test all the algorithms

Author: jschlyter

nodeman/models.py

@@ -9,10 +9,18 @@
 
 class PublicJwk(BaseModel):
     kty: str
-    crv: str
-    x: str
+
+    # for EC and ED
+    crv: str | None = None
+    x: str | None = None
+
+    # for EC
     y: str | None = None
 
+    # for RSA
+    n: str | None = None
+    e: str | None = None
+
 
 class NodeInformation(BaseModel):
     name: str = Field(title="Node name")

nodeman/x509.py

@@ -3,10 +3,13 @@
 
 from cryptography import x509
 from cryptography.hazmat.primitives import hashes
-from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
+from cryptography.hazmat.primitives.asymmetric.ed448 import Ed448PrivateKey
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 from cryptography.x509.oid import ExtensionOID, NameOID
 
-type PrivateKey = ec.EllipticCurvePrivateKey
+type PrivateKey = RSAPrivateKey | EllipticCurvePrivateKey | Ed25519PrivateKey | Ed448PrivateKey
 
 
 @dataclass(frozen=True)
@@ -21,6 +24,12 @@ def sign_csr(self, csr: x509.CertificateSigningRequest, name: str) -> Certificat
         pass
 
 
+def get_hash_algorithm_from_key(key: PrivateKey) -> hashes.SHA256 | None:
+    if isinstance(key, (Ed25519PrivateKey, Ed448PrivateKey)):
+        return None
+    return hashes.SHA256()
+
+
 def generate_x509_csr(name: str, key: PrivateKey) -> x509.CertificateSigningRequest:
     """Generate X.509 CSR with name and key"""
     return (
@@ -30,7 +39,7 @@ def generate_x509_csr(name: str, key: PrivateKey) -> x509.CertificateSigningRequ
             x509.SubjectAlternativeName([x509.DNSName(name)]),
             critical=False,
         )
-        .sign(key, hashes.SHA256())
+        .sign(key, get_hash_algorithm_from_key(key))
     )
 
 

tests/test_api.py

@@ -4,7 +4,9 @@
 from urllib.parse import urljoin
 
 from cryptography.hazmat.primitives import serialization
-from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.hazmat.primitives.asymmetric import ec, rsa
+from cryptography.hazmat.primitives.asymmetric.ed448 import Ed448PrivateKey
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.serialization import load_pem_public_key
 from fastapi.testclient import TestClient
 from jwcrypto.jwk import JWK
@@ -31,13 +33,10 @@ def get_test_client() -> TestClient:
     return TestClient(app)
 
 
-def test_enroll() -> None:
+def _test_enroll(data_key, x509_key) -> None:
     client = get_test_client()
     server = ""
 
-    kty = "OKP"
-    crv = "Ed25519"
-
     logging.basicConfig(level=logging.DEBUG)
     logging.debug("Testing enrollment")
 
@@ -59,10 +58,8 @@ def test_enroll() -> None:
     hmac_key = JWK(kty="oct", k=secret)
     hmac_alg = "HS256"
 
-    data_key = JWK.generate(kty=kty, crv=crv)
     data_alg = jwk_to_alg(data_key)
 
-    x509_key = ec.generate_private_key(ec.SECP256R1())
     x509_csr = generate_x509_csr(key=x509_key, name=name).public_bytes(serialization.Encoding.PEM).decode()
 
     payload = {"x509_csr": x509_csr, "public_key": data_key.export_public(as_dict=True)}
@@ -107,6 +104,36 @@ def test_enroll() -> None:
     assert response.status_code == 404
 
 
+def test_enroll_p256_p256() -> None:
+    data_key = JWK.generate(kty="EC", crv="P-256")
+    x509_key = ec.generate_private_key(ec.SECP256R1())
+    _test_enroll(data_key=data_key, x509_key=x509_key)
+
+
+def test_enroll_ed25519_p256() -> None:
+    data_key = JWK.generate(kty="OKP", crv="Ed25519")
+    x509_key = ec.generate_private_key(ec.SECP256R1())
+    _test_enroll(data_key=data_key, x509_key=x509_key)
+
+
+def test_enroll_ed25519_ed25519() -> None:
+    data_key = JWK.generate(kty="OKP", crv="Ed25519")
+    x509_key = Ed25519PrivateKey.generate()
+    _test_enroll(data_key=data_key, x509_key=x509_key)
+
+
+def test_enroll_ed448_ed448() -> None:
+    data_key = JWK.generate(kty="OKP", crv="Ed448")
+    x509_key = Ed448PrivateKey.generate()
+    _test_enroll(data_key=data_key, x509_key=x509_key)
+
+
+def test_enroll_rsa_rsa() -> None:
+    data_key = JWK.generate(kty="RSA", size=2048)
+    x509_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    _test_enroll(data_key=data_key, x509_key=x509_key)
+
+
 def test_enroll_bad_hmac_signature() -> None:
     client = get_test_client()
     server = ""