yubihsm

package
v0.0.0-...-9cd8256 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 13, 2024 License: MIT Imports: 11 Imported by: 0

Documentation

Overview

Package yubihsm implements core datatypes and serialization/deserialization the YubiHSM2 command protocol.

Index

Constants

View Source 
const (
	_,// CommandResponse is the high-order bit which is OR'ed to the
	// command ID in all response messages.
	CommandResponse = CommandID(iota), CommandID(0x80 | iota)

	CommandEcho, ResponseEcho

	CommandCreateSession, ResponseCreateSession
	CommandAuthenticateSession, ResponseAuthenticateSession
	CommandSessionMessage, ResponseSessionMessage
	CommandGetDeviceInfo, ResponseGetDeviceInfo

	CommandResetDevice, ResponseResetDevice

	CommandGetDevicePublicKey, ResponseGetDevicePublicKey

	CommandCloseSession = iota + 0x40 - CommandGetDevicePublicKey - 1
	CommandGetStorageInfo
	CommandPutOpaque
	CommandGetOpaque
	CommandPutAuthenticationKey
	CommandPutAsymmetricKey
	CommandGenerateAsymmetricKey
	CommandSignPKCS1v15
	CommandListObjects
	CommandDecryptPKCS1v15
	CommandExportWrapped
	CommandImportWrapped
	CommandPutWrapKey
	CommandGetLogEntries
	CommandGetObjectInfo
	CommandSetOption
	CommandGetOption
	CommandGetPseudoRandom
	CommandPutHMACKey
	CommandSignHMAC
	CommandGetPublicKey
	CommandSignPSS
	CommandSignECDSA
	CommandDeriveECDH
	CommandDeleteObject
	CommandDecryptOAEP
	CommandGenerateHMACKey
	CommandGenerateWrapKey
	CommandVerifyHMAC
	CommandSignSSHCertificate
	CommandPutTemplate
	CommandGetTemplate
	CommandDecryptOTP
	CommandCreateOtpAEAD
	CommandRandomizeOTPAEAD
	CommandRewrapOTPAEAD
	CommandSignAttestationCertificate
	CommandPutOtpAEADKey
	CommandGenerateOTPAEADKey
	CommandSetLogIndex
	CommandWrapData
	CommandUnwrapData
	CommandSignEdDSA
	CommandBlinkDevice
	CommandChangeAuthenticationKey
	CommandPutSymmetricKey
	CommandGenerateSymmetrickey
	CommandDecryptAESECB
	CommandEncryptAESECB
	CommandDecryptAESCBC
	CommandEncryptAEDCBC
)
View Source 
const ErrRsaDecryptFailed = errMalformedCommand

ErrRsaDecryptFailed is the error from a failed RSA decryption command.

View Source 
const (
	// HeaderLength is the length of a command header; one byte of
	// command ID and a two byte length.
	HeaderLength = 1 + 2
)

Variables

This section is empty.

Functions

func Append 

func Append[V ~[]byte](b []byte, v V) []byte

func Append16 

func Append16[V ~uint16 | ~int16 | ~int](b []byte, v V) []byte

func Append8 

func Append8[V ~uint8 | ~int8 | ~int](b []byte, v V) []byte

func Parse16 

func Parse16[V ~uint16 | ~int16](b []byte, o int, v *V)

func Parse32 

func Parse32[V ~uint32 | ~int32](b []byte, o int, v *V)

func Parse8 

func Parse8[V ~uint8 | ~int8](b []byte, o int, v *V)

func ParseResponse 

func ParseResponse(cmdID CommandID, rsp Response, buf []byte) error

func Put16 

func Put16[V ~uint16 | ~int16 | ~int](b []byte, v V)

func Put32 

func Put32[V ~uint32 | ~int32 | ~int](b []byte, v V)

func Put8 

func Put8[V ~uint8 | ~int8 | ~int](b []byte, v V)

Types

type AlgorithmID 

type AlgorithmID uint8

AlgorithmID is a cryptographic algorithm identified on a YubiHSM2. 

const (
	AlgorithmRSAPKCS1SHA1 AlgorithmID
	AlgorithmRSAPKCS1SHA256
	AlgorithmRSAPKCS1SHA384
	AlgorithmRSAPKCS1SHA512
	AlgorithmRSAPSSSHA1
	AlgorithmRSAPSSSHA256
	AlgorithmRSAPSSSHA384
	AlgorithmRSAPSSSHA512
	AlgorithmRSA2048
	AlgorithmRSA3072
	AlgorithmRSA4096
	AlgorithmECP256
	AlgorithmECP384
	AlgorithmECP521
	AlgorithmECK256
	AlgorithmECBP256
	AlgorithmECBP384
	AlgorithmECBP512
	AlgorithmHMACSHA1
	AlgorithmHMACSHA256
	AlgorithmHMACSHA384
	AlgorithmHMACSHA512
	AlgorithmECDSASHA1
	AlgorithmECECDH
	AlgorithmRSAOAEPSHA1
	AlgorithmRSAOAEPSHA256
	AlgorithmRSAOAEPSHA384
	AlgorithmRSAOAEPSHA512
	AlgorithmAES128CCMWRAP
	AlgorithmOpaqueData
	AlgorithmOpaqueX509Certificate
	AlgorithmMGF1SHA1
	AlgorithmMGF1SHA256
	AlgorithmMGF1SHA384
	AlgorithmMGF1SHA512
	AlgorithmSSHTemplate
	AlgorithmYubicoOTPAES128
	AlgorithmYubicoAESAuthentication
	AlgorithmYubicoOTPAES192
	AlgorithmYubicoOTPAES256
	AlgorithmAES192CCMWRAP
	AlgorithmAES256CCMWRAP
	AlgorithmECDSASHA256
	AlgorithmECDSASHA384
	AlgorithmECDSASHA512
	AlgorithmED25519
	AlgorithmECP224
	AlgorithmRSAPKCSv15Decrypt
	AlgorithmYubicoECP256Authentication
	AlgorithmAES128
	AlgorithmAES192
	AlgorithmAES256
	AlgorithmAESECB
	AlgorithmAESCBC
)

func (AlgorithmID) String 

func (i AlgorithmID) String() string

type AuthenticateSessionCommand 

type AuthenticateSessionCommand struct {
	SessionID      byte
	HostCryptogram Cryptogram
	CMAC           [8]byte
}

func (*AuthenticateSessionCommand) ID 

func (c *AuthenticateSessionCommand) ID() CommandID

func (*AuthenticateSessionCommand) Serialize 

func (c *AuthenticateSessionCommand) Serialize(out []byte) []byte

type AuthenticateSessionResponse 

type AuthenticateSessionResponse = emptyResponse

type Challenge 

type Challenge [8]byte

Challenge is a fixed-width challenge exchanged during authentication and used to derive session keys.

type CloseSessionCommand 

type CloseSessionCommand struct{}

func (CloseSessionCommand) ID 

func (c CloseSessionCommand) ID() CommandID

func (CloseSessionCommand) Serialize 

func (c CloseSessionCommand) Serialize(out []byte) []byte

type CloseSessionResponse 

type CloseSessionResponse = emptyResponse

type Command 

type Command interface {
	ID() CommandID
	Serialize(out []byte) []byte
}

Command is a serializable message sent to the YubiHSM2.

type CommandID 

type CommandID uint8

CommandID is the identified value for a (request, response) message pair.

func ParseHeader 

func ParseHeader(b []byte) (CommandID, int)

func (CommandID) String 

func (i CommandID) String() string

type CreateSessionCommand 

type CreateSessionCommand struct {
	KeySetID      ObjectID
	HostChallenge Challenge
}

func (*CreateSessionCommand) ID 

func (*CreateSessionCommand) ID() CommandID

func (*CreateSessionCommand) Serialize 

func (c *CreateSessionCommand) Serialize(out []byte) []byte

type CreateSessionResponse 

type CreateSessionResponse struct {
	SessionID      byte
	CardChallenge  Challenge
	CardCryptogram Cryptogram
}

func (*CreateSessionResponse) Parse 

func (r *CreateSessionResponse) Parse(b []byte) error

type Cryptogram 

type Cryptogram [8]byte

Cryptogram is a fixed-width challenge exchanged during authentication and used to derive session keys.

type DecryptOAEPCommand 

type DecryptOAEPCommand struct {
	KeyID      ObjectID
	MGF1       crypto.Hash
	LabelHash  crypto.Hash
	CipherText []byte
	Label      []byte
}

func (*DecryptOAEPCommand) ID 

func (d *DecryptOAEPCommand) ID() CommandID

func (*DecryptOAEPCommand) Serialize 

func (d *DecryptOAEPCommand) Serialize(out []byte) []byte

type DecryptPKCS1v15Command 

type DecryptPKCS1v15Command struct {
	KeyID      ObjectID
	CipherText []byte
}

func (*DecryptPKCS1v15Command) ID 

func (d *DecryptPKCS1v15Command) ID() CommandID

func (*DecryptPKCS1v15Command) Serialize 

func (d *DecryptPKCS1v15Command) Serialize(out []byte) []byte

type DecryptResponse 

type DecryptResponse = sliceResponse

type DeviceInfoCommand 

type DeviceInfoCommand struct{}

func (DeviceInfoCommand) ID 

func (DeviceInfoCommand) ID() CommandID

func (DeviceInfoCommand) Serialize 

func (d DeviceInfoCommand) Serialize(out []byte) []byte

type DeviceInfoResponse 

type DeviceInfoResponse struct {
	Version    string
	Serial     uint32
	LogStore   uint8
	LogLines   uint8
	Algorithms uint64
}

func (*DeviceInfoResponse) Parse 

func (r *DeviceInfoResponse) Parse(b []byte) error

type Echo 

type Echo []byte

Echo command and response type to/from YubiHSM2.

func (Echo) ID 

func (Echo) ID() CommandID

func (*Echo) Parse 

func (e *Echo) Parse(b []byte) error

func (Echo) Serialize 

func (e Echo) Serialize(out []byte) []byte

type Error 

type Error uint8

Error is an error code from the YubiHSM.

func (Error) Error 

func (e Error) Error() string

Error implements [error.Error].

func (Error) String 

func (i Error) String() string

type GetPublicKeyCommand 

type GetPublicKeyCommand struct {
	KeyID ObjectID
}

func (*GetPublicKeyCommand) ID 

func (*GetPublicKeyCommand) ID() CommandID

func (*GetPublicKeyCommand) Serialize 

func (g *GetPublicKeyCommand) Serialize(out []byte) []byte

type GetPublicKeyResponse 

type GetPublicKeyResponse struct {
	PublicKey interface{ Equal(x crypto.PublicKey) bool }
}

func (*GetPublicKeyResponse) Parse 

func (g *GetPublicKeyResponse) Parse(b []byte) error

type InvalidLengthError 

type InvalidLengthError struct{}

InvalidLengthError is the error returned when a received YubiHSM2 message has an invalid length.

func (InvalidLengthError) Error 

func (InvalidLengthError) Error() string

type ListObjectsCommand 

type ListObjectsCommand []ListObjectsFilter

func (ListObjectsCommand) ID 

func (l ListObjectsCommand) ID() CommandID

func (ListObjectsCommand) Serialize 

func (l ListObjectsCommand) Serialize(out []byte) []byte

type ListObjectsFilter 

type ListObjectsFilter func([]byte) []byte

func LabelFilter 

func LabelFilter(label string) ListObjectsFilter

func TypeFilter 

func TypeFilter(typeID TypeID) ListObjectsFilter

type ListObjectsResponse 

type ListObjectsResponse []listObjectsResponse

func (*ListObjectsResponse) Parse 

func (l *ListObjectsResponse) Parse(b []byte) error

type ObjectID 

type ObjectID uint16

ObjectID identifies a key or other object stored on a YubiHSM2.

type PublicKey 

type PublicKey interface {
	Equal(x crypto.PublicKey) bool
}

PublicKey is the strongly-typed crypto.PublicKey.

type Response 

type Response interface {
	Parse(msg []byte) error
}

Response is a deserializable message received from the YubiHSM2.

type SignECDSACommand 

type SignECDSACommand struct {
	KeyID  ObjectID
	Digest []byte
}

func (*SignECDSACommand) ID 

func (s *SignECDSACommand) ID() CommandID

func (*SignECDSACommand) Serialize 

func (s *SignECDSACommand) Serialize(out []byte) []byte

type SignEdDSACommand 

type SignEdDSACommand struct {
	KeyID   ObjectID
	Message []byte
}

func (*SignEdDSACommand) ID 

func (s *SignEdDSACommand) ID() CommandID

func (*SignEdDSACommand) Serialize 

func (s *SignEdDSACommand) Serialize(out []byte) []byte

type SignPKCS1v15Command 

type SignPKCS1v15Command struct {
	KeyID  ObjectID
	Digest []byte
}

func (*SignPKCS1v15Command) ID 

func (s *SignPKCS1v15Command) ID() CommandID

func (*SignPKCS1v15Command) Serialize 

func (s *SignPKCS1v15Command) Serialize(out []byte) []byte

type SignPSSCommand 

type SignPSSCommand struct {
	KeyID   ObjectID
	MGF1    crypto.Hash
	SaltLen uint16
	Digest  []byte
}

func (*SignPSSCommand) ID 

func (s *SignPSSCommand) ID() CommandID

func (*SignPSSCommand) Serialize 

func (s *SignPSSCommand) Serialize(out []byte) []byte

type SignResponse 

type SignResponse = sliceResponse

type TypeID 

type TypeID uint8

TypeID is the cryptographic type of an object on the YubiHSM. 

const (
	TypeOpaque TypeID
	TypeAuthenticationKey
	TypeAsymmetricKey
	TypeWrapKey
	TypeHmacKey
	TypeTemplate
	TypeOtpAeadKey
	TypeSymmetricKey
)

func (TypeID) String 

func (i TypeID) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.