jwek

package
v1.1.39 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 5, 2026 License: MIT Imports: 20 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	A128GCMKW = AESGCMKWPreset{
		Alg:    jwa.A128GCMKW,
		KeyLen: 16,
	}
	A192GCMKW = AESGCMKWPreset{
		Alg:    jwa.A192GCMKW,
		KeyLen: 24,
	}
	A256GCMKW = AESGCMKWPreset{
		Alg:    jwa.A256GCMKW,
		KeyLen: 32,
	}
)
View Source 
var (
	A128KW = AESKWPreset{
		Alg:    jwa.A128KW,
		KeyLen: 16,
	}
	A192KW = AESKWPreset{
		Alg:    jwa.A192KW,
		KeyLen: 24,
	}
	A256KW = AESKWPreset{
		Alg:    jwa.A256KW,
		KeyLen: 32,
	}
)
View Source 
var (
	ECDHESA128CBC = ECDHKeyAgrPreset{
		Enc:    jwa.A128CBC,
		KeyLen: 32,
	}
	ECDHESA192CBC = ECDHKeyAgrPreset{
		Enc:    jwa.A192CBC,
		KeyLen: 48,
	}
	ECDHESA256CBC = ECDHKeyAgrPreset{
		Enc:    jwa.A256CBC,
		KeyLen: 64,
	}

	ECDHESA128GCM = ECDHKeyAgrPreset{
		Enc:    jwa.A128GCM,
		KeyLen: 16,
	}
	ECDHESA192GCM = ECDHKeyAgrPreset{
		Enc:    jwa.A192GCM,
		KeyLen: 24,
	}
	ECDHESA256GCM = ECDHKeyAgrPreset{
		Enc:    jwa.A256GCM,
		KeyLen: 32,
	}
)
View Source 
var (
	ECDHESA128KW = ECDHKeyAgrKWPreset{
		Alg:    jwa.ECDHESA128KW,
		KeyLen: 16,
	}
	ECDHESA192KW = ECDHKeyAgrKWPreset{
		Alg:    jwa.ECDHESA192KW,
		KeyLen: 24,
	}
	ECDHESA256KW = ECDHKeyAgrKWPreset{
		Alg:    jwa.ECDHESA256KW,
		KeyLen: 32,
	}
)
View Source 
var (
	PBES2A128KW = PBES2KeyEncKWPreset{
		Alg:     jwa.PBES2HS256A128KW,
		Hash:    crypto.SHA256,
		KeySize: 16,
	}
	PBES2A192KW = PBES2KeyEncKWPreset{
		Alg:     jwa.PBES2HS384A192KW,
		Hash:    crypto.SHA384,
		KeySize: 24,
	}
	PBES2A256KW = PBES2KeyEncKWPreset{
		Alg:     jwa.PBES2HS512A256KW,
		Hash:    crypto.SHA512,
		KeySize: 32,
	}
)
View Source 
var (
	// Deprecated: this preset uses the broken SHA-1 hash function. Use RSAOAEP256 instead.
	RSAOAEP = RSAOAEPKeyEncPreset{
		Alg:  jwa.RSAOAEP,
		Hash: sha1.New(),
	}
	RSAOAEP256 = RSAOAEPKeyEncPreset{
		Alg:  jwa.RSAOAEP256,
		Hash: sha256.New(),
	}
)

Functions

This section is empty.

Types

type AESGCMKWDecoder 

type AESGCMKWDecoder struct {
	// contains filtered or unexported fields
}

func NewAESGCMKWDecoder 

func NewAESGCMKWDecoder(config *AESGCMKWDecoderConfig, preset AESGCMKWPreset) *AESGCMKWDecoder

NewAESGCMKWDecoder creates a new jwe.CEKDecoder for a key derived using AES GCM Key Wrap.

Use any of the AESGCMKWPreset constants to set the algorithm and key length.

  • A128GCMKW: 16 bytes key length
  • A192GCMKW: 24 bytes key length
  • A256GCMKW: 32 bytes key length

https://datatracker.ietf.org/doc/html/rfc7518#section-4.7

func (*AESGCMKWDecoder) ComputeCEK 

func (decoder *AESGCMKWDecoder) ComputeCEK(_ context.Context, header *jwa.JWH, encKey []byte) ([]byte, error)

type AESGCMKWDecoderConfig 

type AESGCMKWDecoderConfig struct {
	WrapKey []byte
}

type AESGCMKWManager 

type AESGCMKWManager struct {
	// contains filtered or unexported fields
}

func NewAESGCMKWManager 

func NewAESGCMKWManager(
	config *AESGCMKWManagerConfig, preset AESGCMKWPreset,
) *AESGCMKWManager

NewAESGCMKWManager creates a new jwe.CEKManager for a key derived using AES GCM Key Wrap.

Use any of the AESGCMKWPreset constants to set the algorithm and key length.

  • A128GCMKW: 16 bytes key length
  • A192GCMKW: 24 bytes key length
  • A256GCMKW: 32 bytes key length

https://datatracker.ietf.org/doc/html/rfc7518#section-4.7

func (*AESGCMKWManager) ComputeCEK 

func (manager *AESGCMKWManager) ComputeCEK(_ context.Context, _ *jwa.JWH) ([]byte, error)

func (*AESGCMKWManager) EncryptCEK 

func (manager *AESGCMKWManager) EncryptCEK(_ context.Context, header *jwa.JWH, cek []byte) ([]byte, error)

func (*AESGCMKWManager) SetHeader 

func (manager *AESGCMKWManager) SetHeader(_ context.Context, header *jwa.JWH) (*jwa.JWH, error)

type AESGCMKWManagerConfig 

type AESGCMKWManagerConfig struct {
	CEK     []byte
	WrapKey []byte
}

type AESGCMKWPreset 

type AESGCMKWPreset struct {
	Alg    jwa.Alg
	KeyLen int
}

type AESKWDecoder 

type AESKWDecoder struct {
	// contains filtered or unexported fields
}

func NewAESKWDecoder 

func NewAESKWDecoder(secret *AESKWDecoderConfig, preset AESKWPreset) *AESKWDecoder

NewAESKWDecoder creates a new jwe.CEKDecoder for a key derived using AES Key Wrap.

Use any of the AESKWPreset constants to set the algorithm and key length.

  • A128KW: 16 bytes key length
  • A192KW: 24 bytes key length
  • A256KW: 32 bytes key length

https://datatracker.ietf.org/doc/html/rfc7518#section-4.4

func (*AESKWDecoder) ComputeCEK 

func (decoder *AESKWDecoder) ComputeCEK(_ context.Context, header *jwa.JWH, encKey []byte) ([]byte, error)

type AESKWDecoderConfig 

type AESKWDecoderConfig struct {
	WrapKey []byte
}

type AESKWManager 

type AESKWManager struct {
	// contains filtered or unexported fields
}

func NewAESKWManager 

func NewAESKWManager(config *AESKWManagerConfig, preset AESKWPreset) *AESKWManager

NewAESKWManager creates a new jwe.CEKManager for a key derived using AES Key Wrap.

Use any of the AESKWPreset constants to set the algorithm and key length.

  • A128KW: 16 bytes key length
  • A192KW: 24 bytes key length
  • A256KW: 32 bytes key length

https://datatracker.ietf.org/doc/html/rfc7518#section-4.4

func (*AESKWManager) ComputeCEK 

func (manager *AESKWManager) ComputeCEK(_ context.Context, _ *jwa.JWH) ([]byte, error)

func (*AESKWManager) EncryptCEK 

func (manager *AESKWManager) EncryptCEK(_ context.Context, _ *jwa.JWH, cek []byte) ([]byte, error)

func (*AESKWManager) SetHeader 

func (manager *AESKWManager) SetHeader(_ context.Context, header *jwa.JWH) (*jwa.JWH, error)

type AESKWManagerConfig 

type AESKWManagerConfig struct {
	CEK     []byte
	WrapKey []byte
}

type AESKWPreset 

type AESKWPreset struct {
	Alg    jwa.Alg
	KeyLen int
}

type DirectKeyDecoder 

type DirectKeyDecoder struct {
	// contains filtered or unexported fields
}

func NewDirectKeyDecoder 

func NewDirectKeyDecoder(config *DirectKeyDecoderConfig) *DirectKeyDecoder

NewDirectKeyDecoder creates a new instance of DirectKeyDecoder.

https://datatracker.ietf.org/doc/html/rfc7518#section-4.5

func (*DirectKeyDecoder) ComputeCEK 

func (decoder *DirectKeyDecoder) ComputeCEK(_ context.Context, header *jwa.JWH, _ []byte) ([]byte, error)

type DirectKeyDecoderConfig 

type DirectKeyDecoderConfig struct {
	CEK []byte
}

type DirectKeyManager 

type DirectKeyManager struct {
	// contains filtered or unexported fields
}

func NewDirectKeyManager 

func NewDirectKeyManager(cek []byte) *DirectKeyManager

NewDirectKeyManager creates a new instance of DirectKeyManager.

https://datatracker.ietf.org/doc/html/rfc7518#section-4.5

func (*DirectKeyManager) ComputeCEK 

func (manager *DirectKeyManager) ComputeCEK(_ context.Context, _ *jwa.JWH) ([]byte, error)

func (*DirectKeyManager) EncryptCEK 

func (manager *DirectKeyManager) EncryptCEK(_ context.Context, _ []byte) ([]byte, error)

func (*DirectKeyManager) SetHeader 

func (manager *DirectKeyManager) SetHeader(_ context.Context, header *jwa.JWH) (*jwa.JWH, error)

type ECDHKeyAgrDecoder 

type ECDHKeyAgrDecoder struct {
	// contains filtered or unexported fields
}

func NewECDHKeyAgrDecoder 

func NewECDHKeyAgrDecoder(config *ECDHKeyAgrDecoderConfig, preset ECDHKeyAgrPreset) *ECDHKeyAgrDecoder

NewECDHKeyAgrDecoder creates a new jwe.CEKDecoder factory for a key derivation using ECDH.

Use any of the ECDHKeyAgrPreset constants to set the algorithm and key length.

  • ECDHESA128CBC: ECDH-ES using Concat KDF and CEK length of 128 bits
  • ECDHESA192CBC: ECDH-ES using Concat KDF and CEK length of 192 bits
  • ECDHESA256CBC: ECDH-ES using Concat KDF and CEK length of 256 bits
  • ECDHESA128GCM: ECDH-ES using Concat KDF and CEK length of 128 bits
  • ECDHESA192GCM: ECDH-ES using Concat KDF and CEK length of 192 bits
  • ECDHESA256GCM: ECDH-ES using Concat KDF and CEK length of 256 bits

This manager is NOT encryption agnostic.

  • ECDHESA128CBC requires jwe.A128CBCHS256 encryption
  • ECDHESA192CBC requires jwe.A192CBCHS384 encryption
  • ECDHESA256CBC requires jwe.A256CBCHS512 encryption
  • ECDHESA128GCM requires jwe.A128GCM encryption
  • ECDHESA192GCM requires jwe.A192GCM encryption
  • ECDHESA256GCM requires jwe.A256GCM encryption

https://datatracker.ietf.org/doc/html/rfc7518#section-4.6

func (*ECDHKeyAgrDecoder) ComputeCEK 

func (decoder *ECDHKeyAgrDecoder) ComputeCEK(_ context.Context, header *jwa.JWH, encKey []byte) ([]byte, error)

type ECDHKeyAgrDecoderConfig 

type ECDHKeyAgrDecoderConfig struct {
	RecipientKey *ecdh.PrivateKey
}

type ECDHKeyAgrKWDecoder 

type ECDHKeyAgrKWDecoder struct {
	// contains filtered or unexported fields
}

func NewECDHKeyAgrKWDecoder 

func NewECDHKeyAgrKWDecoder(config *ECDHKeyAgrKWDecoderConfig, preset ECDHKeyAgrKWPreset) *ECDHKeyAgrKWDecoder

NewECDHKeyAgrKWDecoder creates a new jwe.CEKDecoder factory for a key derivation using ECDH and AES Key Wrap.

Use any of the ECDHKeyAgrKWPreset constants to set the algorithm and key length.

  • ECDHESA128KW: ECDH-ES using Concat KDF and AES Key Wrap with AES-CBC-HMAC-SHA2
  • ECDHESA192KW: ECDH-ES using Concat KDF and AES Key Wrap with AES-CBC-HMAC-SHA2
  • ECDHESA256KW: ECDH-ES using Concat KDF and AES Key Wrap with AES-CBC-HMAC-SHA2

func (*ECDHKeyAgrKWDecoder) ComputeCEK 

func (decoder *ECDHKeyAgrKWDecoder) ComputeCEK(_ context.Context, header *jwa.JWH, encKey []byte) ([]byte, error)

type ECDHKeyAgrKWDecoderConfig 

type ECDHKeyAgrKWDecoderConfig struct {
	RecipientKey *ecdh.PrivateKey
}

type ECDHKeyAgrKWManager 

type ECDHKeyAgrKWManager struct {
	// contains filtered or unexported fields
}

func NewECDHKeyAgrKWManager 

func NewECDHKeyAgrKWManager(
	config *ECDHKeyAgrKWManagerConfig, preset ECDHKeyAgrKWPreset,
) *ECDHKeyAgrKWManager

NewECDHKeyAgrKWManager creates a new jwe.CEKManager for a key derivation using ECDH and AES Key Wrap.

Use any of the ECDHKeyAgrKWPreset constants to set the algorithm and key length.

  • ECDHESA128KW: ECDH-ES using Concat KDF and AES Key Wrap with AES-CBC-HMAC-SHA2
  • ECDHESA192KW: ECDH-ES using Concat KDF and AES Key Wrap with AES-CBC-HMAC-SHA2
  • ECDHESA256KW: ECDH-ES using Concat KDF and AES Key Wrap with AES-CBC-HMAC-SHA2

func (*ECDHKeyAgrKWManager) ComputeCEK 

func (manager *ECDHKeyAgrKWManager) ComputeCEK(_ context.Context, _ *jwa.JWH) ([]byte, error)

func (*ECDHKeyAgrKWManager) EncryptCEK 

func (manager *ECDHKeyAgrKWManager) EncryptCEK(_ context.Context, header *jwa.JWH, cek []byte) ([]byte, error)

func (*ECDHKeyAgrKWManager) SetHeader 

func (manager *ECDHKeyAgrKWManager) SetHeader(_ context.Context, header *jwa.JWH) (*jwa.JWH, error)

type ECDHKeyAgrKWManagerConfig 

type ECDHKeyAgrKWManagerConfig struct {
	ProducerKey  *ecdh.PrivateKey
	RecipientKey *ecdh.PublicKey

	CEK []byte

	ProducerInfo  string
	RecipientInfo string
}

type ECDHKeyAgrKWPreset 

type ECDHKeyAgrKWPreset struct {
	Alg    jwa.Alg
	KeyLen int
}

type ECDHKeyAgrManager 

type ECDHKeyAgrManager struct {
	// contains filtered or unexported fields
}

func NewECDHKeyAgrManager 

func NewECDHKeyAgrManager(config *ECDHKeyAgrManagerConfig, preset ECDHKeyAgrPreset) *ECDHKeyAgrManager

NewECDHKeyAgrManager creates a new jwe.CEKManager factory for a key derivation using ECDH.

Use any of the ECDHKeyAgrPreset constants to set the algorithm and key length.

  • ECDHESA128CBC: ECDH-ES using Concat KDF and CEK length of 128 bits
  • ECDHESA192CBC: ECDH-ES using Concat KDF and CEK length of 192 bits
  • ECDHESA256CBC: ECDH-ES using Concat KDF and CEK length of 256 bits
  • ECDHESA128GCM: ECDH-ES using Concat KDF and CEK length of 128 bits
  • ECDHESA192GCM: ECDH-ES using Concat KDF and CEK length of 192 bits
  • ECDHESA256GCM: ECDH-ES using Concat KDF and CEK length of 256 bits

This manager is NOT encryption agnostic.

  • ECDHESA128CBC requires jwe.A128CBCHS256 encryption
  • ECDHESA192CBC requires jwe.A192CBCHS384 encryption
  • ECDHESA256CBC requires jwe.A256CBCHS512 encryption
  • ECDHESA128GCM requires jwe.A128GCM encryption
  • ECDHESA192GCM requires jwe.A192GCM encryption
  • ECDHESA256GCM requires jwe.A256GCM encryption

https://datatracker.ietf.org/doc/html/rfc7518#section-4.6

func (*ECDHKeyAgrManager) ComputeCEK 

func (manager *ECDHKeyAgrManager) ComputeCEK(_ context.Context, header *jwa.JWH) ([]byte, error)

func (*ECDHKeyAgrManager) EncryptCEK 

func (manager *ECDHKeyAgrManager) EncryptCEK(_ context.Context, _ *jwa.JWH, _ []byte) ([]byte, error)

func (*ECDHKeyAgrManager) SetHeader 

func (manager *ECDHKeyAgrManager) SetHeader(_ context.Context, header *jwa.JWH) (*jwa.JWH, error)

type ECDHKeyAgrManagerConfig 

type ECDHKeyAgrManagerConfig struct {
	ProducerKey  *ecdh.PrivateKey
	RecipientKey *ecdh.PublicKey

	ProducerInfo  string
	RecipientInfo string
}

type ECDHKeyAgrPreset 

type ECDHKeyAgrPreset struct {
	Enc    jwa.Enc
	Alg    jwa.Alg
	KeyLen int
}

type PBES2KeyEncKWConfig 

type PBES2KeyEncKWConfig struct {
	// contains filtered or unexported fields
}

func NewPBES2KeyEncKWManager 

func NewPBES2KeyEncKWManager(config *PBES2KeyEncKWManagerConfig, preset PBES2KeyEncKWPreset) *PBES2KeyEncKWConfig

NewPBES2KeyEncKWManager creates a new jwe.CEKManager for a key derived using PBES2.

Use any of the PBES2KeyEncKWPreset constants to set the algorithm and key length.

  • PBES2A128KW: PBES2 using HMAC with SHA-256 and a key size of 128 bits
  • PBES2A192KW: PBES2 using HMAC with SHA-384 and a key size of 192 bits
  • PBES2A256KW: PBES2 using HMAC with SHA-512 and a key size of 256 bits

func (*PBES2KeyEncKWConfig) ComputeCEK 

func (manager *PBES2KeyEncKWConfig) ComputeCEK(_ context.Context, _ *jwa.JWH) ([]byte, error)

func (*PBES2KeyEncKWConfig) EncryptCEK 

func (manager *PBES2KeyEncKWConfig) EncryptCEK(_ context.Context, header *jwa.JWH, cek []byte) ([]byte, error)

func (*PBES2KeyEncKWConfig) SetHeader 

func (manager *PBES2KeyEncKWConfig) SetHeader(_ context.Context, header *jwa.JWH) (*jwa.JWH, error)

type PBES2KeyEncKWDecoder 

type PBES2KeyEncKWDecoder struct {
	// contains filtered or unexported fields
}

func NewPBES2KeyEncKWDecoder 

func NewPBES2KeyEncKWDecoder(config *PBES2KeyEncKWDecoderConfig, preset PBES2KeyEncKWPreset) *PBES2KeyEncKWDecoder

NewPBES2KeyEncKWDecoder creates a new jwe.CEKDecoder for a key derived using PBES2.

Use any of the PBES2KeyEncKWPreset constants to set the algorithm and key length.

  • PBES2A128KW: PBES2 using HMAC with SHA-256 and a key size of 128 bits
  • PBES2A192KW: PBES2 using HMAC with SHA-384 and a key size of 192 bits
  • PBES2A256KW: PBES2 using HMAC with SHA-512 and a key size of 256 bits

func (*PBES2KeyEncKWDecoder) ComputeCEK 

func (decoder *PBES2KeyEncKWDecoder) ComputeCEK(_ context.Context, header *jwa.JWH, encKey []byte) ([]byte, error)

type PBES2KeyEncKWDecoderConfig 

type PBES2KeyEncKWDecoderConfig struct {
	// Secret used to decrypt the CEK.
	Secret string
}

type PBES2KeyEncKWManagerConfig 

type PBES2KeyEncKWManagerConfig struct {
	// The iteration count adds computational expense, ideally compounded by
	// the possible range of keys introduced by the salt. A minimum
	// iteration count of 1000 is RECOMMENDED.
	Iterations int
	// The salt size is the size of the salt in bytes. It is RECOMMENDED to
	// use a salt size of 128 bits or more.
	SaltSize int

	// CEK will be encrypted using the Secret.
	CEK []byte
	// Secret used to encrypt the CEK. The recipient will need to know this in order to decrypt the token.
	Secret string
}

type PBES2KeyEncKWPreset 

type PBES2KeyEncKWPreset struct {
	Alg     jwa.Alg
	Hash    crypto.Hash
	KeySize int
}

type RSAOAEPKeyEncDecoder 

type RSAOAEPKeyEncDecoder struct {
	// contains filtered or unexported fields
}

func NewRSAOAEPKeyEncDecoder 

func NewRSAOAEPKeyEncDecoder(
	config *RSAOAEPKeyEncDecoderConfig, preset RSAOAEPKeyEncPreset,
) *RSAOAEPKeyEncDecoder

NewRSAOAEPKeyEncDecoder creates a new jwe.CEKDecoder for a key encrypted using RSAES-OAEP.

Use any of the RSAOAEPKeyEncPreset to set the algorithm and hash function.

  • RSAOAEP: RSAES-OAEP using SHA-1 and MGF1 with SHA-1.
  • RSAOAEP256: RSAES-OAEP using SHA-256 and MGF1 with SHA-256.

https://datatracker.ietf.org/doc/html/rfc7518#section-4.3

func (*RSAOAEPKeyEncDecoder) ComputeCEK 

func (decoder *RSAOAEPKeyEncDecoder) ComputeCEK(_ context.Context, header *jwa.JWH, encKey []byte) ([]byte, error)

type RSAOAEPKeyEncDecoderConfig 

type RSAOAEPKeyEncDecoderConfig struct {
	EncKey *rsa.PrivateKey
}

type RSAOAEPKeyEncManager 

type RSAOAEPKeyEncManager struct {
	// contains filtered or unexported fields
}

func NewRSAOAEPKeyEncManager 

func NewRSAOAEPKeyEncManager(
	config *RSAOAEPKeyEncManagerConfig, preset RSAOAEPKeyEncPreset,
) *RSAOAEPKeyEncManager

NewRSAOAEPKeyEncManager creates a new jwe.CEKManager for a key encrypted using RSAES-OAEP.

Use any of the RSAOAEPKeyEncPreset to set the algorithm and hash function.

  • RSAOAEP: RSAES-OAEP using SHA-1 and MGF1 with SHA-1.
  • RSAOAEP256: RSAES-OAEP using SHA-256 and MGF1 with SHA-256.

https://datatracker.ietf.org/doc/html/rfc7518#section-4.3

func (*RSAOAEPKeyEncManager) ComputeCEK 

func (manager *RSAOAEPKeyEncManager) ComputeCEK(_ context.Context, _ *jwa.JWH) ([]byte, error)

func (*RSAOAEPKeyEncManager) EncryptCEK 

func (manager *RSAOAEPKeyEncManager) EncryptCEK(_ context.Context, _ *jwa.JWH, cek []byte) ([]byte, error)

func (*RSAOAEPKeyEncManager) SetHeader 

func (manager *RSAOAEPKeyEncManager) SetHeader(_ context.Context, header *jwa.JWH) (*jwa.JWH, error)

type RSAOAEPKeyEncManagerConfig 

type RSAOAEPKeyEncManagerConfig struct {
	CEK    []byte
	EncKey *rsa.PublicKey
}

type RSAOAEPKeyEncPreset 

type RSAOAEPKeyEncPreset struct {
	Alg  jwa.Alg
	Hash hash.Hash
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.