tokens

Documentation

Index

• Variables
• func CalcKID(key jwk.Key) (string, error)
• func GetEndorsedKID(t jwt.Token) (string, error)
• func GetKID(key jwk.Key) (string, error)
• func SetKID(key jwk.Key, force bool) error
• func SetKIDs(set jwk.Set, alg *jwa.SignatureAlgorithm) (jwk.Set, error)
• func VerifyConstraints(emblem jwt.Token, endorsement jwt.Token) error
• type ChannelMask
  • func (cm *ChannelMask) MarshalJSON() ([]byte, error)
  • func (cm *ChannelMask) UnmarshalJSON(bs []byte) error
• type EmbeddedKey
  • func (ek *EmbeddedKey) UnmarshalJSON(bs []byte) (err error)
• type EmblemConstraints
• type LeafHash
  • func (h *LeafHash) MarshalJSON() ([]byte, error)
  • func (h *LeafHash) UnmarshalJSON(bs []byte) (err error)
• type LogConfig
• type PurposeMask
  • func (pm *PurposeMask) MarshalJSON() ([]byte, error)
  • func (pm *PurposeMask) UnmarshalJSON(in []byte) error

Variables

var EmblemValidator = jwt.ValidatorFunc(func(_ context.Context, t jwt.Token) jwt.ValidationError {
	if err := validateCommon(t); err != nil {
		return err
	}

	if _, ok := t.Get("ass"); !ok {
		return ErrAssMissing
	}

	if _, ok := t.Get("log"); ok {
		return ErrLogClaim
	}

	return nil
})

Validation function for emblem tokens.

var EndorsementValidator = jwt.ValidatorFunc(func(_ context.Context, t jwt.Token) jwt.ValidationError {
	if err := validateCommon(t); err != nil {
		return err
	}

	end, ok := t.Get("end")
	if ok {
		_, check := end.(bool)
		if !check {
			return ErrIllegalType
		}
	} else {
		return ErrEndMissing
	}

	return nil
})

Validation function for endorsement tokens.

var ErrAlgMissing = errors.New("input key misses algorithm")

var ErrAssMissing = jwt.NewValidationError(errors.New("emblems require ass claim"))

var ErrAssetConstraint = errors.New("emblem does not satisfy asset constraint")

var ErrDstConstraint = errors.New("emblem does not satisfy dst constraint")

var ErrEndMissing = jwt.NewValidationError(errors.New("endorsements require end claim"))

var ErrIllegalConst = errors.New("json element is illegal constant")

var ErrIllegalType = jwt.NewValidationError(errors.New("illegal claim type"))

var ErrIllegalVersion = jwt.NewValidationError(errors.New("illegal version"))

var ErrLogClaim = jwt.NewValidationError(errors.New("emblems must not contain a log claim"))

var ErrNoEndorsedKey = errors.New("no endorsed key present")

var ErrPrpConstraint = errors.New("emblem does not satisfy prp constraint")

var ErrWndConstraint = errors.New("emblem does not satisfy wnd constraint")

Functions

func CalcKID

func CalcKID(key jwk.Key) (string, error)

Calculate a key's KID by hashing it using a canonical JSON representation and SHA256. This function will drop any private-key parameters.

func GetEndorsedKID

func GetEndorsedKID(t jwt.Token) (string, error)

Get the KID of a key endorsed in an emblem. If the endorsed key has no KID, it will be calculated.

func GetKID

func GetKID(key jwk.Key) (string, error)

Get a key's KID. If it has no KID, it will be calculated.

func SetKID

func SetKID(key jwk.Key, force bool) error

Set a key's KID if not already present.

func SetKIDs

func SetKIDs(set jwk.Set, alg *jwa.SignatureAlgorithm) (jwk.Set, error)

Calculate and set the KID of every key in the given set. Will override old KIDs.

func VerifyConstraints

func VerifyConstraints(emblem jwt.Token, endorsement jwt.Token) error

Verify that the given emblem complies with the given endorsement's constraints.

Types

type ChannelMask

type ChannelMask byte

const DNS ChannelMask = 0b0000_0001

const TLS ChannelMask = 0b0000_0010

const UDP ChannelMask = 0b0000_0100

func (*ChannelMask) MarshalJSON

func (cm *ChannelMask) MarshalJSON() ([]byte, error)

func (*ChannelMask) UnmarshalJSON

func (cm *ChannelMask) UnmarshalJSON(bs []byte) error

type EmbeddedKey

type EmbeddedKey struct {
	Key jwk.Key
}

Wrapper type to parse "key" field as jwk.Key.

func (*EmbeddedKey) UnmarshalJSON

func (ek *EmbeddedKey) UnmarshalJSON(bs []byte) (err error)

Attempt to parse a JSON value as string that contains a single JWK in JSON encoding.

type EmblemConstraints

type EmblemConstraints struct {
	Purpose      *PurposeMask `json:"prp,omitempty"`
	Distribution *ChannelMask `json:"dst,omitempty"`
	Assets       []*ident.AI  `json:"ass,omitempty"`
	Window       *int         `json:"wnd,omitempty"`
}

type LeafHash

type LeafHash struct {
	B64 string
	Raw []byte
}

Wrapper type for easier JSON unmarshalling of base64-encoded JSON strings of leaf hashes.

func (*LeafHash) MarshalJSON

func (h *LeafHash) MarshalJSON() ([]byte, error)

func (*LeafHash) UnmarshalJSON

func (h *LeafHash) UnmarshalJSON(bs []byte) (err error)

Attempt to parse a JSON value as string that contains a base64-encoded leaf hash.

type LogConfig

type LogConfig struct {
	Ver  string   `json:"ver"`
	Id   string   `json:"id"`
	Hash LeafHash `json:"hash"`
}

Struct that represents an identifying log binding.

type PurposeMask

type PurposeMask byte

const Indicative PurposeMask = 0b0000_0010

const Protective PurposeMask = 0b0000_0001

func (*PurposeMask) MarshalJSON

func (pm *PurposeMask) MarshalJSON() ([]byte, error)

func (*PurposeMask) UnmarshalJSON

func (pm *PurposeMask) UnmarshalJSON(in []byte) error