1 // Copyright 2012 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 package x509 6 7 import ( 8 "crypto/ecdsa" 9 "crypto/elliptic" 10 "encoding/asn1" 11 "errors" 12 "fmt" 13 "math/big" 14 ) 15 16 const ecPrivKeyVersion = 1 17 18 // ecPrivateKey reflects an ASN.1 Elliptic Curve Private Key Structure. 19 // References: 20 // RFC 5915 21 // SEC1 - http://www.secg.org/sec1-v2.pdf 22 // Per RFC 5915 the NamedCurveOID is marked as ASN.1 OPTIONAL, however in 23 // most cases it is not. 24 type ecPrivateKey struct { 25 Version int 26 PrivateKey []byte 27 NamedCurveOID asn1.ObjectIdentifier `asn1:"optional,explicit,tag:0"` 28 PublicKey asn1.BitString `asn1:"optional,explicit,tag:1"` 29 } 30 31 // ParseECPrivateKey parses an ASN.1 Elliptic Curve Private Key Structure. 32 func ParseECPrivateKey(der []byte) (*ecdsa.PrivateKey, error) { 33 return parseECPrivateKey(nil, der) 34 } 35 36 // MarshalECPrivateKey marshals an EC private key into ASN.1, DER format. 37 func MarshalECPrivateKey(key *ecdsa.PrivateKey) ([]byte, error) { 38 oid, ok := oidFromNamedCurve(key.Curve) 39 if !ok { 40 return nil, errors.New("x509: unknown elliptic curve") 41 } 42 43 privateKeyBytes := key.D.Bytes() 44 paddedPrivateKey := make([]byte, (key.Curve.Params().N.BitLen()+7)/8) 45 copy(paddedPrivateKey[len(paddedPrivateKey)-len(privateKeyBytes):], privateKeyBytes) 46 47 return asn1.Marshal(ecPrivateKey{ 48 Version: 1, 49 PrivateKey: paddedPrivateKey, 50 NamedCurveOID: oid, 51 PublicKey: asn1.BitString{Bytes: elliptic.Marshal(key.Curve, key.X, key.Y)}, 52 }) 53 } 54 55 // parseECPrivateKey parses an ASN.1 Elliptic Curve Private Key Structure. 56 // The OID for the named curve may be provided from another source (such as 57 // the PKCS8 container) - if it is provided then use this instead of the OID 58 // that may exist in the EC private key structure. 59 func parseECPrivateKey(namedCurveOID *asn1.ObjectIdentifier, der []byte) (key *ecdsa.PrivateKey, err error) { 60 var privKey ecPrivateKey 61 if _, err := asn1.Unmarshal(der, &privKey); err != nil { 62 return nil, errors.New("x509: failed to parse EC private key: " + err.Error()) 63 } 64 if privKey.Version != ecPrivKeyVersion { 65 return nil, fmt.Errorf("x509: unknown EC private key version %d", privKey.Version) 66 } 67 68 var curve elliptic.Curve 69 if namedCurveOID != nil { 70 curve = namedCurveFromOID(*namedCurveOID) 71 } else { 72 curve = namedCurveFromOID(privKey.NamedCurveOID) 73 } 74 if curve == nil { 75 return nil, errors.New("x509: unknown elliptic curve") 76 } 77 78 k := new(big.Int).SetBytes(privKey.PrivateKey) 79 curveOrder := curve.Params().N 80 if k.Cmp(curveOrder) >= 0 { 81 return nil, errors.New("x509: invalid elliptic curve private key value") 82 } 83 priv := new(ecdsa.PrivateKey) 84 priv.Curve = curve 85 priv.D = k 86 87 privateKey := make([]byte, (curveOrder.BitLen()+7)/8) 88 89 // Some private keys have leading zero padding. This is invalid 90 // according to [SEC1], but this code will ignore it. 91 for len(privKey.PrivateKey) > len(privateKey) { 92 if privKey.PrivateKey[0] != 0 { 93 return nil, errors.New("x509: invalid private key length") 94 } 95 privKey.PrivateKey = privKey.PrivateKey[1:] 96 } 97 98 // Some private keys remove all leading zeros, this is also invalid 99 // according to [SEC1] but since OpenSSL used to do this, we ignore 100 // this too. 101 copy(privateKey[len(privateKey)-len(privKey.PrivateKey):], privKey.PrivateKey) 102 priv.X, priv.Y = curve.ScalarBaseMult(privateKey) 103 104 return priv, nil 105 } 106
