From c3c428701040d6a2bd22f813229f6d4a0b439543 Mon Sep 17 00:00:00 2001 From: Herman Slatman Date: Wed, 3 Jan 2024 16:22:24 +0100 Subject: [PATCH] Support `ECDSA P-256` public keys in Nebula token validation --- authority/provisioner/nebula.go | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/authority/provisioner/nebula.go b/authority/provisioner/nebula.go index 66c523dc..84887de6 100644 --- a/authority/provisioner/nebula.go +++ b/authority/provisioner/nebula.go @@ -2,6 +2,7 @@ package provisioner import ( "context" + "crypto/ecdh" "crypto/ed25519" "crypto/x509" "encoding/base64" @@ -338,9 +339,15 @@ func (p *Nebula) authorizeToken(token string, audiences []string) (*nebula.Nebul } var pub interface{} - if c.Details.IsCA { + switch { + case c.Details.Curve == nebula.Curve_P256: + // When Nebula is used with ECDSA P-256 keys, both CAs and clients use the same type. + if pub, err = ecdh.P256().NewPublicKey(c.Details.PublicKey); err != nil { + return nil, nil, errs.UnauthorizedErr(err, errs.WithMessage("failed to parse nebula public key")) + } + case c.Details.IsCA: pub = ed25519.PublicKey(c.Details.PublicKey) - } else { + default: pub = x25519.PublicKey(c.Details.PublicKey) }