crypto

Documentation

Index

• func DecodeB64Std(s string) ([]byte, error)
• func ValidateAndParseES256Key(jwk definitions.JWK, allowedKid map[string]struct{}) (*ecdsa.PublicKey, error)
• func VerifySignedDefinitions(env *definitions.SignedDefinitionsResponse, jwks *definitions.JWKSet, ...) error

Functions

func DecodeB64Std

func DecodeB64Std(s string) ([]byte, error)

DecodeB64Std is used for signatures returned as base64 (standard) from the API.

func ValidateAndParseES256Key

func ValidateAndParseES256Key(jwk definitions.JWK, allowedKid map[string]struct{}) (*ecdsa.PublicKey, error)

ValidateAndParseES256Key validates a JWK and returns a usable ECDSA public key.

Validation matches server + .NET SDK behavior: - alg must be ES256 - curve must be P-256 - kid must equal sha1(x||y) + "ES256"

func VerifySignedDefinitions

func VerifySignedDefinitions(env *definitions.SignedDefinitionsResponse, jwks *definitions.JWKSet, allowedKid map[string]struct{}) error

VerifySignedDefinitions verifies a signed definitions response.

It expects: - env.Defs is the exact raw JSON bytes from the "defs" property - env.Timestamp is the integer timestamp (Unix seconds) - env.Signature is base64 (standard) encoding of the ES256 signature