Documentation
¶
Index ¶
- Constants
- func PublicKeyBytesToHandle(pubKey []byte, kt kms.KeyType, opts ...kms.KeyOpts) (*keyset.Handle, error)
- type CryptoBox
- func (b *CryptoBox) Easy(payload, nonce, theirPub []byte, myKID string) ([]byte, error)
- func (b *CryptoBox) EasyOpen(cipherText, nonce, theirPub, myPub []byte) ([]byte, error)
- func (b *CryptoBox) Seal(payload, theirEncPub []byte, randSource io.Reader) ([]byte, error)
- func (b *CryptoBox) SealOpen(cipherText, myPub []byte) ([]byte, error)
- type LocalKMS
- func (l *LocalKMS) Create(kt kmsapi.KeyType, opts ...kmsapi.KeyOpts) (string, interface{}, error)
- func (l *LocalKMS) CreateAndExportPubKeyBytes(kt kmsapi.KeyType, opts ...kmsapi.KeyOpts) (string, []byte, error)
- func (l *LocalKMS) ExportPubKeyBytes(id string) ([]byte, kmsapi.KeyType, error)
- func (l *LocalKMS) Get(keyID string) (interface{}, error)
- func (l *LocalKMS) HealthCheck() error
- func (l *LocalKMS) ImportPrivateKey(privKey interface{}, kt kmsapi.KeyType, opts ...kmsapi.PrivateKeyOpts) (string, interface{}, error)
- func (l *LocalKMS) PubKeyBytesToHandle(pubKey []byte, kt kmsapi.KeyType, opts ...kmsapi.KeyOpts) (interface{}, error)
- func (l *LocalKMS) Rotate(kt kmsapi.KeyType, keyID string, opts ...kmsapi.KeyOpts) (string, interface{}, error)
- type PubKeyWriter
Constants ¶
const ( // Namespace is the store name used when creating a KMS store using kms.NewAriesProviderWrapper. // The reason this is here in addition to kms.AriesWrapperStoreName is because // the IndexedDB implementation refers to this. FOr the WASM unit tests, the aries-framework-go module import gets // replaced with the local version and so in order for both to work correctly, for now we have the constant defined // in both places. Namespace = kms.AriesWrapperStoreName )
Variables ¶
This section is empty.
Functions ¶
func PublicKeyBytesToHandle ¶
func PublicKeyBytesToHandle(pubKey []byte, kt kms.KeyType, opts ...kms.KeyOpts) (*keyset.Handle, error)
PublicKeyBytesToHandle will create and return a key handle for pubKey of type kt it returns an error if it failed creating the key handle Note: The key handle created is not stored in the KMS, it's only useful to execute the crypto primitive associated with it.
Types ¶
type CryptoBox ¶
type CryptoBox struct {
// contains filtered or unexported fields
}
CryptoBox provides an elliptic-curve-based authenticated encryption scheme
Payloads are encrypted using symmetric encryption (XChacha20Poly1305) using a shared key derived from a shared secret created by
Curve25519 Elliptic Curve Diffie-Hellman key exchange.
CryptoBox is created by a KMS, and reads secret keys from the KMS
for encryption/decryption, so clients do not need to see the secrets themselves.
func NewCryptoBox ¶
func NewCryptoBox(w kms.KeyManager) (*CryptoBox, error)
NewCryptoBox creates a CryptoBox which provides crypto box encryption using the given KMS's key.
func (*CryptoBox) Easy ¶
Easy seals a message with a provided nonce theirPub is used as a public key, while myPub is used to identify the private key that should be used.
func (*CryptoBox) EasyOpen ¶
EasyOpen unseals a message sealed with Easy, where the nonce is provided theirPub is the public key used to decrypt directly, while myPub is used to identify the private key to be used.
func (*CryptoBox) Seal ¶
Seal seals a payload using the equivalent of libsodium box_seal
Generates an ephemeral keypair to use for the sender, and includes the ephemeral sender public key in the message.
type LocalKMS ¶
type LocalKMS struct {
// contains filtered or unexported fields
}
LocalKMS implements kms.KeyManager to provide key management capabilities using a local db. It uses an underlying secret lock service (default local secretLock) to wrap (encrypt) keys prior to storing them.
func (*LocalKMS) Create ¶
Create a new key/keyset/key handle for the type kt Returns:
- keyID of the handle
- handle instance (to private key)
- error if failure
func (*LocalKMS) CreateAndExportPubKeyBytes ¶
func (l *LocalKMS) CreateAndExportPubKeyBytes(kt kmsapi.KeyType, opts ...kmsapi.KeyOpts) (string, []byte, error)
CreateAndExportPubKeyBytes will create a key of type kt and export its public key in raw bytes and returns it. The key must be an asymmetric key. Returns:
- keyID of the new handle created.
- marshalled public key []byte
- error if it fails to export the public key bytes
func (*LocalKMS) ExportPubKeyBytes ¶
ExportPubKeyBytes will fetch a key referenced by id then gets its public key in raw bytes and returns it. The key must be an asymmetric key. Returns:
- marshalled public key []byte
- error if it fails to export the public key bytes
func (*LocalKMS) Get ¶
Get key handle for the given keyID Returns:
- handle instance (to private key)
- error if failure
func (*LocalKMS) ImportPrivateKey ¶
func (l *LocalKMS) ImportPrivateKey(privKey interface{}, kt kmsapi.KeyType, opts ...kmsapi.PrivateKeyOpts) (string, interface{}, error)
ImportPrivateKey will import privKey into the KMS storage for the given keyType then returns the new key id and the newly persisted Handle. 'privKey' possible types are: *ecdsa.PrivateKey and ed25519.PrivateKey 'keyType' possible types are signing key types only (ECDSA keys or Ed25519) 'opts' allows setting the keysetID of the imported key using WithKeyID() option. If the ID is already used, then an error is returned. Returns:
- keyID of the handle
- handle instance (to private key)
- error if import failure (key empty, invalid, doesn't match keyType, unsupported keyType or storing key failed)
func (*LocalKMS) PubKeyBytesToHandle ¶
func (l *LocalKMS) PubKeyBytesToHandle(pubKey []byte, kt kmsapi.KeyType, opts ...kmsapi.KeyOpts) (interface{}, error)
PubKeyBytesToHandle will create and return a key handle for pubKey of type kt it returns an error if it failed creating the key handle Note: The key handle created is not stored in the KMS, it's only useful to execute the crypto primitive associated with it.
func (*LocalKMS) Rotate ¶
func (l *LocalKMS) Rotate(kt kmsapi.KeyType, keyID string, opts ...kmsapi.KeyOpts) (string, interface{}, error)
Rotate a key referenced by keyID and return a new handle of a keyset including old key and new key with type kt. It also returns the updated keyID as the first return value Returns:
- new KeyID
- handle instance (to private key)
- error if failure
type PubKeyWriter ¶
type PubKeyWriter struct {
// KeyType is Key Type of the written key. It's needed as Write() is an interface function and can't return it.
KeyType kms.KeyType
// contains filtered or unexported fields
}
PubKeyWriter will write the raw bytes of a Tink KeySet's primary public key The keyset must be one of the keyURLs defined above Note: Only signing public keys and ecdh key types created in tinkcrypto can be exported through this PubKeyWriter. ECHDES has its own Writer to export its public keys due to cyclic dependency.
func NewWriter ¶
func NewWriter(w io.Writer) *PubKeyWriter
NewWriter creates a new PubKeyWriter instance.
func (*PubKeyWriter) Write ¶
func (p *PubKeyWriter) Write(keyset *tinkpb.Keyset) error
Write writes the public keyset to the underlying w.Writer.
func (*PubKeyWriter) WriteEncrypted ¶
func (p *PubKeyWriter) WriteEncrypted(keyset *tinkpb.EncryptedKeyset) error
WriteEncrypted writes the encrypted keyset to the underlying w.Writer.
Source Files
Directories