Skip to content
This repository was archived by the owner on Apr 25, 2025. It is now read-only.

Commit 26b3d2e

Browse files
sudeshrshettysudeshrshetty
committed
[FAB-6983] bccsp import refactoring
Change highlights: - Internal bccsp is not directly referred anywhere in SDK including internal fabric-ca. - All bccsp call is going through cryptosuitebridge - Internal bccsp is still referred in some mocks and integration-test for testdata. Change-Id: I267361869ace224842ebf3ebeffad551aed6c0ef Signed-off-by: Sudesh Shetty <sudesh.shetty@securekey.com>
1 parent e9fa53a commit 26b3d2e

File tree

29 files changed

+886
-183
lines changed

29 files changed

+886
-183
lines changed

‎api/apicryptosuite/cryptosuite.go‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,10 @@ CryptoSuite interface defined in this file acts as a wrapper for
2323

2424
package apicryptosuite
2525

26-
import "crypto"
26+
import (
27+
"crypto"
28+
"hash"
29+
)
2730

2831
//CryptoSuite adaptor for all bccsp functionalities used by SDK
2932
type CryptoSuite interface {
@@ -43,13 +46,21 @@ type CryptoSuite interface {
4346
// If opts is nil, the default hash function will be used.
4447
Hash(msg []byte, opts HashOpts) (hash []byte, err error)
4548

49+
// GetHash returns and instance of hash.Hash using options opts.
50+
// If opts is nil, the default hash function will be returned.
51+
GetHash(opts HashOpts) (h hash.Hash, err error)
52+
4653
// Sign signs digest using key k.
4754
// The opts argument should be appropriate for the algorithm used.
4855
//
4956
// Note that when a signature of a hash of a larger message is needed,
5057
// the caller is responsible for hashing the larger message and passing
5158
// the hash (as digest).
5259
Sign(k Key, digest []byte, opts SignerOpts) (signature []byte, err error)
60+
61+
// Verify verifies signature against key k and digest
62+
// The opts argument should be appropriate for the algorithm used.
63+
Verify(k Key, signature, digest []byte, opts SignerOpts) (valid bool, err error)
5364
}
5465

5566
// Key represents a cryptographic key

‎internal/github.com/hyperledger/fabric-ca/lib/clientconfig.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ package lib
2323
import (
2424
"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric-ca/api"
2525
"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric-ca/lib/tls"
26-
"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp/factory"
26+
factory "github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric-ca/sdkpatch/cryptosuitebridge"
2727
)
2828

2929
// ClientConfig is the fabric-ca client's config

‎internal/github.com/hyperledger/fabric-ca/lib/tls/tls.go‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,11 @@ import (
2727
"time"
2828

2929
"github.com/hyperledger/fabric-sdk-go/api/apicryptosuite"
30-
cryptosuite "github.com/hyperledger/fabric-sdk-go/pkg/cryptosuite/bccsp"
31-
3230
"github.com/hyperledger/fabric-sdk-go/pkg/errors"
3331

32+
factory "github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric-ca/sdkpatch/cryptosuitebridge"
3433
log "github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric-ca/sdkpatch/logbridge"
3534
"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric-ca/util"
36-
"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp/factory"
3735
)
3836

3937
// ServerTLSConfig defines key material for a TLS server
@@ -68,7 +66,7 @@ func GetClientTLSConfig(cfg *ClientTLSConfig, csp apicryptosuite.CryptoSuite) (*
6866
var certs []tls.Certificate
6967

7068
if csp == nil {
71-
csp = cryptosuite.GetSuite(factory.GetDefault())
69+
csp = factory.GetDefault()
7270
}
7371

7472
log.Debugf("CA Files: %+v\n", cfg.CertFiles)

‎internal/github.com/hyperledger/fabric-ca/sdkpatch/cryptosuitebridge/cryptosuitebridge.go‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
/*
2+
Copyright SecureKey Technologies Inc. All Rights Reserved.
3+
4+
SPDX-License-Identifier: Apache-2.0
5+
*/
6+
/*
7+
Notice: This file has been modified for Hyperledger Fabric SDK Go usage.
8+
Please review third_party pinning scripts and patches for more details.
9+
*/
10+
11+
package cryptosuitebridge
12+
13+
import (
14+
"crypto"
15+
"crypto/ecdsa"
16+
17+
"github.com/hyperledger/fabric-sdk-go/api/apicryptosuite"
18+
"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp"
19+
"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp/factory"
20+
cspsigner "github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp/signer"
21+
"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp/sw"
22+
"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp/utils"
23+
cryptosuite "github.com/hyperledger/fabric-sdk-go/pkg/cryptosuite/bccsp"
24+
)
25+
26+
const (
27+
ECDSA = bccsp.ECDSA
28+
ECDSAP256 = bccsp.ECDSAP256
29+
ECDSAP384 = bccsp.ECDSAP384
30+
ECDSAReRand = bccsp.ECDSAReRand
31+
RSA = bccsp.RSA
32+
RSA1024 = bccsp.RSA1024
33+
RSA2048 = bccsp.RSA2048
34+
RSA3072 = bccsp.RSA3072
35+
RSA4096 = bccsp.RSA4096
36+
AES = bccsp.AES
37+
AES128 = bccsp.AES128
38+
AES192 = bccsp.AES192
39+
AES256 = bccsp.AES256
40+
HMAC = bccsp.HMAC
41+
HMACTruncated256 = bccsp.HMACTruncated256
42+
SHA = bccsp.SHA
43+
SHA2 = bccsp.SHA2
44+
SHA3 = bccsp.SHA3
45+
SHA256 = bccsp.SHA256
46+
SHA384 = bccsp.SHA384
47+
SHA3_256 = bccsp.SHA3_256
48+
SHA3_384 = bccsp.SHA3_384
49+
X509Certificate = bccsp.X509Certificate
50+
)
51+
52+
// FactoryOpts holds configuration information used to initialize bccsp factory implementations
53+
type FactoryOpts struct {
54+
*factory.FactoryOpts
55+
}
56+
57+
//GetBCCSPFromOpts is a bridge for factory.GetBCCSPFromOpts(config)
58+
func GetBCCSPFromOpts(config *FactoryOpts) (apicryptosuite.CryptoSuite, error) {
59+
bccsp, err := factory.GetBCCSPFromOpts(getFactoryOpts(config))
60+
if err != nil {
61+
return nil, err
62+
}
63+
return cryptosuite.GetSuite(bccsp), nil
64+
}
65+
66+
//InitFactories is a bridge for bccsp factory.InitFactories(config)
67+
func InitFactories(config *FactoryOpts) error {
68+
return factory.InitFactories(getFactoryOpts(config))
69+
}
70+
71+
// PEMtoPrivateKey is a bridge for bccsp utils.PEMtoPrivateKey()
72+
func PEMtoPrivateKey(raw []byte, pwd []byte) (interface{}, error) {
73+
return utils.PEMtoPrivateKey(raw, pwd)
74+
}
75+
76+
// PrivateKeyToDER marshals is bridge for utils.PrivateKeyToDER
77+
func PrivateKeyToDER(privateKey *ecdsa.PrivateKey) ([]byte, error) {
78+
return utils.PrivateKeyToDER(privateKey)
79+
}
80+
81+
// NewCspsigner is a bridge for bccsp signer.New call
82+
func NewCspsigner(csp apicryptosuite.CryptoSuite, key apicryptosuite.Key) (crypto.Signer, error) {
83+
return cspsigner.New(csp, key)
84+
}
85+
86+
//NewEmptySwOpts creates new empty bccsp factory.SwOpts
87+
func NewSwOpts() *factory.SwOpts {
88+
return &factory.SwOpts{}
89+
}
90+
91+
//NewEmptyFileKeystoreOpts creates new empty bccsp factory.FileKeystoreOpts
92+
func NewFileKeystoreOpts() *factory.FileKeystoreOpts {
93+
return &factory.FileKeystoreOpts{}
94+
}
95+
96+
//GetFactoryDefaultCryptoSuite creates new cryptosuite from bccsp factory default
97+
func GetDefault() apicryptosuite.CryptoSuite {
98+
return cryptosuite.GetSuite(factory.GetDefault())
99+
}
100+
101+
//SignatureToLowS is a bridge for bccsp sw.SignatureToLowS()
102+
func SignatureToLowS(k *ecdsa.PublicKey, signature []byte) ([]byte, error) {
103+
return sw.SignatureToLowS(k, signature)
104+
}
105+
106+
//GetHashOpt is a bridge for bccsp util GetHashOpt
107+
func GetHashOpt(hashFunction string) (apicryptosuite.HashOpts, error) {
108+
return bccsp.GetHashOpt(hashFunction)
109+
}
110+
111+
func getFactoryOpts(config *FactoryOpts) *factory.FactoryOpts {
112+
if config == nil {
113+
return nil
114+
}
115+
return &factory.FactoryOpts{
116+
SwOpts: config.SwOpts,
117+
ProviderName: config.ProviderName,
118+
Pkcs11Opts: config.Pkcs11Opts,
119+
PluginOpts: config.PluginOpts,
120+
}
121+
}
122+
123+
//GetSHAOpts returns options for computing SHA.
124+
func GetSHAOpts() apicryptosuite.HashOpts {
125+
return &bccsp.SHAOpts{}
126+
}
127+
128+
//GetSHA256Opts returns options relating to SHA-256.
129+
func GetSHA256Opts() apicryptosuite.HashOpts {
130+
return &bccsp.SHA256Opts{}
131+
}
132+
133+
//GetRSA2048KeyGenOpts returns options for RSA key generation at 2048 security.
134+
func GetRSA2048KeyGenOpts(ephemeral bool) apicryptosuite.KeyGenOpts {
135+
return &bccsp.RSA2048KeyGenOpts{Temporary: ephemeral}
136+
}
137+
138+
//GetRSA3072KeyGenOpts returns options for RSA key generation at 3072 security.
139+
func GetRSA3072KeyGenOpts(ephemeral bool) apicryptosuite.KeyGenOpts {
140+
return &bccsp.RSA3072KeyGenOpts{Temporary: ephemeral}
141+
}
142+
143+
//GetRSA4096KeyGenOpts returns options for RSA key generation at 4096 security.
144+
func GetRSA4096KeyGenOpts(ephemeral bool) apicryptosuite.KeyGenOpts {
145+
return &bccsp.RSA4096KeyGenOpts{Temporary: ephemeral}
146+
}
147+
148+
// GetECDSAKeyGenOpts returns options for ECDSA key generation.
149+
func GetECDSAKeyGenOpts(ephemeral bool) apicryptosuite.KeyGenOpts {
150+
return &bccsp.ECDSAKeyGenOpts{Temporary: ephemeral}
151+
}
152+
153+
//GetECDSAP256KeyGenOpts returns options for ECDSA key generation with curve P-256.
154+
func GetECDSAP256KeyGenOpts(ephemeral bool) apicryptosuite.KeyGenOpts {
155+
return &bccsp.ECDSAP256KeyGenOpts{Temporary: ephemeral}
156+
}
157+
158+
//GetECDSAP384KeyGenOpts options for ECDSA key generation with curve P-384.
159+
func GetECDSAP384KeyGenOpts(ephemeral bool) apicryptosuite.KeyGenOpts {
160+
return &bccsp.ECDSAP384KeyGenOpts{Temporary: ephemeral}
161+
}
162+
163+
//GetX509PublicKeyImportOpts options for importing public keys from an x509 certificate
164+
func GetX509PublicKeyImportOpts(ephemeral bool) apicryptosuite.KeyImportOpts {
165+
return &bccsp.X509PublicKeyImportOpts{Temporary: ephemeral}
166+
}
167+
168+
//GetECDSAPrivateKeyImportOpts options for ECDSA secret key importation in DER format
169+
// or PKCS#8 format.
170+
func GetECDSAPrivateKeyImportOpts(ephemeral bool) apicryptosuite.KeyImportOpts {
171+
return &bccsp.ECDSAPrivateKeyImportOpts{Temporary: ephemeral}
172+
}

‎internal/github.com/hyperledger/fabric-ca/util/csp.go‎

Lines changed: 16 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,8 @@ import (
3737

3838
"github.com/cloudflare/cfssl/csr"
3939
"github.com/cloudflare/cfssl/helpers"
40+
factory "github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric-ca/sdkpatch/cryptosuitebridge"
4041
log "github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric-ca/sdkpatch/logbridge"
41-
"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp"
42-
"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp/factory"
43-
cspsigner "github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp/signer"
44-
"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp/utils"
45-
cryptosuite "github.com/hyperledger/fabric-sdk-go/pkg/cryptosuite/bccsp"
4642
)
4743

4844
// InitBCCSP initializes BCCSP
@@ -73,7 +69,7 @@ func ConfigureBCCSP(optsPtr **factory.FactoryOpts, mspDir, homeDir string) error
7369
}
7470
if strings.ToUpper(opts.ProviderName) == "SW" {
7571
if opts.SwOpts == nil {
76-
opts.SwOpts = &factory.SwOpts{}
72+
opts.SwOpts = factory.NewSwOpts()
7773
}
7874
if opts.SwOpts.HashFamily == "" {
7975
opts.SwOpts.HashFamily = "SHA2"
@@ -82,7 +78,7 @@ func ConfigureBCCSP(optsPtr **factory.FactoryOpts, mspDir, homeDir string) error
8278
opts.SwOpts.SecLevel = 256
8379
}
8480
if opts.SwOpts.FileKeystore == nil {
85-
opts.SwOpts.FileKeystore = &factory.FileKeystoreOpts{}
81+
opts.SwOpts.FileKeystore = factory.NewFileKeystoreOpts()
8682
}
8783
// The mspDir overrides the KeyStorePath; otherwise, if not set, set default
8884
if mspDir != "" {
@@ -119,7 +115,7 @@ func GetBCCSP(opts *factory.FactoryOpts, homeDir string) (apicryptosuite.CryptoS
119115
if err != nil {
120116
return nil, errors.WithMessage(err, "Failed to get BCCSP with opts")
121117
}
122-
return cryptosuite.GetSuite(csp), nil
118+
return csp, nil
123119
}
124120

125121
// makeFileNamesAbsolute makes all relative file names associated with CSP absolute,
@@ -137,28 +133,28 @@ func makeFileNamesAbsolute(opts *factory.FactoryOpts, homeDir string) error {
137133
// This supports ECDSA and RSA.
138134
func getBCCSPKeyOpts(kr csr.KeyRequest, ephemeral bool) (opts apicryptosuite.KeyGenOpts, err error) {
139135
if kr == nil {
140-
return &bccsp.ECDSAKeyGenOpts{Temporary: ephemeral}, nil
136+
return factory.GetECDSAKeyGenOpts(ephemeral), nil
141137
}
142138
log.Debugf("generate key from request: algo=%s, size=%d", kr.Algo(), kr.Size())
143139
switch kr.Algo() {
144140
case "rsa":
145141
switch kr.Size() {
146142
case 2048:
147-
return &bccsp.RSA2048KeyGenOpts{Temporary: ephemeral}, nil
143+
return factory.GetRSA2048KeyGenOpts(ephemeral), nil
148144
case 3072:
149-
return &bccsp.RSA3072KeyGenOpts{Temporary: ephemeral}, nil
145+
return factory.GetRSA3072KeyGenOpts(ephemeral), nil
150146
case 4096:
151-
return &bccsp.RSA4096KeyGenOpts{Temporary: ephemeral}, nil
147+
return factory.GetRSA4096KeyGenOpts(ephemeral), nil
152148
default:
153149
// Need to add a way to specify arbitrary RSA key size to bccsp
154150
return nil, errors.Errorf("Invalid RSA key size: %d", kr.Size())
155151
}
156152
case "ecdsa":
157153
switch kr.Size() {
158154
case 256:
159-
return &bccsp.ECDSAP256KeyGenOpts{Temporary: ephemeral}, nil
155+
return factory.GetECDSAP256KeyGenOpts(ephemeral), nil
160156
case 384:
161-
return &bccsp.ECDSAP384KeyGenOpts{Temporary: ephemeral}, nil
157+
return factory.GetECDSAP384KeyGenOpts(ephemeral), nil
162158
case 521:
163159
// Need to add curve P521 to bccsp
164160
// return &bccsp.ECDSAP512KeyGenOpts{Temporary: false}, nil
@@ -177,7 +173,7 @@ func GetSignerFromCert(cert *x509.Certificate, csp apicryptosuite.CryptoSuite) (
177173
return nil, nil, errors.New("CSP was not initialized")
178174
}
179175
// get the public key in the right format
180-
certPubK, err := csp.KeyImport(cert, &bccsp.X509PublicKeyImportOpts{Temporary: true})
176+
certPubK, err := csp.KeyImport(cert, factory.GetX509PublicKeyImportOpts(true))
181177
if err != nil {
182178
return nil, nil, errors.WithMessage(err, "Failed to import certificate's public key")
183179
}
@@ -187,7 +183,7 @@ func GetSignerFromCert(cert *x509.Certificate, csp apicryptosuite.CryptoSuite) (
187183
return nil, nil, errors.WithMessage(err, "Could not find matching private key for SKI")
188184
}
189185
// Construct and initialize the signer
190-
signer, err := cspsigner.New(csp, privateKey)
186+
signer, err := factory.NewCspsigner(csp, privateKey)
191187
if err != nil {
192188
return nil, nil, errors.WithMessage(err, "Failed to load ski from bccsp")
193189
}
@@ -224,7 +220,7 @@ func BCCSPKeyRequestGenerate(req *csr.CertificateRequest, myCSP apicryptosuite.C
224220
return nil, nil, err
225221
}
226222

227-
cspSigner, err := cspsigner.New(myCSP, key)
223+
cspSigner, err := factory.NewCspsigner(myCSP, key)
228224
if err != nil {
229225
return nil, nil, errors.WithMessage(err, "Failed initializing CryptoSigner")
230226
}
@@ -237,17 +233,17 @@ func ImportBCCSPKeyFromPEM(keyFile string, myCSP apicryptosuite.CryptoSuite, tem
237233
if err != nil {
238234
return nil, err
239235
}
240-
key, err := utils.PEMtoPrivateKey(keyBuff, nil)
236+
key, err := factory.PEMtoPrivateKey(keyBuff, nil)
241237
if err != nil {
242238
return nil, errors.WithMessage(err, fmt.Sprintf("Failed parsing private key from %s", keyFile))
243239
}
244240
switch key.(type) {
245241
case *ecdsa.PrivateKey:
246-
priv, err := utils.PrivateKeyToDER(key.(*ecdsa.PrivateKey))
242+
priv, err := factory.PrivateKeyToDER(key.(*ecdsa.PrivateKey))
247243
if err != nil {
248244
return nil, errors.WithMessage(err, fmt.Sprintf("Failed to convert ECDSA private key for '%s'", keyFile))
249245
}
250-
sk, err := myCSP.KeyImport(priv, &bccsp.ECDSAPrivateKeyImportOpts{Temporary: temporary})
246+
sk, err := myCSP.KeyImport(priv, factory.GetECDSAPrivateKeyImportOpts(temporary))
251247
if err != nil {
252248
return nil, errors.WithMessage(err, fmt.Sprintf("Failed to import ECDSA private key for '%s'", keyFile))
253249
}

‎internal/github.com/hyperledger/fabric-ca/util/util.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,17 +31,19 @@ import (
3131
"io/ioutil"
3232
"math/big"
3333
mrand "math/rand"
34+
35+
"github.com/hyperledger/fabric-sdk-go/api/apicryptosuite"
36+
factory "github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric-ca/sdkpatch/cryptosuitebridge"
37+
3438
"net/http"
3539
"path/filepath"
3640
"reflect"
3741
"regexp"
3842
"strings"
3943
"time"
4044

41-
"github.com/hyperledger/fabric-sdk-go/api/apicryptosuite"
4245
"github.com/hyperledger/fabric-sdk-go/pkg/errors"
4346

44-
"github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/bccsp"
4547
"golang.org/x/crypto/ocsp"
4648
)
4749

@@ -168,7 +170,7 @@ func GenECDSAToken(csp apicryptosuite.CryptoSuite, cert []byte, key apicryptosui
168170
b64cert := B64Encode(cert)
169171
bodyAndcert := b64body + "." + b64cert
170172

171-
digest, digestError := csp.Hash([]byte(bodyAndcert), &bccsp.SHAOpts{})
173+
digest, digestError := csp.Hash([]byte(bodyAndcert), factory.GetSHAOpts())
172174
if digestError != nil {
173175
return "", errors.WithMessage(digestError, fmt.Sprintf("Hash failed on '%s'", bodyAndcert))
174176
}

0 commit comments

Comments
 (0)
⚡