crypto

Documentation

Index

• Constants
• func Decrypt(key []byte, data []byte) ([]byte, error)
• func DeriveSessionKeys(sharedSecret []byte, salt []byte) ([]byte, []byte, []byte, error)
• func DeriveSharedSecret(privateKey *[KeySize]byte, peerPublic *[KeySize]byte) ([]byte, error)
• func Encrypt(key []byte, plaintext []byte) ([]byte, error)
• func ExportPEM(cert *x509.Certificate, key *ecdsa.PrivateKey) (certPEM, keyPEM []byte, err error)
• func GenerateAgentCert(caCert *x509.Certificate, caKey *ecdsa.PrivateKey, agentID string) (*tls.Certificate, error)
• func GenerateCA() (*x509.Certificate, *ecdsa.PrivateKey, error)
• func GenerateSalt() ([]byte, error)
• func GenerateServerCert(caCert *x509.Certificate, caKey *ecdsa.PrivateKey, host string) (*tls.Certificate, error)
• func GenerateSessionToken(hmacKey []byte, counter uint32) []byte
• func NewMTLSClientConfig(clientCert tls.Certificate, caCert *x509.Certificate, serverName string) *tls.Config
• func NewMTLSServerConfig(serverCert tls.Certificate, caCert *x509.Certificate) *tls.Config
• func VerifySessionToken(hmacKey []byte, token []byte, counter uint32) bool
• type KeyPair
  • func GenerateKeyPair() (*KeyPair, error)
  • func KeyPairFromPrivate(private []byte) (*KeyPair, error)
• type MTLSConfig

Constants

const (
	// KeySize is the size of X25519 keys.
	KeySize = 32
	// NonceSize is the size of XChaCha20 nonces.
	NonceSize = chacha20poly1305.NonceSizeX
	// TagSize is the size of the Poly1305 authentication tag.
	TagSize = 16
	// SessionKeySize is the derived session key size.
	SessionKeySize = chacha20poly1305.KeySize
	// TokenSize is the size of the HMAC-based session token.
	TokenSize = 24
)

Functions

func Decrypt

func Decrypt(key []byte, data []byte) ([]byte, error)

Decrypt decrypts ciphertext using XChaCha20-Poly1305. ciphertext must be: nonce(24) + encrypted_data.

func DeriveSessionKeys

func DeriveSessionKeys(sharedSecret []byte, salt []byte) ([]byte, []byte, []byte, error)

DeriveSessionKeys derives encryption and authentication keys from a shared secret. Returns (encryptionKey, hmacKey, sessionToken).

func DeriveSharedSecret

func DeriveSharedSecret(privateKey *[KeySize]byte, peerPublic *[KeySize]byte) ([]byte, error)

DeriveSharedSecret performs X25519 key exchange and derives session keys.

func Encrypt

func Encrypt(key []byte, plaintext []byte) ([]byte, error)

Encrypt encrypts plaintext using XChaCha20-Poly1305 with a random nonce. Returns nonce + ciphertext.

func ExportPEM

func ExportPEM(cert *x509.Certificate, key *ecdsa.PrivateKey) (certPEM, keyPEM []byte, err error)

ExportPEM exports a certificate and key to PEM format.

func GenerateAgentCert

func GenerateAgentCert(caCert *x509.Certificate, caKey *ecdsa.PrivateKey, agentID string) (*tls.Certificate, error)

GenerateAgentCert creates an agent (client) certificate signed by the CA.

func GenerateCA

func GenerateCA() (*x509.Certificate, *ecdsa.PrivateKey, error)

GenerateCA creates a new Certificate Authority.

func GenerateSalt

func GenerateSalt() ([]byte, error)

GenerateSalt creates a random salt for key derivation.

func GenerateServerCert

func GenerateServerCert(caCert *x509.Certificate, caKey *ecdsa.PrivateKey, host string) (*tls.Certificate, error)

GenerateServerCert creates a server certificate signed by the CA.

func GenerateSessionToken

func GenerateSessionToken(hmacKey []byte, counter uint32) []byte

GenerateSessionToken creates a unique session token using HMAC-SHA256.

func NewMTLSClientConfig

func NewMTLSClientConfig(clientCert tls.Certificate, caCert *x509.Certificate, serverName string) *tls.Config

NewMTLSClientConfig creates a TLS config with client certificate for mTLS.

func NewMTLSServerConfig

func NewMTLSServerConfig(serverCert tls.Certificate, caCert *x509.Certificate) *tls.Config

NewMTLSServerConfig creates a TLS config that requires client certificates.

func VerifySessionToken

func VerifySessionToken(hmacKey []byte, token []byte, counter uint32) bool

VerifySessionToken verifies a session token.

Types

type KeyPair

type KeyPair struct {
	PublicKey  [KeySize]byte
	PrivateKey [KeySize]byte
}

KeyPair represents an X25519 key pair.

func GenerateKeyPair

func GenerateKeyPair() (*KeyPair, error)

GenerateKeyPair creates a new X25519 key pair.

func KeyPairFromPrivate

func KeyPairFromPrivate(private []byte) (*KeyPair, error)

KeyPairFromPrivate creates a key pair from an existing private key.

type MTLSConfig

type MTLSConfig struct {
	CACert     *x509.Certificate
	CAKey      *ecdsa.PrivateKey
	ServerCert *tls.Certificate
}

MTLSConfig holds mutual TLS configuration.