hsm

Documentation

Overview

Package hsm provides the HSM service implementation and key management.

Index

• Constants
• func GetPinBlockFormatFromThalesCode(thalesCode string) (pinblock.PinBlockFormat, error)
• type HSM
  • func NewHSM(firmwareVersion string, pciMode bool) (*HSM, error)
  • func (h *HSM) DecryptKeyWithVariantScheme(encryptedKeyData []byte, keyTypeStr string, schemeTag byte) ([]byte, error)
  • func (h *HSM) EncryptKeyWithVariantScheme(keyData []byte, keyTypeStr string, schemeTag byte) ([]byte, error)
  • func (h *HSM) FirmwareVersion() string
  • func (h *HSM) GenerateRandomKey(length int) ([]byte, error)
• type HSMInterface

Constants

const FirmwareVersion = "7000-E000"

FirmwareVersion is the constant firmware version for the HSM.

Functions

func GetPinBlockFormatFromThalesCode

func GetPinBlockFormatFromThalesCode(thalesCode string) (pinblock.PinBlockFormat, error)

GetPinBlockFormatFromThalesCode maps a Thales PIN block format code string to the corresponding pinblock.PinBlockFormat. The Thales codes are based on common interpretations of their documentation.

Types

type HSM

type HSM struct {
	VariantLmkSet variantlmk.LMKSet
	PciMode       bool
	// contains filtered or unexported fields
}

HSM represents the hardware security module server. It holds the Variant LMK set for scheme-based encryption, firmware version, and PCI compliance mode.

func NewHSM

func NewHSM(firmwareVersion string, pciMode bool) (*HSM, error)

NewHSM creates a new HSM instance. firmwareVersion is the HSM firmware version string. pciMode determines which set of key type definitions to use for Variant LMK operations.

func (*HSM) DecryptKeyWithVariantScheme

func (h *HSM) DecryptKeyWithVariantScheme(
	encryptedKeyData []byte,
	keyTypeStr string,
	schemeTag byte,
) ([]byte, error)

DecryptKeyWithVariantScheme decrypts key data that was encrypted under a variant LMK using a specific key type and scheme tag ('U' or 'T'). encryptedKeyData is the ciphertext key to be decrypted. keyTypeStr is the string representation of the key type (e.g., "001", "209"). schemeTag is 'U' for double-length TDES keys or 'T' for triple-length TDES keys.

func (*HSM) EncryptKeyWithVariantScheme

func (h *HSM) EncryptKeyWithVariantScheme(
	keyData []byte,
	keyTypeStr string,
	schemeTag byte,
) ([]byte, error)

EncryptKeyWithVariantScheme encrypts key data under a variant LMK using a specific key type and scheme tag ('U' or 'T'). keyData is the plaintext key to be encrypted (16 bytes for 'U', 24 bytes for 'T'). keyTypeStr is the string representation of the key type (e.g., "001", "209"). schemeTag is 'U' for double-length TDES keys or 'T' for triple-length TDES keys.

func (*HSM) FirmwareVersion

func (h *HSM) FirmwareVersion() string

FirmwareVersion returns the HSM firmware version.

func (*HSM) GenerateRandomKey

func (h *HSM) GenerateRandomKey(length int) ([]byte, error)

GenerateRandomKey generates a cryptographically secure random key of the specified length.

type HSMInterface

type HSMInterface interface {
	// GenerateRandomKey generates a cryptographically secure random key of the specified length.
	GenerateRandomKey(length int) ([]byte, error)

	// EncryptKeyWithVariantScheme encrypts key data under a variant LMK using a specific key type and scheme tag.
	EncryptKeyWithVariantScheme(keyData []byte, keyTypeStr string, schemeTag byte) ([]byte, error)

	// DecryptKeyWithVariantScheme decrypts key data that was encrypted under a variant LMK.
	DecryptKeyWithVariantScheme(
		encryptedKeyData []byte,
		keyTypeStr string,
		schemeTag byte,
	) ([]byte, error)

	// FirmwareVersion returns the HSM firmware version.
	FirmwareVersion() string
}

HSMInterface defines the interface for HSM operations.