Move from RSA to Ed25519. This breaks backwards compatibility and therefore a new semantic release.

go.mod

@@ -4,9 +4,8 @@ go 1.22
 
 require (
 	github.com/catalinc/hashcash v1.0.0
-	github.com/dgrijalva/jwt-go v3.2.0+incompatible
-	github.com/gin-contrib/sessions v1.0.1
 	github.com/gin-gonic/gin v1.9.1
+	github.com/golang-jwt/jwt v3.2.2+incompatible
 	github.com/mattn/go-sqlite3 v1.14.22
 	github.com/spf13/viper v1.18.2
 	golang.org/x/crypto v0.22.0
@@ -23,9 +22,6 @@ require (
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.19.0 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
-	github.com/gorilla/context v1.1.2 // indirect
-	github.com/gorilla/securecookie v1.1.2 // indirect
-	github.com/gorilla/sessions v1.2.2 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.7 // indirect

go.sum

@@ -15,16 +15,12 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
 github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
 github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
-github.com/gin-contrib/sessions v1.0.1 h1:3hsJyNs7v7N8OtelFmYXFrulAf6zSR7nW/putcPEHxI=
-github.com/gin-contrib/sessions v1.0.1/go.mod h1:ouxSFM24/OgIud5MJYQJLpy6AwxQ5EYO9yLhbtObGkM=
 github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqJ+Jmg=
@@ -39,17 +35,11 @@ github.com/go-playground/validator/v10 v10.19.0 h1:ol+5Fu+cSq9JD7SoSqe04GMI92cbn
 github.com/go-playground/validator/v10 v10.19.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
+github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/gorilla/context v1.1.2 h1:WRkNAv2uoa03QNIc1A6u4O7DAGMUVoopZhkiXWA2V1o=
-github.com/gorilla/context v1.1.2/go.mod h1:KDPwT9i/MeWHiLl90fuTgrt4/wPcv75vFAZLaOOcbxM=
-github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
-github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
-github.com/gorilla/sessions v1.2.2 h1:lqzMYz6bOfvn2WriPUjNByzeXIlVzURcPmgMczkmTjY=
-github.com/gorilla/sessions v1.2.2/go.mod h1:ePLdVu+jbEgHH+KWw8I1z2wqd0BAdAQh/8LRvBeoNcQ=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=

main.go

@@ -3,20 +3,18 @@
 package main
 
 import (
+	"crypto/ed25519"
 	"crypto/rand"
-	"crypto/rsa"
 	"crypto/sha256"
 	"crypto/x509"
 	"database/sql"
 	"encoding/base64"
-	"encoding/binary"
 	"encoding/hex"
 	"encoding/json"
 	"encoding/pem"
 	"errors"
 	"fmt"
 	"log"
-	"math/big"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -26,8 +24,8 @@ import (
 	"time"
 
 	"github.com/catalinc/hashcash"
-	"github.com/dgrijalva/jwt-go"
 	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt"
 	_ "github.com/mattn/go-sqlite3"
 	"github.com/spf13/viper"
 	"golang.org/x/crypto/scrypt"
@@ -36,10 +34,8 @@ import (
 var (
 	conn       *sql.DB
 	mem        *sql.DB
-	privateKey *rsa.PrivateKey
+	privateKey ed25519.PrivateKey
-	publicKey  *rsa.PublicKey
+	publicKey  ed25519.PublicKey
-	modulus    *big.Int
-	exponent   int
 )
 
 func ensureTrailingSlash(url string) string {
@@ -49,29 +45,6 @@ func ensureTrailingSlash(url string) string {
 	return url
 }
 
-func Int64ToBase64URL(num int64) (string, error) {
-	numBytes := make([]byte, 8)
-	binary.BigEndian.PutUint64(numBytes, uint64(num))
-	startIndex := 0
-	for startIndex < len(numBytes) && numBytes[startIndex] == 0 {
-		startIndex++
-	}
-	trimmedBytes := numBytes[startIndex:]
-	encoded := base64.URLEncoding.EncodeToString(trimmedBytes)
-	return encoded, nil
-}
-
-func BigIntToBase64URL(num *big.Int) (string, error) {
-	numBytes := num.Bytes()
-	startIndex := 0
-	for startIndex < len(numBytes) && numBytes[startIndex] == 0 {
-		startIndex++
-	}
-	trimmedBytes := numBytes[startIndex:]
-	encoded := base64.URLEncoding.EncodeToString(trimmedBytes)
-	return encoded, nil
-}
-
 const saltChars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
 
 func randomChars(length int) (string, error) {
@@ -402,7 +375,7 @@ func main() {
 				log.Println("[INFO] Key pair not found. Obviously someone hasn't read the README. I guess I'll have to do everything myself :P")
 			}
 
-			tempPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+			tempPublicKey, tempPrivateKey, err := ed25519.GenerateKey(rand.Reader)
 			if err != nil {
 				log.Fatalln("[ERROR] Cannot generate private key:", err)
 			}
@@ -412,18 +385,16 @@ func main() {
 				log.Fatalln("[ERROR] Cannot marshal private key:", err)
 			}
 			privateKeyFile = pem.EncodeToMemory(&pem.Block{
-				Type:  "RSA PRIVATE KEY",
+				Type:  "ED25519 PRIVATE KEY",
 				Bytes: privateKeyBytes,
 			})
 
-			tempPublicKey := tempPrivateKey.Public()
-
 			publicKeyBytes, err := x509.MarshalPKIXPublicKey(tempPublicKey)
 			if err != nil {
 				log.Fatalln("[ERROR] Cannot marshal public key:", err)
 			}
 			pubKeyFile = pem.EncodeToMemory(&pem.Block{
-				Type:  "RSA PUBLIC KEY",
+				Type:  "ED25519 PUBLIC KEY",
 				Bytes: publicKeyBytes,
 			})
 
@@ -466,15 +437,15 @@ func main() {
 		log.Fatalln("[ERROR] Failed to parse PEM block containing the private key")
 	}
 
-	privateKeyRaw, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	privateKeyBytes, err := x509.ParsePKCS8PrivateKey(block.Bytes)
 	if err != nil {
 		log.Fatalln("[ERROR] Failed to parse private key:", err)
 	}
 
 	var ok bool
-	privateKey, ok = privateKeyRaw.(*rsa.PrivateKey)
+	privateKey, ok = privateKeyBytes.(ed25519.PrivateKey)
 	if !ok {
-		log.Fatalln("[ERROR] Failed to convert private key to RSA private key")
+		log.Fatalln("[ERROR] Failed to parse private key")
 	}
 
 	pubKeyFile, err = os.ReadFile(publicKeyPath)
@@ -487,19 +458,16 @@ func main() {
 		log.Fatalln("[ERROR] Failed to parse PEM block containing the public key")
 	}
 
-	pubKey, err := x509.ParsePKIXPublicKey(block.Bytes)
+	publicKeyBytes, err := x509.ParsePKIXPublicKey(block.Bytes)
 	if err != nil {
 		log.Fatalln("[ERROR] Failed to parse public key:", err)
 	}
 
-	publicKey, ok = pubKey.(*rsa.PublicKey)
+	publicKey, ok = publicKeyBytes.(ed25519.PublicKey)
 	if !ok {
-		log.Fatalln("[ERROR] Failed to convert public key to RSA public key")
+		log.Fatalln("[ERROR] Failed to parse public key")
 	}
 
-	modulus = privateKey.N
-	exponent = privateKey.E
-
 	gin.SetMode(gin.ReleaseMode)
 	router := gin.New()
 
@@ -562,8 +530,9 @@ func main() {
 				if err != nil {
 					log.Println("[ERROR] Unknown in /testapp createTestApp():", err)
 					c.String(500, "Something went wrong on our end. Please report this bug at https://centrifuge.hectabit.org/hectabit/burgernotes and refer to the documentation for more info. Your error code is: UNKNOWN-TESTAPP-CREATE")
+				} else {
+					c.HTML(200, "refresh.html", gin.H{})
 				}
-				c.HTML(200, "refresh.html", gin.H{})
 				return
 			} else {
 				log.Println("[ERROR] Unknown in /testapp:", err)
@@ -1424,7 +1393,7 @@ func main() {
 				"session":   sessionKey,
 				"nonce":     nonce,
 			}
-			tokenTemp := jwt.NewWithClaims(jwt.SigningMethodRS256, dataTemplate)
+			tokenTemp := jwt.NewWithClaims(jwt.SigningMethodEdDSA, dataTemplate)
 			tokenTemp.Header["kid"] = "burgerauth"
 			jwtToken, err = tokenTemp.SignedString(privateKey)
 			if err != nil {
@@ -1443,7 +1412,7 @@ func main() {
 			"aud":     appId,
 		}
 
-		secretTemp := jwt.NewWithClaims(jwt.SigningMethodRS256, dataTemplateTwo)
+		secretTemp := jwt.NewWithClaims(jwt.SigningMethodEdDSA, dataTemplateTwo)
 		secretTemp.Header["kid"] = "burgerauth"
 		secretToken, err := secretTemp.SignedString(privateKey)
 		if err != nil {
@@ -2006,28 +1975,15 @@ func main() {
 	})
 
 	router.GET("/.well-known/jwks.json", func(c *gin.Context) {
-		mod, err := BigIntToBase64URL(modulus)
-		if err != nil {
-			log.Println("[ERROR] Unknown in /well-known/jwks.json modulus:", err)
-			c.JSON(500, gin.H{"error": "Something went wrong on our end. Please report this bug at https://concord.hectabit.org/hectabit/burgerauth and refer to the docs for more info. Your error code is: UNKNOWN-JWKS-MODULUS"})
-			return
-		}
-
-		exp, err := Int64ToBase64URL(int64(exponent))
-		if err != nil {
-			log.Println("[ERROR] Unknown in /well-known/jwks.json exponent:", err)
-			c.JSON(500, gin.H{"error": "Something went wrong on our end. Please report this bug at https://concord.hectabit.org/hectabit/burgerauth and refer to the docs for more info. Your error code is: UNKNOWN-JWKS-EXPONENT"})
-			return
-		}
 		keys := gin.H{
 			"keys": []gin.H{
 				{
-					"kty": "RSA",
+					"kty": "OKP",
-					"alg": "RS256",
+					"alg": "EdDSA",
 					"use": "sig",
 					"kid": keyIdentifier,
-					"n":   mod,
+					"x":   base64.RawURLEncoding.EncodeToString(publicKey),
-					"e":   exp,
+					"crv": "Ed25519",
 				},
 			},
 		}