logic

Documentation

Overview

Package logic provides business logic for HSM commands.

filepath: internal/hsm/logic/CA.go

Package logic implements HSM command business logic.

Package logic implements HSM command business logic.

Package logic provides business logic for HSM commands.

This package just contains stubs for the WASM functions. to avoid linter compains.

Index

• Variables
• func ExecuteA0(input []byte) ([]byte, error)
• func ExecuteB2(input []byte) ([]byte, error)
• func ExecuteBU(input []byte) ([]byte, error)
• func ExecuteCA(input []byte) ([]byte, error)
• func ExecuteCW(input []byte) ([]byte, error)
• func ExecuteCY(input []byte) ([]byte, error)
• func ExecuteDC(input []byte) ([]byte, error)
• func ExecuteEC(input []byte) ([]byte, error)
• func ExecuteFA(input []byte) ([]byte, error)
• func ExecuteHC(input []byte) ([]byte, error)
• func ExecuteKQ(input []byte) ([]byte, error)
• func ExecuteNC(input []byte) ([]byte, error)
• func RegisterKeyBlockLMK(id, lmkHex string) error
• func RegisterVariantLMK(id string)
• func SetDefaultLMKProvider()
• func SetLMKProvider(p LMKProvider)
• func SetupTestLMKProvider() error
• type KeyBlockLMKProvider
  • func (p KeyBlockLMKProvider) DecryptUnderLMK(data []byte, _ string, _ byte, _ string) ([]byte, error)
  • func (p KeyBlockLMKProvider) EncryptUnderLMK(key []byte, keyType string, _ byte, _ string) ([]byte, error)
  • func (p KeyBlockLMKProvider) GetLMKType() LMKType
  • func (p KeyBlockLMKProvider) WrapWithHeader(header keyblocklmk.Header, key []byte) ([]byte, error)
• type LMKEngine
• type LMKProvider
  • func GetLMKProvider() LMKProvider
• type LMKType
• type VariantLMKProvider
  • func (p VariantLMKProvider) DecryptUnderLMK(data []byte, keyType string, schemeTag byte, _ string) ([]byte, error)
  • func (p VariantLMKProvider) EncryptUnderLMK(key []byte, keyType string, schemeTag byte, _ string) ([]byte, error)
  • func (p VariantLMKProvider) GetLMKType() LMKType

Variables

var (

	// LMKProviderInstance provides thread-safe access to the active LMKProvider.
	LMKProviderInstance = lmkProviderProxy{}
)

var LMKRegistry = make(map[string]LMKEngine)

LMKRegistry holds registered LMK engines by string ID.

Functions

func ExecuteA0

func ExecuteA0(input []byte) ([]byte, error)

ExecuteA0 processes the A0 payload and returns response bytes. It always returns: "A1" + "00" + U|hex(newkey under lmk) [+ U|hex(neyKey under ZMK)] + 6-hex-digit KCV of new clear key.

func ExecuteB2

func ExecuteB2(input []byte) ([]byte, error)

ExecuteB2 processes the B2 command payload. B2 is an Echo command that returns the same data back to the caller.

func ExecuteBU

func ExecuteBU(input []byte) ([]byte, error)

ExecuteBU processes the BU payload and returns response bytes. BU command generates a Key Check Value for a provided key. Format: KeyTypeCode(2) + KeyLengthFlag(1) + Key.

func ExecuteCA

func ExecuteCA(input []byte) ([]byte, error)

ExecuteCA translates a PIN block encrypted under a TPK to one encrypted under a ZPK or BDK under Variant LMK.

func ExecuteCW

func ExecuteCW(input []byte) ([]byte, error)

ExecuteCW executes the CW command to generate a CVV.

func ExecuteCY

func ExecuteCY(input []byte) ([]byte, error)

ExecuteCY executes the CY command to verify a CVV.

func ExecuteDC

func ExecuteDC(input []byte) ([]byte, error)

ExecuteDC processes the DC (Verify PIN) command and returns response bytes. Format: [TPK scheme + key](optional) + PIN block + source format code + account number + PVKI + PVV.

func ExecuteEC

func ExecuteEC(input []byte) ([]byte, error)

ExecuteEC processes the EC (Verify PIN) command and returns response bytes. Format: [ZPK scheme + key] + PVK scheme + key + PIN block + format code + account number + PVKI + PVV.

func ExecuteFA

func ExecuteFA(input []byte) ([]byte, error)

ExecuteFA translates a ZPK from ZMK to LMK (Variant LMK, not keyblock).

func ExecuteHC

func ExecuteHC(input []byte) ([]byte, error)

ExecuteHC generates a TMK, TPK or PVK Variant LMK key, ignoring PCI compliance enforcement.

func ExecuteKQ

func ExecuteKQ(input []byte) ([]byte, error)

ExecuteKQ implements the KQ HSM command for ARQC verification and/or ARPC generation. Command supports Visa VIS CVN 10 (scheme 0) with modes 0, 1, 2.

func ExecuteNC

func ExecuteNC(input []byte) ([]byte, error)

ExecuteNC processes the NC payload and returns response bytes.

func RegisterKeyBlockLMK

func RegisterKeyBlockLMK(id, lmkHex string) error

RegisterKeyBlockLMK registers a key block LMK provider under the given ID using the provided LMK hex string.

func RegisterVariantLMK

func RegisterVariantLMK(id string)

RegisterVariantLMK registers a variant LMK provider under the given ID.

func SetDefaultLMKProvider

func SetDefaultLMKProvider()

func SetLMKProvider

func SetLMKProvider(p LMKProvider)

func SetupTestLMKProvider

func SetupTestLMKProvider() error

SetupTestLMKProvider sets LMKProviderInstance to a deterministic test provider for unit tests. The test provider uses a fixed LMK key and deterministic random key generation.

Types

type KeyBlockLMKProvider

type KeyBlockLMKProvider struct {
	// contains filtered or unexported fields
}

KeyBlockLMKProvider implements LMKEngine for key block LMK operations (wrap/unwrap). It will use the keyblocklmk package under the hood.

func (KeyBlockLMKProvider) DecryptUnderLMK

func (p KeyBlockLMKProvider) DecryptUnderLMK(
	data []byte,
	_ string,
	_ byte,
	_ string,
) ([]byte, error)

DecryptUnderLMK unwraps a key block under the LMK and returns the clear key.

func (KeyBlockLMKProvider) EncryptUnderLMK

func (p KeyBlockLMKProvider) EncryptUnderLMK(
	key []byte,
	keyType string,
	_ byte,
	_ string,
) ([]byte, error)

EncryptUnderLMK encrypts clear key into a key block under the LMK.

func (KeyBlockLMKProvider) GetLMKType

func (p KeyBlockLMKProvider) GetLMKType() LMKType

GetLMKType for KeyBlockLMKProvider.

func (KeyBlockLMKProvider) WrapWithHeader

func (p KeyBlockLMKProvider) WrapWithHeader(header keyblocklmk.Header, key []byte) ([]byte, error)

WrapWithHeader encrypts clear key into a key block using the provided header.

type LMKEngine

type LMKEngine interface {
	EncryptUnderLMK(key []byte, keyType string, schemeTag byte, lmkID string) ([]byte, error)
	DecryptUnderLMK(data []byte, keyType string, schemeTag byte, lmkID string) ([]byte, error)
	GetLMKType() LMKType
}

LMKEngine defines unified interface for variant and keyblock LMKs.

type LMKProvider

type LMKProvider struct {
	EncryptUnderLMK func(plainKey []byte, keyType string, schemeTag byte) ([]byte, error)
	DecryptUnderLMK func(encryptedKey []byte, keyType string, schemeTag byte) ([]byte, error)
	RandomKey       func(length int) ([]byte, error)
}

func GetLMKProvider

func GetLMKProvider() LMKProvider

type LMKType

type LMKType int

LMKType represents the type of LMK: Variant or KeyBlock.

const (
	LMKTypeVariant LMKType = iota
	LMKTypeKeyBlock
)

type VariantLMKProvider

type VariantLMKProvider struct{}

VariantLMKProvider implements LMKEngine using the existing variant LMK functions.

func (VariantLMKProvider) DecryptUnderLMK

func (p VariantLMKProvider) DecryptUnderLMK(
	data []byte,
	keyType string,
	schemeTag byte,
	_ string,
) ([]byte, error)

DecryptUnderLMK decrypts data under variant LMK, ignoring lmkID.

func (VariantLMKProvider) EncryptUnderLMK

func (p VariantLMKProvider) EncryptUnderLMK(
	key []byte,
	keyType string,
	schemeTag byte,
	_ string,
) ([]byte, error)

EncryptUnderLMK encrypts key under variant LMK, ignoring lmkID.

func (VariantLMKProvider) GetLMKType

func (p VariantLMKProvider) GetLMKType() LMKType

GetLMKType for VariantLMKProvider.