Merge pull request #30 from Mastercard/feature/support_p8_p1

Adding support for PKCS8 and PCKS1 private key files

Author: rfeelin

lib/mcapi/crypto/crypto.js

@@ -18,11 +18,7 @@ function Crypto(config) {
   this.encryptionCertificate = readPublicCertificate(config.encryptionCertificate);
 
   // Load private key (for decryption)
-  if (config.privateKey) {
-    this.privateKey = loadPrivateKey(config.privateKey);
-  } else if (config.keyStore) {
-    this.privateKey = getPrivateKey(config.keyStore, config.keyStoreAlias, config.keyStorePassword);
-  }
+  this.privateKey = getPrivateKey(config);
 
   this.encoding = config.dataEncoding;
 
@@ -196,7 +192,27 @@ function readPublicCertificate(publicCertificatePath) {
 /**
  * @private
  */
-function getPrivateKey(p12Path, alias, password) {
+function getPrivateKey(config) {
+  if (config.privateKey) {
+    return loadPrivateKey(config.privateKey);
+  } else if (config.keyStore) {
+    if (config.keyStore.includes(".p12")) {
+      return getPrivateKey12(config.keyStore, config.keyStoreAlias, config.keyStorePassword);
+    }
+    if (config.keyStore.includes(".pem")) {
+      return getPrivateKeyPem(config.keyStore);
+    }
+    if (config.keyStore.includes(".der")) {
+      return getPrivateKeyDer(config.keyStore);
+    }
+  }
+  return null;
+}
+
+/**
+ * @private
+ */
+function getPrivateKey12(p12Path, alias, password) {
   const p12Content = fs.readFileSync(p12Path, 'binary');
 
   if (!p12Content || p12Content.length <= 1) {
@@ -230,6 +246,38 @@ function getPrivateKey(p12Path, alias, password) {
   return keyObj.key;
 }
 
+/**
+ * Load a PKCS#1 PEM (starts with "-----BEGIN RSA PRIVATE KEY-----")
+ * or a PKCS#8 PEM (starts with "-----BEGIN PRIVATE KEY-----")"
+ */
+function getPrivateKeyPem(pemPath) {
+  let pemContent = fs.readFileSync(pemPath, 'binary');
+
+  if (!pemContent || pemContent.length <= 1) {
+    throw new Error('pem keystore content is empty');
+  }
+
+  pemContent = pemContent.replace("\n", "");
+  pemContent = pemContent.replace("\r\n", "");
+
+  return forge.pki.privateKeyFromPem(pemContent);
+}
+
+/**
+ * Load a Binary DER-encoded PKCS#8
+ */
+function getPrivateKeyDer(derPath) {
+  const derContent = fs.readFileSync(derPath, 'binary');
+  
+  if (!derContent || derContent.length <= 1) {
+    throw new Error('der keystore content is empty');
+  }
+
+  const pkeyAsn1 = forge.asn1.fromDer(derContent);
+  return forge.pki.privateKeyFromAsn1(pkeyAsn1);
+}
+
+
 /**
  * @private
  * @param config Configuration object

test/crypto.test.js

@@ -57,7 +57,7 @@ describe("Crypto", () => {
     it("with valid config with private keystore", () => {
       const config = JSON.parse(JSON.stringify(testConfig));
       delete config.privateKey;
-      config.keyStore = "./test/res/test_key.p12";
+      config.keyStore = "./test/res/keys/pkcs12/test_key.p12";
       config.keyStoreAlias = "mykeyalias";
       config.keyStorePassword = "Password1";
       assert.doesNotThrow(() => {
@@ -66,6 +66,36 @@ describe("Crypto", () => {
       );
     });
 
+    it("with valid config with private pkcs1 pem keystore", () => {
+      const config = JSON.parse(JSON.stringify(testConfig));
+      delete config.privateKey;
+      config.keyStore = "./test/res/keys/pkcs1/test_key.pem";
+      assert.doesNotThrow(() => {
+          new Crypto(config);
+        }
+      );
+    });
+
+    it("with valid config with private pkcs8 pem keystore", () => {
+      const config = JSON.parse(JSON.stringify(testConfig));
+      delete config.privateKey;
+      config.keyStore = "./test/res/keys/pkcs8/test_key.pem";
+      assert.doesNotThrow(() => {
+          new Crypto(config);
+        }
+      );
+    });
+
+    it("with valid config with private pkcs8 der keystore", () => {
+      const config = JSON.parse(JSON.stringify(testConfig));
+      delete config.privateKey;
+      config.keyStore = "./test/res/keys/pkcs8/test_key.der";
+      assert.doesNotThrow(() => {
+          new Crypto(config);
+        }
+      );
+    });
+
     it("with valid config header", () => {
       assert.doesNotThrow(() =>
         new Crypto(testConfigHeader)
@@ -233,8 +263,8 @@ describe("Crypto", () => {
     });
   });
 
-  describe("#getPrivateKey", () => {
-    const getPrivateKey = Crypto.__get__("getPrivateKey");
+  describe("#getPrivateKey12", () => {
+    const getPrivateKey = Crypto.__get__("getPrivateKey12");
 
     it("not valid key", () => {
       assert.throws(() => {
@@ -244,30 +274,65 @@ describe("Crypto", () => {
 
     it("empty alias", () => {
       assert.throws(() => {
-        getPrivateKey("./test/res/test_key_container.p12");
+        getPrivateKey("./test/res/keys/pkcs12/test_key_container.p12");
       }, /Key alias is not set/);
     });
 
     it("empty password", () => {
       assert.throws(() => {
-        getPrivateKey("./test/res/test_key_container.p12", "keyalias");
+        getPrivateKey("./test/res/keys/pkcs12/test_key_container.p12", "keyalias");
       }, /Keystore password is not set/);
     });
 
     it("valid p12", () => {
-      const pk = getPrivateKey("./test/res/test_key_container.p12", "mykeyalias", "Password1");
+      const pk = getPrivateKey("./test/res/keys/pkcs12/test_key_container.p12", "mykeyalias", "Password1");
       assert.ok(pk);
     });
 
     it("valid p12, alias not found", () => {
       assert.throws(() => {
-        getPrivateKey("./test/res/test_key_container.p12", "mykeyalias1", "Password1");
+        getPrivateKey("./test/res/keys/pkcs12/test_key_container.p12", "mykeyalias1", "Password1");
       }, /No key found for alias \[mykeyalias1\]/);
     });
   });
 
+  describe("#getPrivateKeyPem", () => {
+    const getPrivateKeyPem = Crypto.__get__("getPrivateKeyPem");
+
+    it("valid pkcs8 pem", () => {
+      const pk = getPrivateKeyPem("./test/res/keys/pkcs8/test_key.pem");
+      assert.ok(pk);
+    });
+
+    it("valid pkcs1 pem", () => {
+      const pk = getPrivateKeyPem("./test/res/keys/pkcs1/test_key.pem");
+      assert.ok(pk);
+    });
+
+    it("not valid key", () => {
+      assert.throws(() => {
+        getPrivateKeyPem("./test/res/empty.key");
+      }, /pem keystore content is empty/);
+    });
+  });
+
+  describe("#getPrivateKeyDer", () => {
+    const getPrivateKeyDer = Crypto.__get__("getPrivateKeyDer");
+
+    it("valid pkcs8 der", () => {
+      const pk = getPrivateKeyDer("./test/res/keys/pkcs8/test_key.der");
+      assert.ok(pk);
+    });
+
+    it("not valid key", () => {
+      assert.throws(() => {
+        getPrivateKeyDer("./test/res/empty.key");
+      }, /der keystore content is empty/);
+    });
+
+  })
 
-  describe("#newEncryptionParams", () => {
+    describe("#newEncryptionParams", () => {
     let crypto;
     before(() => {
       crypto = new Crypto(testConfig);

test/res/keys/pkcs1/test_key.pem

@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQDHul8A7MM3ynx1XRxmLCRZ1Lr66QppWP5ZaEotsQPpFtyq3w/x
+dLWZd5XXQcIb/wUQWcbxBWYJPMk/GVQ3pvkIKEqC+h08VdXtfbBlM+RE8OYaQW5O
+Fg7YjHgL/WvCka6VJ990RuX9Zdj9TUu8GyqERll/XUDACs85atbSW6PBQQIDAQAB
+AoGBAL9acs0LCZn5OLalB6FoJ0edhasA/MWjysRUI8WU898s1SwsXDUEkTxAk2HR
+kayK7woUSYL/nhu5jkIS/Vn4clvH7XRkch22cjAAs4oGZXUUlVrcXFDiR0o2OqAI
+Xh24ESM/tpDWmn/N30afn31TBAKxgY5Ej2SrmK5gjSeMGI9xAkEA+gPM/P+jLiwy
+wuiS4QRYxeDFtluaafl7UHR/I6vL9VaqOptwV1e/JlytKNMCwoMqadd739/BAX9d
+qNgpniHC9QJBAMyCZBAc8PIjfM1h4seEDeb2mxl1Y2DmcDUVWIt+E4Zs3m1I59we
+VgY/BwX4UIElhgsVjNo6qXYPbWiql4/tzZ0CQQCLJ6RnyO2NXIJgY8yku6Ohd6r0
+BeZbR8XwEPdW5l8eTb9v4WZU5vz4oCqtB02I8DKiOJK1F7g4WijKOo5neoklAkBt
+G9/w7M/sD9zk4qWQVrboE4faRFPZ/fe9in7sJT6biHf/DFePi6vPt06y87FXxcJH
+JZ85SvTgZQi1P9aO1ovNAkAVxgJq94CKCZjOiks5xTro6V0pYdsx0tuuIlx/vGVG
+H3bcmpSm/S54nSovzbEDN7gKr4CSSsAQqC6oPwJSQN6m
+-----END RSA PRIVATE KEY-----

test/res/test_key.p12 renamed to test/res/keys/pkcs12/test_key.p12

@@ -0,0 +1,16 @@
+-----BEGIN PRIVATE KEY-----
+MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBALCcqlioDdtVqSIW
+/Y0PUM0YX5Us76B6VSS5e9LwFeK9g/jsrfGs72WdRxEX1uHTzZXHGimMmmODqv4M
+bZ5Qbbs7dCZwSKlqNlSKLx40zwy4xZh1ie/UJ2CgUhu62wXDnUMg4HE0l9oY5g/P
+BXvSbuGM87gMnNOk0E+pfWHjQbvlAgMBAAECgYBggfuD3rFTvYdinXWH82qP6FWy
+yo9W/gIwwzqqlY8gC7dl+s9CVOGsgTkoWgKN/JNG2Tmuoqpq3rQ9hsUP0Ztj32ty
+VfEWqKipDtC0x2xi2D7I25gxVLu521tqLhoaWN1oWdPraflXEkEY9p8CD8tzxc6Q
+wi6ShZ8TSacuLvivgQJBAOd/X4iNmmPZ0AY+ZVri4Ic+YXOOapagkXuR2Y5pcRfw
+3jueEwZMIo142L+dFZMDORsqPhFwwCzOcbn2NEID4ckCQQDDTh607HbkvXAwYHDZ
+6gpczrhSAkpjQ0fffOFuF8sI5A64KjnTGte+fm8ic5Mess1oP6LdaS0HvJs4n+m7
+nPc9AkEApTwbOmKoQoEjpHFA8wBhducls8+BcQYnEWZnPOkyGf6JAVCxD5ukRgpt
+20cKMSbpyeP67YPnB5RLRIrhfgU7UQJAX3d5NRD9UPR0uYD6yNpJNHJr0NKD0B+c
+K1dczjbdLTxlIYqqd1GAsgIViu6ZtIDMPTAWCUqXE1gTO8uXMfkZNQJASgdEiTiI
+EnZLto+1hRr/fYNzIJHDelJ2oGtzbRmUtXQ8d489obsZusK2kSPWgX1lzXjvrv07
+jznkRk0QtDG8Vw==
+-----END PRIVATE KEY-----