verifier

Documentation

Index

• func CreateCredential(username string, privateKey ed25519.PrivateKey) (string, error)
• func CreateCredentialAtTime(username string, privateKey ed25519.PrivateKey, timestamp time.Time) (string, error)
• type Credential
  • func ParseCredential(token string) (*Credential, error)
• type Verifier
  • func NewVerifier(s *store.Store, credentialTTL, maxNonceAge time.Duration) *Verifier
  • func NewVerifierWithSkew(s *store.Store, credentialTTL, maxNonceAge, clockSkewTolerance time.Duration) *Verifier
  • func (v *Verifier) Verify(ctx context.Context, username, credentialToken string) (*VerifyResult, error)
• type VerifyResult

Functions

func CreateCredential

func CreateCredential(username string, privateKey ed25519.PrivateKey) (string, error)

CreateCredential creates a signed credential token for a user. SECURITY FIX: Now includes username hash to bind credential to specific username. Returns a base64url-encoded string that fits within RADIUS PAP 128-byte limit.

func CreateCredentialAtTime

func CreateCredentialAtTime(username string, privateKey ed25519.PrivateKey, timestamp time.Time) (string, error)

CreateCredentialAtTime creates a credential with a specific timestamp (for testing).

Types

type Credential

type Credential struct {
	Timestamp    time.Time
	Nonce        []byte // 8 bytes
	UsernameHash []byte // 8 bytes - SECURITY FIX: binds credential to specific username
	Signature    []byte // 64 bytes
	NonceHex     string // hex string of nonce for DB storage
	RawMsg       []byte // raw 20-byte message (timestamp + nonce + username-hash) for signature verification
}

Credential represents a parsed authentication credential token. Binary format: 4-byte timestamp (big-endian uint32) + 8-byte nonce + 8-byte username hash + 64-byte signature Wire format: base64url(84 bytes) = ~113 characters (fits RADIUS PAP 128-byte limit)

func ParseCredential

func ParseCredential(token string) (*Credential, error)

ParseCredential parses a base64url-encoded credential token. Format: base64url(4-byte-timestamp + 8-byte-nonce + 8-byte-username-hash + 64-byte-ed25519-signature)

type Verifier

type Verifier struct {
	// contains filtered or unexported fields
}

Verifier handles offline credential verification using Ed25519 signatures.

func NewVerifier

func NewVerifier(s *store.Store, credentialTTL, maxNonceAge time.Duration) *Verifier

NewVerifier creates a new Verifier with the given store and configuration.

func NewVerifierWithSkew

func NewVerifierWithSkew(s *store.Store, credentialTTL, maxNonceAge, clockSkewTolerance time.Duration) *Verifier

NewVerifierWithSkew creates a new Verifier with explicit clock skew tolerance.

func (*Verifier) Verify

func (v *Verifier) Verify(ctx context.Context, username, credentialToken string) (*VerifyResult, error)

Verify performs the complete offline credential verification pipeline: 1. Parse credential token 2. Look up user by username in SQLite 3. SECURITY FIX: Verify username hash matches (constant-time comparison) 4. Verify Ed25519 signature 5. Check credential expiration (with clock skew tolerance) 6. Check nonce replay 7. Check revocation 8. Record nonce

This function makes ZERO network calls. All operations are local.

type VerifyResult

type VerifyResult struct {
	Allowed  bool
	Reason   string
	Username string
	DID      string
	Role     string
}

VerifyResult contains the outcome of credential verification.