keys

Documentation

Overview

Package keys manages Curve25519 keypairs for secret sharing via NaCl crypto_box.

Key format:

• bento-pk-<base64url(32 bytes)> — public key
• bento-sk-<base64url(32 bytes)> — private key

Keys are stored as JSON files in a platform-specific directory:

• macOS: ~/.bento/keys/
• Linux: ~/.local/share/bento/keys/ (or $XDG_DATA_HOME/bento/keys/)
• Windows: %LOCALAPPDATA%\bento\keys\

Index

• Constants
• Variables
• func DefaultKeysDir() string
• func DerivePublicKey(priv [32]byte) ([32]byte, error)
• func FormatPrivateKey(key [32]byte) string
• func FormatPublicKey(key [32]byte) string
• func GenerateKeypair() (publicKey, privateKey [32]byte, err error)
• func LoadDefaultKeypair() (pub, priv [32]byte, err error)
• func LoadDefaultKeypairFrom(keysDir string) (pub, priv [32]byte, err error)
• func LoadKeypair(name string) (pub, priv [32]byte, err error)
• func LoadKeypairFrom(keysDir, name string) (pub, priv [32]byte, err error)
• func LoadOrCreateKeypair() (pub, priv [32]byte, created bool, err error)
• func ParsePrivateKey(s string) ([32]byte, error)
• func ParsePublicKey(s string) ([32]byte, error)
• func ResolveRecipients(specifiers []string, configRecipients []ConfigRecipient, senderPub [32]byte, ...) ([][32]byte, error)
• func SaveKeypair(name string, pub, priv [32]byte) error
• func SaveKeypairTo(keysDir, name string, pub, priv [32]byte) error
• type ConfigRecipient
• type KeypairFile
  • func ListKeypairs() ([]KeypairFile, error)
  • func ListKeypairsFrom(keysDir string) ([]KeypairFile, error)

Constants

const (
	PrefixPublicKey  = "bento-pk-"
	PrefixPrivateKey = "bento-sk-"
)

Key prefixes.

Variables

var ErrNoKeypair = errors.New("no keypair found")

ErrNoKeypair is returned when no keypair is found on disk.

Functions

func DefaultKeysDir

func DefaultKeysDir() string

DefaultKeysDir returns the platform-specific keys directory. If BENTO_KEYS_DIR is set, it takes precedence over the platform default.

func DerivePublicKey

func DerivePublicKey(priv [32]byte) ([32]byte, error)

DerivePublicKey computes the Curve25519 public key from a private key.

func FormatPrivateKey

func FormatPrivateKey(key [32]byte) string

FormatPrivateKey encodes a private key as "bento-sk-<base64url>".

func FormatPublicKey

func FormatPublicKey(key [32]byte) string

FormatPublicKey encodes a public key as "bento-pk-<base64url>".

func GenerateKeypair

func GenerateKeypair() (publicKey, privateKey [32]byte, err error)

GenerateKeypair creates a new Curve25519 keypair using crypto/rand. Returns the public and private keys as 32-byte arrays.

func LoadDefaultKeypair

func LoadDefaultKeypair() (pub, priv [32]byte, err error)

LoadDefaultKeypair loads the user's default keypair from the platform- specific keys directory. Returns (publicKey, privateKey, error).

Search order:

1. default.json in the keys directory
2. If no default, iterate named keypairs alphabetically, use first found.
3. If no keypairs exist, return ErrNoKeypair.

func LoadDefaultKeypairFrom

func LoadDefaultKeypairFrom(keysDir string) (pub, priv [32]byte, err error)

LoadDefaultKeypairFrom loads the default keypair from a specific keys directory.

func LoadKeypair

func LoadKeypair(name string) (pub, priv [32]byte, err error)

LoadKeypair loads a named keypair from the keys directory.

func LoadKeypairFrom

func LoadKeypairFrom(keysDir, name string) (pub, priv [32]byte, err error)

LoadKeypairFrom loads a named keypair from a specific keys directory.

func LoadOrCreateKeypair

func LoadOrCreateKeypair() (pub, priv [32]byte, created bool, err error)

LoadOrCreateKeypair loads the default keypair, or generates one if none exists. This is the primary entry point used by save/push flows.

Returns (publicKey, privateKey, created, error) where created=true if a new keypair was generated.

func ParsePrivateKey

func ParsePrivateKey(s string) ([32]byte, error)

ParsePrivateKey decodes a "bento-sk-..." string to 32 bytes. Returns an error if the prefix is wrong or the key is not 32 bytes.

func ParsePublicKey

func ParsePublicKey(s string) ([32]byte, error)

ParsePublicKey decodes a "bento-pk-..." string to 32 bytes. Returns an error if the prefix is wrong or the key is not 32 bytes.

func ResolveRecipients

func ResolveRecipients(
	specifiers []string,
	configRecipients []ConfigRecipient,
	senderPub [32]byte,
	keysDir string,
) ([][32]byte, error)

ResolveRecipients resolves a list of recipient specifiers to public keys.

Each specifier is resolved in order:

1. If it starts with "bento-pk-": parse as a literal public key
2. If it matches a name in bento.yaml recipients: use that key
3. If it matches a file in keysDir/recipients/<name>.pub: read that file
4. Otherwise: return an error with actionable message

The sender's own public key is always appended (implicit self-recipient) and the list is deduplicated by public key bytes.

func SaveKeypair

func SaveKeypair(name string, pub, priv [32]byte) error

SaveKeypair writes a keypair to the keys directory. Creates the directory (0700) and file (0600) if they don't exist.

func SaveKeypairTo

func SaveKeypairTo(keysDir, name string, pub, priv [32]byte) error

SaveKeypairTo writes a keypair to a specific keys directory. Returns an error if a keypair with the same name already exists.

Types

type ConfigRecipient

type ConfigRecipient struct {
	Name string `yaml:"name"`
	Key  string `yaml:"key"`
}

ConfigRecipient represents a recipient entry from bento.yaml.

type KeypairFile

type KeypairFile struct {
	Name       string `json:"name"`
	PublicKey  string `json:"publicKey"`
	PrivateKey string `json:"privateKey"`
	Created    string `json:"created"`
}

KeypairFile is the on-disk JSON format for a keypair.

func ListKeypairs

func ListKeypairs() ([]KeypairFile, error)

ListKeypairs returns all keypair files in the keys directory.

func ListKeypairsFrom

func ListKeypairsFrom(keysDir string) ([]KeypairFile, error)

ListKeypairsFrom returns all keypair files in a specific keys directory.