerprintFormat.test(fingerprintString!)) {
+				throw new PossessionParseError("proof of possession fingerprint was an invalid format")
 			}
 
 			// convert siganture from base64
@@ -86,26 +104,26 @@ constructor(proof: string, options?: { from?: number, logger?: Logger, skew?: nu
 				throw new PossessionParseError("proof of possession signature could not be parsed", err)
 			}
 
-			this.fingerprint = fingerprint
+			this.fingerprint = fingerprintString!
 			this.data = `${timestamp}.${fingerprintString}`
-			this.signaturePubkey = parseKey(this.signature.publickey.toString())
+			this.signaturePubkey = PublicKey.parse(this.signature.publickey.toString())
 
 			// ensure the provided fingerprint matches the signature public key
-			if (!this.fingerprint.matches(this.signaturePubkey)) {
+			if (this.fingerprint !== this.signaturePubkey.fingerprint()) {
 				throw new PossessionParseError("proof of possession fingerprint does not match signature public key")
 			}
 
 			this.logger.debug("constructor completed",
 				...group("this",
 					"timestamp", this.timestamp,
-					"fingerprint", this.fingerprint.toString("base64"),
-					"signaturePubkey.fingerprint()", this.signaturePubkey.fingerprint().toString("base64"),
+					"fingerprint", this.fingerprint,
+					"signaturePubkey.fingerprint()", this.signaturePubkey.fingerprint(),
 				),
 			)
 		} catch (err) {
 			switch (true) {
-				case (err instanceof FingerprintFormatError):
-					throw new PossessionParseError("proof of possession fingerprint was an invalid format", err)
+				case (err instanceof KeyParseError):
+					throw new PossessionParseError(`proof of possession signature key could not be used: ${err.message}`, err)
 				default:
 					throw err
 			}
@@ -120,26 +138,42 @@ constructor(proof: string, options?: { from?: number, logger?: Logger, skew?: nu
 		return await verify(this.signature, this.data, { namespace: namespace || Namespace })
 	}
 
+	/**
+	 * Verifies the proof was made for a specific request, so it cannot be
+	 * replayed against another endpoint or with other path parameters (such
+	 * as a different certificate serial).
+	 *
+	 * The signed data is `${timestamp}.${fingerprint}.${METHOD} ${path}` using
+	 * the {@link RequestNamespace} namespace.
+	 *
+	 * @param method The HTTP method of the request
+	 * @param path The path of the request with any parameters filled in
+	 * @returns true if signature is valid for the request, false otherwise
+	 */
+	async verifyRequest(method: string, path: string): Promise<boolean> {
+		return await verify(this.signature, `${this.data}.${requestBinding(method, path)}`, { namespace: RequestNamespace })
+	}
+
 	/**
 	 *
 	 * @param keys array of keys to verify finterprint against
 	 * @returns true if the proof of possession fingerprint matches any of the provided keys, false otherwise
 	 */
-	matches(key: Key): boolean
-	matches(...keys: Key[]): boolean
+	matches(key: PublicKey): boolean
+	matches(...keys: PublicKey[]): boolean
 
-	matches(...keys: Key[]): boolean {
+	matches(...keys: PublicKey[]): boolean {
 		this.logger.debug("matches() called", "in", "ProofOfPossession", "keys", keys.length)
 		try {
 			for (const key of keys) {
 				// confirm proof of possession fingerprint matches keys
-				this.logger.debug("this.fingerprint.matches()", "in", "ProofOfPossession", "fingerprint", this.fingerprint.toString("base64"), "key", key.toString("ssh"))
-				if (!this.fingerprint.matches(key))
+				this.logger.debug("comparing fingerprint", "in", "ProofOfPossession", "fingerprint", this.fingerprint, "key", key.toString())
+				if (this.fingerprint !== key.fingerprint())
 					return false
 
 				// also confirm key used to sign proof of possession matches
-				this.logger.debug("this.signaturePubkey.fingerprint().matches()", "in", "ProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint().toString("base64"), "key", key.toString("ssh"))
-				if (!this.signaturePubkey.fingerprint().matches(key))
+				this.logger.debug("comparing signature public key", "in", "ProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint(), "key", key.toString())
+				if (!this.signaturePubkey.equals(key))
 					return false
 			}
 			this.logger.debug("matches() completed", "in", "ProofOfPossession", "keys", keys.length)
@@ -163,10 +197,10 @@ export class PossessionMatchError extends Error {
 }
 
 export class RenewalProofOfPossession extends ProofOfPossession {
-	override matches(key: Key): never
-	override matches(...keys: Key[]): boolean
+	override matches(key: PublicKey): never
+	override matches(...keys: PublicKey[]): boolean
 
-	override matches(...keys: Key[]): boolean {
+	override matches(...keys: PublicKey[]): boolean {
 		this.logger.debug("matches() called", "in", "RenewalProofOfPossession", "keys", keys.length)
 		if (keys.length === 1) {
 			throw new PossessionMatchError("must verify both public key and certificate")
@@ -174,11 +208,11 @@ export class RenewalProofOfPossession extends ProofOfPossession {
 
 		try {
 			for (const key of keys) {
-				this.logger.debug("this.fingerprint.matches()", "in", "RenewalProofOfPossession", "fingerprint", this.fingerprint.toString("base64"), "key", key.toString("ssh"))
-				if (!this.fingerprint.matches(key))
+				this.logger.debug("comparing fingerprint", "in", "RenewalProofOfPossession", "fingerprint", this.fingerprint, "key", key.toString())
+				if (this.fingerprint !== key.fingerprint())
 					return false
-				this.logger.debug("this.signaturePubkey.fingerprint().matches()", "in", "RenewalProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint().toString("base64"), "key", key.toString("ssh"))
-				if (!this.signaturePubkey.fingerprint().matches(key))
+				this.logger.debug("comparing signature public key", "in", "RenewalProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint(), "key", key.toString())
+				if (!this.signaturePubkey.equals(key))
 					return false
 			}
 			this.logger.debug("matches() completed", "in", "RenewalProofOfPossession", "keys", keys.length)