keystores

type AsyncKeyPair interface {
	Id(ctx context.Context) <-chan KeyPairId
	Label(ctx context.Context) <-chan string
	SetLabel(ctx context.Context, label string) (errCh <-chan error)
	Algorithm(ctx context.Context) <-chan KeyAlgorithm
	KeyUsage(ctx context.Context) <-chan []KeyUsage
	KeyStore(ctx context.Context) <-chan AsyncKeyStore
	Public(ctx context.Context) <-chan crypto.PublicKey
	Sign(ctx context.Context, rand io.Reader, digest []byte, opts crypto.SignerOpts) (signatureCh <-chan []byte, errCh <-chan error)
	Decrypt(ctx context.Context, rand io.Reader, msg []byte, opts crypto.DecrypterOpts) (plaintextCh <-chan []byte, errCh <-chan error)
	ExportPrivate(ctx context.Context) (privKeyCh <-chan crypto.PrivateKey, errCh <-chan error)
	Destroy(ctx context.Context) <-chan error
	Verify(ctx context.Context, signature []byte, digest []byte, opts crypto.SignerOpts) <-chan error
	Attestation(ctx context.Context, nonce []byte) (att <-chan Attestation, errCh <-chan error)
}

type AsyncKeyStore interface {
	Id(ctx context.Context) <-chan string
	Name(ctx context.Context) <-chan string
	Open(ctx context.Context) <-chan error
	Close(ctx context.Context) <-chan error
	IsOpen(ctx context.Context) <-chan bool
	Reload(ctx context.Context) <-chan error
	SupportedPrivateKeyAlgorithms(ctx context.Context) <-chan KeyAlgorithm
	KeyPairs(ctx context.Context) (<-chan AsyncKeyPair, <-chan error)
	CreateKeyPair(ctx context.Context, opts GenKeyPairOpts) (<-chan AsyncKeyPair, <-chan error)
	ImportKeyPair(ctx context.Context, der []byte) (<-chan AsyncKeyPair, <-chan error)
}

type AsyncProvider interface {
	AsyncKeyStores(ctx context.Context) (chan KeyStore, chan error)
}

type Attestation []byte

type DynamicProvider interface {
	Provider
	OnConnected(handler func(store KeyStore) error)
	OnDisconnected(handler func(store KeyStore) error)
}

type GenKeyPairOpts struct {
	Algorithm  KeyAlgorithm
	Label      string
	KeyUsage   map[KeyUsage]bool
	Exportable bool
	Ephemeral  bool
}

type KeyAlgorithm struct {
	Oid          asn1.ObjectIdentifier
	RSAKeyLength int
	ECCCurve     elliptic.Curve
	Name         string
}

type KeyPair interface {
	Id() KeyPairId
	Label() string
	SetLabel(label string) error
	Algorithm() KeyAlgorithm
	KeyUsage() map[KeyUsage]bool
	KeyStore() KeyStore
	Public() crypto.PublicKey
	Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error)
	Decrypt(rand io.Reader, ciphertext []byte, opts crypto.DecrypterOpts) (plaintext []byte, err error)
	ExportPrivate() (privKey crypto.PrivateKey, err error)
	Destroy() error
	Verify(signature []byte, digest []byte, opts crypto.SignerOpts) (err error)
	ECDH(remote *ecdsa.PublicKey) ([]byte, error)
	Attestation(nonce []byte) (att Attestation, err error)
}

type KeyPairId string

type KeyStore interface {
	// Unique identifier within the provider. The returned Id must be URL safe.
	Id() string
	Name() string
	Open() error
	Close() error
	IsOpen() bool
	Reload() error
	SupportedPrivateKeyAlgorithms() []KeyAlgorithm
	KeyPairById(id KeyPairId) KeyPair
	KeyPairs(reload bool) (map[KeyPairId]KeyPair, error)
	CreateKeyPair(opts GenKeyPairOpts) (kp KeyPair, err error)
	ImportKeyPair(privKey crypto.PrivateKey, opts GenKeyPairOpts) (kp KeyPair, err error)
}

type KeyUsage string

type Openable interface {
	Open() error
	Close() error
	IsOpen() bool
}

type Provider interface {
	KeyStores() ([]KeyStore, error)
	Open() error
	Close() error
	IsOpen() bool
}