grpc node mutual auth failed when uses secp256k1 with the ECDSA algorithm
- Dominant language
- TypeScript
- Stars
- 4.8k
- Forks
- 716
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 10
Description
### Problem description
I've been using a self generated **RSA** Certificate Authority to sign my server and clients certificates and so far [grpc node mutual authentication](https://github.com/vulnsystem/OpenssLabs/tree/main/grpc-client-auth) worked fine.
Following the same why, I'm trying to use secp256k1 with the ECDSA algorithm, assmuming that the key of **BTC** or **ETH** will be used grpc authentication directly. Unfortunately I cannot get right output.
### Reproduction steps
All the following contents and steps can been found from the [repository](https://github.com/vulnsystem/OpenssLabs/tree/main/grpc-auth-secp256k1)
1. To generate server and client's EC secp256k1 private key and TLS certificates with [gen.sh](https://github.com/vulnsystem/OpenssLabs/blob/main/grpc-auth-secp256k1/credentials/gen.sh).
```
# 1. Generate EC private key and self-signed certificate
openssl ecparam -genkey -out ca.key -name secp256k1
openssl req -x509 -new -key ca.key -out ca.cert -subj "/C=FR/ST=Occitanie/L=Toulouse/O=Tech School/OU=Education/CN=*.techschool.guru/emailAddress=root.guru@gmail.com"
echo "CA's self-signed certificate"
openssl x509 -in ca.cert -noout -text
# 2. Generate web server's private key and certificate signing request (EC)
openssl ecparam -genkey -out server.key -name secp256k1
openssl req -key server.key -new -out server.req -subj "/C=FR/ST=Ile de France/L=Paris/O=PC Book/OU=Computer/CN=*.pcbook.com/emailAddress=server@gmail.com"
# 3. Use CA's private key to sign web server's CSR and get back the signed certificate
openssl x509 -req -in server.req -days 60 -CA ca.cert -CAkey ca.key -CAcreateserial -out server.cert -extfile server.ext
echo "Server's signed certificate"
openssl x509 -in server.cert -noout -text
# 4. Generate client's private key and certificate signing request (EC)
openssl ecparam -genkey -out client.key -name secp256k1
openssl req -key client.key -new -out client.req -subj "/C=FR/ST=Alsace/L=Strasbourg/O=PC Client/OU=Computer/CN=*.client.com/emailAddress=client@gmail.com"
# 5. Use CA's private key to sign client's CSR and get back the signed certificate
openssl x509 -req -in client.req -days 60 -CA ca.cert -CAkey ca.key -CAcreateserial -out client.cert -extfile client.ext
echo "Client's signed certificate"
openssl x509 -in client.cert -noout -text
# 6. To verify the server certificate aginst by root CA
echo "server's certificate verification"
openssl verify -show_chain -CAfile ca.cert server.cert
# 7. To verify the client certificate aginst by root CA.
echo "client's certificate verification"
openssl verify -show_chain -CAfile ca.cert client.cert
```
2. Implement server-side Auth in [greeter_server.js](https://github.com/vulnsystem/OpenssLabs/blob/main/grpc-auth-secp256k1/greeter_server.js)
```
function main() {
var server = new grpc.Server();
server.addService(hello_proto.Greeter.service, {sayHello: sayHello});
server.bindAsync('0.0.0.0:50051', grpc.ServerCredentials.createSsl(
fs.readFileSync('./credentials/ca.cert'),
[{
cert_chain: fs.readFileSync('./credentials/server.cert'),
private_key: fs.readFileSync('./credentials/server.key')
}],
true
), () => {
server.start();
});
}
```
3. Implement client-side Auth in [greeter_client.js](https://github.com/vulnsystem/OpenssLabs/blob/main/grpc-auth-secp256k1/greeter_client.js)
```
var client = new hello_proto.Greeter(target,
grpc.credentials.createSsl(fs.readFileSync('./credentials/ca.cert'),
fs.readFileSync('./credentials/client.key'),
fs.readFileSync('./credentials/client.cert')));
```
4. Try it out!
```shell
npm install
node greeter_server.js
node greeter_client.js
```
5. The server started successfully and Error output from client is:
```
/grpc-auth-secp256k1/greeter_client.js:57
console.log('Greeting:', response.message); ^
TypeError: Cannot read property 'message' of undefined
at Object.callback (grpc-auth-secp256k1/greeter_client.js:57:39)
at Object.onReceiveStatus (grpc-auth-secp256k1/node_modules/@grpc/grpc-js/build/src/client.js:176:36)
at Object.onReceiveStatus (grpc-auth-secp256k1/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:342:141)
at Object.onReceiveStatus OpenssLabs/grpc-auth-secp256k1/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:305:181)
at grpc-auth-secp256k1/node_modules/@grpc/grpc-js/build/src/call-stream.js:124:78
at processTicksAndRejections (internal/process/task_queues.js:75:11)
```
The grpc node mutual authentication is successful with [RSA Certificate](https://github.com/vulnsystem/OpenssLabs/tree/main/grpc-client-auth) , but failed with **secp256k1**.
### Environment
- OS [Ubuntu 18.04 amd64]
- Node version [v14.16.1]
- Node installation method [nvm]
- Package name and version [@grpc/grpc-js : 1.1.0]
- Authentication mode: SSL/TLS
- Signature algorithm: ecdsa-withsha256
- Key generate type: **secp256k1**
- Source code: dynamic_codegen from grpc node examples
### Additional context
No
### Question
1. How to show the grpc TLS handshake informaiton like openssl debug?
2. Is there any clue to fix the problem?
Contributor guide
Assessment
This issue has not been assessed yet.