def _forge_cert(self, cert_issuer_id, issuer, cert_subject_id, subject):
self._log.debug("Forging chain element %d -> %d: %s -> %s", cert_issuer_id, cert_subject_id, issuer, subject)
issuer_key_filename = self._args.key_template % (cert_issuer_id)
key_filename = self._args.key_template % (cert_subject_id)
crt_filename = self._args.cert_template % (cert_subject_id)
if (not os.path.isfile(key_filename)) or self._args.force:
OpenSSLTools.create_private_key(PrivateKeyStorage(storage_form = PrivateKeyStorageForm.PEM_FILE, filename = key_filename), subject.pubkey.keyspec)
# Read new private key and convert to public key
with tempfile.NamedTemporaryFile(prefix = "pubkey_", suffix = ".pem") as pubkey_file:
OpenSSLTools.private_to_public(key_filename, pubkey_file.name)
subject_pubkey = PublicKey.read_pemfile(pubkey_file.name)[0]
# Do the same for the issuer key to get the issuer key ID
with tempfile.NamedTemporaryFile(prefix = "pubkey_", suffix = ".pem") as pubkey_file:
OpenSSLTools.private_to_public(issuer_key_filename, pubkey_file.name)
issuer_pubkey = PublicKey.read_pemfile(pubkey_file.name)[0]
# Replace public key first
forged_cert_asn1 = subject.asn1_clone
forged_cert_asn1["tbsCertificate"]["subjectPublicKeyInfo"] = subject_pubkey.asn1
# Do identifiers need to be recalculated?
if self._args.recalculate_keyids:
if subject.extensions.has(OIDDB.X509Extensions.inverse("SubjectKeyIdentifier")):
# Replace subject key identifier
new_key_id = subject_pubkey.keyid()
replacement_extension = X509SubjectKeyIdentifierExtension.construct(new_key_id)
subject.extensions.filter(OIDDB.X509Extensions.inverse("SubjectKeyIdentifier"), replacement_extension)
if subject.extensions.has(OIDDB.X509Extensions.inverse("AuthorityKeyIdentifier")):
# Replace authority key identifier
new_key_id = issuer_pubkey.keyid()
replacement_extension = X509AuthorityKeyIdentifierExtension.construct(new_key_id)
subject.extensions.filter(OIDDB.X509Extensions.inverse("AuthorityKeyIdentifier"), replacement_extension)
forged_cert_asn1["tbsCertificate"]["extensions"] = subject.extensions.to_asn1()
# Re-serialize certificate
forged_cert = X509Certificate.from_asn1(forged_cert_asn1)
# Then sign the modified certifiate
signature = OpenSSLTools.sign_data(subject.signature_algorithm, issuer_key_filename, forged_cert.signed_payload)
# Finally, place the signature into the certificate
forged_cert_asn1["signatureValue"] = ASN1Tools.bytes2bitstring(signature)
forged_cert = X509Certificate.from_asn1(forged_cert_asn1)
forged_cert.write_pemfile(crt_filename)
def pubkey(self):
return PublicKey.create(cryptosystem=self.cryptosystem,
parameters={
"curve": self.curve,
"x": self.x,
"y": self.y
})
def pubkey(self):
(scalar, point) = self.curve.expand_secret(self.priv)
return PublicKey.create(cryptosystem=self.cryptosystem,
parameters={
"curve": self.curve,
"x": point.x,
"y": point.y
})
def test_extract_nested(self):
with tempfile.TemporaryDirectory() as tempdir, WorkDir(
tempdir), tempfile.NamedTemporaryFile(prefix="scrapeme_",
suffix=".bin") as f:
crt = self._load_crt("ok/johannes-bauer.com")
self._prepare_file(f, [100, crt.der_data, 100])
self._run_x509sak(["scrape", "--extract-nested", f.name])
found = os.listdir("scrape/")
self.assertEqual(len(found), 2)
scraped_crt = X509Certificate.read_pemfile(
"scrape/scrape_%07x_crt.pem" % (100))[0]
scraped_pubkey = PublicKey.read_pemfile(
"scrape/scrape_%07x_pubkey.pem" % (287))[0]
self.assertEqual(scraped_crt.pubkey, scraped_pubkey)
def pubkey(self):
pubkey_asn1 = self.asn1["tbsCertificate"]["subjectPublicKeyInfo"]
return PublicKey.from_asn1(pubkey_asn1)
def __init__(self, cmdname, args):
BaseAction.__init__(self, cmdname, args)
if self._args.public_key:
key = PublicKey.read_pemfile(self._args.key_filename)[0]
if key.pk_alg.value.cryptosystem == Cryptosystems.RSA:
print("# %d bit RSA public key (ID %s)" %
(key.n.bit_length(), key.keyid().hex()))
print("n = 0x%x" % (key.n))
print("e = 0x%x" % (key.e))
elif key.pk_alg.value.cryptosystem == Cryptosystems.ECC_ECDSA:
print("# ECC public key on %s (key ID %s)" %
(key.curve.name, key.keyid().hex()))
print("curve_name = \"%s\"" % (key.curve.name))
print("(x, y) = (0x%x, 0x%x)" % (key.x, key.y))
elif key.pk_alg.value.cryptosystem == Cryptosystems.ECC_EdDSA:
print(
"# ECC public key on Twisted Edwards curve %s %s prehashing (key ID %s)"
% (key.curve.name, "with" if key.prehash else "without",
key.keyid().hex()))
print("curve_name = \"%s\"" % (key.curve.name))
print("prehash = %s" % (key.prehash))
print("(x, y) = (0x%x, 0x%x)" % (key.x, key.y))
else:
raise NotImplementedError(key.pk_alg.value.cryptosystem)
else:
if self._args.key_type == "rsa":
key = RSAPrivateKey.read_pemfile(self._args.key_filename)[0]
print("# %d bit RSA private key (ID %s)" %
(key.n.bit_length(), key.pubkey.keyid().hex()))
print("p = 0x%x" % (key.p))
print("q = 0x%x" % (key.q))
print("n = p * q")
print("e = 0x%x" % (key.e))
print("d = 0x%x" % (key.d))
elif self._args.key_type == "ecc":
key = ECPrivateKey.read_pemfile(self._args.key_filename)[0]
print("# ECC private key on %s (key ID %s)" %
(key.curve.name, key.pubkey.keyid().hex()))
print("curve_name = \"%s\"" % (key.curve.name))
print("d = 0x%x" % (key.d))
print("(x, y) = (0x%x, 0x%x)" % (key.x, key.y))
elif self._args.key_type == "eddsa":
key = EDPrivateKey.read_pemfile(self._args.key_filename)[0]
pubkey = key.pubkey
print(
"# ECC private key on Twisted Edwards curve %s %s prehashing (key ID %s)"
% (key.curve.name, "with" if key.prehash else "without",
pubkey.keyid().hex()))
print("curve_name = \"%s\"" % (key.curve.name))
print("prehash = %s" % (key.prehash))
print("priv = bytes.fromhex(\"%s\")" % (key.priv.hex()))
print("hashfnc = hashlib.new(\"%s\")" %
(key.curve.expand_hashfnc))
print(
"(expand_bitwise_and, expand_bitwise_or) = (0x%x, 0x%x)" %
(key.curve.expand_bitwise_and,
key.curve.expand_bitwise_or))
print("a = 0x%x" % (key.scalar))
print("(x, y) = (0x%x, 0x%x)" % (pubkey.x, pubkey.y))
else:
raise NotImplementedError(self._args.key_type)
def _load_raw_pubkey(self, keyname): return PublicKey.from_pem_data(self._load_data(keyname))[0]
def pubkey(self):
return PublicKey.create(cryptosystem=self.cryptosystem,
parameters={
"n": self.n,
"e": self.e
})