From bedb51bf52cbd6e07737211f2d38045342f9216e Mon Sep 17 00:00:00 2001
From: Adrien Beraud <adrien.beraud@savoirfairelinux.com>
Date: Thu, 10 Aug 2017 09:47:41 -0400
Subject: [PATCH] crypto: add EC curve identity generation

---
 include/opendht/crypto.h |  3 +++
 src/crypto.cpp           | 17 ++++++++++++++++-
 tools/dhtnode.cpp        |  4 ++--
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/include/opendht/crypto.h b/include/opendht/crypto.h
index 81985c66..07ca9199 100644
--- a/include/opendht/crypto.h
+++ b/include/opendht/crypto.h
@@ -583,6 +583,9 @@ using SecureBlob = secure_vector<uint8_t>;
 OPENDHT_PUBLIC Identity generateIdentity(const std::string& name, Identity ca, unsigned key_length, bool is_ca);
 OPENDHT_PUBLIC Identity generateIdentity(const std::string& name = "dhtnode", Identity ca = {}, unsigned key_length = 4096);
 
+OPENDHT_PUBLIC Identity generateEcIdentity(const std::string& name, Identity ca, bool is_ca);
+OPENDHT_PUBLIC Identity generateEcIdentity(const std::string& name = "dhtnode", Identity ca = {});
+
 
 /**
  * Performs SHA512, SHA256 or SHA1, depending on hash_length.
diff --git a/src/crypto.cpp b/src/crypto.cpp
index 8b162138..dae67deb 100644
--- a/src/crypto.cpp
+++ b/src/crypto.cpp
@@ -882,6 +882,19 @@ generateIdentity(const std::string& name, Identity ca, unsigned key_length) {
     return generateIdentity(name, ca, key_length, !ca.first || !ca.second);
 }
 
+Identity
+generateEcIdentity(const std::string& name, crypto::Identity ca, bool is_ca)
+{
+    auto key = std::make_shared<PrivateKey>(PrivateKey::generateEC());
+    auto cert = std::make_shared<Certificate>(Certificate::generate(*key, name, ca, is_ca));
+    return {std::move(key), std::move(cert)};
+}
+
+Identity
+generateEcIdentity(const std::string& name, Identity ca) {
+    return generateEcIdentity(name, ca, !ca.first || !ca.second);
+}
+
 Certificate
 Certificate::generate(const PrivateKey& key, const std::string& name, Identity ca, bool is_ca)
 {
@@ -916,10 +929,12 @@ Certificate::generate(const PrivateKey& key, const std::string& name, Identity c
         gnutls_x509_crt_set_serial(cert, &cert_serial, sizeof(cert_serial));
     }
 
-    unsigned key_usage = GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_DATA_ENCIPHERMENT;
+    unsigned key_usage = 0;
     if (is_ca) {
         gnutls_x509_crt_set_ca_status(cert, 1);
         key_usage |= GNUTLS_KEY_KEY_CERT_SIGN | GNUTLS_KEY_CRL_SIGN;
+    } else {
+        key_usage |= GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_DATA_ENCIPHERMENT;
     }
     gnutls_x509_crt_set_key_usage(cert, key_usage);
 
diff --git a/tools/dhtnode.cpp b/tools/dhtnode.cpp
index 8aaf75f3..7e42c641 100644
--- a/tools/dhtnode.cpp
+++ b/tools/dhtnode.cpp
@@ -365,8 +365,8 @@ main(int argc, char **argv)
 
         dht::crypto::Identity crt {};
         if (params.generate_identity) {
-            auto ca_tmp = dht::crypto::generateIdentity("DHT Node CA");
-            crt = dht::crypto::generateIdentity("DHT Node", ca_tmp);
+            auto ca_tmp = dht::crypto::generateEcIdentity("DHT Node CA");
+            crt = dht::crypto::generateEcIdentity("DHT Node", ca_tmp);
         }
 
         dht->run(params.port, crt, true, params.network);