Use crypto.Signer whenever possible

[hoihochan]

For certificate-based authentication, it is possible that the private key resides in hardware such as Trusted Platform Module (TPM) and the only way in Golang to access it via the crypto.Signer interface.

Any code paths that deal with a private key should use the crypto.Signer interface which comes with a function called Public() and it can be used to determine the type of key used.

Fixes #524

[codecov]

Codecov Report

Attention: Patch coverage is 77.94118% with 15 lines in your changes missing coverage. Please review.

Project coverage is 78.56%. Comparing base (16d6306) to head (43a6805).
Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
cipher_suite.go	57.14%	2 Missing and 1 partial ⚠️
flight4handler.go	50.00%	2 Missing and 1 partial ⚠️
flight5handler.go	66.66%	2 Missing and 1 partial ⚠️
pkg/crypto/selfsign/selfsign.go	78.57%	2 Missing and 1 partial ⚠️
pkg/crypto/signaturehash/signaturehash.go	70.00%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #681      +/-   ##
==========================================
- Coverage   78.75%   78.56%   -0.19%     
==========================================
  Files         101      101              
  Lines        6810     6831      +21     
==========================================
+ Hits         5363     5367       +4     
- Misses       1077     1089      +12     
- Partials      370      375       +5     

Flag	Coverage Δ
go	78.59% <77.94%> (-0.19%)	⬇️
wasm	63.62% <54.41%> (-0.17%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Sean-Der]

LGTM @hoihochan!

Would it be possible to fix the API breaks? Maybe leave the old functions?

github.com/pion/dtls/v3/pkg/crypto/selfsign
  Incompatible changes:
  - SelfSign: changed from func(crypto.PrivateKey) (crypto/tls.Certificate, error) to func(crypto.Signer) (crypto/tls.Certificate, error)
  - WithDNS: changed from func(crypto.PrivateKey, string, ...string) (crypto/tls.Certificate, error) to func(crypto.Signer, string, ...string) (crypto/tls.Certificate, error)

github.com/pion/dtls/v3/pkg/crypto/signaturehash
  Incompatible changes:
  - SelectSignatureScheme: changed from func([]Algorithm, crypto.PrivateKey) (Algorithm, error) to func([]Algorithm, crypto.Signer) (Algorithm, error)'
+ GOAPIDIFF_RC=1
+ set -e
++ dd if=/dev/urandom bs=15 count=1 status=none
++ base64
+ EOF=91zKzIfpY5R4+8vuyenb
+ echo 'output<<91zKzIfpY5R4+8vuyenb'
+ echo '
github.com/pion/dtls/v3/pkg/crypto/selfsign
  Incompatible changes:
  - SelfSign: changed from func(crypto.PrivateKey) (crypto/tls.Certificate, error) to func(crypto.Signer) (crypto/tls.Certificate, error)
  - WithDNS: changed from func(crypto.PrivateKey, string, ...string) (crypto/tls.Certificate, error) to func(crypto.Signer, string, ...string) (crypto/tls.Certificate, error)

github.com/pion/dtls/v3/pkg/crypto/signaturehash
  Incompatible changes:
  - SelectSignatureScheme: changed from func([]Algorithm, crypto.PrivateKey) (Algorithm, error) to func([]Algorithm, crypto.Signer) (Algorithm, error)'

[hoihochan]

LGTM @hoihochan!

Would it be possible to fix the API breaks? Maybe leave the old functions?

github.com/pion/dtls/v3/pkg/crypto/selfsign
  Incompatible changes:
  - SelfSign: changed from func(crypto.PrivateKey) (crypto/tls.Certificate, error) to func(crypto.Signer) (crypto/tls.Certificate, error)
  - WithDNS: changed from func(crypto.PrivateKey, string, ...string) (crypto/tls.Certificate, error) to func(crypto.Signer, string, ...string) (crypto/tls.Certificate, error)

github.com/pion/dtls/v3/pkg/crypto/signaturehash
  Incompatible changes:
  - SelectSignatureScheme: changed from func([]Algorithm, crypto.PrivateKey) (Algorithm, error) to func([]Algorithm, crypto.Signer) (Algorithm, error)'
+ GOAPIDIFF_RC=1
+ set -e
++ dd if=/dev/urandom bs=15 count=1 status=none
++ base64
+ EOF=91zKzIfpY5R4+8vuyenb
+ echo 'output<<91zKzIfpY5R4+8vuyenb'
+ echo '
github.com/pion/dtls/v3/pkg/crypto/selfsign
  Incompatible changes:
  - SelfSign: changed from func(crypto.PrivateKey) (crypto/tls.Certificate, error) to func(crypto.Signer) (crypto/tls.Certificate, error)
  - WithDNS: changed from func(crypto.PrivateKey, string, ...string) (crypto/tls.Certificate, error) to func(crypto.Signer, string, ...string) (crypto/tls.Certificate, error)

github.com/pion/dtls/v3/pkg/crypto/signaturehash
  Incompatible changes:
  - SelectSignatureScheme: changed from func([]Algorithm, crypto.PrivateKey) (Algorithm, error) to func([]Algorithm, crypto.Signer) (Algorithm, error)'

I could, but they look like internal functions that is not shared in the public documentation so let me know.

[Sean-Der]

Someone could be using them. I believe pion/webrtc uses them to create certificates?

Can't really know for sure. We can't break API without a major bump. I think we can avoid that here though!

[hoihochan]

Hi, any other feedbacks? I have updated the PR.

[hoihochan]

@Sean-Der, I have re-based the PR and fixed a few linter issues on existing code - would appreciate if this can be merged.

[kevmo314]

Is it possible to still accept a crypto.PrivateKey? The documentation suggests that the stdlib crypto.PrivateKey implementations satisfy crypto.Signer but that's not necessarily true for custom implementations. I think this would be a breaking API change if someone provides a custom implementation that does not satisfy crypto.Signer?

[hoihochan]

Either way it should fail because everyone should be implementing crypto.Signer underneath - the crypto.PrivateKey was strictly there for backwards compatibility purposes.

[hoihochan]

A custom implementation written currently would never work in the first place, because ultimately pion/dtls would invoke Go's standard crypto APIs that assumes crypto.PrivateKey satisfies crypto.Signer.