From: Stefan Berger <stefanb@linux.ibm.com>
To: linux-integrity@vger.kernel.org
Cc: zohar@linux.ibm.com, Stefan Berger <stefanb@linux.ibm.com>
Subject: [PATCH ima-evm-utils v3 4/4] Add example scripts for EC key and certs generation
Date: Wed, 26 Apr 2023 18:35:59 -0400 [thread overview]
Message-ID: <20230426223559.681668-5-stefanb@linux.ibm.com> (raw)
In-Reply-To: <20230426223559.681668-1-stefanb@linux.ibm.com>
Add example scripts for EC key and certificate creation and reference
them from the README and Makefile.am.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
Makefile.am | 8 +++++++-
README | 3 +++
examples/ima-gen-local-ca-ecc.sh | 29 +++++++++++++++++++++++++++
examples/ima-genkey-ecc.sh | 34 ++++++++++++++++++++++++++++++++
examples/ima-genkey-self-ecc.sh | 29 +++++++++++++++++++++++++++
5 files changed, 102 insertions(+), 1 deletion(-)
create mode 100755 examples/ima-gen-local-ca-ecc.sh
create mode 100755 examples/ima-genkey-ecc.sh
create mode 100755 examples/ima-genkey-self-ecc.sh
diff --git a/Makefile.am b/Makefile.am
index e686d65..9ec5681 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -7,7 +7,13 @@ if MANPAGE_DOCBOOK_XSL
dist_man_MANS = evmctl.1
endif
-doc_DATA = examples/ima-genkey-self.sh examples/ima-genkey.sh examples/ima-gen-local-ca.sh
+doc_DATA = \
+ examples/ima-genkey-self.sh \
+ examples/ima-genkey.sh \
+ examples/ima-gen-local-ca.sh \
+ examples/ima-genkey-self-ecc.sh \
+ examples/ima-genkey-ecc.sh \
+ examples/ima-gen-local-ca-ecc.sh
EXTRA_DIST = autogen.sh $(doc_DATA)
CLEANFILES = *.html *.xsl
diff --git a/README b/README
index d631eb7..40a61f9 100644
--- a/README
+++ b/README
@@ -470,6 +470,9 @@ Examples of scripts to generate X509 public key certificates:
/usr/share/doc/ima-evm-utils/ima-genkey-self.sh
/usr/share/doc/ima-evm-utils/ima-genkey.sh
/usr/share/doc/ima-evm-utils/ima-gen-local-ca.sh
+ /usr/share/doc/ima-evm-utils/ima-genkey-self-ecc.sh
+ /usr/share/doc/ima-evm-utils/ima-genkey-ecc.sh
+ /usr/share/doc/ima-evm-utils/ima-gen-local-ca-ecc.sh
AUTHOR
diff --git a/examples/ima-gen-local-ca-ecc.sh b/examples/ima-gen-local-ca-ecc.sh
new file mode 100755
index 0000000..1f17bcf
--- /dev/null
+++ b/examples/ima-gen-local-ca-ecc.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+GENKEY=ima-local-ca.genkey
+
+cat << __EOF__ >$GENKEY
+[ req ]
+distinguished_name = req_distinguished_name
+prompt = no
+string_mask = utf8only
+x509_extensions = v3_ca
+
+[ req_distinguished_name ]
+O = IMA-CA
+CN = IMA/EVM certificate signing key
+emailAddress = ca@ima-ca
+
+[ v3_ca ]
+basicConstraints=CA:TRUE
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid:always,issuer
+keyUsage = cRLSign, keyCertSign
+__EOF__
+
+openssl req -new -x509 -utf8 -sha256 -days 3650 -batch -config $GENKEY \
+ -outform DER -out ima-local-ca.x509 -keyout ima-local-ca.priv \
+ -newkey ec -pkeyopt ec_paramgen_curve:prime256v1
+
+openssl x509 -inform DER -in ima-local-ca.x509 -out ima-local-ca.pem
+
diff --git a/examples/ima-genkey-ecc.sh b/examples/ima-genkey-ecc.sh
new file mode 100755
index 0000000..bdc8d17
--- /dev/null
+++ b/examples/ima-genkey-ecc.sh
@@ -0,0 +1,34 @@
+#!/bin/sh
+
+GENKEY=ima.genkey
+
+cat << __EOF__ >$GENKEY
+[ req ]
+distinguished_name = req_distinguished_name
+prompt = no
+string_mask = utf8only
+x509_extensions = v3_usr
+
+[ req_distinguished_name ]
+O = `hostname`
+CN = `whoami` signing key
+emailAddress = `whoami`@`hostname`
+
+[ v3_usr ]
+basicConstraints=critical,CA:FALSE
+#basicConstraints=CA:FALSE
+keyUsage=digitalSignature
+#keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+extendedKeyUsage=critical,codeSigning
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid
+#authorityKeyIdentifier=keyid,issuer
+__EOF__
+
+openssl req -new -nodes -utf8 -sha256 -days 365 -batch -config $GENKEY \
+ -out csr_ima.pem -keyout privkey_ima.pem \
+ -newkey ec -pkeyopt ec_paramgen_curve:prime256v1
+openssl x509 -req -in csr_ima.pem -days 365 -extfile $GENKEY -extensions v3_usr \
+ -CA ima-local-ca.pem -CAkey ima-local-ca.priv -CAcreateserial \
+ -outform DER -out x509_ima.der
+
diff --git a/examples/ima-genkey-self-ecc.sh b/examples/ima-genkey-self-ecc.sh
new file mode 100755
index 0000000..b5431e2
--- /dev/null
+++ b/examples/ima-genkey-self-ecc.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+GENKEY=x509_evm.genkey
+
+cat << __EOF__ >$GENKEY
+[ req ]
+distinguished_name = req_distinguished_name
+prompt = no
+string_mask = utf8only
+x509_extensions = myexts
+
+[ req_distinguished_name ]
+O = `hostname`
+CN = `whoami` signing key
+emailAddress = `whoami`@`hostname`
+
+[ myexts ]
+basicConstraints=critical,CA:FALSE
+keyUsage=digitalSignature
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid
+__EOF__
+
+openssl req -x509 -new -nodes -utf8 -sha256 -days 3650 -batch -config $GENKEY \
+ -outform DER -out x509_evm.der -keyout privkey_evm.pem \
+ -newkey ec -pkeyopt ec_paramgen_curve:prime256v1
+
+openssl ec -pubout -in privkey_evm.pem -out pubkey_evm.pem
+
--
2.39.2
next prev parent reply other threads:[~2023-04-26 22:37 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-26 22:35 [PATCH ima-evm-utils v3 0/4] Update README and examples and add EC key support Stefan Berger
2023-04-26 22:35 ` [PATCH ima-evm-utils v3 1/4] Update default key sizes and hash to up-to-date values Stefan Berger
2023-04-26 22:35 ` [PATCH ima-evm-utils v3 2/4] Update OpenSSL config files for support for .machine keyring Stefan Berger
2023-04-26 22:35 ` [PATCH ima-evm-utils v3 3/4] Add openssl command line examples for creation of EC keys Stefan Berger
2023-04-26 22:35 ` Stefan Berger [this message]
2023-04-27 14:21 ` [PATCH ima-evm-utils v3 0/4] Update README and examples and add EC key support Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230426223559.681668-5-stefanb@linux.ibm.com \
--to=stefanb@linux.ibm.com \
--cc=linux-integrity@vger.kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox