grpc / grpc/grpc-node

grpc node mutual auth failed when uses secp256k1 with the ECDSA algorithm

Open
#1,802 6 comments 0 reactions 0 assignees View on GitHub
package: @grpc/grpc-js
Dominant language
TypeScript
Stars
4.8k
Forks
716
Avg merge
2d 3h
Merged PRs (30d)
10

Description

### Problem description
I've been using a self generated **RSA** Certificate Authority to sign my server and clients certificates and so far [grpc node mutual authentication](https://github.com/vulnsystem/OpenssLabs/tree/main/grpc-client-auth) worked fine.

Following the same why, I'm trying to use secp256k1 with the ECDSA algorithm, assmuming that the key of **BTC** or **ETH** will be used grpc authentication directly. Unfortunately I cannot get right output.

### Reproduction steps
All the following contents and steps can been found from the [repository](https://github.com/vulnsystem/OpenssLabs/tree/main/grpc-auth-secp256k1)
1. To generate server and client's EC secp256k1 private key and TLS certificates with [gen.sh](https://github.com/vulnsystem/OpenssLabs/blob/main/grpc-auth-secp256k1/credentials/gen.sh).
```
# 1. Generate EC private key and self-signed certificate
openssl ecparam -genkey -out ca.key -name secp256k1
openssl req -x509 -new -key ca.key -out ca.cert -subj "/C=FR/ST=Occitanie/L=Toulouse/O=Tech School/OU=Education/CN=*.techschool.guru/emailAddress=root.guru@gmail.com"

echo "CA's self-signed certificate"
openssl x509 -in ca.cert -noout -text

# 2. Generate web server's private key and certificate signing request (EC)
openssl ecparam -genkey -out server.key -name secp256k1
openssl req -key server.key -new -out server.req -subj "/C=FR/ST=Ile de France/L=Paris/O=PC Book/OU=Computer/CN=*.pcbook.com/emailAddress=server@gmail.com"

# 3. Use CA's private key to sign web server's CSR and get back the signed certificate
openssl x509 -req -in server.req -days 60 -CA ca.cert -CAkey ca.key -CAcreateserial -out server.cert -extfile server.ext

echo "Server's signed certificate"
openssl x509 -in server.cert -noout -text

# 4. Generate client's private key and certificate signing request (EC)
openssl ecparam -genkey -out client.key -name secp256k1
openssl req -key client.key -new -out client.req -subj "/C=FR/ST=Alsace/L=Strasbourg/O=PC Client/OU=Computer/CN=*.client.com/emailAddress=client@gmail.com"

# 5. Use CA's private key to sign client's CSR and get back the signed certificate
openssl x509 -req -in client.req -days 60 -CA ca.cert -CAkey ca.key -CAcreateserial -out client.cert -extfile client.ext

echo "Client's signed certificate"
openssl x509 -in client.cert -noout -text

# 6. To verify the server certificate aginst by root CA
echo "server's certificate verification"
openssl verify -show_chain -CAfile ca.cert server.cert

# 7. To verify the client certificate aginst by root CA.
echo "client's certificate verification"
openssl verify -show_chain -CAfile ca.cert client.cert
```
2. Implement server-side Auth in [greeter_server.js](https://github.com/vulnsystem/OpenssLabs/blob/main/grpc-auth-secp256k1/greeter_server.js)
```
function main() {
var server = new grpc.Server();

server.addService(hello_proto.Greeter.service, {sayHello: sayHello});
server.bindAsync('0.0.0.0:50051', grpc.ServerCredentials.createSsl(
fs.readFileSync('./credentials/ca.cert'),
[{
cert_chain: fs.readFileSync('./credentials/server.cert'),
private_key: fs.readFileSync('./credentials/server.key')
}],
true
), () => {
server.start();
});
}
```
3. Implement client-side Auth in [greeter_client.js](https://github.com/vulnsystem/OpenssLabs/blob/main/grpc-auth-secp256k1/greeter_client.js)
```
var client = new hello_proto.Greeter(target,
grpc.credentials.createSsl(fs.readFileSync('./credentials/ca.cert'),
fs.readFileSync('./credentials/client.key'),
fs.readFileSync('./credentials/client.cert')));
```
4. Try it out!
```shell
npm install
node greeter_server.js
node greeter_client.js
```
5. The server started successfully and Error output from client is:
```
/grpc-auth-secp256k1/greeter_client.js:57
console.log('Greeting:', response.message); ^

TypeError: Cannot read property 'message' of undefined
at Object.callback (grpc-auth-secp256k1/greeter_client.js:57:39)
at Object.onReceiveStatus (grpc-auth-secp256k1/node_modules/@grpc/grpc-js/build/src/client.js:176:36)
at Object.onReceiveStatus (grpc-auth-secp256k1/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:342:141)
at Object.onReceiveStatus OpenssLabs/grpc-auth-secp256k1/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:305:181)
at grpc-auth-secp256k1/node_modules/@grpc/grpc-js/build/src/call-stream.js:124:78
at processTicksAndRejections (internal/process/task_queues.js:75:11)
```

The grpc node mutual authentication is successful with [RSA Certificate](https://github.com/vulnsystem/OpenssLabs/tree/main/grpc-client-auth) , but failed with **secp256k1**.

### Environment
- OS [Ubuntu 18.04 amd64]
- Node version [v14.16.1]
- Node installation method [nvm]
- Package name and version [@grpc/grpc-js : 1.1.0]
- Authentication mode: SSL/TLS
- Signature algorithm: ecdsa-withsha256
- Key generate type: **secp256k1**
- Source code: dynamic_codegen from grpc node examples

### Additional context
No

### Question
1. How to show the grpc TLS handshake informaiton like openssl debug?
2. Is there any clue to fix the problem?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.