Make key identifier hashing selectable

Preserve legacy RFC 5280 SHA-1 subject key identifiers by default and allow callers and binary configuration to explicitly select RFC 7093 SHA-256.

Made-with: Codex

Author: pzduniak

README.md

@@ -75,6 +75,29 @@ correctly.
 5. cd pebble
 6. go install ./cmd/pebble
 
+### FIPS builds
+
+Ordinary builds retain Pebble's legacy RFC 5280 SHA-1 subject key identifiers.
+To use RFC 7093 SHA-256 subject key identifiers, set
+`subjectKeyIdentifierHash` to `sha256` in the `pebble` section of the
+configuration:
+
+```json
+{
+  "pebble": {
+    "subjectKeyIdentifierHash": "sha256"
+  }
+}
+```
+
+The SHA-256 setting is required when running with `GODEBUG=fips140=only`. To
+build against the Go Cryptographic Module v1.0.0 with FIPS mode enabled by
+default:
+
+```bash
+GOFIPS140=v1.0.0 go install ./cmd/pebble
+```
+
 ## Usage
 
 ### Binary

ca/ca.go

@@ -7,7 +7,8 @@ import (
 	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/rsa"
-	"crypto/sha1"
+	"crypto/sha1" //nolint:gosec // Required for legacy RFC 5280 SKI compatibility.
+	"crypto/sha256"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/asn1"
@@ -32,10 +33,37 @@ const (
 	defaultValidityPeriod = 7776000
 )
 
+// SubjectKeyIdentifierHash identifies the hash used to generate certificate
+// subject key identifiers.
+type SubjectKeyIdentifierHash string
+
+const (
+	SubjectKeyIdentifierHashSHA1   SubjectKeyIdentifierHash = "sha1"
+	SubjectKeyIdentifierHashSHA256 SubjectKeyIdentifierHash = "sha256"
+)
+
+// Option configures a CA.
+type Option struct {
+	apply func(*options)
+}
+
+// WithSubjectKeyIdentifierHash configures the hash used to generate
+// certificate subject key identifiers.
+func WithSubjectKeyIdentifierHash(hash SubjectKeyIdentifierHash) Option {
+	return Option{apply: func(options *options) {
+		options.subjectKeyIdentifierHash = hash
+	}}
+}
+
+type options struct {
+	subjectKeyIdentifierHash SubjectKeyIdentifierHash
+}
+
 type CAImpl struct {
-	log              *log.Logger
-	db               *db.MemoryStore
-	ocspResponderURL string
+	log                      *log.Logger
+	db                       *db.MemoryStore
+	ocspResponderURL         string
+	subjectKeyIdentifierHash SubjectKeyIdentifierHash
 
 	chains   []*chain
 	profiles map[string]*Profile
@@ -77,7 +105,7 @@ func makeSerial() *big.Int {
 }
 
 // Taken from https://github.com/cloudflare/cfssl/blob/b94e044bb51ec8f5a7232c71b1ed05dbe4da96ce/signer/signer.go#L221-L244
-func makeSubjectKeyID(key crypto.PublicKey) ([]byte, error) {
+func makeSubjectKeyID(key crypto.PublicKey, hash SubjectKeyIdentifierHash) ([]byte, error) {
 	// Marshal the public key as ASN.1
 	pubAsDER, err := x509.MarshalPKIXPublicKey(key)
 	if err != nil {
@@ -94,17 +122,28 @@ func makeSubjectKeyID(key crypto.PublicKey) ([]byte, error) {
 		return nil, err
 	}
 
-	// Hash it according to https://tools.ietf.org/html/rfc5280#section-4.2.1.2 Method #1:
-	ski := sha1.Sum(pubInfo.SubjectPublicKey.Bytes)
-	return ski[:], nil
+	switch hash {
+	case SubjectKeyIdentifierHashSHA256:
+		// RFC 7093, section 2, method 1 uses the leftmost 160 bits of the
+		// SHA-256 hash of the subjectPublicKey.
+		ski := sha256.Sum256(pubInfo.SubjectPublicKey.Bytes)
+		return ski[:20], nil
+	case SubjectKeyIdentifierHashSHA1:
+		// RFC 5280, section 4.2.1.2, method 1. SHA-1 is retained for legacy
+		// compatibility when explicitly selected.
+		ski := sha1.Sum(pubInfo.SubjectPublicKey.Bytes)
+		return ski[:], nil
+	default:
+		return nil, fmt.Errorf("unsupported subject key identifier hash %q", hash)
+	}
 }
 
 // makeKey and makeRootCert are adapted from MiniCA:
 // https://github.com/jsha/minica/blob/3a621c05b61fa1c24bcb42fbde4b261db504a74f/main.go
 
 // makeKey creates a new private key of the requested key algorithm, and
 // returns it and its corresponding Subject Key Identifier.
-func makeKey(keyAlg string) (crypto.Signer, []byte, error) {
+func (ca *CAImpl) makeKey(keyAlg string) (crypto.Signer, []byte, error) {
 	var key crypto.Signer
 	var err error
 	switch keyAlg {
@@ -116,7 +155,7 @@ func makeKey(keyAlg string) (crypto.Signer, []byte, error) {
 	if err != nil {
 		return nil, nil, err
 	}
-	ski, err := makeSubjectKeyID(key.Public())
+	ski, err := makeSubjectKeyID(key.Public(), ca.subjectKeyIdentifierHash)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -182,7 +221,7 @@ func (ca *CAImpl) makeCACert(
 
 func (ca *CAImpl) newRootIssuer(name string, keyAlg string) (*issuer, error) {
 	// Make a root private key
-	rk, subjectKeyID, err := makeKey(keyAlg)
+	rk, subjectKeyID, err := ca.makeKey(keyAlg)
 	if err != nil {
 		return nil, err
 	}
@@ -238,7 +277,7 @@ func (ca *CAImpl) newChain(intermediateKey crypto.Signer, intermediateSubject pk
 	prev := root
 	intermediates := make([]*issuer, numIntermediates)
 	for i := numIntermediates - 1; i > 0; i-- {
-		k, ski, err := makeKey(keyAlg)
+		k, ski, err := ca.makeKey(keyAlg)
 		if err != nil {
 			panic(fmt.Sprintf("Error creating new intermediate issuer: %v", err))
 		}
@@ -373,11 +412,19 @@ func (ca *CAImpl) newCertificate(domains []string, ips []net.IP, key crypto.Publ
 	return newCert, nil
 }
 
-func New(log *log.Logger, db *db.MemoryStore, ocspResponderURL string, keyAlg string, alternateRoots int, chainLength int, profiles map[string]Profile) *CAImpl {
+func New(log *log.Logger, db *db.MemoryStore, ocspResponderURL string, keyAlg string, alternateRoots int, chainLength int, profiles map[string]Profile, opts ...Option) *CAImpl {
+	options := options{subjectKeyIdentifierHash: SubjectKeyIdentifierHashSHA1}
+	for _, option := range opts {
+		if option.apply != nil {
+			option.apply(&options)
+		}
+	}
+
 	ca := &CAImpl{
-		log:      log,
-		db:       db,
-		profiles: make(map[string]*Profile, len(profiles)),
+		log:                      log,
+		db:                       db,
+		subjectKeyIdentifierHash: options.subjectKeyIdentifierHash,
+		profiles:                 make(map[string]*Profile, len(profiles)),
 	}
 
 	if ocspResponderURL != "" {
@@ -388,7 +435,7 @@ func New(log *log.Logger, db *db.MemoryStore, ocspResponderURL string, keyAlg st
 	intermediateSubject := pkix.Name{
 		CommonName: intermediateCAPrefix + hex.EncodeToString(makeSerial().Bytes()[:3]),
 	}
-	intermediateKey, subjectKeyID, err := makeKey(keyAlg)
+	intermediateKey, subjectKeyID, err := ca.makeKey(keyAlg)
 	if err != nil {
 		panic(fmt.Sprintf("Error creating new intermediate private key: %s", err.Error()))
 	}

ca/ca_test.go

@@ -4,10 +4,12 @@ import (
 	"bytes"
 	"crypto/ecdsa"
 	"crypto/elliptic"
+	"crypto/fips140"
 	"crypto/rand"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/asn1"
+	"encoding/hex"
 	"log"
 	"net"
 	"os"
@@ -27,7 +29,71 @@ var (
 func makeCa() *CAImpl {
 	logger := log.New(os.Stdout, "Pebble ", log.LstdFlags)
 	db := db.NewMemoryStore()
-	return New(logger, db, "", "ecdsa", 0, 1, map[string]Profile{"default": {}})
+	return New(
+		logger,
+		db,
+		"",
+		"ecdsa",
+		0,
+		1,
+		map[string]Profile{"default": {}},
+		WithSubjectKeyIdentifierHash(SubjectKeyIdentifierHashSHA256),
+	)
+}
+
+func testMakeSubjectKeyID(t *testing.T, hash SubjectKeyIdentifierHash, expected string) {
+	t.Helper()
+	publicKeyBytes, err := hex.DecodeString(
+		"047f7f35a79794c950060b8029fc8f363a28f11159692d9d34e6ac948190434735" +
+			"f833b1a66652dc514337aff7f5c9c75d670c019d95a5d639b72744c64a9128bb",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	x, y := elliptic.Unmarshal(elliptic.P256(), publicKeyBytes)
+	if x == nil || y == nil {
+		t.Fatal("failed to parse RFC 7093 public key")
+	}
+
+	got, err := makeSubjectKeyID(&ecdsa.PublicKey{Curve: elliptic.P256(), X: x, Y: y}, hash)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want, err := hex.DecodeString(expected)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(got, want) {
+		t.Fatalf("unexpected subject key identifier: got %x, want %x", got, want)
+	}
+}
+
+func TestMakeSubjectKeyIDSHA1(t *testing.T) {
+	if fips140.Enforced() {
+		t.Skip("SHA-1 is unavailable when FIPS enforcement is enabled")
+	}
+	testMakeSubjectKeyID(t, SubjectKeyIdentifierHashSHA1, "6fef9162c0a3f2e7608956d41c37da0c8e87f0ae")
+}
+
+func TestMakeSubjectKeyIDSHA256(t *testing.T) {
+	testMakeSubjectKeyID(t, SubjectKeyIdentifierHashSHA256, "bf37b3e5808fd46d54b28e846311bcce1cad2e1a")
+}
+
+func TestMakeSubjectKeyIDRejectsUnknownHash(t *testing.T) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := makeSubjectKeyID(key.Public(), SubjectKeyIdentifierHash("unknown")); err == nil {
+		t.Fatal("expected an error")
+	}
+}
+
+func TestWithSubjectKeyIdentifierHash(t *testing.T) {
+	ca := makeCa()
+	if ca.subjectKeyIdentifierHash != SubjectKeyIdentifierHashSHA256 {
+		t.Fatalf("unexpected hash: got %q, want %q", ca.subjectKeyIdentifierHash, SubjectKeyIdentifierHashSHA256)
+	}
 }
 
 func makeCertOrderWithExtensions(extensions []pkix.Extension) core.Order {

cmd/pebble/main.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"errors"
 	"flag"
 	"fmt"
 	"log"
@@ -35,7 +36,9 @@ type config struct {
 		// Configure policies to deny certain domains
 		DomainBlocklist []string
 		KeyAlgorithm    string
-		Profiles        map[string]ca.Profile
+		// Select the hash used for certificate subject key identifiers.
+		SubjectKeyIdentifierHash string
+		Profiles                 map[string]ca.Profile
 
 		RetryAfter struct {
 			Authz int
@@ -115,6 +118,15 @@ func main() {
 		cmd.FailOnError(fmt.Errorf("%q is not one of %#v", keyAlg, acceptableKeyAlgs), "invalid key algorithm")
 	}
 
+	subjectKeyIdentifierHash := ca.SubjectKeyIdentifierHash(c.Pebble.SubjectKeyIdentifierHash)
+	if subjectKeyIdentifierHash == "" {
+		subjectKeyIdentifierHash = ca.SubjectKeyIdentifierHashSHA1
+	}
+	if subjectKeyIdentifierHash != ca.SubjectKeyIdentifierHashSHA1 &&
+		subjectKeyIdentifierHash != ca.SubjectKeyIdentifierHashSHA256 {
+		cmd.FailOnError(errors.New("must be sha1 or sha256"), "invalid subject key identifier hash")
+	}
+
 	profiles := c.Pebble.Profiles
 	if len(profiles) == 0 {
 		profiles = map[string]ca.Profile{
@@ -126,7 +138,16 @@ func main() {
 	}
 
 	db := db.NewMemoryStore()
-	ca := ca.New(logger, db, c.Pebble.OCSPResponderURL, keyAlg, alternateRoots, chainLength, profiles)
+	ca := ca.New(
+		logger,
+		db,
+		c.Pebble.OCSPResponderURL,
+		keyAlg,
+		alternateRoots,
+		chainLength,
+		profiles,
+		ca.WithSubjectKeyIdentifierHash(subjectKeyIdentifierHash),
+	)
 	va := va.New(logger, c.Pebble.HTTPPort, c.Pebble.TLSPort, *strictMode, *resolverAddress, db)
 
 	for keyID, key := range c.Pebble.ExternalAccountMACKeys {