Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

crypto

package module

Go to main page

Versions in this module

v0

v0.0.4

Jul 18, 2026

v0.0.3

Jul 8, 2026

Changes in this version

+ func X5CFromHeader(h Header) ([]*x509.Certificate, error)

type Header

+ func ParseJWSHeader(token []byte) (Header, error)

v0.0.2

Jul 6, 2026

Changes in this version

+ func JWKThumbprint(pub stdcrypto.PublicKey) (string, error)

v0.0.1

Jul 5, 2026

Changes in this version

+ const ECCGVersion

+ var ErrAlgKeyMismatch = errors.New("crypto: token algorithm does not match key")

+ var ErrAlgorithmNotAllowed = errors.New("crypto: algorithm not allowed by ECCG policy")

+ var ErrCritUnsupported = errors.New("crypto: unsupported critical header parameter")

+ var ErrCurveNotAllowed = errors.New("crypto: curve not allowed by ECCG policy")

+ var ErrDecryptionFailed = errors.New("crypto: decryption failed")

+ var ErrKeyNotFound = errors.New("crypto: key not found")

+ var ErrKeyTypeNotAllowed = errors.New("crypto: key type not allowed by ECCG policy")

+ var ErrMalformed = errors.New("crypto: malformed input")

+ var ErrNoAnchors = errors.New("crypto: no trust anchors provided")

+ var ErrProtectedHeader = errors.New("crypto: forbidden protected header parameter")

+ var ErrVerificationFailed = errors.New("crypto: verification failed")

+ func ECPublicKeyToJWK(pub stdcrypto.PublicKey) (map[string]any, error)

+ func EncryptJWE(recipient stdcrypto.PublicKey, protected map[string]any, payload []byte) ([]byte, error)

+ func GenerateEphemeralKey(crv string) (*ecdsa.PrivateKey, error)

+ func ParseCertChain(raw []byte) ([]*x509.Certificate, error)

+ func ParseECPublicKeyJWK(jwkJSON []byte) (stdcrypto.PublicKey, error)

+ func SignCOSESign1(ctx context.Context, kp KeyProvider, keyID string, protected COSEHeader, ...) ([]byte, error)

+ func SignJWS(ctx context.Context, kp KeyProvider, keyID string, protected map[string]any, ...) ([]byte, error)

+ func VerifyChain(leaf *x509.Certificate, intermediates []*x509.Certificate, opts ChainOptions) ([][]*x509.Certificate, error)

+ type COSEHeader map[int64]any

+ func VerifyCOSESign1(raw []byte, key stdcrypto.PublicKey) ([]byte, COSEHeader, error)

+ type ChainOptions struct

+ Anchors []*x509.Certificate

+ At time.Time

+ EKUs []x509.ExtKeyUsage

+ type Decrypter interface

+ PrivateKey func() stdcrypto.PrivateKey

+ type Header map[string]any

+ func DecryptJWE(ctx context.Context, kp KeyProvider, keyID string, token []byte) ([]byte, Header, error)

+ func VerifyJWS(token []byte, key stdcrypto.PublicKey) ([]byte, Header, error)

+ type KeyProvider interface

+ Decrypter func(ctx context.Context, keyID string) (Decrypter, error)

+ Public func(ctx context.Context, keyID string) (stdcrypto.PublicKey, error)

+ Signer func(ctx context.Context, keyID string) (stdcrypto.Signer, error)

+ type Policy interface

+ AllowedCOSEAlg func(alg int64) bool

+ AllowedCurve func(crv string) bool

+ AllowedHashName func(name string) bool

+ AllowedJWEAlg func(alg, enc string) bool

+ AllowedJWSAlg func(alg string) bool

+ HashForAlg func(alg string) (stdcrypto.Hash, error)

+ HashForMSODigestAlg func(alg string) (stdcrypto.Hash, error)

+ HashForName func(name string) (stdcrypto.Hash, error)

+ func ECCG() Policy

+ type StaticProvider struct

+ func NewStaticProvider(keys map[string]*ecdsa.PrivateKey) *StaticProvider

+ func (p *StaticProvider) Decrypter(_ context.Context, keyID string) (Decrypter, error)

+ func (p *StaticProvider) Public(_ context.Context, keyID string) (stdcrypto.PublicKey, error)

+ func (p *StaticProvider) Signer(_ context.Context, keyID string) (stdcrypto.Signer, error)