security

Documentation

Index

• Constants
• func B64(bytes []byte) string
• func BuildSecret(input BuildSecretInput) (domain.SecretBody, error)
• func CanonicalJSON(value interface{}) (string, error)
• func DecryptEnvelope(identity domain.LocalIdentityRecord, envelope domain.EnvelopeJSON) ([]byte, error)
• func DecryptSecret(secret domain.SecretBody, envKey []byte) (string, error)
• func DecryptXChaCha(key []byte, payload domain.EncryptedPayload, aad []byte) ([]byte, error)
• func DeriveValueKeys(master []byte, scope string) ([]byte, []byte, error)
• func DeviceIDForSigningPublicKey(publicKey []byte) string
• func EncryptForDevice(identity domain.LocalIdentityRecord, recipientPublicKeyB64 string, ...) (domain.EnvelopeJSON, error)
• func EncryptXChaCha(key []byte, plaintext []byte, aad []byte) (domain.EncryptedPayload, error)
• func Fingerprint(bytes []byte) string
• func NewAccessGrant(projectID string, envName string, identity domain.LocalIdentityRecord, ...) (domain.AccessGrantRecord, error)
• func NewDeviceIdentity(projectID string, name string, platform string) (domain.LocalIdentityRecord, domain.DeviceRecord, error)
• func NewEnvironmentKey(projectID string, envName string, identity domain.LocalIdentityRecord, ...) (domain.EnvironmentKeyRecord, domain.AccessGrantRecord, []byte, error)
• func Now() string
• func PublicDeviceRecord(identity domain.LocalIdentityRecord) domain.DeviceRecord
• func RandomBytes(size int) ([]byte, error)
• func RotateEnvironmentKey(projectID string, envName string, identity domain.LocalIdentityRecord, ...) (domain.EnvironmentKeyRecord, []byte, []byte, error)
• func SignCanonical(value interface{}, identity domain.LocalIdentityRecord) (string, error)
• func SignDeviceRecord(record *domain.DeviceRecord, identity domain.LocalIdentityRecord) error
• func SignEnvelope(envelope domain.EnvelopeJSON, identity domain.LocalIdentityRecord) (string, error)
• func SignSecretBody(secret *domain.SecretBody, identity domain.LocalIdentityRecord) error
• func UB64(value string) ([]byte, error)
• func UUID() (string, error)
• func VerifyCanonical(value interface{}, publicKeyB64 string, signatureB64 string) bool
• func VerifyDeviceRecord(record domain.DeviceRecord) error
• func VerifyEnvelope(envelope domain.EnvelopeJSON, senderPublicKeyB64 string) bool
• func VerifySecretBody(secret domain.SecretBody, publicKeyB64 string, signatureB64 string) bool
• type BuildSecretInput
• type IdentityRegistryEntry
• type IdentityStore
  • func NewIdentityStore() (IdentityStore, error)
  • func (s IdentityStore) Delete(projectID string) error
  • func (s IdentityStore) ListProjectIdentities() ([]IdentityRegistryEntry, error)
  • func (s IdentityStore) Load(projectID string) (domain.LocalIdentityRecord, error)
  • func (s IdentityStore) Path(projectID string) string
  • func (s IdentityStore) ProjectIdentity(projectID string) (IdentityRegistryEntry, bool, error)
  • func (s IdentityStore) RegisterProjectIdentity(identity domain.LocalIdentityRecord, projectName string, root string) error
  • func (s IdentityStore) RegistryPath() (string, error)
  • func (s IdentityStore) Save(identity domain.LocalIdentityRecord) error
  • func (s IdentityStore) UnregisterProjectIdentity(projectID string) error

Constants

const (
	CipherAlg   = "xchacha20-poly1305"
	EnvelopeAlg = "XChaCha20-Poly1305+HKDF-SHA256"
)

Functions

func B64

func B64(bytes []byte) string

func BuildSecret

func BuildSecret(input BuildSecretInput) (domain.SecretBody, error)

func CanonicalJSON

func CanonicalJSON(value interface{}) (string, error)

func DecryptEnvelope

func DecryptEnvelope(identity domain.LocalIdentityRecord, envelope domain.EnvelopeJSON) ([]byte, error)

func DecryptSecret

func DecryptSecret(secret domain.SecretBody, envKey []byte) (string, error)

func DecryptXChaCha

func DecryptXChaCha(key []byte, payload domain.EncryptedPayload, aad []byte) ([]byte, error)

func DeriveValueKeys

func DeriveValueKeys(master []byte, scope string) ([]byte, []byte, error)

func DeviceIDForSigningPublicKey

func DeviceIDForSigningPublicKey(publicKey []byte) string

func EncryptForDevice

func EncryptForDevice(identity domain.LocalIdentityRecord, recipientPublicKeyB64 string, plaintext []byte, meta map[string]string) (domain.EnvelopeJSON, error)

func EncryptXChaCha

func EncryptXChaCha(key []byte, plaintext []byte, aad []byte) (domain.EncryptedPayload, error)

func Fingerprint

func Fingerprint(bytes []byte) string

func NewAccessGrant

func NewAccessGrant(projectID string, envName string, identity domain.LocalIdentityRecord, device domain.DeviceRecord, dek []byte, envKey domain.EnvironmentKeyRecord) (domain.AccessGrantRecord, error)

func NewDeviceIdentity

func NewDeviceIdentity(projectID string, name string, platform string) (domain.LocalIdentityRecord, domain.DeviceRecord, error)

func NewEnvironmentKey

func NewEnvironmentKey(projectID string, envName string, identity domain.LocalIdentityRecord, device domain.DeviceRecord) (domain.EnvironmentKeyRecord, domain.AccessGrantRecord, []byte, error)

func Now

func Now() string

func PublicDeviceRecord

func PublicDeviceRecord(identity domain.LocalIdentityRecord) domain.DeviceRecord

func RandomBytes

func RandomBytes(size int) ([]byte, error)

func RotateEnvironmentKey

func RotateEnvironmentKey(projectID string, envName string, identity domain.LocalIdentityRecord, previous domain.EnvironmentKeyRecord) (domain.EnvironmentKeyRecord, []byte, []byte, error)

func SignCanonical

func SignCanonical(value interface{}, identity domain.LocalIdentityRecord) (string, error)

func SignDeviceRecord

func SignDeviceRecord(record *domain.DeviceRecord, identity domain.LocalIdentityRecord) error

func SignEnvelope

func SignEnvelope(envelope domain.EnvelopeJSON, identity domain.LocalIdentityRecord) (string, error)

func SignSecretBody

func SignSecretBody(secret *domain.SecretBody, identity domain.LocalIdentityRecord) error

func UB64

func UB64(value string) ([]byte, error)

func UUID

func UUID() (string, error)

func VerifyCanonical

func VerifyCanonical(value interface{}, publicKeyB64 string, signatureB64 string) bool

func VerifyDeviceRecord

func VerifyDeviceRecord(record domain.DeviceRecord) error

func VerifyEnvelope

func VerifyEnvelope(envelope domain.EnvelopeJSON, senderPublicKeyB64 string) bool

func VerifySecretBody

func VerifySecretBody(secret domain.SecretBody, publicKeyB64 string, signatureB64 string) bool

Types

type BuildSecretInput

type BuildSecretInput struct {
	ProjectID            string
	Environment          string
	Key                  string
	Plaintext            string
	ChangeReason         string
	EnvironmentKey       []byte
	EnvironmentKeyRecord domain.EnvironmentKeyRecord
	Identity             domain.LocalIdentityRecord
	PreviousVersion      int
}

type IdentityRegistryEntry

type IdentityRegistryEntry struct {
	ProjectID   string `json:"projectId"`
	ProjectName string `json:"projectName"`
	Root        string `json:"root"`
	DeviceID    string `json:"deviceId"`
	Identity    string `json:"identity"`
	UpdatedAt   string `json:"updatedAt"`
}

type IdentityStore

type IdentityStore struct {
	// contains filtered or unexported fields
}

func NewIdentityStore

func NewIdentityStore() (IdentityStore, error)

func (IdentityStore) Delete

func (s IdentityStore) Delete(projectID string) error

func (IdentityStore) ListProjectIdentities

func (s IdentityStore) ListProjectIdentities() ([]IdentityRegistryEntry, error)

func (IdentityStore) Load

func (s IdentityStore) Load(projectID string) (domain.LocalIdentityRecord, error)

func (IdentityStore) Path

func (s IdentityStore) Path(projectID string) string

func (IdentityStore) ProjectIdentity

func (s IdentityStore) ProjectIdentity(projectID string) (IdentityRegistryEntry, bool, error)

func (IdentityStore) RegisterProjectIdentity

func (s IdentityStore) RegisterProjectIdentity(identity domain.LocalIdentityRecord, projectName string, root string) error

func (IdentityStore) RegistryPath

func (s IdentityStore) RegistryPath() (string, error)

func (IdentityStore) Save

func (s IdentityStore) Save(identity domain.LocalIdentityRecord) error

func (IdentityStore) UnregisterProjectIdentity

func (s IdentityStore) UnregisterProjectIdentity(projectID string) error