Documentation
¶
Index ¶
- Constants
- Variables
- func Crc32c(data []byte) uint32
- func KeyLabelAndID(val string) (label string, id string)
- func KmsLoader(tc cryptoprov.TokenConfig) (cryptoprov.Provider, error)
- func NewSigner(keyID string, label string, publicKey crypto.PublicKey, prov *Provider) crypto.Signer
- type KmsClient
- type Provider
- func (p *Provider) Close() error
- func (p *Provider) CurrentSlotID() uint
- func (p *Provider) DestroyKeyPairOnSlot(slotID uint, keyID string) error
- func (p *Provider) EnumKeys(slotID uint, prefix string) ([]cryptoprov.KeyInfo, error)
- func (p *Provider) EnumTokens(currentSlotOnly bool) ([]cryptoprov.TokenInfo, error)
- func (p *Provider) ExportKey(keyID string) (string, []byte, error)
- func (p *Provider) FindKeyPairOnSlot(slotID uint, keyID, label string) (crypto.PrivateKey, error)
- func (p *Provider) GenerateECDSAKey(label string, curve elliptic.Curve) (crypto.PrivateKey, error)
- func (p *Provider) GenerateRSAKey(label string, bits int, purpose int) (crypto.PrivateKey, error)
- func (p *Provider) GetKey(keyID string) (crypto.PrivateKey, error)
- func (p *Provider) IdentifyKey(priv crypto.PrivateKey) (keyID, label string, err error)
- func (p *Provider) KeyInfo(slotID uint, keyID string, includePublic bool) (*cryptoprov.KeyInfo, error)
- func (p *Provider) Manufacturer() string
- func (p *Provider) Model() string
- type Signer
Constants ¶
const ProviderName = "GCPKMS"
ProviderName specifies a provider name
Variables ¶
var KmsClientFactory = func() (KmsClient, error) { ctx := context.Background() client, err := kms.NewKeyManagementClient(ctx) if err != nil { return nil, errors.WithMessagef(err, "failed to create kms client") } return client, nil }
KmsClientFactory override for unittest
Functions ¶
func KeyLabelAndID ¶
KeyLabelAndID adds a date suffix to ID of a key
func KmsLoader ¶
func KmsLoader(tc cryptoprov.TokenConfig) (cryptoprov.Provider, error)
KmsLoader provides loader for KMS provider
Types ¶
type KmsClient ¶
type KmsClient interface {
ListCryptoKeys(context.Context, *kmspb.ListCryptoKeysRequest, ...gax.CallOption) *kms.CryptoKeyIterator
GetCryptoKey(context.Context, *kmspb.GetCryptoKeyRequest, ...gax.CallOption) (*kmspb.CryptoKey, error)
GetPublicKey(context.Context, *kmspb.GetPublicKeyRequest, ...gax.CallOption) (*kmspb.PublicKey, error)
GetCryptoKeyVersion(context.Context, *kmspb.GetCryptoKeyVersionRequest, ...gax.CallOption) (*kmspb.CryptoKeyVersion, error)
DestroyCryptoKeyVersion(context.Context, *kmspb.DestroyCryptoKeyVersionRequest, ...gax.CallOption) (*kmspb.CryptoKeyVersion, error)
AsymmetricSign(context.Context, *kmspb.AsymmetricSignRequest, ...gax.CallOption) (*kmspb.AsymmetricSignResponse, error)
CreateCryptoKey(context.Context, *kmspb.CreateCryptoKeyRequest, ...gax.CallOption) (*kmspb.CryptoKey, error)
Close() error
}
KmsClient interface
type Provider ¶
type Provider struct {
KmsClient
// contains filtered or unexported fields
}
Provider implements Provider interface for KMS
func Init ¶
func Init(tc cryptoprov.TokenConfig) (*Provider, error)
Init configures Kms based hsm impl
func (*Provider) CurrentSlotID ¶
CurrentSlotID returns current slot id. For KMS only one slot is assumed to be available.
func (*Provider) DestroyKeyPairOnSlot ¶
DestroyKeyPairOnSlot destroys key pair on slot. For KMS slotID is ignored and KMS retire API is used to destroy the key.
func (*Provider) EnumTokens ¶
func (p *Provider) EnumTokens(currentSlotOnly bool) ([]cryptoprov.TokenInfo, error)
EnumTokens lists tokens. For KMS currentSlotOnly is ignored and only one slot is assumed to be available.
func (*Provider) ExportKey ¶
ExportKey returns PKCS#11 URI for specified key ID. It does not return key bytes
func (*Provider) FindKeyPairOnSlot ¶
FindKeyPairOnSlot retrieves a previously created asymmetric key, using a specified slot.
func (*Provider) GenerateECDSAKey ¶
GenerateECDSAKey creates signer using randomly generated ECDSA key
func (*Provider) GenerateRSAKey ¶
GenerateRSAKey creates signer using randomly generated RSA key
func (*Provider) GetKey ¶
func (p *Provider) GetKey(keyID string) (crypto.PrivateKey, error)
GetKey returns PrivateKey
func (*Provider) IdentifyKey ¶
func (p *Provider) IdentifyKey(priv crypto.PrivateKey) (keyID, label string, err error)
IdentifyKey returns key id and label for the given private key
func (*Provider) KeyInfo ¶
func (p *Provider) KeyInfo(slotID uint, keyID string, includePublic bool) (*cryptoprov.KeyInfo, error)
KeyInfo retrieves info about key with the specified id
func (*Provider) Manufacturer ¶
Manufacturer returns manufacturer for the provider
type Signer ¶
type Signer struct {
// contains filtered or unexported fields
}
Signer implements crypto.Signer interface
Source Files