keys

Documentation

Overview

Package keys manages the instance master key and per-project ES256 signing keypairs.

The master key never signs anything: it only encrypts project private keys at rest (AES-256-GCM). Each project gets its own ES256 (ECDSA P-256) keypair so a token minted for one app can never validate for another.

Index

• Constants
• func BuildJWKS(pems map[string]string) ([]byte, error)
• func DecryptPrivateKey(mk MasterKey, enc []byte) (*ecdsa.PrivateKey, error)
• func ParsePublicKeyPEM(pubPEM string) (*ecdsa.PublicKey, error)
• func Thumbprint(pub *ecdsa.PublicKey) (string, error)
• type JWK
• type JWKS
• type MasterKey
  • func LoadOrCreateMasterKey(dataDir string, getenv func(string) string) (MasterKey, error)
  • func (mk MasterKey) Decrypt(ciphertext []byte) ([]byte, error)
  • func (mk MasterKey) Encrypt(plaintext []byte) ([]byte, error)
• type SigningKey
  • func GenerateSigningKey(mk MasterKey) (SigningKey, error)

Constants

const MasterKeyEnv = "MOTH_MASTER_KEY"

MasterKeyEnv is the environment variable that injects the master key (64 hex chars) instead of reading it from disk, for KMS-style setups.

Functions

func BuildJWKS

func BuildJWKS(pems map[string]string) ([]byte, error)

BuildJWKS assembles the JWKS document for a project's public keys, given as (kid, public key PEM) pairs.

func DecryptPrivateKey

func DecryptPrivateKey(mk MasterKey, enc []byte) (*ecdsa.PrivateKey, error)

DecryptPrivateKey recovers a project's private key from its encrypted PKCS#8 form.

func ParsePublicKeyPEM

func ParsePublicKeyPEM(pubPEM string) (*ecdsa.PublicKey, error)

ParsePublicKeyPEM parses a PEM-encoded ECDSA public key.

func Thumbprint

func Thumbprint(pub *ecdsa.PublicKey) (string, error)

Thumbprint computes the RFC 7638 JWK thumbprint of a P-256 public key, base64url-encoded; moth uses it as the key's kid.

Types

type JWK

type JWK struct {
	Kty string `json:"kty"`
	Crv string `json:"crv"`
	X   string `json:"x"`
	Y   string `json:"y"`
	Kid string `json:"kid"`
	Use string `json:"use"`
	Alg string `json:"alg"`
}

JWK is a JSON Web Key restricted to the fields moth serves.

type JWKS

type JWKS struct {
	Keys []JWK `json:"keys"`
}

JWKS is the document served at /p/{slug}/.well-known/jwks.json.

type MasterKey

type MasterKey struct {
	// contains filtered or unexported fields
}

MasterKey encrypts project private keys at rest.

func LoadOrCreateMasterKey

func LoadOrCreateMasterKey(dataDir string, getenv func(string) string) (MasterKey, error)

LoadOrCreateMasterKey returns the instance master key. Precedence: the MOTH_MASTER_KEY environment value (via getenv), then dataDir/keys/master.key, which is generated on first use.

func (MasterKey) Decrypt

func (mk MasterKey) Decrypt(ciphertext []byte) ([]byte, error)

Decrypt opens a ciphertext produced by Encrypt.

func (MasterKey) Encrypt

func (mk MasterKey) Encrypt(plaintext []byte) ([]byte, error)

Encrypt seals plaintext with AES-256-GCM; the nonce is prepended.

type SigningKey

type SigningKey struct {
	Kid           string
	Algorithm     string
	PublicKeyPEM  string
	PrivateKeyEnc []byte
}

SigningKey is a freshly generated per-project ES256 keypair in the forms the store needs: the kid, the public part as PEM, and the private part encrypted under the master key.

func GenerateSigningKey

func GenerateSigningKey(mk MasterKey) (SigningKey, error)

GenerateSigningKey creates a new ES256 keypair for a project.