Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2021-10-15' into staging
[qemu.git] / scripts / u2f-setup-gen.py
1 #!/usr/bin/env python3
2 #
3 # Libu2f-emu setup directory generator for USB U2F key emulation.
4 #
5 # Copyright (c) 2020 César Belley <cesar.belley@lse.epita.fr>
6 # Written by César Belley <cesar.belley@lse.epita.fr>
7 #
8 # This work is licensed under the terms of the GNU GPL, version 2
9 # or, at your option, any later version. See the COPYING file in
10 # the top-level directory.
11
12 import sys
13 import os
14 from random import randint
15 from typing import Tuple
16
17 from cryptography.hazmat.backends import default_backend
18 from cryptography.hazmat.primitives.asymmetric import ec
19 from cryptography.hazmat.primitives.serialization import Encoding, \
20 NoEncryption, PrivateFormat, PublicFormat
21 from OpenSSL import crypto
22
23
24 def write_setup_dir(dirpath: str, privkey_pem: bytes, cert_pem: bytes,
25 entropy: bytes, counter: int) -> None:
26 """
27 Write the setup directory.
28
29 Args:
30 dirpath: The directory path.
31 key_pem: The private key PEM.
32 cert_pem: The certificate PEM.
33 entropy: The 48 bytes of entropy.
34 counter: The counter value.
35 """
36 # Directory
37 os.mkdir(dirpath)
38
39 # Private key
40 with open(f'{dirpath}/private-key.pem', 'bw') as f:
41 f.write(privkey_pem)
42
43 # Certificate
44 with open(f'{dirpath}/certificate.pem', 'bw') as f:
45 f.write(cert_pem)
46
47 # Entropy
48 with open(f'{dirpath}/entropy', 'wb') as f:
49 f.write(entropy)
50
51 # Counter
52 with open(f'{dirpath}/counter', 'w') as f:
53 f.write(f'{str(counter)}\n')
54
55
56 def generate_ec_key_pair() -> Tuple[str, str]:
57 """
58 Generate an ec key pair.
59
60 Returns:
61 The private and public key PEM.
62 """
63 # Key generation
64 privkey = ec.generate_private_key(ec.SECP256R1, default_backend())
65 pubkey = privkey.public_key()
66
67 # PEM serialization
68 privkey_pem = privkey.private_bytes(encoding=Encoding.PEM,
69 format=PrivateFormat.TraditionalOpenSSL,
70 encryption_algorithm=NoEncryption())
71 pubkey_pem = pubkey.public_bytes(encoding=Encoding.PEM,
72 format=PublicFormat.SubjectPublicKeyInfo)
73 return privkey_pem, pubkey_pem
74
75
76 def generate_certificate(privkey_pem: str, pubkey_pem: str) -> str:
77 """
78 Generate a x509 certificate from a key pair.
79
80 Args:
81 privkey_pem: The private key PEM.
82 pubkey_pem: The public key PEM.
83
84 Returns:
85 The certificate PEM.
86 """
87 # Convert key pair
88 privkey = crypto.load_privatekey(crypto.FILETYPE_PEM, privkey_pem)
89 pubkey = crypto.load_publickey(crypto.FILETYPE_PEM, pubkey_pem)
90
91 # New x509v3 certificate
92 cert = crypto.X509()
93 cert.set_version(0x2)
94
95 # Serial number
96 cert.set_serial_number(randint(1, 2 ** 64))
97
98 # Before / After
99 cert.gmtime_adj_notBefore(0)
100 cert.gmtime_adj_notAfter(4 * (365 * 24 * 60 * 60))
101
102 # Public key
103 cert.set_pubkey(pubkey)
104
105 # Subject name and issueer
106 cert.get_subject().CN = "U2F emulated"
107 cert.set_issuer(cert.get_subject())
108
109 # Extensions
110 cert.add_extensions([
111 crypto.X509Extension(b"subjectKeyIdentifier",
112 False, b"hash", subject=cert),
113 ])
114 cert.add_extensions([
115 crypto.X509Extension(b"authorityKeyIdentifier",
116 False, b"keyid:always", issuer=cert),
117 ])
118 cert.add_extensions([
119 crypto.X509Extension(b"basicConstraints", True, b"CA:TRUE")
120 ])
121
122 # Signature
123 cert.sign(privkey, 'sha256')
124
125 return crypto.dump_certificate(crypto.FILETYPE_PEM, cert)
126
127
128 def generate_setup_dir(dirpath: str) -> None:
129 """
130 Generates the setup directory.
131
132 Args:
133 dirpath: The directory path.
134 """
135 # Key pair
136 privkey_pem, pubkey_pem = generate_ec_key_pair()
137
138 # Certificate
139 certificate_pem = generate_certificate(privkey_pem, pubkey_pem)
140
141 # Entropy
142 entropy = os.urandom(48)
143
144 # Counter
145 counter = 0
146
147 # Write
148 write_setup_dir(dirpath, privkey_pem, certificate_pem, entropy, counter)
149
150
151 def main() -> None:
152 """
153 Main function
154 """
155 # Dir path
156 if len(sys.argv) != 2:
157 sys.stderr.write(f'Usage: {sys.argv[0]} <setup_dir>\n')
158 exit(2)
159 dirpath = sys.argv[1]
160
161 # Dir non existence
162 if os.path.exists(dirpath):
163 sys.stderr.write(f'Directory: {dirpath} already exists.\n')
164 exit(1)
165
166 generate_setup_dir(dirpath)
167
168
169 if __name__ == '__main__':
170 main()