vault: add support for RSA keysvault/v0.2.6

1 files changed, 34 insertions, 0 deletions

diff --git a/vault/client.go b/vault/client.go
index afc1868..bef65d4 100644
--- a/vault/client.go
+++ b/vault/client.go
@@ -2,6 +2,9 @@ package vault
 
 import (
         "context"
+        "crypto/rsa"
+        "crypto/x509"
+        "encoding/base64"
         "encoding/json"
         "fmt"
         "os"
@@ -48,6 +51,37 @@ func (s *VaultSecret) VaultSecret() *VaultSecret {
         return s
 }
 
+// VaultRSAKey holds a base64 encoded RSA private key in PKCS8 format
+// (effectively PEM encoding without the headers and line-breaks). It
+// can decode this into a private key.
+type VaultRSAKey struct {
+        Key string `json:"key"`
+        s   *VaultSecret
+}
+
+func (k *VaultRSAKey) RSAPrivateKey() (*rsa.PrivateKey, error) {
+        der, err := base64.StdEncoding.DecodeString(k.Key)
+        if err != nil {
+                return nil, err
+        }
+
+        pr, err := x509.ParsePKCS8PrivateKey(der)
+        if err != nil {
+                return nil, err
+        }
+
+        pk, ok := pr.(*rsa.PrivateKey)
+        if !ok {
+                return nil, fmt.Errorf("RSAPrivateKey: parsed key is not an rsa.PrivateKey")
+        }
+
+        return pk, nil
+}
+
+func (k *VaultRSAKey) VaultSecret() *VaultSecret {
+        return k.s
+}
+
 type VaultApiKey struct {
         Key string `json:"key"`
         s   *VaultSecret