[feature] Updated code to handle ECDSA signature algorithm #118

[praptisharma28]

Fixes #118

[coveralls]

coverage: 99.287%. remained the same
when pulling 98c5193 on praptisharma28:ecdsa
into b9699e8 on openwisp:master.

[nemesifier]

I did a bit of research. Since we are adding this algorithm, it doesn't make much sense to not add other algorithms too.

Since we are at it, let's patch it so that more users will be able to use this library.

Until today we have worked mostly with RSA, but other type of algorithm are gaining momentum and would be good to support them.

x509 algorithms

Python libraries for handling X.509 certificates typically support a wide range of algorithms for signing and verifying certificates. These algorithms include various RSA, ECDSA, and SHA-based options. Here are some common algorithms supported by popular Python libraries such as cryptography, pyOpenSSL, and M2Crypto:

Common Algorithms

RSA-based Algorithms:

• sha1WithRSAEncryption
• sha256WithRSAEncryption
• sha384WithRSAEncryption
• sha512WithRSAEncryption
• md5WithRSAEncryption (not recommended due to security vulnerabilities)

ECDSA-based Algorithms:

• ecdsa-with-SHA1
• ecdsa-with-SHA256
• ecdsa-with-SHA384
• ecdsa-with-SHA512

DSA-based Algorithms:

• dsaWithSHA1
• dsaWithSHA256

EdDSA Algorithms:

• Ed25519
• Ed448

Can you please add these as well?

[praptisharma28]

I did a bit of research. Since we are adding this algorithm, it doesn't make much sense to not add other algorithms too.

Since we are at it, let's patch it so that more users will be able to use this library.

Until today we have worked mostly with RSA, but other type of algorithm are gaining momentum and would be good to support them.

x509 algorithms

Python libraries for handling X.509 certificates typically support a wide range of algorithms for signing and verifying certificates. These algorithms include various RSA, ECDSA, and SHA-based options. Here are some common algorithms supported by popular Python libraries such as cryptography, pyOpenSSL, and M2Crypto:

Common Algorithms

RSA-based Algorithms:

• sha1WithRSAEncryption
• sha256WithRSAEncryption
• sha384WithRSAEncryption
• sha512WithRSAEncryption
• md5WithRSAEncryption (not recommended due to security vulnerabilities)

ECDSA-based Algorithms:

• ecdsa-with-SHA1
• ecdsa-with-SHA256
• ecdsa-with-SHA384
• ecdsa-with-SHA512

DSA-based Algorithms:

• dsaWithSHA1
• dsaWithSHA256

EdDSA Algorithms:

• Ed25519
• Ed448

Can you please add these as well?

Yes @nemesifier will work upon it.

[nemesifier]

The suggestion I have given in #118 (comment) is incorrect.

I assumed we just had to change that part of the code to support generating certificates with other algorithms but that's not the case.

The digest options being added here are invalid, try to create a CA or a cert from the admin interface with any of those and you'll see it doesn't work.

To support this feature properly, we must add a way to specify the algorithm used for generating the certificate, which now is hardcoded to be crypto.TYPE_RSA (RSA).

[nemesifier]

I don't think it makes sense to alter the digest choices. Try creating a new certificate or CA with any of these and watch it fail.

[praptisharma28]

The suggestion I have given in #118 (comment) is incorrect.
I assumed we just had to change that part of the code to support generating certificates with other algorithms but that's not the case.
The digest options being added here are invalid, try to create a CA or a cert from the admin interface with any of those and you'll see it doesn't work.
To support this feature properly, we must add a way to specify the algorithm used for generating the certificate, which now is hardcoded to be crypto.TYPE_RSA (RSA).

Okay

[nemesifier]

Will close this for now as I don't think we'll work on it.