add support for ed25519 private keys for VPN connection setup

5 files changed, 140 insertions, 96 deletions

diff --git a/app/src/main/java/se/leap/bitmaskclient/base/models/Provider.java b/app/src/main/java/se/leap/bitmaskclient/base/models/Provider.java
index 64e57cda..725c602a 100644
--- a/app/src/main/java/se/leap/bitmaskclient/base/models/Provider.java
+++ b/app/src/main/java/se/leap/bitmaskclient/base/models/Provider.java
@@ -28,7 +28,7 @@ import static se.leap.bitmaskclient.base.models.Constants.PROVIDER_ALLOWED_REGIS
 import static se.leap.bitmaskclient.base.models.Constants.PROVIDER_ALLOW_ANONYMOUS;
 import static se.leap.bitmaskclient.base.models.Constants.TRANSPORT;
 import static se.leap.bitmaskclient.base.models.Constants.TYPE;
-import static se.leap.bitmaskclient.base.utils.RSAHelper.parseRsaKeyFromString;
+import static se.leap.bitmaskclient.base.utils.PrivateKeyHelper.parsePrivateKeyFromString;
 import static se.leap.bitmaskclient.providersetup.ProviderAPI.ERRORS;
 
 import android.os.Parcel;
@@ -44,7 +44,7 @@ import org.json.JSONObject;
 
 import java.net.MalformedURLException;
 import java.net.URL;
-import java.security.interfaces.RSAPrivateKey;
+import java.security.PrivateKey;
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.Locale;
@@ -79,9 +79,8 @@ public final class Provider implements Parcelable {
     private String certificatePinEncoding = "";
     private String caCert = "";
     private String apiVersion = "";
-    private String privateKey = "";
-
-    private transient RSAPrivateKey rsaPrivateKey = null;
+    private String privateKeyString = "";
+    private transient PrivateKey privateKey = null;
     private String vpnCertificate = "";
     private long lastEipServiceUpdate = 0L;
     private long lastGeoIpUpdate = 0L;
@@ -416,7 +415,7 @@ public final class Provider implements Parcelable {
         parcel.writeString(getEipServiceJsonString());
         parcel.writeString(getGeoIpJsonString());
         parcel.writeString(getMotdJsonString());
-        parcel.writeString(getPrivateKey());
+        parcel.writeString(getPrivateKeyString());
         parcel.writeString(getVpnCertificate());
         parcel.writeLong(lastEipServiceUpdate);
         parcel.writeLong(lastGeoIpUpdate);
@@ -471,7 +470,7 @@ public final class Provider implements Parcelable {
             }
             tmpString = in.readString();
             if (!tmpString.isEmpty()) {
-                this.setPrivateKey(tmpString);
+                this.setPrivateKeyString(tmpString);
             }
             tmpString = in.readString();
             if (!tmpString.isEmpty()) {
@@ -510,7 +509,7 @@ public final class Provider implements Parcelable {
             certificatePinEncoding.equals(p.getCertificatePinEncoding()) &&
             caCert.equals(p.getCaCert()) &&
             apiVersion.equals(p.getApiVersion()) &&
-            privateKey.equals(p.getPrivateKey()) &&
+            privateKeyString.equals(p.getPrivateKeyString()) &&
             vpnCertificate.equals(p.getVpnCertificate()) &&
             allowAnonymous == p.allowsAnonymous() &&
             allowRegistered == p.allowsRegistered();
@@ -697,23 +696,23 @@ public final class Provider implements Parcelable {
                 caCert.isEmpty();
     }
 
-    public String getPrivateKey() {
-        return privateKey;
+    public String getPrivateKeyString() {
+        return privateKeyString;
     }
 
-    public RSAPrivateKey getRSAPrivateKey() {
-        if (rsaPrivateKey == null) {
-            rsaPrivateKey = parseRsaKeyFromString(privateKey);
+    public PrivateKey getPrivateKey() {
+        if (privateKey == null) {
+            privateKey = parsePrivateKeyFromString(privateKeyString);
         }
-        return rsaPrivateKey;
+        return privateKey;
     }
 
-    public void setPrivateKey(String privateKey) {
-        this.privateKey = privateKey;
+    public void setPrivateKeyString(String privateKeyString) {
+        this.privateKeyString = privateKeyString;
     }
 
     public boolean hasPrivateKey() {
-        return privateKey != null && privateKey.length() > 0;
+        return privateKeyString != null && privateKeyString.length() > 0;
     }
 
     public String getVpnCertificate() {
@@ -754,7 +753,7 @@ public final class Provider implements Parcelable {
         certificatePinEncoding = "";
         caCert = "";
         apiVersion = "";
-        privateKey = "";
+        privateKeyString = "";
         vpnCertificate = "";
         allowRegistered = false;
         allowAnonymous = false;
diff --git a/app/src/main/java/se/leap/bitmaskclient/base/utils/PreferenceHelper.java b/app/src/main/java/se/leap/bitmaskclient/base/utils/PreferenceHelper.java
index 8d1f21e5..c2c0d85e 100644
--- a/app/src/main/java/se/leap/bitmaskclient/base/utils/PreferenceHelper.java
+++ b/app/src/main/java/se/leap/bitmaskclient/base/utils/PreferenceHelper.java
@@ -143,7 +143,7 @@ public class PreferenceHelper {
                 provider.define(new JSONObject(preferences.getString(Provider.KEY, "")));
                 provider.setCaCert(preferences.getString(Provider.CA_CERT, ""));
                 provider.setVpnCertificate(preferences.getString(PROVIDER_VPN_CERTIFICATE, ""));
-                provider.setPrivateKey(preferences.getString(PROVIDER_PRIVATE_KEY, ""));
+                provider.setPrivateKeyString(preferences.getString(PROVIDER_PRIVATE_KEY, ""));
                 provider.setEipServiceJson(new JSONObject(preferences.getString(PROVIDER_EIP_DEFINITION, "")));
                 provider.setMotdJson(new JSONObject(preferences.getString(PROVIDER_MOTD, "")));
                 provider.setLastMotdSeen(preferences.getLong(PROVIDER_MOTD_LAST_SEEN, 0L));
@@ -242,7 +242,7 @@ public class PreferenceHelper {
                     putString(Provider.KEY, provider.getDefinitionString()).
                     putString(Provider.CA_CERT, provider.getCaCert()).
                     putString(PROVIDER_EIP_DEFINITION, provider.getEipServiceJsonString()).
-                    putString(PROVIDER_PRIVATE_KEY, provider.getPrivateKey()).
+                    putString(PROVIDER_PRIVATE_KEY, provider.getPrivateKeyString()).
                     putString(PROVIDER_VPN_CERTIFICATE, provider.getVpnCertificate()).
                     putString(PROVIDER_MOTD, provider.getMotdJsonString()).
                     putStringSet(PROVIDER_MOTD_HASHES, provider.getMotdLastSeenHashes()).
diff --git a/app/src/main/java/se/leap/bitmaskclient/base/utils/PrivateKeyHelper.java b/app/src/main/java/se/leap/bitmaskclient/base/utils/PrivateKeyHelper.java
new file mode 100644
index 00000000..7abe9416
--- /dev/null
+++ b/app/src/main/java/se/leap/bitmaskclient/base/utils/PrivateKeyHelper.java
@@ -0,0 +1,106 @@
+package se.leap.bitmaskclient.base.utils;
+
+import android.os.Build;
+
+import androidx.annotation.Nullable;
+import androidx.annotation.VisibleForTesting;
+
+import org.spongycastle.util.encoders.Base64;
+
+import java.security.KeyFactory;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.PrivateKey;
+import java.security.interfaces.EdECPrivateKey;
+import java.security.interfaces.RSAPrivateKey;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.PKCS8EncodedKeySpec;
+
+import de.blinkt.openvpn.core.NativeUtils;
+
+public class PrivateKeyHelper {
+
+    public static final String RSA = "RSA";
+    public static final String ED_25519 = "Ed25519";
+
+    public static final String RSA_KEY_BEGIN = "-----BEGIN RSA PRIVATE KEY-----\n";
+    public static final String RSA_KEY_END = "-----END RSA PRIVATE KEY-----";
+    public static final String ED_25519_KEY_BEGIN = "-----BEGIN PRIVATE KEY-----\n";
+    public static final String ED_25519_KEY_END = "-----END PRIVATE KEY-----";
+
+
+    public interface PrivateKeyHelperInterface {
+
+
+        @Nullable PrivateKey parsePrivateKeyFromString(String privateKeyString);
+    }
+
+    public static class DefaultPrivateKeyHelper implements PrivateKeyHelperInterface {
+
+        public PrivateKey parsePrivateKeyFromString(String privateKeyString) {
+            if (privateKeyString == null || privateKeyString.isBlank()) {
+                return null;
+            }
+            if (privateKeyString.contains(RSA_KEY_BEGIN)) {
+                return parseRsaKeyFromString(privateKeyString);
+            } else if (privateKeyString.contains(ED_25519_KEY_BEGIN)) {
+               return parseECPrivateKey(privateKeyString);
+            } else {
+                return null;
+            }
+        }
+
+        private RSAPrivateKey parseRsaKeyFromString(String rsaKeyString) {
+            RSAPrivateKey key;
+            try {
+                KeyFactory kf;
+                if (Build.VERSION.SDK_INT < Build.VERSION_CODES.P) {
+                    kf = KeyFactory.getInstance(RSA, "BC");
+                } else {
+                    kf = KeyFactory.getInstance(RSA);
+                }
+                rsaKeyString = rsaKeyString.replaceFirst(RSA_KEY_BEGIN, "").replaceFirst(RSA_KEY_END, "");
+
+                PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(Base64.decode(rsaKeyString));
+                key = (RSAPrivateKey) kf.generatePrivate(keySpec);
+            } catch (InvalidKeySpecException | NoSuchAlgorithmException | NullPointerException |
+                     NoSuchProviderException e) {
+                e.printStackTrace();
+                return null;
+            }
+
+            return key;
+        }
+
+        private EdECPrivateKey parseECPrivateKey(String ecKeyString) {
+            KeyFactory kf;
+            try {
+                if (Build.VERSION.SDK_INT < Build.VERSION_CODES.P) {
+                    kf = KeyFactory.getInstance(ED_25519, "BC");
+                } else {
+                    kf = KeyFactory.getInstance(ED_25519);
+                }
+                ecKeyString = ecKeyString.replaceFirst(ED_25519_KEY_BEGIN, "").replaceFirst(ED_25519_KEY_END, "");
+                PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(Base64.decode(ecKeyString));
+                return (EdECPrivateKey) kf.generatePrivate(keySpec);
+            } catch (NoSuchAlgorithmException | NoSuchProviderException | InvalidKeySpecException e) {
+                e.printStackTrace();
+                return null;
+            }
+        }
+    }
+
+    private static PrivateKeyHelperInterface instance = new DefaultPrivateKeyHelper();
+
+    @VisibleForTesting
+    public PrivateKeyHelper(PrivateKeyHelperInterface helperInterface) {
+        if (!NativeUtils.isUnitTest()) {
+            throw new IllegalStateException("PrivateKeyHelper injected with PrivateKeyHelperInterface outside of an unit test");
+        }
+        instance = helperInterface;
+    }
+
+    public static @Nullable PrivateKey parsePrivateKeyFromString(String rsaKeyString) {
+       return instance.parsePrivateKeyFromString(rsaKeyString);
+    }
+}
diff --git a/app/src/main/java/se/leap/bitmaskclient/base/utils/RSAHelper.java b/app/src/main/java/se/leap/bitmaskclient/base/utils/RSAHelper.java
deleted file mode 100644
index 2872139a..00000000
--- a/app/src/main/java/se/leap/bitmaskclient/base/utils/RSAHelper.java
+++ /dev/null
@@ -1,72 +0,0 @@
-package se.leap.bitmaskclient.base.utils;
-
-import android.os.Build;
-
-import androidx.annotation.VisibleForTesting;
-
-import org.spongycastle.util.encoders.Base64;
-
-import java.security.KeyFactory;
-import java.security.NoSuchAlgorithmException;
-import java.security.NoSuchProviderException;
-import java.security.interfaces.RSAPrivateKey;
-import java.security.spec.InvalidKeySpecException;
-import java.security.spec.PKCS8EncodedKeySpec;
-
-import de.blinkt.openvpn.core.NativeUtils;
-
-public class RSAHelper {
-
-    public interface RSAHelperInterface {
-        RSAPrivateKey parseRsaKeyFromString(String rsaKeyString);
-    }
-
-    public static class DefaultRSAHelper implements RSAHelperInterface {
-
-        @Override
-        public RSAPrivateKey parseRsaKeyFromString(String rsaKeyString) {
-            RSAPrivateKey key;
-            try {
-                KeyFactory kf;
-                if (Build.VERSION.SDK_INT < Build.VERSION_CODES.P) {
-                    kf = KeyFactory.getInstance("RSA", "BC");
-                } else {
-                    kf = KeyFactory.getInstance("RSA");
-                }
-                rsaKeyString = rsaKeyString.replaceFirst("-----BEGIN RSA PRIVATE KEY-----", "").replaceFirst("-----END RSA PRIVATE KEY-----", "");
-                PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(Base64.decode(rsaKeyString));
-                key = (RSAPrivateKey) kf.generatePrivate(keySpec);
-            } catch (InvalidKeySpecException e) {
-                // TODO Auto-generated catch block
-                e.printStackTrace();
-                return null;
-            } catch (NoSuchAlgorithmException e) {
-                // TODO Auto-generated catch block
-                e.printStackTrace();
-                return null;
-            } catch (NullPointerException e) {
-                e.printStackTrace();
-                return null;
-            } catch (NoSuchProviderException e) {
-                e.printStackTrace();
-                return null;
-            }
-
-            return key;
-        }
-    }
-
-    private static RSAHelperInterface instance = new DefaultRSAHelper();
-
-    @VisibleForTesting
-    public RSAHelper(RSAHelperInterface helperInterface) {
-        if (!NativeUtils.isUnitTest()) {
-            throw new IllegalStateException("RSAHelper injected with RSAHelperInterface outside of an unit test");
-        }
-        instance = helperInterface;
-    }
-
-    public static RSAPrivateKey parseRsaKeyFromString(String rsaKeyString) {
-       return instance.parseRsaKeyFromString(rsaKeyString);
-    }
-}
diff --git a/app/src/main/java/se/leap/bitmaskclient/providersetup/ProviderApiManagerBase.java b/app/src/main/java/se/leap/bitmaskclient/providersetup/ProviderApiManagerBase.java
index e511e276..ea50e741 100644
--- a/app/src/main/java/se/leap/bitmaskclient/providersetup/ProviderApiManagerBase.java
+++ b/app/src/main/java/se/leap/bitmaskclient/providersetup/ProviderApiManagerBase.java
@@ -35,7 +35,11 @@ import static se.leap.bitmaskclient.base.utils.PreferenceHelper.deleteProviderDe
 import static se.leap.bitmaskclient.base.utils.PreferenceHelper.getFromPersistedProvider;
 import static se.leap.bitmaskclient.base.utils.PreferenceHelper.getLongFromPersistedProvider;
 import static se.leap.bitmaskclient.base.utils.PreferenceHelper.getStringSetFromPersistedProvider;
-import static se.leap.bitmaskclient.base.utils.RSAHelper.parseRsaKeyFromString;
+import static se.leap.bitmaskclient.base.utils.PrivateKeyHelper.ED_25519_KEY_BEGIN;
+import static se.leap.bitmaskclient.base.utils.PrivateKeyHelper.ED_25519_KEY_END;
+import static se.leap.bitmaskclient.base.utils.PrivateKeyHelper.RSA_KEY_BEGIN;
+import static se.leap.bitmaskclient.base.utils.PrivateKeyHelper.RSA_KEY_END;
+import static se.leap.bitmaskclient.base.utils.PrivateKeyHelper.parsePrivateKeyFromString;
 
 import android.content.Intent;
 import android.content.res.Resources;
@@ -46,6 +50,7 @@ import org.json.JSONException;
 import org.json.JSONObject;
 
 import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
@@ -57,6 +62,7 @@ import java.util.concurrent.TimeoutException;
 import se.leap.bitmaskclient.base.models.Provider;
 import se.leap.bitmaskclient.base.utils.ConfigHelper;
 import se.leap.bitmaskclient.base.utils.PreferenceHelper;
+import se.leap.bitmaskclient.base.utils.PrivateKeyHelper;
 
 /**
  * Implements the logic of the http api calls. The methods of this class needs to be called from
@@ -141,7 +147,7 @@ public abstract class ProviderApiManagerBase {
         if (hasUpdatedProviderDetails(providerDomain)) {
             provider.setCaCert(getPersistedProviderCA(providerDomain));
             provider.define(getPersistedProviderDefinition(providerDomain));
-            provider.setPrivateKey(getPersistedPrivateKey(providerDomain));
+            provider.setPrivateKeyString(getPersistedPrivateKey(providerDomain));
             provider.setVpnCertificate(getPersistedVPNCertificate(providerDomain));
             provider.setProviderApiIp(getPersistedProviderApiIp(providerDomain));
             provider.setProviderIp(getPersistedProviderIp(providerDomain));
@@ -232,9 +238,14 @@ public abstract class ProviderApiManagerBase {
                 }
             }
 
-            RSAPrivateKey key = parseRsaKeyFromString(keyString);
+            PrivateKey key = parsePrivateKeyFromString(keyString);
             keyString = Base64.encodeToString(key.getEncoded(), Base64.DEFAULT);
-            provider.setPrivateKey( "-----BEGIN RSA PRIVATE KEY-----\n" + keyString + "-----END RSA PRIVATE KEY-----");
+
+            if (key instanceof RSAPrivateKey) {
+                provider.setPrivateKeyString(RSA_KEY_BEGIN + keyString + RSA_KEY_END);
+            } else {
+                provider.setPrivateKeyString(ED_25519_KEY_BEGIN + keyString + ED_25519_KEY_END);
+            }
 
             ArrayList<X509Certificate> certificates = ConfigHelper.parseX509CertificatesFromString(certificateString);
             certificates.get(0).checkValidity();