transit

type JWTKeyTransit ¶

type JWTKeyTransit struct {
	// vault transit 'signature_algorithm'
	APISignatureAlgorithm string
	// vault transit 'hash_algorithm'
	APIHashAlgorithm string

	// Vault supported key type
	SupportedKeyType []string
}

JWTKeyTransit metadata for Vault transit key properties

type TransitPublicKey ¶

type TransitPublicKey struct {
	// pub key for JWKS
	PublicKey crypto.PublicKey
	// Version
	Version int

	// Name
	Name string
}

func NewTransitPublicKey(pub crypto.PublicKey, v int, name string) *TransitPublicKey

func (k *TransitPublicKey) KeyID() string

type TransitSigningMethodES256 ¶

type TransitSigningMethodES256 struct{}

implement jwt SigningMethod interface: Verify(signingString, signature string, key interface{}) error // Returns nil if signature is valid Sign(signingString string, key interface{}) (string, error) // Returns encoded signature or error Alg() string // returns the alg identifier for this method (example: 'HS256')

func NewTransitSigningMethodES256() *TransitSigningMethodES256

func (m *TransitSigningMethodES256) Alg() string

func (m *TransitSigningMethodES256) Sign(signingString string, key interface{}) (string, error)

func (m *TransitSigningMethodES256) Verify(signingString, signature string, key interface{}) error

type TransitSigningMethodES384 ¶

type TransitSigningMethodES384 struct{}

implement jwt SigningMethod interface: Verify(signingString, signature string, key interface{}) error // Returns nil if signature is valid Sign(signingString string, key interface{}) (string, error) // Returns encoded signature or error Alg() string // returns the alg identifier for this method (example: 'HS256')

func NewTransitSigningMethodES384() *TransitSigningMethodES384

func (m *TransitSigningMethodES384) Alg() string

func (m *TransitSigningMethodES384) Sign(signingString string, key interface{}) (string, error)

func (m *TransitSigningMethodES384) Verify(signingString, signature string, key interface{}) error

type TransitSigningMethodES512 ¶

type TransitSigningMethodES512 struct{}

implement jwt SigningMethod interface: Verify(signingString, signature string, key interface{}) error // Returns nil if signature is valid Sign(signingString string, key interface{}) (string, error) // Returns encoded signature or error Alg() string // returns the alg identifier for this method (example: 'HS256')

func NewTransitSigningMethodES512() *TransitSigningMethodES512

func (m *TransitSigningMethodES512) Alg() string

func (m *TransitSigningMethodES512) Sign(signingString string, key interface{}) (string, error)

func (m *TransitSigningMethodES512) Verify(signingString, signature string, key interface{}) error

type TransitSigningMethodRS256 ¶

type TransitSigningMethodRS256 struct{}

implement jwt SigningMethod interface: Verify(signingString, signature string, key interface{}) error // Returns nil if signature is valid Sign(signingString string, key interface{}) (string, error) // Returns encoded signature or error Alg() string // returns the alg identifier for this method (example: 'HS256')

func NewTransitSigningMethodRS256() *TransitSigningMethodRS256

func (m *TransitSigningMethodRS256) Alg() string

func (m *TransitSigningMethodRS256) Sign(signingString string, key interface{}) (string, error)

func (m *TransitSigningMethodRS256) Verify(signingString, signature string, key interface{}) error

type TransitSigningMethodRS384 ¶

type TransitSigningMethodRS384 struct{}

implement jwt SigningMethod interface: Verify(signingString, signature string, key interface{}) error // Returns nil if signature is valid Sign(signingString string, key interface{}) (string, error) // Returns encoded signature or error Alg() string // returns the alg identifier for this method (example: 'HS384')

func NewTransitSigningMethodRS384() *TransitSigningMethodRS384

func (m *TransitSigningMethodRS384) Alg() string

func (m *TransitSigningMethodRS384) Sign(signingString string, key interface{}) (string, error)

func (m *TransitSigningMethodRS384) Verify(signingString, signature string, key interface{}) error

type TransitSigningMethodRS512 ¶

type TransitSigningMethodRS512 struct{}

implement jwt SigningMethod interface: Verify(signingString, signature string, key interface{}) error // Returns nil if signature is valid Sign(signingString string, key interface{}) (string, error) // Returns encoded signature or error Alg() string // returns the alg identifier for this method (example: 'HS512')

func NewTransitSigningMethodRS512() *TransitSigningMethodRS512

func (m *TransitSigningMethodRS512) Alg() string

func (m *TransitSigningMethodRS512) Sign(signingString string, key interface{}) (string, error)

func (m *TransitSigningMethodRS512) Verify(signingString, signature string, key interface{}) error

type VaultTransitKey ¶

type VaultTransitKey struct {
	// transit backend mount
	MountPath string
	// transit Key Name
	Name string

	// 'key' type
	Type string

	// Version
	Version int

	// Set sig version
	SigVersion int

	// List of public keys
	PublicKeys []*TransitPublicKey
	// contains filtered or unexported fields
}

func NewVaultTransitKey(ctx context.Context, l *zap.Logger, client *vault.Client, mount string, name string) (*VaultTransitKey, error)

func (k *VaultTransitKey) GetPublicKeyFromTransitResponse(keyInfo *vault.Secret, version int) (crypto.PublicKey, error)

func (k *VaultTransitKey) JWTSign(signingString, alg string) (string, error)

func (k *VaultTransitKey) JWTVerify(signingString, signature, alg string) error

func (k *VaultTransitKey) LatestKeyID() string

func (k *VaultTransitKey) SetSigKeyVersion(v int)

func (k *VaultTransitKey) SetSignVersionFromKeyID(kid string) error

func (k *VaultTransitKey) Sign(inputBytes []byte, apiSigAlg string, apiHashAlg string, marshallingAlg string, prehashed bool) (string, error)

func (k *VaultTransitKey) SyncKeyInfo() error

func (k *VaultTransitKey) Validate(alg string) (*JWTKeyTransit, error)

func (k *VaultTransitKey) Verify(inputBytes []byte, signature string, apiSigAlg string, apiHashAlg string, marshallingAlg string, prehashed bool) (bool, error)

returns true if signature is valid for byte payload