module

Krikri::PluginHelpers::Pkey

The operations openssl_privatekey (and any future key-material plugin) needs, expressed against EVP_PKEY handles:

generate - EVP_PKEY keygen for RSA/DSA/ECC/Ed25519/Ed448/ X25519/X448 (DSA gets its parameters generated in the same keygen pass, as openssl genpkey does) serialize_pem - PEM output: PKCS#8, traditional PKCS#1 (RSA/DSA/EC), or PKCS#8 for the Edwards types that have no traditional encoding; optionally encrypted with AES-256-CBC (the "auto" cipher, which is the only cipher the Ansible module's cryptography backend accepts) pkcs8_der - unencrypted DER PrivateKeyInfo (the source of format: raw's bare key bytes) load - parse PEM/DER key material back into a handle, with the given passphrase (nil on any failure - wrong passphrase, not a key at all, ...) info - key type NID, size in bits and (for EC keys) the curve's OpenSSL short name public_der - SubjectPublicKeyInfo DER, the fingerprint input

Constants

BIO_CTRL_INFO = 3
NID_DSA = 116
NID_EC = 408
NID_ED25519 = 1087
NID_ED448 = 1088
NID_RSA = 6
NID_X25519 = 1034
NID_X448 = 1035
TYPE_NIDS = {"RSA" => NID_RSA, "DSA" => NID_DSA, "ECC" => NID_EC, "Ed25519" => NID_ED25519, "Ed448" => NID_ED448, "X25519" => NID_X25519, "X448" => NID_X448}

Instance methods

free_pkey(pkey : Pointer(Void)) : Nil
Source
generate(type : String, size : Int32, curve_nid : Int32) : Pointer(Void) | Nil

EVP_PKEY* the caller owns (free_pkey) or nil on any failure.

Source
info(pkey : Pointer(Void)) : Info
Source
load(data : Bytes | String, passphrase : String | Nil) : Pointer(Void) | Nil

Parses PEM key material back into an EVP_PKEY handle the caller owns, decrypting with passphrase when the key is encrypted. nil on any failure (wrong passphrase, not key material, truncated PEM).

Source
load_checked(data : Bytes | String, passphrase : String | Nil) : Tuple(Pointer(Void) | Nil, LoadFailure | Nil)

cryptography-semantics private-key load: on failure the returned LoadFailure.message is byte-for-byte what the Ansible module puts in fail_json (verified against community.crypto 3.1.1 + the libcrypto the target ships). On success the caller owns the returned EVP_PKEY (free_pkey).

Source
load_public(data : Bytes | String) : Pointer(Void) | Nil

Parses PEM public key material (SubjectPublicKeyInfo) back into an EVP_PKEY handle the caller owns; nil on any failure.

Source
pkcs8_der(pkey : Pointer(Void)) : Bytes | Nil

Unencrypted DER PrivateKeyInfo - format: raw slices the bare key bytes off its tail (the Edwards/montgomery key is the last field).

Source
public_der(pkey : Pointer(Void)) : Bytes | Nil

SubjectPublicKeyInfo DER - the input the Ansible module hashes for its fingerprint result.

Source
public_pem(pkey : Pointer(Void)) : Bytes | Nil

SubjectPublicKeyInfo PEM of pkey's public half - the bytes the Ansible module writes for format: PEM.

Source
serialize_pem(pkey : Pointer(Void), type : String, format : String, passphrase : String | Nil) : Bytes | Nil

PEM bytes for pkey, or nil. format is "pkcs8" or "pkcs1" (raw is the caller's job - it needs the DER, not a PEM wrapper).

Source

Nested types