Documentation
¶
Overview ¶
Package agessh provides age.Identity and age.Recipient implementations of types "ssh-rsa" and "ssh-ed25519", which allow reusing existing SSH keys for encryption with age-encryption.org/v1.
These recipient types should only be used for compatibility with existing keys, and native X25519 keys should be preferred otherwise.
Note that these recipient types are not anonymous: the encrypted message will include a short 32-bit ID of the public key.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Ed25519Identity ¶
type Ed25519Identity struct {
// contains filtered or unexported fields
}
func NewEd25519Identity ¶
func NewEd25519Identity(key ed25519.PrivateKey) (*Ed25519Identity, error)
func (*Ed25519Identity) Recipient ¶
func (i *Ed25519Identity) Recipient() age.Recipient
type Ed25519Recipient ¶
type Ed25519Recipient struct {
// contains filtered or unexported fields
}
func NewEd25519Recipient ¶
func NewEd25519Recipient(pk ssh.PublicKey) (*Ed25519Recipient, error)
type EncryptedSSHIdentity ¶
type EncryptedSSHIdentity struct {
// contains filtered or unexported fields
}
EncryptedSSHIdentity is an age.Identity implementation based on a passphrase encrypted SSH private key.
It requests the passphrase only if the public key matches a recipient stanza. If the application knows it will always have to decrypt the private key, it would be simpler to use ssh.ParseRawPrivateKeyWithPassphrase directly and pass the result to NewEd25519Identity or NewRSAIdentity.
func NewEncryptedSSHIdentity ¶
func NewEncryptedSSHIdentity(pubKey ssh.PublicKey, pemBytes []byte, passphrase func() ([]byte, error)) (*EncryptedSSHIdentity, error)
NewEncryptedSSHIdentity returns a new EncryptedSSHIdentity.
pubKey must be the public key associated with the encrypted private key, and it must have type "ssh-ed25519" or "ssh-rsa". For OpenSSH encrypted files it can be extracted from an ssh.PassphraseMissingError, otherwise it can often be found in ".pub" files.
pemBytes must be a valid input to ssh.ParseRawPrivateKeyWithPassphrase. passphrase is a callback that will be invoked by Unwrap when the passphrase is necessary.
func (*EncryptedSSHIdentity) Recipient ¶
func (i *EncryptedSSHIdentity) Recipient() age.Recipient
func (*EncryptedSSHIdentity) Unwrap ¶
func (i *EncryptedSSHIdentity) Unwrap(stanzas []*age.Stanza) (fileKey []byte, err error)
Unwrap implements age.Identity. If the private key is still encrypted, and any of the stanzas match the public key, it will request the passphrase. The decrypted private key will be cached after the first successful invocation.
type RSAIdentity ¶
type RSAIdentity struct {
// contains filtered or unexported fields
}
func NewRSAIdentity ¶
func NewRSAIdentity(key *rsa.PrivateKey) (*RSAIdentity, error)
func (*RSAIdentity) Recipient ¶
func (i *RSAIdentity) Recipient() age.Recipient
type RSARecipient ¶
type RSARecipient struct {
// contains filtered or unexported fields
}
func NewRSARecipient ¶
func NewRSARecipient(pk ssh.PublicKey) (*RSARecipient, error)
Source Files