Documentation
¶
Index ¶
- Constants
- Variables
- func ValidReference(ref string) error
- type SignerVerifier
- func (g *SignerVerifier) CreateKey(ctx context.Context, algorithm string) (crypto.PublicKey, error)
- func (g *SignerVerifier) CryptoSigner(ctx context.Context, errFunc func(error)) (crypto.Signer, crypto.SignerOpts, error)
- func (g *SignerVerifier) DefaultAlgorithm() string
- func (g *SignerVerifier) PublicKey(opts ...signature.PublicKeyOption) (crypto.PublicKey, error)
- func (g *SignerVerifier) Sign(ctx context.Context, payload []byte) ([]byte, []byte, error)
- func (g *SignerVerifier) SignMessage(message io.Reader, opts ...signature.SignOption) ([]byte, error)
- func (g *SignerVerifier) SupportedAlgorithms() (result []string)
- func (g *SignerVerifier) VerifySignature(signature, message io.Reader, opts ...signature.VerifyOption) error
Constants ¶
const ( Algorithm_ECDSA_P256_SHA256 = "ecdsa-p256-sha256" Algorithm_ECDSA_P384_SHA384 = "ecdsa-p384-sha384" Algorithm_RSA_PKCS1v15_2048_SHA256 = "rsa-pkcs1v15-2048-sha256" Algorithm_RSA_PKCS1v15_3072_SHA256 = "rsa-pkcs1v15-3072-sha256" Algorithm_RSA_PKCS1v15_4096_SHA256 = "rsa-pkcs1v15-4096-sha256" Algorithm_RSA_PKCS1v15_4096_SHA512 = "rsa-pkcs1v15-4096-sha512" Algorithm_RSA_PSS_2048_SHA256 = "rsa-pss-2048-sha256" Algorithm_RSA_PSS_3072_SHA256 = "rsa-pss-3072-sha256" Algorithm_RSA_PSS_4096_SHA256 = "rsa-pss-4096-sha256" Algorithm_RSA_PSS_4096_SHA512 = "rsa-pss-4096-sha512" )
const CacheKey = "crypto_key_version"
use a consistent key for cache lookups
const ReferenceScheme = "gcpkms://"
schemes for various KMS services are copied from https://github.com/google/go-cloud/tree/master/secrets
Variables ¶
var (
ErrKMSReference = errors.New("kms specification should be in the format gcpkms://projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEY_RING]/cryptoKeys/[KEY]/versions/[VERSION]")
)
Functions ¶
func ValidReference ¶
Types ¶
type SignerVerifier ¶
type SignerVerifier struct {
// contains filtered or unexported fields
}
func LoadSignerVerifier ¶
func LoadSignerVerifier(defaultCtx context.Context, referenceStr string) (*SignerVerifier, error)
LoadSignerVerifier generates signatures using the specified key object in GCP KMS and hash algorithm.
It also can verify signatures locally using the public key. hashFunc must not be crypto.Hash(0).
func (*SignerVerifier) CreateKey ¶
CreateKey attempts to create a new key in Vault with the specified algorithm.
func (*SignerVerifier) CryptoSigner ¶
func (g *SignerVerifier) CryptoSigner(ctx context.Context, errFunc func(error)) (crypto.Signer, crypto.SignerOpts, error)
func (*SignerVerifier) DefaultAlgorithm ¶
func (g *SignerVerifier) DefaultAlgorithm() string
func (*SignerVerifier) PublicKey ¶
func (g *SignerVerifier) PublicKey(opts ...signature.PublicKeyOption) (crypto.PublicKey, error)
PublicKey returns the public key that can be used to verify signatures created by this signer. If the caller wishes to specify the context to use to obtain the public key, pass option.WithContext(desiredCtx).
All other options are ignored if specified.
func (*SignerVerifier) SignMessage ¶
func (g *SignerVerifier) SignMessage(message io.Reader, opts ...signature.SignOption) ([]byte, error)
SignMessage signs the provided message using GCP KMS. If the message is provided, this method will compute the digest according to the hash function specified when the Signer was created.
SignMessage recognizes the following Options listed in order of preference:
- WithContext()
- WithDigest()
- WithCryptoSignerOpts()
All other options are ignored if specified.
func (*SignerVerifier) SupportedAlgorithms ¶
func (g *SignerVerifier) SupportedAlgorithms() (result []string)
func (*SignerVerifier) VerifySignature ¶
func (g *SignerVerifier) VerifySignature(signature, message io.Reader, opts ...signature.VerifyOption) error
VerifySignature verifies the signature for the given message. Unless provided in an option, the digest of the message will be computed using the hash function specified when the SignerVerifier was created.
This function returns nil if the verification succeeded, and an error message otherwise.
This function recognizes the following Options listed in order of preference:
- WithDigest()
All other options are ignored if specified.
Source Files