Redesign authentication protocol

crypto/pem.go

@@ -1,14 +1,17 @@
 package crypto
 
 import (
+	"crypto"
+	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
 	"encoding/pem"
+	"errors"
 
 	jwt "github.com/dgrijalva/jwt-go"
 )
 
-func EncodePublicKeyToPEM(key interface{}) ([]byte, error) {
+func EncodePublicKeyToPEM(key crypto.PublicKey) ([]byte, error) {
 	pub, err := x509.MarshalPKIXPublicKey(key)
 	if err != nil {
 		return nil, err
@@ -20,6 +23,55 @@ func EncodePublicKeyToPEM(key interface{}) ([]byte, error) {
 	return data, nil
 }
 
-func DecodePEMToPublicKey(pem []byte) (*rsa.PublicKey, error) {
+func DecodePEMToPublicKey(pem []byte) (crypto.PublicKey, error) {
 	return jwt.ParseRSAPublicKeyFromPEM(pem)
 }
+
+func DecodePEMEncryptedPrivateKey(key []byte, passphrase []byte) (*rsa.PrivateKey, error) {
+	var err error
+
+	// Parse PEM block
+	var block *pem.Block
+	if block, _ = pem.Decode(key); block == nil {
+		return nil, errors.New("invalid PEM block")
+	}
+
+	decryptedBlock, err := x509.DecryptPEMBlock(block, passphrase)
+	if err != nil {
+		return nil, err
+	}
+
+	var parsedKey interface{}
+	if parsedKey, err = x509.ParsePKCS1PrivateKey(decryptedBlock); err != nil {
+		return nil, err
+	}
+
+	var privateKey *rsa.PrivateKey
+	var ok bool
+	if privateKey, ok = parsedKey.(*rsa.PrivateKey); !ok {
+		return nil, errors.New("invalid RSA private key")
+	}
+
+	return privateKey, nil
+}
+
+func EncodePrivateKeyToEncryptedPEM(key *rsa.PrivateKey, passphrase []byte) ([]byte, error) {
+	if passphrase == nil {
+		return nil, errors.New("passphrase cannot be empty")
+	}
+
+	block := &pem.Block{
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(key),
+	}
+
+	block, err := x509.EncryptPEMBlock(
+		rand.Reader, block.Type,
+		block.Bytes, passphrase, x509.PEMCipherAES256,
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return pem.EncodeToMemory(block), nil
+}

crypto/rsa.go

@@ -0,0 +1,34 @@
+package crypto
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"time"
+
+	peering "forge.cadoles.com/wpetit/go-http-peering"
+
+	jwt "github.com/dgrijalva/jwt-go"
+)
+
+func CreateRSAKey(bits int) (*rsa.PrivateKey, error) {
+	key, err := rsa.GenerateKey(rand.Reader, bits)
+	if err != nil {
+		return nil, err
+	}
+	return key, nil
+}
+
+func CreateServerToken(privateKey *rsa.PrivateKey, issuer string, peerID peering.PeerID) (string, error) {
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, peering.ServerTokenClaims{
+		StandardClaims: jwt.StandardClaims{
+			NotBefore: time.Now().Unix(),
+			Issuer:    issuer,
+		},
+		PeerID: peerID,
+	})
+	tokenStr, err := token.SignedString(privateKey)
+	if err != nil {
+		return "", err
+	}
+	return tokenStr, nil
+}