saltpack

func Armor62Open ¶

func Armor62Open(msg string) (body []byte, header string, footer string, err error)

Armor62Open runs armor stream decoding, but on a string, and it outputs a string. It does not do any validation on the header and footer. Deprecated: user Armor62OpenWithValidation instead.

func Armor62OpenWithValidation ¶

func Armor62OpenWithValidation(msg string, hc HeaderChecker, fc FrameChecker) (body []byte, brand string, header string, footer string, err error)

Armor62OpenWithValidation runs armor stream decoding, but on a string, and it outputs a string. It validates header and footer with the provided checkers (which are optional and can be nil).

func Armor62Seal ¶

func Armor62Seal(plaintext []byte, typ MessageType, brand string) (string, error)

Armor62Seal takes an input plaintext and returns and output armor encoding as a string, or an error if a problem was encountered. Also provide a header and a footer to frame the message. Uses Base62 encoding scheme

func CheckArmor62 ¶

func CheckArmor62(hdr string, ftr string, typ MessageType) (brand string, err error)

CheckArmor62 checks that the frame matches our standard begin/end frame

func CheckArmor62Frame ¶

func CheckArmor62Frame(frame Frame, typ MessageType) (brand string, err error)

CheckArmor62Frame checks that the frame matches our standard begin/end frame

func CheckKnownMajorVersion ¶

func CheckKnownMajorVersion(version Version) error

CheckKnownMajorVersion returns nil if the given version has a known major version. You probably want to use this with NewDecryptStream, unless you want to restrict to specific versions only.

func ClassifyEncryptedStreamAndMakeDecoder ¶

func ClassifyEncryptedStreamAndMakeDecoder(source io.Reader, decryptionKeyring SigncryptKeyring, keyResolver SymmetricKeyResolver) (
	plainsource io.Reader, msgType MessageType, mki *MessageKeyInfo, senderPublic SigningPublicKey, isArmored bool, brand string, ver Version, err error)

ClassifyEncryptedStreamAndMakeDecoder takes as input an io.Reader (containing an encrypted saltpack stream), a SigncryptKeyring containing the keys to use for decryption, and a SymmetricKeyResolver (used to map an identifiers to symmetric keys in an application specific way). It classifies the encrypted stream (encryption vs signcryption mode and binary vs armored format) and returns a reader for the decoded stream, as well as some informtation about the stream. The brand is only returned for armored ciphertexts, mki only for encryption-mode ciphertext, senderPublic only for signcryption-mode ciphertexts.

func ClassifyStream ¶

func ClassifyStream(stream *bufio.Reader) (isArmored bool, brand string, messageType MessageType, ver Version, err error)

ClassifyStream peeks at the beginning of a stream and checks wether it seems to contain a valid saltpack message (either armored or not). The buffer size must be at least minLengthToIdentifyBinarySaltpack bytes for binary messages, and large enough that if there is a header frame (i.e. "BEGIN FOO."), plus the first base62 encoded block (43 characters) of the steam (the default buffer size of bufio.Reader will be enough in most cases). Otherwise, ErrShortSliceOrBuffer will be returned. If err is nil, then the expected message type and version will be returned, as well as a booleand indicating if the message is ASCII-armored and the brand (for armored messages only). Note this classification is just a guess based on the beginning of the stream, and it does not guarantee that the message is valid or well formed.

func EncryptArmor62Seal ¶

func EncryptArmor62Seal(version Version, plaintext []byte, sender BoxSecretKey, receivers []BoxPublicKey, brand string) (string, error)

EncryptArmor62Seal is the non-streaming version of NewEncryptArmor62Stream, which inputs a plaintext (in bytes) and output a ciphertext (as a string).

package main

import (
	"fmt"

	"github.com/keybase/saltpack"
	"github.com/keybase/saltpack/basic"
)

func main() {

	var err error

	// Make a new Keyring, initialized to be empty
	keyring := basic.NewKeyring()

	// The test message
	msg := []byte("The Magic Words are Squeamish Ossifrage")

	// Make a secret key for the sender
	var sender saltpack.BoxSecretKey
	sender, err = keyring.GenerateBoxKey()
	if err != nil {
		return
	}

	// And one for the receiver
	var receiver saltpack.BoxSecretKey
	receiver, err = keyring.GenerateBoxKey()
	if err != nil {
		return
	}

	// AllReceivers can contain more receivers (like the sender)
	// but for now, just the one.
	var ciphertext string
	allReceivers := []saltpack.BoxPublicKey{receiver.GetPublicKey()}
	ciphertext, err = saltpack.EncryptArmor62Seal(saltpack.CurrentVersion(), msg, sender, allReceivers, "")
	if err != nil {
		return
	}

	// The decrypted message should match the input mesasge.
	var msg2 []byte
	_, msg2, _, err = saltpack.Dearmor62DecryptOpen(saltpack.CheckKnownMajorVersion, ciphertext, keyring)
	if err != nil {
		return
	}

	fmt.Println(string(msg2))

}

Output:

The Magic Words are Squeamish Ossifrage

func IsSaltpackArmored ¶

func IsSaltpackArmored(stream *bufio.Reader) (brand string, msgType MessageType, ver Version, err error)

IsSaltpackArmored peeks into the provided bufio.Reader to determine whether it encodes an ASCII-armored saltpack message. It does not consume any of the reader's bytes. The buffer size of the reader must be sufficient to contain the header frame plus the first Base62 encoded block of the payload. It returns a non nil error if the buffer size of the reader is not large enough to make this determination (ErrShortSliceOrBuffer), or if the stream does not appear to contain a valid saltpack message. If err is nil, then the brand, version and expected type of the message will be returned, but this does *NOT* guarantee that the rest of the message is well formed.

func IsSaltpackArmoredPrefix ¶

func IsSaltpackArmoredPrefix(pref string) (brand string, messageType MessageType, ver Version, err error)

IsSaltpackArmoredPrefix tries to determine whether the string is the prefix of a valid ASCII-armored saltpack message. The prefix must be large enough to contain the header frame plus the first Base62 encoded block of the payload. It returns a non nil error if the buffer size of the reader is not large enough to make this determination (ErrShortSliceOrBuffer), or if the stream does not appear to contain a valid saltpack message. If err is nil, then the brand, version and expected type of the message will be returned, but this does *NOT* guarantee that the rest of the message is well formed.

func IsSaltpackBinary ¶

func IsSaltpackBinary(stream *bufio.Reader) (msgType MessageType, version Version, err error)

IsSaltpackBinary peeks into the provided bufio.Reader to determine whether it encodes a binary saltpack message. It does not consume any of the reader's bytes (whose buffer length must be at least minLengthToIdentifyBinarySaltpack). It returns a non nil error if the buffer size of the reader is not large enough (ErrShortSliceOrBuffer), or if the stream does not appear to contain a binary saltpack message. If err is nil, msgType will return the type of the encoded message, but this does *NOT* guarantee that the rest of the message is well formed.

func IsSaltpackBinarySlice ¶

func IsSaltpackBinarySlice(b []byte) (msgType MessageType, version Version, err error)

IsSaltpackBinarySlice tries to determine if the input slice encodes the beginning of a binary saltpack message. It returns a non nil error if the slice is not long enough to make this determination, or if it does not appear to contain a binary saltpack message. If err is nil, msgType will return the type of the encoded message, but this does *NOT* guarantee that the rest of the message is well formed.

func MakeArmorFooter ¶

func MakeArmorFooter(typ MessageType, brand string) string

MakeArmorFooter makes the armor footer for the message type for the given "brand"

func MakeArmorHeader ¶

func MakeArmorHeader(typ MessageType, brand string) string

MakeArmorHeader makes the armor header for the message type for the given "brand"

func NewArmor62EncoderStream ¶

func NewArmor62EncoderStream(encoded io.Writer, typ MessageType, brand string) (io.WriteCloser, error)

NewArmor62EncoderStream makes a new Armor 62 encoding stream, using the base62-alphabet and a 32/43 encoding rate strategy. Pass it an `encoded` stream writer to write the encoded stream to. Also pass an optional "brand" . It will return an io.WriteCloser on success, that you can write raw (unencoded) data to. An error will be returned if there is trouble writing the header to encoded.

To make the output look pretty, a space is inserted every 15 characters of output, and a newline is inserted every 200 words.

func NewEncryptArmor62Stream ¶

func NewEncryptArmor62Stream(version Version, ciphertext io.Writer, sender BoxSecretKey, receivers []BoxPublicKey, brand string) (plaintext io.WriteCloser, err error)

NewEncryptArmor62Stream creates a stream that consumes plaintext data. It will write out encrypted data to the io.Writer passed in as ciphertext. The encryption is from the specified sender, and is encrypted for the given receivers.

The "brand" is the optional "brand" string to put into the header and footer.

The ciphertext is additionally armored with the recommended armor62-style format.

If initialization succeeds, returns an io.WriteCloser that accepts plaintext data to be encrypted and a nil error. Otherwise, returns nil and the initialization error.

package main

import (
	"bytes"
	"io"
	"os"

	"github.com/keybase/saltpack"
	"github.com/keybase/saltpack/basic"
)

func main() {

	var err error

	// Make a new Keyring, initialized to be empty
	keyring := basic.NewKeyring()

	// The test message
	plaintext := "The Magic Words are Squeamish Ossifrage"

	// Make a secret key for the sender
	var sender saltpack.BoxSecretKey
	sender, err = keyring.GenerateBoxKey()
	if err != nil {
		return
	}

	// And one for the receiver
	var receiver saltpack.BoxSecretKey
	receiver, err = keyring.GenerateBoxKey()
	if err != nil {
		return
	}

	// AllReceivers can contain more receivers (like the sender)
	// but for now, just the one.
	var output bytes.Buffer
	allReceivers := []saltpack.BoxPublicKey{receiver.GetPublicKey()}
	var input io.WriteCloser
	input, err = saltpack.NewEncryptArmor62Stream(saltpack.CurrentVersion(), &output, sender, allReceivers, "")
	if err != nil {
		return
	}
	// Write plaintext into the returned WriteCloser stream
	_, err = input.Write([]byte(plaintext))
	if err != nil {
		return
	}
	// And close when we're done
	input.Close()

	// The decrypted message
	var plaintextOutput io.Reader
	_, plaintextOutput, _, err = saltpack.NewDearmor62DecryptStream(saltpack.CheckKnownMajorVersion, &output, keyring)
	if err != nil {
		return
	}

	// Copy all of the data out of the output decrypted stream, and into standard
	// output, here for testing / comparison purposes.
	_, err = io.Copy(os.Stdout, plaintextOutput)
	if err != nil {
		return
	}
	os.Stdout.Write([]byte{'\n'})

}

Output:

The Magic Words are Squeamish Ossifrage

func NewEncryptStream ¶

func NewEncryptStream(version Version, ciphertext io.Writer, sender BoxSecretKey, receivers []BoxPublicKey) (io.WriteCloser, error)

NewEncryptStream creates a stream that consumes plaintext data. It will write out encrypted data to the io.Writer passed in as ciphertext. The encryption is from the specified sender, and is encrypted for the given receivers.

If initialization succeeds, returns an io.WriteCloser that accepts plaintext data to be encrypted and a nil error. Otherwise, returns nil and the initialization error.

func NewSignArmor62Stream ¶

func NewSignArmor62Stream(version Version, signedtext io.Writer, signer SigningSecretKey, brand string) (stream io.WriteCloser, err error)

NewSignArmor62Stream creates a stream that consumes plaintext data. It will write out signed data to the io.Writer passed in as signedtext. The `brand` is optional, and allows you to specify your "white label" brand to this signature. NewSignArmor62Stream only generates attached signatures.

The signed data is armored with the recommended armor62-style format.

package main

import (
	"bytes"
	"fmt"
	"io"
	"os"

	"github.com/keybase/saltpack"
	"github.com/keybase/saltpack/basic"
)

func main() {

	var err error

	// Make a new Keyring, initialized to be empty
	keyring := basic.NewKeyring()

	// The test message
	msg := []byte("The Magic Words are Squeamish Ossifrage")

	// Make a secret key for the sender
	var signer saltpack.SigningSecretKey
	signer, err = keyring.GenerateSigningKey()
	if err != nil {
		return
	}

	// Make a new signature stream. We write the input data into
	// the input stream, and we read output out of the output stream.
	// In this case, the output stream is just a buffer.
	var input io.WriteCloser
	var output bytes.Buffer
	input, err = saltpack.NewSignArmor62Stream(saltpack.CurrentVersion(), &output, signer, "")
	if err != nil {
		return
	}

	// Write the message into the input stream, and then close
	_, err = input.Write(msg)
	if err != nil {
		return
	}
	input.Close()

	// The verified message. We pass the signed stream as the first argument
	// as a stream (here a bytes.Buffer which is output from above), and read the
	// verified data out of verified stream.
	var verifiedStream io.Reader
	var signingPublicKey saltpack.SigningPublicKey
	signingPublicKey, verifiedStream, _, err = saltpack.NewDearmor62VerifyStream(saltpack.CheckKnownMajorVersion, &output, keyring)
	if err != nil {
		return
	}

	// Assert we got the right key back.
	if saltpack.PublicKeyEqual(signingPublicKey, signer.GetPublicKey()) {
		fmt.Println("The right key")
	}

	// Copy all of the data out of the verified stream, and into standard
	// output, here for testing / comparison purposes.
	_, err = io.Copy(os.Stdout, verifiedStream)
	if err != nil {
		return
	}
	_, err = os.Stdout.Write([]byte{'\n'})
	if err != nil {
		return
	}

}

Output:

The right key
The Magic Words are Squeamish Ossifrage

func NewSignDetachedArmor62Stream ¶

func NewSignDetachedArmor62Stream(version Version, detachedsig io.Writer, signer SigningSecretKey, brand string) (stream io.WriteCloser, err error)

NewSignDetachedArmor62Stream creates a stream that consumes plaintext data. It will write out the detached signature to the io.Writer passed in as detachedsig. The `brand` is optional, and allows you to specify your "white label" brand to this signature.

The signed data is armored with the recommended armor62-style NewSignDetachedArmor62Stream only generates detached signatures.

The signature is armored with the recommended armor62-style format.

func NewSignDetachedStream ¶

func NewSignDetachedStream(version Version, detachedsig io.Writer, signer SigningSecretKey) (stream io.WriteCloser, err error)

NewSignDetachedStream creates a stream that consumes plaintext data. It will write out a detached signature to the io.Writer passed in as detachedsig.

func NewSignStream ¶

func NewSignStream(version Version, signedtext io.Writer, signer SigningSecretKey) (stream io.WriteCloser, err error)

NewSignStream creates a stream that consumes plaintext data. It will write out signed data to the io.Writer passed in as signedtext. NewSignStream only generates attached signatures.

func NewSigncryptArmor62SealStream ¶

func NewSigncryptArmor62SealStream(ciphertext io.Writer, ephemeralKeyCreator EphemeralKeyCreator, sender SigningSecretKey, receiverBoxKeys []BoxPublicKey, receiverSymmetricKeys []ReceiverSymmetricKey, brand string) (plaintext io.WriteCloser, err error)

NewSigncryptArmor62SealStream creates a stream that consumes plaintext data. It will write out signcrypted data to the io.Writer passed in as ciphertext. The signcryption is from the specified sender, and is signcrypted for the given receivers.

The "brand" is the optional "brand" string to put into the header and footer.

The ciphertext is additionally armored with the recommended armor62-style format.

If initialization succeeds, returns an io.WriteCloser that accepts plaintext data to be signcrypted and a nil error. Otherwise, returns nil and the initialization error.

ephemeralKeyCreator should be the last argument; it's the 2nd one to preserve the public API.

func NewSigncryptSealStream ¶

func NewSigncryptSealStream(ciphertext io.Writer, ephemeralKeyCreator EphemeralKeyCreator, sender SigningSecretKey, receiverBoxKeys []BoxPublicKey, receiverSymmetricKeys []ReceiverSymmetricKey) (io.WriteCloser, error)

NewSigncryptSealStream creates a stream that consumes plaintext data. It will write out signed and encrypted data to the io.Writer passed in as ciphertext. The encryption is from the specified sender, and is encrypted for the given receivers.

ephemeralKeyCreator should be the last argument; it's the 2nd one to preserve the public API.

If initialization succeeds, returns an io.WriteCloser that accepts plaintext data to be encrypted and a nil error. Otherwise, returns nil and the initialization error.

func PublicKeyEqual ¶

func PublicKeyEqual(k1, k2 BasePublicKey) bool

PublicKeyEqual returns true if the two public keys are equal.

func Seal ¶

func Seal(version Version, plaintext []byte, sender BoxSecretKey, receivers []BoxPublicKey) (out []byte, err error)

Seal a plaintext from the given sender, for the specified receiver groups. Returns a ciphertext, or an error if something bad happened.

func Sign ¶

func Sign(version Version, plaintext []byte, signer SigningSecretKey) ([]byte, error)

Sign creates an attached signature message of plaintext from signer.

func SignArmor62 ¶

func SignArmor62(version Version, plaintext []byte, signer SigningSecretKey, brand string) (string, error)

SignArmor62 creates an attached armored signature message of plaintext from signer.

package main

import (
	"fmt"

	"github.com/keybase/saltpack"
	"github.com/keybase/saltpack/basic"
)

func main() {

	var err error

	// Make a new Keyring, initialized to be empty
	keyring := basic.NewKeyring()

	// The test message
	msg := []byte("The Magic Words are Squeamish Ossifrage")

	// Make a secret key for the sender
	var signer saltpack.SigningSecretKey
	signer, err = keyring.GenerateSigningKey()
	if err != nil {
		return
	}

	var signed string
	signed, err = saltpack.SignArmor62(saltpack.CurrentVersion(), msg, signer, "")
	if err != nil {
		return
	}

	// The verified message should match the input mesasge.
	var verifiedMsg []byte
	var signingPublicKey saltpack.SigningPublicKey
	signingPublicKey, verifiedMsg, _, err = saltpack.Dearmor62Verify(saltpack.CheckKnownMajorVersion, signed, keyring)
	if err != nil {
		return
	}

	if saltpack.PublicKeyEqual(signingPublicKey, signer.GetPublicKey()) {
		fmt.Println("The right key")
	}

	fmt.Println(string(verifiedMsg))

}

Output:

The right key
The Magic Words are Squeamish Ossifrage

func SignDetached ¶

func SignDetached(version Version, plaintext []byte, signer SigningSecretKey) ([]byte, error)

SignDetached returns a detached signature of plaintext from signer.

func SignDetachedArmor62 ¶

func SignDetachedArmor62(version Version, plaintext []byte, signer SigningSecretKey, brand string) (string, error)

SignDetachedArmor62 returns a detached armored signature of plaintext from signer.

func SigncryptArmor62Seal ¶

func SigncryptArmor62Seal(plaintext []byte, ephemeralKeyCreator EphemeralKeyCreator, sender SigningSecretKey, receiverBoxKeys []BoxPublicKey, receiverSymmetricKeys []ReceiverSymmetricKey, brand string) (string, error)

SigncryptArmor62Seal is the non-streaming version of NewSigncryptArmor62SealStream, which inputs a plaintext (in bytes) and output a ciphertext (as a string).

ephemeralKeyCreator should be the last argument; it's the 2nd one to preserve the public API.

func SigncryptSeal ¶

func SigncryptSeal(plaintext []byte, ephemeralKeyCreator EphemeralKeyCreator, sender SigningSecretKey, receiverBoxKeys []BoxPublicKey, receiverSymmetricKeys []ReceiverSymmetricKey) (out []byte, err error)

SigncryptSeal a plaintext from the given sender, for the specified receiver groups. Returns a ciphertext, or an error if something bad happened.

ephemeralKeyCreator should be the last argument; it's the 2nd one to preserve the public API.