Source code for keystone.common.jwt_utils

# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.

from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives.asymmetric import ed25519
from cryptography.hazmat.primitives import serialization

_ALGORITHM_KEY_GENERATORS = {
    'ES256': lambda: ec.generate_private_key(ec.SECP256R1()),
    'ES384': lambda: ec.generate_private_key(ec.SECP384R1()),
    'ES512': lambda: ec.generate_private_key(ec.SECP521R1()),
    'EdDSA': lambda: ed25519.Ed25519PrivateKey.generate(),
}




def create_jws_keypair(private_key_path, public_key_path, algorithm='ES256'):
    """Create an asymmetric key pair suitable for the given JWS algorithm.

    :param private_key_path: location to save the private key
    :param public_key_path: location to save the public key
    :param algorithm: JWS algorithm name (ES256, ES384, ES512, EdDSA)

    """
    generator = _ALGORITHM_KEY_GENERATORS.get(algorithm)
    if generator is None:
        raise ValueError(
            'Unsupported JWS algorithm: {}. Supported: {}'.format(
                algorithm, ', '.join(sorted(_ALGORITHM_KEY_GENERATORS))
            )
        )
    private_key = generator()

    with open(private_key_path, 'wb') as f:
        f.write(
            private_key.private_bytes(
                encoding=serialization.Encoding.PEM,
                format=serialization.PrivateFormat.PKCS8,
                encryption_algorithm=serialization.NoEncryption(),
            )
        )

    public_key = private_key.public_key()
    with open(public_key_path, 'wb') as f:
        f.write(
            public_key.public_bytes(
                encoding=serialization.Encoding.PEM,
                format=serialization.PublicFormat.SubjectPublicKeyInfo,
            )
        )