ca

defmodule CA.ECDSA.OTP do
  @moduledoc "CA/ECDSA ECC Signature (Erlang/OTP)."
  require CA

  # openssl ec -in $client.key -pubout -out $client.pub
  # openssl dgst -sha256 -sign $client.key mix.exs > mix.sig
  # openssl dgst -sha256 -verify $client.pub -signature mix.sig mix.exs
  # > CA.CSR.ca
  # > CA.CSR.csr          "maxim"
  # > CA.CSR.client       "maxim"
  # > CA.ECDSA.sign       "mix.exs", "maxim.key"
  # > CA.ECDSA.OTP.sign   "mix.exs", "maxim.key"
  # > CA.ECDSA.verify     "mix.exs", "mix.sig", "maxim.pub"
  # > CA.ECDSA.OTP.verify "mix.exs", "mix.sig", "maxim.pub"

  def signBin(msg, priv) do
    {:ECPrivateKey, point, {:namedCurve, oid}} = priv
    :crypto.sign(:ecdsa, :sha256, msg, [point, :crypto.ec_curve(:pubkey_cert_records.namedCurves(oid))])
  end

  def verifyBin(msg, sig, pub) do
    {{:ECPoint, point}, {:namedCurve, oid}} = pub
    :crypto.verify(:ecdsa, :sha256, msg, sig, [point, :crypto.ec_curve(:pubkey_cert_records.namedCurves(oid))])
  end

  def sign(file, priv) do
    {:ok, msg} = :file.read_file(file)
    {:ok, key} = :file.read_file(priv)
    {:ok, {_, r, s}} = :"PKIXAlgs-2009".decode(:"ECDSA-Sig-Value", signBin(msg, private(key)))
    {r, s}
  end

  def verify(file, signature, pub) do
    {:ok, msg} = :file.read_file(file)
    {:ok, sig} = :file.read_file(signature)
    {:ok, pem} = :file.read_file(pub)
    verifyBin(msg, sig, public(pem))
  end

  def private(bin) do
    password = :application.get_env(:ca, :password, "0000")
    key =
      case X509.PrivateKey.from_pem(bin, password: password) do
        {:ok, k} -> k
        _ ->
          case X509.PrivateKey.from_pem(bin) do
            {:ok, k} -> k
          end
      end
    key
  end
  def public(bin), do: :public_key.pem_entry_decode(hd(:public_key.pem_decode(bin)))
end