past

Documentation

Overview

Package past implements the Platform-Agnostic Security Tokens specification.

key, err := past.NewKey()
if err != nil {
	// handle error
}
data := `{"data":"this is an authenticated message","exp":"2039-01-01T00:00:00"}`
token, err := past.V2.Auth(key, data)

Index

• Variables
• func NewKey() ([]byte, error)
• func NewV1SignKey() (*rsa.PrivateKey, error)
• func NewV2SignKey() (ed25519.PrivateKey, error)
• type Version
  • func (v *Version) Auth(key, payload []byte) (string, error)
  • func (v *Version) AuthVerify(key []byte, token string) ([]byte, error)
  • func (v *Version) Enc(key, payload []byte) (string, error)
  • func (v *Version) EncVerify(key []byte, token string) ([]byte, error)
  • func (v *Version) Sign(key crypto.Signer, payload []byte) (string, error)
  • func (v *Version) SignVerify(key crypto.PublicKey, token string) ([]byte, error)

Variables

var (
	// V1 implements the following algorithms:
	// - auth: HMAC-SHA384
	// - enc:  AES-256-CTR + HMAC-SHA384 (Encrypt-then-MAC) with HKDF-SHA384
	// - sign: *not implemented* (RSASSA-PSS)
	V1 = Version{version1{}}
	// V2 implements the following algorithms:
	// - auth: HMAC-SHA512
	// - enc:  *not implemented* (XChaCha20-Poly1305)
	// - sign: ED25519
	V2 = Version{version2{}}
)

Functions

func NewKey

func NewKey() ([]byte, error)

NewKey returns a symmetric key for authentication and/or encryption.

func NewV1SignKey

func NewV1SignKey() (*rsa.PrivateKey, error)

NewV1SignKey returns a signing key used for V1 signatures.

func NewV2SignKey

func NewV2SignKey() (ed25519.PrivateKey, error)

NewV2SignKey returns a signing key used for V2 signatures.

Types

type Version

type Version struct {
	// contains filtered or unexported fields
}

Version is a PAST version. The version determines the authentication, encryption and signing algorithms used to creating tokens.

func (*Version) Auth

func (v *Version) Auth(key, payload []byte) (string, error)

Auth creates an authenticated token from the key and payload.

func (*Version) AuthVerify

func (v *Version) AuthVerify(key []byte, token string) ([]byte, error)

AuthVerify verifies the token's authentication tag and returns the payload.

func (*Version) Enc

func (v *Version) Enc(key, payload []byte) (string, error)

Enc returns a token that encrypts and authenticates the payload.

func (*Version) EncVerify

func (v *Version) EncVerify(key []byte, token string) ([]byte, error)

EncVerify decrypts and authenticates a token and returns the payload.

func (*Version) Sign

func (v *Version) Sign(key crypto.Signer, payload []byte) (string, error)

Sign creates a signed token from the key and payload.

func (*Version) SignVerify

func (v *Version) SignVerify(key crypto.PublicKey, token string) ([]byte, error)

SignVerify verifies the token's signature and returns the paylaod.