ds-01 1.0.11 → 1.0.13

package/dist/native/macos-key-helper.swift

@@ -0,0 +1,272 @@
+import Foundation
+import Security
+
+let keyTag = "com.ds01.cli.device-key"
+
+func fail(_ message: String) -> Never {
+    fputs(message + "\n", stderr)
+    exit(1)
+}
+
+// Find the existing Secure Enclave private key.
+func findPrivateKey() -> SecKey? {
+    let query: [String: Any] = [
+        kSecClass as String: kSecClassKey,
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom,
+        kSecAttrTokenID as String:
+            kSecAttrTokenIDSecureEnclave,
+        kSecReturnRef as String: true
+    ]
+
+    var result: CFTypeRef?
+
+    let status = SecItemCopyMatching(
+        query as CFDictionary,
+        &result
+    )
+
+    guard status == errSecSuccess else {
+        return nil
+    }
+
+    return (result as! SecKey)
+}
+
+func createKey() {
+
+    // If the key already exists, don't create another one.
+    if findPrivateKey() != nil {
+        print("EXISTS")
+        return
+    }
+
+    // Keychain access control.
+    //
+    // WhenUnlockedThisDeviceOnly means:
+    // - available only while the device is unlocked
+    // - cannot be restored onto another device
+    //
+    // privateKeyUsage means the key can be used for signing.
+    var accessError: Unmanaged<CFError>?
+
+    guard let access = SecAccessControlCreateWithFlags(
+        nil,
+        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+        .privateKeyUsage,
+        &accessError
+    ) else {
+
+        if let error = accessError {
+            fail(
+                "Unable to create Keychain access control: " +
+                error.takeRetainedValue().localizedDescription
+            )
+        }
+
+        fail("Unable to create Keychain access control.")
+    }
+
+    let privateAttributes: [String: Any] = [
+
+        // Permanently store the private key.
+        kSecAttrIsPermanent as String: true,
+
+        // Identifier used to find the key later.
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
+
+        // Access rules for the private key.
+        kSecAttrAccessControl as String:
+            access
+    ]
+
+    let attributes: [String: Any] = [
+
+        // EC P-256 key.
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom,
+
+        kSecAttrKeySizeInBits as String:
+            256,
+
+        // IMPORTANT:
+        // The private key lives inside the Secure Enclave.
+        kSecAttrTokenID as String:
+            kSecAttrTokenIDSecureEnclave,
+
+        // Private key configuration.
+        kSecPrivateKeyAttrs as String:
+            privateAttributes
+    ]
+
+    var error: Unmanaged<CFError>?
+
+    guard SecKeyCreateRandomKey(
+        attributes as CFDictionary,
+        &error
+    ) != nil else {
+
+        if let error {
+            fail(
+                "Secure Enclave key creation failed: " +
+                error.takeRetainedValue().localizedDescription
+            )
+        }
+
+        fail("Secure Enclave key creation failed.")
+    }
+
+    print("CREATED")
+}
+
+
+// Return ONLY the public key.
+//
+// The private key is never exported.
+func publicKey() {
+
+    guard let privateKey = findPrivateKey() else {
+        fail("DS01 Secure Enclave key not found.")
+    }
+
+    guard let publicKey = SecKeyCopyPublicKey(privateKey) else {
+        fail("Unable to obtain public key.")
+    }
+
+    var error: Unmanaged<CFError>?
+
+    guard let data = SecKeyCopyExternalRepresentation(
+        publicKey,
+        &error
+    ) else {
+
+        if let error {
+            fail(
+                "Unable to export public key: " +
+                error.takeRetainedValue().localizedDescription
+            )
+        }
+
+        fail("Unable to export public key.")
+    }
+
+    print(
+        (data as Data).base64EncodedString()
+    )
+}
+
+
+// Sign data using the Secure Enclave private key.
+func sign(_ base64Data: String) {
+
+    guard let privateKey = findPrivateKey() else {
+        fail("DS01 Secure Enclave key not found.")
+    }
+
+    guard let data = Data(
+        base64Encoded: base64Data
+    ) else {
+        fail("Invalid input data.")
+    }
+
+    let algorithm =
+        SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
+
+    guard SecKeyIsAlgorithmSupported(
+        privateKey,
+        .sign,
+        algorithm
+    ) else {
+        fail(
+            "Secure Enclave key does not support signing."
+        )
+    }
+
+    var error: Unmanaged<CFError>?
+
+    guard let signature = SecKeyCreateSignature(
+        privateKey,
+        algorithm,
+        data as CFData,
+        &error
+    ) else {
+
+        if let error {
+            fail(
+                "Secure Enclave signing failed: " +
+                error.takeRetainedValue().localizedDescription
+            )
+        }
+
+        fail("Secure Enclave signing failed.")
+    }
+
+    print(
+        (signature as Data).base64EncodedString()
+    )
+}
+
+
+// Remove the DS01 key from this Mac.
+func deleteKey() {
+
+    let query: [String: Any] = [
+        kSecClass as String:
+            kSecClassKey,
+
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
+
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom,
+
+        kSecAttrTokenID as String:
+            kSecAttrTokenIDSecureEnclave
+    ]
+
+    let status = SecItemDelete(
+        query as CFDictionary
+    )
+
+    if status != errSecSuccess &&
+       status != errSecItemNotFound {
+
+        fail(
+            "Unable to delete DS01 Secure Enclave key."
+        )
+    }
+
+    print("DELETED")
+}
+
+
+// Command dispatcher.
+guard CommandLine.arguments.count >= 2 else {
+    fail("Missing operation.")
+}
+
+switch CommandLine.arguments[1] {
+
+case "create":
+    createKey()
+
+case "public":
+    publicKey()
+
+case "sign":
+
+    guard CommandLine.arguments.count >= 3 else {
+        fail("Missing data to sign.")
+    }
+
+    sign(CommandLine.arguments[2])
+
+case "delete":
+    deleteKey()
+
+default:
+    fail("Unknown operation.")
+}

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "ds-01",
-  "version": "1.0.11",
+  "version": "1.0.13",
   "description": "Make your site best with DS01",
   "type": "module",
   "bin": {
     "ds01": "dist/index.js"
   },
   "scripts": {
-    "build": "tsc"
+    "build": "tsc && node scripts/copy-native.js"
   },
   "publishConfig": {
     "access": "public"

package/scripts/copy-native.js

@@ -0,0 +1,15 @@
+import fs from "node:fs";
+import path from "node:path";
+
+const source = path.resolve("src/native/macos-key-helper.swift");
+const destinationDir = path.resolve("dist/native");
+const destination = path.join(
+  destinationDir,
+  "macos-key-helper.swift",
+);
+
+fs.mkdirSync(destinationDir, { recursive: true });
+
+fs.copyFileSync(source, destination);
+
+

package/src/native/macos-key-helper.swift

@@ -8,30 +8,16 @@ func fail(_ message: String) -> Never {
     exit(1)
 }
 
-func getAccessControl() -> SecAccessControl {
-    var error: Unmanaged<CFError>?
-
-    guard let access = SecAccessControlCreateWithFlags(
-        nil,
-        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-        .privateKeyUsage,
-        &error
-    ) else {
-        if let error {
-            fail(error.takeRetainedValue().localizedDescription)
-        }
-
-        fail("Unable to create Secure Enclave access control.")
-    }
-
-    return access
-}
-
+// Find the existing Secure Enclave private key.
 func findPrivateKey() -> SecKey? {
     let query: [String: Any] = [
         kSecClass as String: kSecClassKey,
-        kSecAttrApplicationTag as String: keyTag.data(using: .utf8)!,
-        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom,
+        kSecAttrTokenID as String:
+            kSecAttrTokenIDSecureEnclave,
         kSecReturnRef as String: true
     ]
 
@@ -50,33 +36,70 @@ func findPrivateKey() -> SecKey? {
 }
 
 func createKey() {
+
+    // If the key already exists, don't create another one.
     if findPrivateKey() != nil {
         print("EXISTS")
         return
     }
 
-    let access = getAccessControl()
+    // Keychain access control.
+    //
+    // WhenUnlockedThisDeviceOnly means:
+    // - available only while the device is unlocked
+    // - cannot be restored onto another device
+    //
+    // privateKeyUsage means the key can be used for signing.
+    var accessError: Unmanaged<CFError>?
+
+    guard let access = SecAccessControlCreateWithFlags(
+        nil,
+        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+        .privateKeyUsage,
+        &accessError
+    ) else {
+
+        if let error = accessError {
+            fail(
+                "Unable to create Keychain access control: " +
+                error.takeRetainedValue().localizedDescription
+            )
+        }
+
+        fail("Unable to create Keychain access control.")
+    }
+
+    let privateAttributes: [String: Any] = [
+
+        // Permanently store the private key.
+        kSecAttrIsPermanent as String: true,
+
+        // Identifier used to find the key later.
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
+
+        // Access rules for the private key.
+        kSecAttrAccessControl as String:
+            access
+    ]
 
     let attributes: [String: Any] = [
+
+        // EC P-256 key.
         kSecAttrKeyType as String:
             kSecAttrKeyTypeECSECPrimeRandom,
 
         kSecAttrKeySizeInBits as String:
             256,
 
+        // IMPORTANT:
+        // The private key lives inside the Secure Enclave.
         kSecAttrTokenID as String:
             kSecAttrTokenIDSecureEnclave,
 
-        kSecPrivateKeyAttrs as String: [
-            kSecAttrIsPermanent as String:
-                true,
-
-            kSecAttrApplicationTag as String:
-                keyTag.data(using: .utf8)!,
-
-            kSecAttrAccessControl as String:
-                access
-        ]
+        // Private key configuration.
+        kSecPrivateKeyAttrs as String:
+            privateAttributes
     ]
 
     var error: Unmanaged<CFError>?
@@ -85,17 +108,26 @@ func createKey() {
         attributes as CFDictionary,
         &error
     ) != nil else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Secure Enclave key creation failed: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
-        fail("Unable to create Secure Enclave key.")
+        fail("Secure Enclave key creation failed.")
     }
 
     print("CREATED")
 }
 
+
+// Return ONLY the public key.
+//
+// The private key is never exported.
 func publicKey() {
+
     guard let privateKey = findPrivateKey() else {
         fail("DS01 Secure Enclave key not found.")
     }
@@ -110,35 +142,47 @@ func publicKey() {
         publicKey,
         &error
     ) else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Unable to export public key: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
         fail("Unable to export public key.")
     }
 
-    let base64 = (data as Data).base64EncodedString()
-
-    print(base64)
+    print(
+        (data as Data).base64EncodedString()
+    )
 }
 
+
+// Sign data using the Secure Enclave private key.
 func sign(_ base64Data: String) {
+
     guard let privateKey = findPrivateKey() else {
         fail("DS01 Secure Enclave key not found.")
     }
 
-    guard let data = Data(base64Encoded: base64Data) else {
+    guard let data = Data(
+        base64Encoded: base64Data
+    ) else {
         fail("Invalid input data.")
     }
 
-    let algorithm = SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
+    let algorithm =
+        SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
 
     guard SecKeyIsAlgorithmSupported(
         privateKey,
         .sign,
         algorithm
     ) else {
-        fail("Secure Enclave key does not support signing.")
+        fail(
+            "Secure Enclave key does not support signing."
+        )
     }
 
     var error: Unmanaged<CFError>?
@@ -149,23 +193,38 @@ func sign(_ base64Data: String) {
         data as CFData,
         &error
     ) else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Secure Enclave signing failed: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
         fail("Secure Enclave signing failed.")
     }
 
-    print((signature as Data).base64EncodedString())
+    print(
+        (signature as Data).base64EncodedString()
+    )
 }
 
+
+// Remove the DS01 key from this Mac.
 func deleteKey() {
+
     let query: [String: Any] = [
-        kSecClass as String: kSecClassKey,
+        kSecClass as String:
+            kSecClassKey,
+
         kSecAttrApplicationTag as String:
             keyTag.data(using: .utf8)!,
+
         kSecAttrKeyType as String:
-            kSecAttrKeyTypeECSECPrimeRandom
+            kSecAttrKeyTypeECSECPrimeRandom,
+
+        kSecAttrTokenID as String:
+            kSecAttrTokenIDSecureEnclave
     ]
 
     let status = SecItemDelete(
@@ -174,17 +233,23 @@ func deleteKey() {
 
     if status != errSecSuccess &&
        status != errSecItemNotFound {
-        fail("Unable to delete DS01 Secure Enclave key.")
+
+        fail(
+            "Unable to delete DS01 Secure Enclave key."
+        )
     }
 
     print("DELETED")
 }
 
+
+// Command dispatcher.
 guard CommandLine.arguments.count >= 2 else {
     fail("Missing operation.")
 }
 
 switch CommandLine.arguments[1] {
+
 case "create":
     createKey()
 
@@ -192,6 +257,7 @@ case "public":
     publicKey()
 
 case "sign":
+
     guard CommandLine.arguments.count >= 3 else {
         fail("Missing data to sign.")
     }