key-gen

#!/usr/bin/env ruby
# frozen_string_literal: true

# Copyright (c) 2011 The University of Manchester, UK.
#
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
#  * Redistributions of source code must retain the above copyright notice,
#    this list of conditions and the following disclaimer.
#
#  * Redistributions in binary form must reproduce the above copyright notice,
#    this list of conditions and the following disclaimer in the documentation
#    and/or other materials provided with the distribution.
#
#  * Neither the names of The University of Manchester nor the names of its
#    contributors may be used to endorse or promote products derived from this
#    software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#
# Author: Robert Haines

require 'rubygems'
require 'openssl'
require 'optparse'
require 'io/console'

MIN_KEY_SIZE = 1024
KEY_TYPES = %i[dsa rsa].freeze
DEFAULT_TYPE = KEY_TYPES[1]

options = {
  type: DEFAULT_TYPE,
  size: MIN_KEY_SIZE,
  cipher: 'aes-128-cbc'
}

opts = OptionParser.new do |opt|
  opt.banner = 'Usage: key-gen [options]'
  opt.separator '  Generate a public key pair where [options] can be:'
  opt.on('-o FILENAME', '--out=FILENAME', 'The filename root in which to ' \
    'store the generated keys. If this is not specified they will be written ' \
    "to 'id_<key-type>'.") do |val|
    options[:out] = val.chomp
  end
  opt.on('-t TYPE', '--type=TYPE', "The type of the key. Can be 'rsa' or " \
    "'dsa'. Default '#{DEFAULT_TYPE}'.") do |val|
    type = val.chomp.downcase.to_sym
    options[:type] = type if KEY_TYPES.include? type
  end
  opt.on('-s SIZE', '--size=SIZE', 'The desired key size. Anything under ' \
    "#{MIN_KEY_SIZE} will be ignored. Default #{MIN_KEY_SIZE}.") do |val|
    size = val.chomp.to_i
    options[:size] = size > MIN_KEY_SIZE ? size : MIN_KEY_SIZE
  end
  opt.on('-c CIPHER', '--cipher=CIPHER', 'Set the cipher to be used for ' \
    "encrypting the key. Use 'none' for no encryption. Default " \
    "'#{options[:cipher]}'.") do |val|
    options[:cipher] = val.chomp
  end
  opt.on('-l', '--list-ciphers', 'List available ciphers for output.') do
    list = OpenSSL::Cipher.ciphers
    puts list[(list.length / 2)..-1]
    exit
  end
  opt.on_tail('-h', '-?', '--help', 'Show this help message.') do
    puts opts
    exit
  end
  opt.on_tail('-v', '--version', 'Show the version.') do
    puts '2.0'
    exit
  end
end

opts.parse!

# set default file name root
options[:out] = "id_#{options[:type]}" unless options[:out]

case options[:type]
when :dsa
  key = OpenSSL::PKey::DSA.generate(options[:size])
when :rsa
  key = OpenSSL::PKey::RSA.generate(options[:size], 17)
end
pkey = key.public_key

password = nil
if options[:cipher] == 'none'
  cipher = nil
else
  cipher = OpenSSL::Cipher.new(options[:cipher])
  p1 = $stdin.getpass('Enter passphrase:')
  p2 = $stdin.getpass('Verify passphrase:')

  if p1 == p2
    if p1 == ''
      password = nil
      cipher = nil
    else
      password = p1
    end
  else
    warn 'Password mismatch'
    exit(1)
  end
end

File.open(options[:out], 'w') { |f| f.syswrite(key.to_pem(cipher, password)) }
File.open("#{options[:out]}.pub", 'w') { |f| f.syswrite(pkey.to_pem) }