[FAB-4884] Restrict KeyUsage for signing keys

FAB-4626 introduces a change to restrict the
KeyUsage for signing certificates to
x509.KeyUsageDigitalSignature and restricts
ExtendedKeyUsage as well.

cryptogen currently uses the same certs
for signing and TLS and therefore the
the generated certs will no longer be
valid signing identities.

This CR does the following:
- generates signing certs with the proper
KeyUsage
- generates separate TLS certs with the
appropriate KeyUsage and ExtendedKeyUsage

Change-Id: I9112d47d2635370489fec3ff07f09118dc021318
Signed-off-by: Gari Singh <[email protected]>

Author: mastersingh24

common/tools/cryptogen/ca/ca_test.go

@@ -71,23 +71,36 @@ func TestGenerateSignCertificate(t *testing.T) {
 	rootCA, err := ca.NewCA(caDir, testCA2Name, testCA2Name)
 	assert.NoError(t, err, "Error generating CA")
 
-	_, err = rootCA.SignCertificate(certDir, testName, nil, ecPubKey)
+	cert, err := rootCA.SignCertificate(certDir, testName, nil, ecPubKey,
+		x509.KeyUsageDigitalSignature|x509.KeyUsageKeyEncipherment,
+		[]x509.ExtKeyUsage{x509.ExtKeyUsageAny})
 	assert.NoError(t, err, "Failed to generate signed certificate")
+	// KeyUsage should be x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment
+	assert.Equal(t, x509.KeyUsageDigitalSignature|x509.KeyUsageKeyEncipherment,
+		cert.KeyUsage)
+	assert.Contains(t, cert.ExtKeyUsage, x509.ExtKeyUsageAny)
+
+	cert, err = rootCA.SignCertificate(certDir, testName, nil, ecPubKey,
+		x509.KeyUsageDigitalSignature, []x509.ExtKeyUsage{})
+	assert.NoError(t, err, "Failed to generate signed certificate")
+	assert.Equal(t, 0, len(cert.ExtKeyUsage))
 
 	// check to make sure the signed public key was stored
 	pemFile := filepath.Join(certDir, testName+"-cert.pem")
 	assert.Equal(t, true, checkForFile(pemFile),
 		"Expected to find file "+pemFile)
 
-	_, err = rootCA.SignCertificate(certDir, "empty/CA", nil, ecPubKey)
+	_, err = rootCA.SignCertificate(certDir, "empty/CA", nil, ecPubKey,
+		x509.KeyUsageKeyEncipherment, []x509.ExtKeyUsage{x509.ExtKeyUsageAny})
 	assert.Error(t, err, "Bad name should fail")
 
 	// use an empty CA to test error path
 	badCA := &ca.CA{
 		Name:     "badCA",
 		SignCert: &x509.Certificate{},
 	}
-	_, err = badCA.SignCertificate(certDir, testName, nil, &ecdsa.PublicKey{})
+	_, err = badCA.SignCertificate(certDir, testName, nil, &ecdsa.PublicKey{},
+		x509.KeyUsageKeyEncipherment, []x509.ExtKeyUsage{x509.ExtKeyUsageAny})
 	assert.Error(t, err, "Empty CA should not be able to sign")
 	cleanup(testDir)
 

common/tools/cryptogen/ca/generator.go

@@ -57,8 +57,10 @@ func NewCA(baseDir, org, name string) (*CA, error) {
 				template := x509Template()
 				//this is a CA
 				template.IsCA = true
-				template.KeyUsage |= x509.KeyUsageCertSign | x509.KeyUsageCRLSign
-				template.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageAny, x509.ExtKeyUsageServerAuth}
+				template.KeyUsage |= x509.KeyUsageDigitalSignature |
+					x509.KeyUsageKeyEncipherment | x509.KeyUsageCertSign |
+					x509.KeyUsageCRLSign
+				template.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageAny}
 
 				//set the organization for the subject
 				subject := subjectTemplate()
@@ -86,10 +88,12 @@ func NewCA(baseDir, org, name string) (*CA, error) {
 
 // SignCertificate creates a signed certificate based on a built-in template
 // and saves it in baseDir/name
-func (ca *CA) SignCertificate(baseDir, name string, sans []string, pub *ecdsa.PublicKey) (*x509.Certificate, error) {
+func (ca *CA) SignCertificate(baseDir, name string, sans []string, pub *ecdsa.PublicKey,
+	ku x509.KeyUsage, eku []x509.ExtKeyUsage) (*x509.Certificate, error) {
 
 	template := x509Template()
-	template.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}
+	template.KeyUsage = ku
+	template.ExtKeyUsage = eku
 
 	//set the organization for the subject
 	subject := subjectTemplate()
@@ -130,7 +134,6 @@ func x509Template() x509.Certificate {
 		SerialNumber:          serialNumber,
 		NotBefore:             now,
 		NotAfter:              now.Add(3650 * 24 * time.Hour), //~ten years
-		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
 		BasicConstraintsValid: true,
 	}
 	return x509

common/tools/cryptogen/msp/generator.go

@@ -36,7 +36,7 @@ func GenerateLocalMSP(baseDir, name string, sans []string, rootCA *ca.CA) error
 	mspDir := filepath.Join(baseDir, "msp")
 	tlsDir := filepath.Join(baseDir, "tls")
 
-	err := createFolderStructure(mspDir)
+	err := createFolderStructure(mspDir, true)
 	if err != nil {
 		return err
 	}
@@ -46,6 +46,9 @@ func GenerateLocalMSP(baseDir, name string, sans []string, rootCA *ca.CA) error
 		return err
 	}
 
+	/*
+		Create the MSP identity artifacts
+	*/
 	// get keystore path
 	keystore := filepath.Join(mspDir, "keystore")
 
@@ -55,26 +58,24 @@ func GenerateLocalMSP(baseDir, name string, sans []string, rootCA *ca.CA) error
 		return err
 	}
 
-	// get public signing certificate
+	// get public key
 	ecPubKey, err := csp.GetECPublicKey(priv)
 	if err != nil {
 		return err
 	}
-
-	cert, err := rootCA.SignCertificate(filepath.Join(mspDir, "signcerts"), name, sans, ecPubKey)
+	// generate X509 certificate
+	cert, err := rootCA.SignCertificate(filepath.Join(mspDir, "signcerts"),
+		name, []string{}, ecPubKey, x509.KeyUsageDigitalSignature, []x509.ExtKeyUsage{})
 	if err != nil {
 		return err
 	}
 
 	// write artifacts to MSP folders
 
 	// the CA certificate goes into cacerts
-	folders := []string{"cacerts"}
-	for _, folder := range folders {
-		err = x509Export(filepath.Join(mspDir, folder, x509Filename(rootCA.Name)), rootCA.SignCert)
-		if err != nil {
-			return err
-		}
+	err = x509Export(filepath.Join(mspDir, "cacerts", x509Filename(rootCA.Name)), rootCA.SignCert)
+	if err != nil {
+		return err
 	}
 
 	// the signing identity goes into admincerts.
@@ -84,26 +85,46 @@ func GenerateLocalMSP(baseDir, name string, sans []string, rootCA *ca.CA) error
 	// cleared up anyway by copyAdminCert, but
 	// we leave a valid admin for now for the sake
 	// of unit tests
-	folders = []string{"admincerts"}
-	for _, folder := range folders {
-		err = x509Export(filepath.Join(mspDir, folder, x509Filename(rootCA.Name)), cert)
-		if err != nil {
-			return err
-		}
+	err = x509Export(filepath.Join(mspDir, "admincerts", x509Filename(name)), cert)
+	if err != nil {
+		return err
 	}
 
-	// write artifacts to TLS folder
+	/*
+		Generate the TLS artifacts in the TLS folder
+	*/
+
+	// generate private key
+	tlsPrivKey, _, err := csp.GeneratePrivateKey(tlsDir)
+	if err != nil {
+		return err
+	}
+	// get public key
+	tlsPubKey, err := csp.GetECPublicKey(tlsPrivKey)
+	if err != nil {
+		return err
+	}
+	// generate X509 certificate
+	_, err = rootCA.SignCertificate(filepath.Join(tlsDir),
+		name, sans, tlsPubKey, x509.KeyUsageDigitalSignature|x509.KeyUsageKeyEncipherment,
+		[]x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth})
+	if err != nil {
+		return err
+	}
 	err = x509Export(filepath.Join(tlsDir, "ca.crt"), rootCA.SignCert)
 	if err != nil {
 		return err
 	}
 
-	err = x509Export(filepath.Join(tlsDir, "server.crt"), cert)
+	// rename the generated TLS X509 cert
+	err = os.Rename(filepath.Join(tlsDir, x509Filename(name)),
+		filepath.Join(tlsDir, "server.crt"))
+	//err = x509Export(filepath.Join(tlsDir, "server.crt"), tlsCert)
 	if err != nil {
 		return err
 	}
 
-	err = keyExport(keystore, filepath.Join(tlsDir, "server.key"), priv)
+	err = keyExport(tlsDir, filepath.Join(tlsDir, "server.key"), tlsPrivKey)
 	if err != nil {
 		return err
 	}
@@ -114,10 +135,11 @@ func GenerateLocalMSP(baseDir, name string, sans []string, rootCA *ca.CA) error
 func GenerateVerifyingMSP(baseDir string, rootCA *ca.CA) error {
 
 	// create folder structure
-	err := createFolderStructure(baseDir)
+	err := createFolderStructure(baseDir, false)
 	if err == nil {
 		// write MSP cert to appropriate folders
-		folders := []string{"cacerts", "signcerts"}
+		//folders := []string{"cacerts", "signcerts"}
+		folders := []string{"cacerts"}
 		for _, folder := range folders {
 			err = x509Export(filepath.Join(baseDir, folder, x509Filename(rootCA.Name)), rootCA.SignCert)
 			if err != nil {
@@ -137,22 +159,26 @@ func GenerateVerifyingMSP(baseDir string, rootCA *ca.CA) error {
 	if err != nil {
 		return err
 	}
-	_, err = rootCA.SignCertificate(filepath.Join(baseDir, "admincerts"), rootCA.Name, []string{""}, ecPubKey)
+	_, err = rootCA.SignCertificate(filepath.Join(baseDir, "admincerts"), rootCA.Name,
+		[]string{""}, ecPubKey, x509.KeyUsageDigitalSignature, []x509.ExtKeyUsage{})
 	if err != nil {
 		return err
 	}
 
 	return nil
 }
 
-func createFolderStructure(rootDir string) error {
+func createFolderStructure(rootDir string, local bool) error {
 
+	var folders []string
 	// create admincerts, cacerts, keystore and signcerts folders
-	folders := []string{
+	folders = []string{
 		filepath.Join(rootDir, "admincerts"),
 		filepath.Join(rootDir, "cacerts"),
-		filepath.Join(rootDir, "keystore"),
-		filepath.Join(rootDir, "signcerts"),
+	}
+	if local {
+		folders = append(folders, filepath.Join(rootDir, "keystore"),
+			filepath.Join(rootDir, "signcerts"))
 	}
 
 	for _, folder := range folders {
@@ -195,7 +221,7 @@ func copyFile(src, dst string) error {
 func keyExport(keystore, output string, key bccsp.Key) error {
 	id := hex.EncodeToString(key.SKI())
 
-	return copyFile(filepath.Join(keystore, id+"_sk"), output)
+	return os.Rename(filepath.Join(keystore, id+"_sk"), output)
 }
 
 func pemExport(path, pemType string, bytes []byte) error {

common/tools/cryptogen/msp/msp_test.go

@@ -50,7 +50,7 @@ func TestGenerateLocalMSP(t *testing.T) {
 
 	// check to see that the right files were generated/saved
 	files := []string{
-		filepath.Join(mspDir, "admincerts", testCAName+"-cert.pem"),
+		filepath.Join(mspDir, "admincerts", testName+"-cert.pem"),
 		filepath.Join(mspDir, "cacerts", testCAName+"-cert.pem"),
 		filepath.Join(mspDir, "keystore"),
 		filepath.Join(mspDir, "signcerts", testName+"-cert.pem"),
@@ -91,7 +91,6 @@ func TestGenerateVerifyingMSP(t *testing.T) {
 	files := []string{
 		filepath.Join(mspDir, "admincerts", testCAName+"-cert.pem"),
 		filepath.Join(mspDir, "cacerts", testCAName+"-cert.pem"),
-		filepath.Join(mspDir, "signcerts", testCAName+"-cert.pem"),
 	}
 
 	for _, file := range files {