1 // Copyright 2021 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 //
15 ///////////////////////////////////////////////////////////////////////////////
16
17 #include "tink/jwt/jwt_key_templates.h"
18
19 #include <string>
20
21 #include "openssl/bn.h"
22 #include "openssl/rsa.h"
23 #include "tink/internal/bn_util.h"
24 #include "tink/internal/ssl_unique_ptr.h"
25 #include "tink/util/statusor.h"
26 #include "proto/common.pb.h"
27 #include "proto/jwt_ecdsa.pb.h"
28 #include "proto/jwt_hmac.pb.h"
29 #include "proto/jwt_rsa_ssa_pkcs1.pb.h"
30 #include "proto/jwt_rsa_ssa_pss.pb.h"
31 #include "proto/tink.pb.h"
32
33 using ::google::crypto::tink::JwtEcdsaAlgorithm;
34 using ::google::crypto::tink::JwtEcdsaKeyFormat;
35 using ::google::crypto::tink::JwtHmacAlgorithm;
36 using ::google::crypto::tink::JwtHmacKeyFormat;
37 using ::google::crypto::tink::JwtRsaSsaPkcs1Algorithm;
38 using ::google::crypto::tink::JwtRsaSsaPkcs1KeyFormat;
39 using ::google::crypto::tink::JwtRsaSsaPssAlgorithm;
40 using ::google::crypto::tink::JwtRsaSsaPssKeyFormat;
41 using ::google::crypto::tink::KeyTemplate;
42 using ::google::crypto::tink::OutputPrefixType;
43
44 namespace crypto {
45 namespace tink {
46
47 namespace {
48
NewJwtHmacKeyTemplate(JwtHmacAlgorithm algorithm,uint32_t key_size,OutputPrefixType output_prefix_type)49 KeyTemplate* NewJwtHmacKeyTemplate(JwtHmacAlgorithm algorithm,
50 uint32_t key_size,
51 OutputPrefixType output_prefix_type) {
52 KeyTemplate* key_template = new KeyTemplate;
53 key_template->set_type_url(
54 "type.googleapis.com/google.crypto.tink.JwtHmacKey");
55 key_template->set_output_prefix_type(output_prefix_type);
56 JwtHmacKeyFormat key_format;
57 key_format.set_key_size(key_size);
58 key_format.set_algorithm(algorithm);
59 key_format.SerializeToString(key_template->mutable_value());
60 return key_template;
61 }
62
NewJwtEcdsaKeyTemplate(JwtEcdsaAlgorithm algorithm,OutputPrefixType output_prefix_type)63 KeyTemplate* NewJwtEcdsaKeyTemplate(JwtEcdsaAlgorithm algorithm,
64 OutputPrefixType output_prefix_type) {
65 KeyTemplate* key_template = new KeyTemplate;
66 key_template->set_type_url(
67 "type.googleapis.com/google.crypto.tink.JwtEcdsaPrivateKey");
68 key_template->set_output_prefix_type(output_prefix_type);
69 JwtEcdsaKeyFormat key_format;
70 key_format.set_algorithm(algorithm);
71 key_format.SerializeToString(key_template->mutable_value());
72 return key_template;
73 }
74
NewJwtRsaSsaPkcs1KeyTemplate(JwtRsaSsaPkcs1Algorithm algorithm,int modulus_size_in_bits,int public_exponent,OutputPrefixType output_prefix_type)75 KeyTemplate* NewJwtRsaSsaPkcs1KeyTemplate(JwtRsaSsaPkcs1Algorithm algorithm,
76 int modulus_size_in_bits,
77 int public_exponent,
78 OutputPrefixType output_prefix_type) {
79 KeyTemplate* key_template = new KeyTemplate;
80 key_template->set_type_url(
81 "type.googleapis.com/google.crypto.tink.JwtRsaSsaPkcs1PrivateKey");
82 key_template->set_output_prefix_type(output_prefix_type);
83 JwtRsaSsaPkcs1KeyFormat key_format;
84 key_format.set_algorithm(algorithm);
85 key_format.set_modulus_size_in_bits(modulus_size_in_bits);
86 internal::SslUniquePtr<BIGNUM> e(BN_new());
87 BN_set_word(e.get(), public_exponent);
88 util::StatusOr<std::string> e_str =
89 internal::BignumToString(e.get(), BN_num_bytes(e.get()));
90 key_format.set_public_exponent(e_str.value());
91 key_format.SerializeToString(key_template->mutable_value());
92 return key_template;
93 }
94
NewJwtRsaSsaPssKeyTemplate(JwtRsaSsaPssAlgorithm algorithm,int modulus_size_in_bits,int public_exponent,OutputPrefixType output_prefix_type)95 KeyTemplate* NewJwtRsaSsaPssKeyTemplate(JwtRsaSsaPssAlgorithm algorithm,
96 int modulus_size_in_bits,
97 int public_exponent,
98 OutputPrefixType output_prefix_type) {
99 KeyTemplate* key_template = new KeyTemplate;
100 key_template->set_type_url(
101 "type.googleapis.com/google.crypto.tink.JwtRsaSsaPssPrivateKey");
102 key_template->set_output_prefix_type(output_prefix_type);
103 JwtRsaSsaPssKeyFormat key_format;
104 key_format.set_algorithm(algorithm);
105 key_format.set_modulus_size_in_bits(modulus_size_in_bits);
106 internal::SslUniquePtr<BIGNUM> e(BN_new());
107 BN_set_word(e.get(), public_exponent);
108 util::StatusOr<std::string> e_str =
109 internal::BignumToString(e.get(), BN_num_bytes(e.get()));
110 key_format.set_public_exponent(e_str.value());
111 key_format.SerializeToString(key_template->mutable_value());
112 return key_template;
113 }
114
115 } // anonymous namespace
116
JwtHs256Template()117 const KeyTemplate& JwtHs256Template() {
118 static const KeyTemplate* key_template = NewJwtHmacKeyTemplate(
119 JwtHmacAlgorithm::HS256, 32, OutputPrefixType::TINK);
120 return *key_template;
121 }
122
RawJwtHs256Template()123 const KeyTemplate& RawJwtHs256Template() {
124 static const KeyTemplate* key_template =
125 NewJwtHmacKeyTemplate(JwtHmacAlgorithm::HS256, 32, OutputPrefixType::RAW);
126 return *key_template;
127 }
128
JwtHs384Template()129 const KeyTemplate& JwtHs384Template() {
130 static const KeyTemplate* key_template = NewJwtHmacKeyTemplate(
131 JwtHmacAlgorithm::HS384, 48, OutputPrefixType::TINK);
132 return *key_template;
133 }
134
RawJwtHs384Template()135 const KeyTemplate& RawJwtHs384Template() {
136 static const KeyTemplate* key_template =
137 NewJwtHmacKeyTemplate(JwtHmacAlgorithm::HS384, 48, OutputPrefixType::RAW);
138 return *key_template;
139 }
140
JwtHs512Template()141 const KeyTemplate& JwtHs512Template() {
142 static const KeyTemplate* key_template = NewJwtHmacKeyTemplate(
143 JwtHmacAlgorithm::HS512, 64, OutputPrefixType::TINK);
144 return *key_template;
145 }
146
RawJwtHs512Template()147 const KeyTemplate& RawJwtHs512Template() {
148 static const KeyTemplate* key_template =
149 NewJwtHmacKeyTemplate(JwtHmacAlgorithm::HS512, 64, OutputPrefixType::RAW);
150 return *key_template;
151 }
152
JwtEs256Template()153 const KeyTemplate& JwtEs256Template() {
154 static const KeyTemplate* key_template =
155 NewJwtEcdsaKeyTemplate(JwtEcdsaAlgorithm::ES256, OutputPrefixType::TINK);
156 return *key_template;
157 }
158
RawJwtEs256Template()159 const KeyTemplate& RawJwtEs256Template() {
160 static const KeyTemplate* key_template =
161 NewJwtEcdsaKeyTemplate(JwtEcdsaAlgorithm::ES256, OutputPrefixType::RAW);
162 return *key_template;
163 }
164
JwtEs384Template()165 const KeyTemplate& JwtEs384Template() {
166 static const KeyTemplate* key_template =
167 NewJwtEcdsaKeyTemplate(JwtEcdsaAlgorithm::ES384, OutputPrefixType::TINK);
168 return *key_template;
169 }
170
RawJwtEs384Template()171 const KeyTemplate& RawJwtEs384Template() {
172 static const KeyTemplate* key_template =
173 NewJwtEcdsaKeyTemplate(JwtEcdsaAlgorithm::ES384, OutputPrefixType::RAW);
174 return *key_template;
175 }
176
JwtEs512Template()177 const KeyTemplate& JwtEs512Template() {
178 static const KeyTemplate* key_template =
179 NewJwtEcdsaKeyTemplate(JwtEcdsaAlgorithm::ES512, OutputPrefixType::TINK);
180 return *key_template;
181 }
182
RawJwtEs512Template()183 const KeyTemplate& RawJwtEs512Template() {
184 static const KeyTemplate* key_template =
185 NewJwtEcdsaKeyTemplate(JwtEcdsaAlgorithm::ES512, OutputPrefixType::RAW);
186 return *key_template;
187 }
188
JwtRs256_2048_F4_Template()189 const KeyTemplate& JwtRs256_2048_F4_Template() {
190 static const KeyTemplate* key_template = NewJwtRsaSsaPkcs1KeyTemplate(
191 JwtRsaSsaPkcs1Algorithm::RS256, 2048, RSA_F4, OutputPrefixType::TINK);
192 return *key_template;
193 }
194
RawJwtRs256_2048_F4_Template()195 const KeyTemplate& RawJwtRs256_2048_F4_Template() {
196 static const KeyTemplate* key_template = NewJwtRsaSsaPkcs1KeyTemplate(
197 JwtRsaSsaPkcs1Algorithm::RS256, 2048, RSA_F4, OutputPrefixType::RAW);
198 return *key_template;
199 }
200
JwtRs256_3072_F4_Template()201 const KeyTemplate& JwtRs256_3072_F4_Template() {
202 static const KeyTemplate* key_template = NewJwtRsaSsaPkcs1KeyTemplate(
203 JwtRsaSsaPkcs1Algorithm::RS256, 3072, RSA_F4, OutputPrefixType::TINK);
204 return *key_template;
205 }
206
RawJwtRs256_3072_F4_Template()207 const KeyTemplate& RawJwtRs256_3072_F4_Template() {
208 static const KeyTemplate* key_template = NewJwtRsaSsaPkcs1KeyTemplate(
209 JwtRsaSsaPkcs1Algorithm::RS256, 3072, RSA_F4, OutputPrefixType::RAW);
210 return *key_template;
211 }
212
JwtRs384_3072_F4_Template()213 const KeyTemplate& JwtRs384_3072_F4_Template() {
214 static const KeyTemplate* key_template = NewJwtRsaSsaPkcs1KeyTemplate(
215 JwtRsaSsaPkcs1Algorithm::RS384, 3072, RSA_F4, OutputPrefixType::TINK);
216 return *key_template;
217 }
218
RawJwtRs384_3072_F4_Template()219 const KeyTemplate& RawJwtRs384_3072_F4_Template() {
220 static const KeyTemplate* key_template = NewJwtRsaSsaPkcs1KeyTemplate(
221 JwtRsaSsaPkcs1Algorithm::RS384, 3072, RSA_F4, OutputPrefixType::RAW);
222 return *key_template;
223 }
224
JwtRs512_4096_F4_Template()225 const KeyTemplate& JwtRs512_4096_F4_Template() {
226 static const KeyTemplate* key_template = NewJwtRsaSsaPkcs1KeyTemplate(
227 JwtRsaSsaPkcs1Algorithm::RS512, 4096, RSA_F4, OutputPrefixType::TINK);
228 return *key_template;
229 }
230
RawJwtRs512_4096_F4_Template()231 const KeyTemplate& RawJwtRs512_4096_F4_Template() {
232 static const KeyTemplate* key_template = NewJwtRsaSsaPkcs1KeyTemplate(
233 JwtRsaSsaPkcs1Algorithm::RS512, 4096, RSA_F4, OutputPrefixType::RAW);
234 return *key_template;
235 }
236
JwtPs256_2048_F4_Template()237 const KeyTemplate& JwtPs256_2048_F4_Template() {
238 static const KeyTemplate* key_template = NewJwtRsaSsaPssKeyTemplate(
239 JwtRsaSsaPssAlgorithm::PS256, 2048, RSA_F4, OutputPrefixType::TINK);
240 return *key_template;
241 }
242
RawJwtPs256_2048_F4_Template()243 const KeyTemplate& RawJwtPs256_2048_F4_Template() {
244 static const KeyTemplate* key_template = NewJwtRsaSsaPssKeyTemplate(
245 JwtRsaSsaPssAlgorithm::PS256, 2048, RSA_F4, OutputPrefixType::RAW);
246 return *key_template;
247 }
248
JwtPs256_3072_F4_Template()249 const KeyTemplate& JwtPs256_3072_F4_Template() {
250 static const KeyTemplate* key_template = NewJwtRsaSsaPssKeyTemplate(
251 JwtRsaSsaPssAlgorithm::PS256, 3072, RSA_F4, OutputPrefixType::TINK);
252 return *key_template;
253 }
254
RawJwtPs256_3072_F4_Template()255 const KeyTemplate& RawJwtPs256_3072_F4_Template() {
256 static const KeyTemplate* key_template = NewJwtRsaSsaPssKeyTemplate(
257 JwtRsaSsaPssAlgorithm::PS256, 3072, RSA_F4, OutputPrefixType::RAW);
258 return *key_template;
259 }
260
JwtPs384_3072_F4_Template()261 const KeyTemplate& JwtPs384_3072_F4_Template() {
262 static const KeyTemplate* key_template = NewJwtRsaSsaPssKeyTemplate(
263 JwtRsaSsaPssAlgorithm::PS384, 3072, RSA_F4, OutputPrefixType::TINK);
264 return *key_template;
265 }
266
RawJwtPs384_3072_F4_Template()267 const KeyTemplate& RawJwtPs384_3072_F4_Template() {
268 static const KeyTemplate* key_template = NewJwtRsaSsaPssKeyTemplate(
269 JwtRsaSsaPssAlgorithm::PS384, 3072, RSA_F4, OutputPrefixType::RAW);
270 return *key_template;
271 }
272
JwtPs512_4096_F4_Template()273 const KeyTemplate& JwtPs512_4096_F4_Template() {
274 static const KeyTemplate* key_template = NewJwtRsaSsaPssKeyTemplate(
275 JwtRsaSsaPssAlgorithm::PS512, 4096, RSA_F4, OutputPrefixType::TINK);
276 return *key_template;
277 }
278
RawJwtPs512_4096_F4_Template()279 const KeyTemplate& RawJwtPs512_4096_F4_Template() {
280 static const KeyTemplate* key_template = NewJwtRsaSsaPssKeyTemplate(
281 JwtRsaSsaPssAlgorithm::PS512, 4096, RSA_F4, OutputPrefixType::RAW);
282 return *key_template;
283 }
284
285 } // namespace tink
286 } // namespace crypto
287