Add new algorithms supported in firmware 5.7.x

v2/go.mod

@@ -1,3 +1,3 @@
 module github.com/go-piv/piv-go/v2
 
-go 1.16
+go 1.20

v2/piv/key.go

@@ -17,6 +17,7 @@ package piv
 import (
 	"bytes"
 	"crypto"
+	"crypto/ecdh"
 	"crypto/ecdsa"
 	"crypto/ed25519"
 	"crypto/elliptic"
@@ -448,6 +449,9 @@ const (
 	AlgorithmEd25519
 	AlgorithmRSA1024
 	AlgorithmRSA2048
+	AlgorithmRSA3072
+	AlgorithmRSA4096
+	AlgorithmX25519
 )
 
 // PINPolicy represents PIN requirements when signing or decrypting with an
@@ -531,6 +535,9 @@ var algorithmsMap = map[Algorithm]byte{
 	AlgorithmEd25519: algEd25519,
 	AlgorithmRSA1024: algRSA1024,
 	AlgorithmRSA2048: algRSA2048,
+	AlgorithmRSA3072: algRSA3072,
+	AlgorithmRSA4096: algRSA4096,
+	AlgorithmX25519:  algX25519,
 }
 
 var algorithmsMapInv = map[byte]Algorithm{
@@ -539,6 +546,9 @@ var algorithmsMapInv = map[byte]Algorithm{
 	algEd25519: AlgorithmEd25519,
 	algRSA1024: AlgorithmRSA1024,
 	algRSA2048: AlgorithmRSA2048,
+	algRSA3072: AlgorithmRSA3072,
+	algRSA4096: AlgorithmRSA4096,
+	algX25519:  AlgorithmX25519,
 }
 
 // AttestationCertificate returns the YubiKey's attestation certificate, which
@@ -846,7 +856,7 @@ func ykGenerateKey(tx *scTx, slot Slot, o Key) (crypto.PublicKey, error) {
 func decodePublic(b []byte, alg Algorithm) (crypto.PublicKey, error) {
 	var curve elliptic.Curve
 	switch alg {
-	case AlgorithmRSA1024, AlgorithmRSA2048:
+	case AlgorithmRSA1024, AlgorithmRSA2048, AlgorithmRSA3072, AlgorithmRSA4096:
 		pub, err := decodeRSAPublic(b)
 		if err != nil {
 			return nil, fmt.Errorf("decoding rsa public key: %v", err)
@@ -862,6 +872,12 @@ func decodePublic(b []byte, alg Algorithm) (crypto.PublicKey, error) {
 			return nil, fmt.Errorf("decoding ed25519 public key: %v", err)
 		}
 		return pub, nil
+	case AlgorithmX25519:
+		pub, err := decodeX25519Public(b)
+		if err != nil {
+			return nil, fmt.Errorf("decoding X25519 public key: %v", err)
+		}
+		return pub, nil
 	default:
 		return nil, fmt.Errorf("unsupported algorithm")
 	}
@@ -990,6 +1006,11 @@ func (yk *YubiKey) PrivateKey(slot Slot, public crypto.PublicKey, auth KeyAuth)
 		return &keyEd25519{yk, slot, pub, auth, pp}, nil
 	case *rsa.PublicKey:
 		return &keyRSA{yk, slot, pub, auth, pp}, nil
+	case *ecdh.PublicKey:
+		if crv := pub.Curve(); crv != ecdh.X25519() {
+			return nil, fmt.Errorf("unsupported ecdh curve: %v", crv)
+		}
+		return &X25519PrivateKey{yk, slot, pub, auth, pp}, nil
 	default:
 		return nil, fmt.Errorf("unsupported public key type: %T", public)
 	}
@@ -1024,6 +1045,12 @@ func (yk *YubiKey) SetPrivateKeyInsecure(key []byte, slot Slot, private crypto.P
 		case 2048:
 			policy.Algorithm = AlgorithmRSA2048
 			elemLen = 128
+		case 3072:
+			policy.Algorithm = AlgorithmRSA3072
+			elemLen = 192
+		case 4096:
+			policy.Algorithm = AlgorithmRSA4096
+			elemLen = 256
 		default:
 			return errUnsupportedKeySize
 		}
@@ -1056,8 +1083,25 @@ func (yk *YubiKey) SetPrivateKeyInsecure(key []byte, slot Slot, private crypto.P
 		copy(privateKey[padding:], valueBytes)
 
 		params = append(params, privateKey)
+	case ed25519.PrivateKey:
+		paramTag = 0x07
+		elemLen = ed25519.SeedSize
+
+		// seed
+		privateKey := make([]byte, elemLen)
+		copy(privateKey, priv[:32])
+		params = append(params, privateKey)
+	case *ecdh.PrivateKey:
+		if crv := priv.Curve(); crv != ecdh.X25519() {
+			return fmt.Errorf("unsupported ecdh curve: %v", crv)
+		}
+		paramTag = 0x08
+		elemLen = 32
+
+		// seed
+		params = append(params, priv.Bytes())
 	default:
-		return errors.New("unsupported private key type")
+		return fmt.Errorf("unsupported private key type: %T", private)
 	}
 
 	elemLenASN1 := marshalASN1Length(uint64(elemLen))
@@ -1193,6 +1237,33 @@ func (k *ECDSAPrivateKey) SharedKey(peer *ecdsa.PublicKey) ([]byte, error) {
 	})
 }
 
+// X25519PrivateKey is a crypto.PrivateKey implementation for X25519 keys. It
+// implements the method ECDH to perform Diffie-Hellman key agreements.
+//
+// Keys returned by YubiKey.PrivateKey() may be type asserted to
+// *X25519PrivateKey, if the slot contains an X25519 key.
+type X25519PrivateKey struct {
+	yk   *YubiKey
+	slot Slot
+	pub  *ecdh.PublicKey
+	auth KeyAuth
+	pp   PINPolicy
+}
+
+func (k *X25519PrivateKey) Public() crypto.PublicKey {
+	return k.pub
+}
+
+// ECDH performs an ECDH exchange and returns the shared secret.
+//
+// Peer's public key must use the same algorithm as the key in this slot, or an
+// error will be returned.
+func (k *X25519PrivateKey) ECDH(peer *ecdh.PublicKey) ([]byte, error) {
+	return k.auth.do(k.yk, k.pp, func(tx *scTx) ([]byte, error) {
+		return ykECDHX25519(tx, k.slot, k.pub, peer)
+	})
+}
+
 type keyEd25519 struct {
 	yk   *YubiKey
 	slot Slot
@@ -1278,6 +1349,38 @@ func ykSignECDSA(tx *scTx, slot Slot, pub *ecdsa.PublicKey, digest []byte) ([]by
 	return rs, nil
 }
 
+func ykECDHX25519(tx *scTx, slot Slot, pub *ecdh.PublicKey, peer *ecdh.PublicKey) ([]byte, error) {
+	if crv := pub.Curve(); crv != ecdh.X25519() {
+		return nil, fmt.Errorf("unsupported ecdh curve: %v", crv)
+	}
+	if pub.Curve() != peer.Curve() {
+		return nil, errMismatchingAlgorithms
+	}
+	cmd := apdu{
+		instruction: insAuthenticate,
+		param1:      algX25519,
+		param2:      byte(slot.Key),
+		data: marshalASN1(0x7c,
+			append([]byte{0x82, 0x00},
+				marshalASN1(0x85, peer.Bytes())...)),
+	}
+	resp, err := tx.Transmit(cmd)
+	if err != nil {
+		return nil, fmt.Errorf("command failed: %w", err)
+	}
+
+	sig, _, err := unmarshalASN1(resp, 1, 0x1c) // 0x7c
+	if err != nil {
+		return nil, fmt.Errorf("unmarshal response: %v", err)
+	}
+	sharedSecret, _, err := unmarshalASN1(sig, 2, 0x02) // 0x82
+	if err != nil {
+		return nil, fmt.Errorf("unmarshal response signature: %v", err)
+	}
+
+	return sharedSecret, nil
+}
+
 // This function only works on SoloKeys prototypes and other PIV devices that choose
 // to implement Ed25519 signatures under alg 0x22.
 func skSignEd25519(tx *scTx, slot Slot, pub ed25519.PublicKey, digest []byte) ([]byte, error) {
@@ -1375,13 +1478,27 @@ func decodeRSAPublic(b []byte) (*rsa.PublicKey, error) {
 	return &rsa.PublicKey{N: &n, E: int(e.Int64())}, nil
 }
 
+func decodeX25519Public(b []byte) (*ecdh.PublicKey, error) {
+	// Adaptation of
+	// https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-73-4.pdf#page=95
+	p, _, err := unmarshalASN1(b, 2, 0x06)
+	if err != nil {
+		return nil, fmt.Errorf("unmarshal points: %v", err)
+	}
+	return ecdh.X25519().NewPublicKey(p)
+}
+
 func rsaAlg(pub *rsa.PublicKey) (byte, error) {
 	size := pub.N.BitLen()
 	switch size {
 	case 1024:
 		return algRSA1024, nil
 	case 2048:
 		return algRSA2048, nil
+	case 3072:
+		return algRSA3072, nil
+	case 4096:
+		return algRSA4096, nil
 	default:
 		return 0, fmt.Errorf("unsupported rsa key size: %d", size)
 	}