step ca init using Ed25519

[MacWeber]

How to run step ca init using Ed25519 for all kind of certificates?

[maraino]

At the moment, you can't, but you can replace the root and intermediate certificate with one generated using step certificate create:

$ step certificate create --kty OKP --profile root-ca "My Ed25519 Root CA" root.crt root.key
Please enter the password to encrypt the private key:
Your certificate has been saved in root.crt.
Your private key has been saved in root.key.
$ step certificate create --kty OKP --profile intermediate-ca --ca root.crt --ca-key root.key "My Ed25519 Intermediate CA" intermediate_ca.crt intermediate_ca.key
Please enter the password to decrypt root.key:
Please enter the password to encrypt the private key:
Your certificate has been saved in intermediate_ca.crt.
Your private key has been saved in intermediate_ca.key.

[maraino]

Then to get a certificate with a Ed25519 key you can do one of these options:

1. Add the --kty OKP flag like this:

step ca certificate --kty OKP localhost localhost.crt localhost.key

2. Add it to your defaults file $(step path)/defaults.json:

{
  "...": "...",
  "kty": "OKP"
}

3. Add the environment variable STEP_KTY=OKP

[MacWeber]

@maraino shall I open a feature request to get this option implemented?

Some side questions:

• As far as I understand the defaults.json is used by the CLI only, correct?
• Following your instructions, I could get the keys to be generated using Ed25519. However, creating a JWK provisioner it comes with curve P-256 declared in $STEPPATH/config/ca.json. How to force curve 25519 there and maybe in all provisioners that get added later?

[maraino]

Sure, you can add an issue for it. And yes, you can remove that and add a provisioner with Ed25519.

You can create the key like this:

$ step crypto jwk create --kty OKP --crv Ed25519 ed25519.pub ed25519.priv

But you might also need to convert ed25519.priv to the compact form if you want that to be available in the configuration:

$ cat ed25519.priv | step crypto jose format

[MacWeber]

@maraino thank you for your help!
Here is the issue I created: #1304