Use ECC keys for authentication between Mender client server

General Discussions
1

Thanks for this! Very helpful guide.

I got all of this working just fine but would like to use ECC instead of RSA. I followed this guide and generated the ECC keys using the following:

openssl ecparam -genkey -name prime256v1 -out private-and-params.key
openssl ec -in private-and-params.key -out private.key
openssl ec -in private-and-params.key -pubout -out public.key

Then I use the same method to generate a signature

X_MEN_SIGNATURE=$(echo -n "${REQUEST_BODY}" | openssl dgst -sha256 -sign private.key | openssl base64 -A)

But when I go to send the authorization request I get an error about not being able to decode the public key. Any suggestions? Am I generating the keys correctly?

2

Hi @msaenger, glad you found the guide useful.

Regarding ECC, unfortunately this is a limitation in the backend and it only accepts RSA. It is something that we are looking at, but nothing committed yet.

3

Ah okay. Thanks for the quick response.

4

Hello.

I think the client side key-pair will be generated by keygen-client script. At this point this script only generates key pair using RSA algorithm for master branch or 3.2.x branch.

But now, the server side release note states there added ED25519 and ECDSA support.

add support for ED25519 and ECDSA public keys in auth requests ([MEN-3728])

https://docs.mender.io/3.2/release-information/release-notes-changelog/mender-server#deviceauth-2-4-0

So how we can use ED25519 / ECDSA keys for client connection? Is it possible now?

5

If it helps, I have been using ECDSA secp384r1 with my mender 2.4.1 server for a year and a half now, albeit I manage the keys/certs myself rather than using the scripts. So there is support in the server for it now.

6

Oh that information is very helpful.
Now I will try using ED25529 or ECDSA in keygen script and try confirming it is now working.