scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-11-01 11:08:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use go-secure-stdlib's RSA key generator backed by a DRBG (#29020)

Browse Source 
* Use DRBG based RSA key generation everywhere

* switch to the conditional generator

* Use DRBG based RSA key generation everywhere

* switch to the conditional generator

* Add an ENV var to disable the DRBG in a pinch

* update go.mod

* Use DRBG based RSA key generation everywhere

* switch to the conditional generator

* Add an ENV var to disable the DRBG in a pinch

* Use DRBG based RSA key generation everywhere

* update go.mod

* fix import

* Remove rsa2 alias, remove test code

* move cryptoutil/rsa.go to sdk

* move imports too

* remove makefile change

* rsa2->rsa

* more rsa2->rsa, remove test code

* fix some overzelous search/replace

* Update to a real tag

* changelog

* copyright

* work around copyright check

* work around copyright check pt2

* bunch of dupe imports

* missing import

* wrong license

* fix go.mod conflict

* missed a spot

* dupe import
This commit is contained in:
Scott Miller
2024-12-05 15:39:16 -06:00
committed by GitHub
parent d8482b008a
commit 86ba0dbdeb
28 changed files with 132 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
builtin/logical/pki/backend_test.go
View File

@@ -50,6 +50,7 @@ import (
"github.com/hashicorp/vault/helper/testhelpers/teststorage"
vaulthttp "github.com/hashicorp/vault/http"
"github.com/hashicorp/vault/sdk/helper/certutil"
"github.com/hashicorp/vault/sdk/helper/cryptoutil"
"github.com/hashicorp/vault/sdk/helper/testhelpers/schema"
"github.com/hashicorp/vault/sdk/logical"
"github.com/hashicorp/vault/vault"
@@ -510,14 +511,14 @@ func generateURLSteps(t *testing.T, caCert, caKey string, intdata, reqdata map[s
},
}
priv1024, _ := rsa.GenerateKey(rand.Reader, 1024)
priv1024, _ := cryptoutil.GenerateRSAKey(rand.Reader, 1024)
csr1024, _ := x509.CreateCertificateRequest(rand.Reader, &csrTemplate, priv1024)
csrPem1024 := strings.TrimSpace(string(pem.EncodeToMemory(&pem.Block{
Type: "CERTIFICATE REQUEST",
Bytes: csr1024,
})))
priv2048, _ := rsa.GenerateKey(rand.Reader, 2048)
priv2048, _ := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
csr2048, _ := x509.CreateCertificateRequest(rand.Reader, &csrTemplate, priv2048)
csrPem2048 := strings.TrimSpace(string(pem.EncodeToMemory(&pem.Block{
Type: "CERTIFICATE REQUEST",
@@ -699,7 +700,7 @@ func generateCSR(t *testing.T, csrTemplate *x509.CertificateRequest, keyType str
var err error
switch keyType {
case "rsa":
priv, err = rsa.GenerateKey(rand.Reader, keyBits)
priv, err = cryptoutil.GenerateRSAKey(rand.Reader, keyBits)
case "ec":
switch keyBits {
case 224:
@@ -1180,7 +1181,7 @@ func generateRoleSteps(t *testing.T, useCSRs bool) []logicaltest.TestStep {
case "rsa":
privKey, ok = generatedRSAKeys[keyBits]
if !ok {
privKey, _ = rsa.GenerateKey(rand.Reader, keyBits)
privKey, _ = cryptoutil.GenerateRSAKey(rand.Reader, keyBits)
generatedRSAKeys[keyBits] = privKey
}
@@ -2164,7 +2165,7 @@ func runTestSignVerbatim(t *testing.T, keyType string) {
}
// create a CSR and key
key, err := rsa.GenerateKey(rand.Reader, 2048)
key, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
if err != nil {
t.Fatal(err)
}
@@ -2735,7 +2736,7 @@ func TestBackend_SignSelfIssued(t *testing.T) {
t.Fatal(err)
}
key, err := rsa.GenerateKey(rand.Reader, 2048)
key, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
if err != nil {
t.Fatal(err)
}
@@ -2879,7 +2880,7 @@ func TestBackend_SignSelfIssued_DifferentTypes(t *testing.T) {
t.Fatal(err)
}
key, err := rsa.GenerateKey(rand.Reader, 2048)
key, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
if err != nil {
t.Fatal(err)
}
@@ -3834,7 +3835,7 @@ func setCerts() {
}
ecCACert = strings.TrimSpace(string(pem.EncodeToMemory(caCertPEMBlock)))
rak, err := rsa.GenerateKey(rand.Reader, 2048)
rak, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
if err != nil {
panic(err)
}