mirror of
https://github.com/slackhq/nebula.git
synced 2024-09-20 14:56:12 +08:00
e0185c4b01
* Support NIST curve P256 This change adds support for NIST curve P256. When you use `nebula-cert ca` or `nebula-cert keygen`, you can specify `-curve P256` to enable it. The curve to use is based on the curve defined in your CA certificate. Internally, we use ECDSA P256 to sign certificates, and ECDH P256 to do Noise handshakes. P256 is not supported natively in Noise Protocol, so we define `DHP256` in the `noiseutil` package to implement support for it. You cannot have a mixed network of Curve25519 and P256 certificates, since the Noise protocol will only attempt to parse using the Curve defined in the host's certificate. * verify the curves match in VerifyPrivateKey This would have failed anyways once we tried to actually use the bytes in the private key, but its better to detect the issue up front with a better error message. * add cert.Curve argument to Sign method * fix mismerge * use crypto/ecdh This is the preferred method for doing ECDH functions now, and also has a boringcrypto specific codepath. * remove other ecdh uses of crypto/elliptic use crypto/ecdh instead
55 lines
1.1 KiB
Protocol Buffer
55 lines
1.1 KiB
Protocol Buffer
syntax = "proto3";
|
|
package cert;
|
|
|
|
option go_package = "github.com/slackhq/nebula/cert";
|
|
|
|
//import "google/protobuf/timestamp.proto";
|
|
|
|
enum Curve {
|
|
CURVE25519 = 0;
|
|
P256 = 1;
|
|
}
|
|
|
|
message RawNebulaCertificate {
|
|
RawNebulaCertificateDetails Details = 1;
|
|
bytes Signature = 2;
|
|
}
|
|
|
|
message RawNebulaCertificateDetails {
|
|
string Name = 1;
|
|
|
|
// Ips and Subnets are in big endian 32 bit pairs, 1st the ip, 2nd the mask
|
|
repeated uint32 Ips = 2;
|
|
repeated uint32 Subnets = 3;
|
|
|
|
repeated string Groups = 4;
|
|
int64 NotBefore = 5;
|
|
int64 NotAfter = 6;
|
|
bytes PublicKey = 7;
|
|
|
|
bool IsCA = 8;
|
|
|
|
// sha-256 of the issuer certificate, if this field is blank the cert is self-signed
|
|
bytes Issuer = 9;
|
|
|
|
Curve curve = 100;
|
|
}
|
|
|
|
message RawNebulaEncryptedData {
|
|
RawNebulaEncryptionMetadata EncryptionMetadata = 1;
|
|
bytes Ciphertext = 2;
|
|
}
|
|
|
|
message RawNebulaEncryptionMetadata {
|
|
string EncryptionAlgorithm = 1;
|
|
RawNebulaArgon2Parameters Argon2Parameters = 2;
|
|
}
|
|
|
|
message RawNebulaArgon2Parameters {
|
|
int32 version = 1; // rune in Go
|
|
uint32 memory = 2;
|
|
uint32 parallelism = 4; // uint8 in Go
|
|
uint32 iterations = 3;
|
|
bytes salt = 5;
|
|
}
|