cocert

cocert

cocert, generates ECDSA - P521 key and uses a technique known as Shamir's Secret Sharing algorithm to split the master key into x shares, any y of which are required to reconstruct the master private key. Private keys are stored in PEM-encoded PKCS8 format, which are encrypted by The Update Framework (TUF). Each private key is splitted using Shamir Split. To Combine private key files into single one, it is necessary to enter decrypt password if it has been encrypted by TUF.

*cocert does not support any Distributed Key Generation (DGK) algorithm, yet.

This repository is signed via cosign, by using cocert itself

Asciinema

High Level Architecture

Use-Case Example

• What happens if your private key is exposed by either public 3rd-party cloud service provider or internal security breach?

Your private key would have compromised and supply chain attacks would inevitable. What would happen if we not trust just one key, however, distribute our key to multiple secure environments? We would avoid supply chain attacks, that said, even if one of our private keys is compromised, we still need two more keys to combine and get the final private key.

Installation

• Go

$ go install github.com/Dentrax/cocert@latest

• Docker

$ docker pull ghcr.io/dentrax/cocert

Verify

Prerequities

1. cosign
2. crane

Check

# 1. Download the public key
$ curl https://raw.githubusercontent.com/Dentrax/cocert/main/.github/workflows/certs/cocert.pub -o cocert.pub

# 2. Verify
$ cosign verify -key cocert.pub ghcr.io/dentrax/cocert | jq

# 3. Make sure verified commit matches the digest of the latest image 
$ crane digest ghcr.io/dentrax/cocert

Usage

…

Use-Case Demonstration

1. Generate

$ cocert generate --parts 3 --threshold 2

Generating TUF encrypted Shamir PEMs...
Create new password for private key:  (master)
Confirm password: (master)
Extracting PEMs to files...
Do you want to encrypt each key using TUF? (y/n) [n]: y
Create new password for cocert0.key key: (foo)
Create new password for cocert1.key key: (bar)
Create new password for cocert2.key key: (baz)

2.1. Sign with Private Key

$ cocert sign -f cocert0.key -f cocert1.key -p "Foo Bar Baz"

(Press Enter to continue without decrypt...)
Enter your password for cocert0.key: (foo)
Enter your password for cocert1.key: (bar)
Enter your master key: (master)
Signed: MIGIAkIBCisWXRLBRcv/...+3pccRjm+nUNA==

2.2. Sign with Fulcio (Keyless)

$ cocert sign -f cocert0.key -f cocert1.key  -p "Foo Bar Baz" -o my.cert

(Press Enter to continue without decrypt...)
Enter your password for cocert0.key: (foo)
Enter your password for cocert1.key: (bar)
Enter your master key: (master)
Your browser will now be opened to:
https://oauth2.sigstore.dev/auth/auth?access_type=online&client_id=sigstore&code_challenge=CODE&code_challenge_method=S256&nonce=NONCE&redirect_uri=http%3A%2F%2Flocalhost%3A5556%2Fauth%2Fcallback&response_type=code&scope=openid+email&state=STATE
Signed: MIGIAkIBCisWXRLBRcv/...+3pccRjm+nUNA==

3.1. Verify with Public Key

$ cocert verify -f cocert.pub -p "Foo Bar Baz" -k "MIGIAkIBCisWXRLBRcv/...+3pccRjm+nUNA=="

3.2. Verify with Certificate

$ cocert verify -c my.cert -p "Foo Bar Baz" -k "MIGIAkIBCisWXRLBRcv/...+3pccRjm+nUNA=="

Bonus: Splitting

…

Encrypt & Decrypt Keys

• Encrypt

$ cocert encrypt -f cocert0.key -o "cocert0.key.encrypted"

Enter your password for : (foo2)
Confirm password: (foo2)

• Decrypt

$ cocert decrypt -f cocert0.key.encrypted -o "cocert0.key.decrypted"
# [[ $(md5 -q cocert0.key) -eq $(md5 -q cocert0.key.decrypted) ]]

Enter your password for : (foo2)

$ cocert decrypt -f cocert0.key.decrypted -o "cocert0.key.unencrypted"
# You can pass empty password for 'cocert0.key.unencrypted' key

Enter your password for : (foo)

• Combine

$ cocert combine -f cocert0.key.unencrypted -f cocert1.key 

Loading PEMs from files...
(Press Enter to continue without decrypt...)
Enter your password for cocert0.key.unencrypted: (PASS)
Enter your password for cocert1.key: (bar)
Decrypting TUF encrypted PEMs...
Enter your master key: (master)
Combined

Special Thanks

Package	Author	License
cosign	sigstore	Apache License 2.0
go-tuf	The Update Framework	BSD
Vault	HashiCorp	Mozilla Public License 2.0
prompter	Songmu	MIT

• Thanks to everyone who contributed these libraries and others that made this project possible.

License

cocert was created by Furkan 'Dentrax' Türkal

The base project code is licensed under MIT unless otherwise specified. Please see the LICENSE file for more information.

Best Regards