chevah / chevah-keycert Goto Github PK

View Code? Open in Web Editor NEW

3.0 3.0 0.0 842 KB

SSH Keys and SSL certificates handling

Home Page: http://styleguide.chevah.com

License: MIT License

Python 86.90% Shell 13.10%

chevah-keycert's People

Contributors

Stargazers

Watchers

chevah-keycert's Issues

Run tests using standard runner

right now it depends on chevah.empirical runner

Support unicode in email name

domains are encoded using IDNA but mailbox should be unicode.

Sync with latest code from chevah-server

Get the CRL distribution point values from a certificate

Return them as lists

Each CRL object might contain:

type
value
refresh interval

Return empty list if CRL distribution point is not set or is empty.

Move ssh exceptions into a common module

Also update ssh command to generate only key and then a separate method to write key.

Extract ~/.putty/sshhostkeys to the OpenSSH format

in this way you can use OpenSSH tools for that file

there is a code here for doing OpneSSH to putty https://github.com/codexns/putty/blob/master/contrib/kh2reg.py

this ticket only targeted the unix part... when putty stores the key in a file

Fix loading and saving keys with non-ascii comments.

Loading keys with non-ASCII comments fails for keys generated with puttygen.
This might be two separate bugs, because I get different results if I append "🚀" or " 🚀" at the end of the comment (which used to be the same as the password).

Show the key type in the error message produce by a key generation error.

The diff should be something like this

- Wrong key size "256". Key_size must be at least 512-bits.
+ Failed to generate RSA key. Wrong key size "256". Key_size must be at least 512-bits.

Add support for OpenSSH new key format

From #40 (comment)

Also tried OpenSSH 8.1 to export my old RSA key in the supported formats for -m: RFC4716, PKCS8 (both private and public) and PEM public key. The last one failed with Fail to parse key content. Here's how it looks:

Have also tested with Putty for DSA and the supported outputs: public, public-openssh, private-openssh, private-openssh-new, private-sshcom. The private-openssh-new format gave me the error Cannot guess the type for …. Here's how it looks:

Generate from CLI private SSH keys with a password

Allow generating DSA key greater than 1024

Port to py3

we can do this on travis-ci

Support EC keys in SSH.com and Putty format

and all the other format that we support... both reading but also writing

Add support for Putty v3 key file format

There is a new format.

Ubuntu 21.02 putty still generated v2

Example

PuTTY-User-Key-File-3: ssh-rsa
Encryption: none
Comment: rsa-key-20211214
Public-Lines: 6
AAAAB3NzaC1yc2EAAAADAQABAAABAQCQWPBUsyVmi5vl8myEQ91IP2JroWP1N2NR
xvFeIcGgtPSwq/7MIq2Vis8s2JlpBjFY2aDDGSlrWrh4Ryqs9NnvueLgeWjgD8wv
3qnYgv4pdu6k7HLrE5J22vQ6M8tFjpPDAVS+mfFIe9+RutO1eimhuh824ErTPKPT
LdBrheuZpUIaWl45Kd529V6CO0+b0/U/7zVfC/uKcHxDZ4RK2AkKOYMROb93B0qY
6n4t0tjkzFDJvqgMa7FoIwLkczyGSbpmKh39pvoMOyQB50WFSXbPuNscubGcOJAa
1SARXLLQh6UB9AiJqt+bk6r4OQyiXeKkk5u9lXNnxk1aMQQW46hh
Private-Lines: 14
AAABACnnyA2u3ILCsQW2tU5IrWsWC6qXdf9wjwLksJnVTvMq1YacyCHXR3GMlMy+
LPtScu0KcSNyoJWsBrXUY01G4CY6XuUwGgRCUdLr338duE+tWWbDxjD8w56BvjlP
ZAnTdI4+Sq3y3xtd6u/RvziGOKPc9sblopNknWLngARXIqi94TVawRHNyrnCNNn2
gWfi62ZxY2rLOHD5hJv2xFh84eNEdf94nnWkbaJ/aZmR6d8VdBcJCiK/60CgKYlO
ZuRHdEC3QCqa/S1Ya8m9egT90jUf6vmxb/GkK4Y0VigVLFdtaT7cJ8W6gbCmTaa2
4iax3M6y9AR2sQLpNNhB1gf3oAEAAACBAO04zQFxbgozu7m58RIc87pm8NeQ5UmF
hCV/K8Ja9QpUzztmoouo6r43itW+6DWmIYLqjlcV7zK6W4aTQ4/fSREiDHPhG7wG
NloXL+jsyAuu7FqfQVKVbh8aIg4uvKpg+nUV+YYgOKcucriKMwdpP8dy1D2Ti5jn
rVZNfmCAtLLhAAAAgQCbxhO4l2rtzodMnwSTyt3s17D5PPXPKSU03cDFsAnSYo2K
6q7pVxMBPYqo4KWlhM4fN0ByY3kobFc2cAbLbck+x12C559LJr9RP3DHUQ9oxjB5
JhYLgjN1JFS3dc7THi1nTM+NO0OQuytbeY+aNJ+UXW0zRtK/bwiGpsdGiFslgQAA
AIAeH7hALcDaAiZs0Jsb4/39zuGlb27r+KesxkYgIy7DaAOvQyZaT3X0JrAwqRqs
UJl+AS39VpL7XQFIbICJyhPbHHO3IGCUKhOz0BCqpHjnn9/ViRuNnrr1UTgDS0qc
tw/JH+KlK94nGmMEjBUUJpXJqjAXR7x8feoTqjtvijQtjA==
Private-MAC: a172468747b16c488815cb90b4359fe61d262c9a9329f60cabf6763deb638d8e

When loading SSH keys from X509 certificates ignore things outside of the armor

RIght now, when loading SSH key from X509 cert, the PEM should contain a single object and the armor should be the first thing in the file.

We should relax this to allow for "PEM comments" for example

BagAttribute=bla
---- BEGIN CERTIFICATE ---
TRALA

Generate keys with non-ascii password and comments.

Generating keys with non-ASCII passwords or comments is not possible (known limitation?).

Keep SSH key metadata, comment, subject

When a SSH key is loaded its comment , subject and other header are lost.

Beside data a key should also have metadata which should be used when exporting the key.

Not all key formats support metadata and for those, we can ignore it.

Add support to sign a certificate

Set version when generating CSR

looks like this break compatibiltity with older win 2003 and 2008 servers

http://stackoverflow.com/questions/15294964/windows-2008r2-ca-openssl-csr-error-parsing-csr-asn1-bad-value-met

we should use

http://www.pyopenssl.org/en/stable/api/crypto.html#OpenSSL.crypto.X509Req.set_version

The first part, ASN.1 type CertificationRequestInfo, consists of a version number (which is 0 for all known versions, 1.0, 1.5, and 1.7 of the specifications)

just set it to 0

Generate a self signed certificate with custom input values

right now, the self signed certificate is generated with standard vales...
we can still keep those values as default

Fix loading keys with comments starting with a space.

$ echo 'password' > pass_file
$ puttygen -t ed25519 -C " comment" --new-passphrase pass_file -o putty_ed25519_private.key
$ ./build-keycert/bin/python keycert-demo.py ssh-load-key --file putty_ed25519_private.key  --type putty --password $(cat pass_file)
EXPECTED ERROR
Bad password or HMAC mismatch.

Interestingly, this generated an expected error…

Read ECDSA OpenSSH public/private keys

        The format of a ECDSA public key blob is::
            string 'ecdsa-sha2-nistpNNN'
            string generator_name
            integer point

Generate SSH keys using OpenSSL

this should be faster than pycrypo and hope we will have access to ecdsa keys

Validate a certificate based on a CRL distribution points

This depends on #22

It will receive a list of CRL distribution points.

Will raise an error if list is empty

Will return true or false

We need to see how to pass callbacks for getting the new content based on each CRL DP type.

CRL should be cached... so we need to see how to cache them and how to retrieve them from the cache.

Add interoptesting for Tectia SSH keys.

Ditto, enable testing loading SSH keys generated by Tectia's ssh-keygen-g3.

The Tectia tests are written, but not executed, as there's no Tectia on GitHub's own runners.

P.S. Actually only loading Tectia-generated keys tests are written, not loading our keys with Tectia.

@dumol do you have any suggestion for the default curve type?

Generate , read in OpenSSH format, sign / verify

chevah / chevah-keycert Goto Github PK

chevah-keycert's People

Contributors

Stargazers

Watchers

chevah-keycert's Issues

Recommend Projects

Recommend Topics

Recommend Org