]>
git.proxmox.com Git - mirror_edk2.git/blob - BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256GenerateKeys.py
2 # This tool can be used to generate new RSA 2048 bit private/public key pairs
3 # in a PEM file format using OpenSSL command line utilities that are installed
4 # on the path specified by the system environment variable OPENSSL_PATH.
5 # This tool can also optionally write one or more SHA 256 hashes of 2048 bit
6 # public keys to a binary file, write one or more SHA 256 hashes of 2048 bit
7 # public keys to a file in a C structure format, and in verbose mode display
8 # one or more SHA 256 hashes of 2048 bit public keys in a C structure format
10 # This tool has been tested with OpenSSL 1.0.1e 11 Feb 2013
12 # Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
13 # This program and the accompanying materials
14 # are licensed and made available under the terms and conditions of the BSD License
15 # which accompanies this distribution. The full text of the license may be found at
16 # http://opensource.org/licenses/bsd-license.php
18 # THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
19 # WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
23 Rsa2048Sha256GenerateKeys
25 from __future__
import print_function
31 from Common
. BuildVersion
import gBUILD_VERSION
34 # Globals for help information
36 __prog__
= 'Rsa2048Sha256GenerateKeys'
37 __version__
= ' %s Version %s ' % ( __prog__
, '0.9 ' + gBUILD_VERSION
)
38 __copyright__
= 'Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.'
39 __usage__
= ' %s [options]' % ( __prog__
)
42 if __name__
== '__main__' :
44 # Create command line argument parser object
46 parser
= argparse
. ArgumentParser ( prog
= __prog__
, version
= __version__
, usage
= __usage__
, description
= __copyright__
, conflict_handler
= 'resolve' )
47 group
= parser
. add_mutually_exclusive_group ( required
= True )
48 group
. add_argument ( "-o" , "--output" , dest
= 'OutputFile' , type = argparse
. FileType ( 'wb' ), metavar
= 'filename' , nargs
= '*' , help = "specify the output private key filename in PEM format" )
49 group
. add_argument ( "-i" , "--input" , dest
= 'InputFile' , type = argparse
. FileType ( 'rb' ), metavar
= 'filename' , nargs
= '*' , help = "specify the input private key filename in PEM format" )
50 parser
. add_argument ( "--public-key-hash" , dest
= 'PublicKeyHashFile' , type = argparse
. FileType ( 'wb' ), help = "specify the public key hash filename that is SHA 256 hash of 2048 bit RSA public key in binary format" )
51 parser
. add_argument ( "--public-key-hash-c" , dest
= 'PublicKeyHashCFile' , type = argparse
. FileType ( 'wb' ), help = "specify the public key hash filename that is SHA 256 hash of 2048 bit RSA public key in C structure format" )
52 parser
. add_argument ( "-v" , "--verbose" , dest
= 'Verbose' , action
= "store_true" , help = "increase output messages" )
53 parser
. add_argument ( "-q" , "--quiet" , dest
= 'Quiet' , action
= "store_true" , help = "reduce output messages" )
54 parser
. add_argument ( "--debug" , dest
= 'Debug' , type = int , metavar
= '[0-9]' , choices
= range ( 0 , 10 ), default
= 0 , help = "set debug level" )
57 # Parse command line arguments
59 args
= parser
. parse_args ()
62 # Generate file path to Open SSL command
64 OpenSslCommand
= 'openssl'
66 OpenSslPath
= os
. environ
[ 'OPENSSL_PATH' ]
67 OpenSslCommand
= os
. path
. join ( OpenSslPath
, OpenSslCommand
)
68 if ' ' in OpenSslCommand
:
69 OpenSslCommand
= '"' + OpenSslCommand
+ '"'
74 # Verify that Open SSL command is available
77 Process
= subprocess
. Popen ( ' %s version' % ( OpenSslCommand
), stdout
= subprocess
. PIPE
, stderr
= subprocess
. PIPE
, shell
= True )
79 print ( 'ERROR: Open SSL command not available. Please verify PATH or set OPENSSL_PATH' )
82 Version
= Process
. communicate ()
83 if Process
. returncode
!= 0 :
84 print ( 'ERROR: Open SSL command not available. Please verify PATH or set OPENSSL_PATH' )
85 sys
. exit ( Process
. returncode
)
91 # Check for output file argument
93 if args
. OutputFile
is not None :
94 for Item
in args
. OutputFile
:
96 # Save PEM filename and close output file
98 args
. PemFileName
. append ( Item
. name
)
102 # Generate private key and save it to output file in a PEM file format
104 Process
= subprocess
. Popen ( ' %s genrsa -out %s 2048' % ( OpenSslCommand
, Item
. name
), stdout
= subprocess
. PIPE
, stderr
= subprocess
. PIPE
, shell
= True )
105 Process
. communicate ()
106 if Process
. returncode
!= 0 :
107 print ( 'ERROR: RSA 2048 key generation failed' )
108 sys
. exit ( Process
. returncode
)
111 # Check for input file argument
113 if args
. InputFile
is not None :
114 for Item
in args
. InputFile
:
116 # Save PEM filename and close input file
118 args
. PemFileName
. append ( Item
. name
)
122 for Item
in args
. PemFileName
:
124 # Extract public key from private key into STDOUT
126 Process
= subprocess
. Popen ( ' %s rsa -in %s -modulus -noout' % ( OpenSslCommand
, Item
), stdout
= subprocess
. PIPE
, stderr
= subprocess
. PIPE
, shell
= True )
127 PublicKeyHexString
= Process
. communicate ()[ 0 ]. split ( '=' )[ 1 ]. strip ()
128 if Process
. returncode
!= 0 :
129 print ( 'ERROR: Unable to extract public key from private key' )
130 sys
. exit ( Process
. returncode
)
132 for Index
in range ( 0 , len ( PublicKeyHexString
), 2 ):
133 PublicKey
= PublicKey
+ chr ( int ( PublicKeyHexString
[ Index
: Index
+ 2 ], 16 ))
136 # Generate SHA 256 hash of RSA 2048 bit public key into STDOUT
138 Process
= subprocess
. Popen ( ' %s dgst -sha256 -binary' % ( OpenSslCommand
), stdin
= subprocess
. PIPE
, stdout
= subprocess
. PIPE
, stderr
= subprocess
. PIPE
, shell
= True )
139 Process
. stdin
. write ( PublicKey
)
140 PublicKeyHash
= PublicKeyHash
+ Process
. communicate ()[ 0 ]
141 if Process
. returncode
!= 0 :
142 print ( 'ERROR: Unable to extract SHA 256 hash of public key' )
143 sys
. exit ( Process
. returncode
)
146 # Write SHA 256 hash of 2048 bit binary public key to public key hash file
149 args
. PublicKeyHashFile
. write ( PublicKeyHash
)
150 args
. PublicKeyHashFile
. close ()
155 # Convert public key hash to a C structure string
158 for Item
in PublicKeyHash
:
159 PublicKeyHashC
= PublicKeyHashC
+ '0x %0 2x, ' % ( ord ( Item
))
160 PublicKeyHashC
= PublicKeyHashC
[:- 2 ] + '}'
163 # Write SHA 256 of 2048 bit binary public key to public key hash C structure file
166 args
. PublicKeyHashCFile
. write ( PublicKeyHashC
)
167 args
. PublicKeyHashCFile
. close ()
172 # If verbose is enabled display the public key in C structure format
175 print ( 'PublicKeySha256 = ' + PublicKeyHashC
)