signed

Documentation

Index

• Variables
• func RegisterVerifier(algorithm data.SigAlgorithm, v Verifier)
• func Sign(service CryptoService, s *data.Signed, keys ...data.PublicKey) error
• func Unmarshal(b []byte, v interface{}, role string, minVersion int, db *keys.KeyDB) error
• func UnmarshalTrusted(b []byte, v interface{}, role string, db *keys.KeyDB) error
• func Verify(s *data.Signed, role string, minVersion int, db *keys.KeyDB) error
• func VerifyRoot(s *data.Signed, minVersion int, keys map[string]data.PublicKey) error
• func VerifySignatures(s *data.Signed, role string, db *keys.KeyDB) error
• type CryptoService
• type ECDSAVerifier
  • func (v ECDSAVerifier) Verify(key data.PublicKey, sig []byte, msg []byte) error
• type Ed25519
  • func NewEd25519() *Ed25519
  • func (e *Ed25519) Create(role string, algorithm data.KeyAlgorithm) (data.PublicKey, error)
  • func (e *Ed25519) GetKey(keyID string) data.PublicKey
  • func (e *Ed25519) PublicKeys(keyIDs ...string) (map[string]data.PublicKey, error)
  • func (e *Ed25519) RemoveKey(keyID string) error
  • func (e *Ed25519) Sign(keyIDs []string, toSign []byte) ([]data.Signature, error)
• type Ed25519Verifier
  • func (v Ed25519Verifier) Verify(key data.PublicKey, sig []byte, msg []byte) error
• type ErrExpired
  • func (e ErrExpired) Error() string
• type ErrInvalidKeyLength
  • func (e ErrInvalidKeyLength) Error() string
• type ErrInvalidKeyType
  • func (e ErrInvalidKeyType) Error() string
• type ErrLowVersion
  • func (e ErrLowVersion) Error() string
• type ErrRoleThreshold
  • func (e ErrRoleThreshold) Error() string
• type KeyService
• type RSAPKCS1v15Verifier
  • func (v RSAPKCS1v15Verifier) Verify(key data.PublicKey, sig []byte, msg []byte) error
• type RSAPSSVerifier
  • func (v RSAPSSVerifier) Verify(key data.PublicKey, sig []byte, msg []byte) error
• type RSAPyCryptoVerifier
  • func (v RSAPyCryptoVerifier) Verify(key data.PublicKey, sig []byte, msg []byte) error
• type SigningService
• type Verifier

Variables

var (
	ErrMissingKey   = errors.New("tuf: missing key")
	ErrNoSignatures = errors.New("tuf: data has no signatures")
	ErrInvalid      = errors.New("tuf: signature verification failed")
	ErrWrongMethod  = errors.New("tuf: invalid signature type")
	ErrUnknownRole  = errors.New("tuf: unknown role")
	ErrWrongType    = errors.New("tuf: meta file has wrong type")
)

var IsExpired = func(t time.Time) bool {
	return t.Before(time.Now())
}

var Verifiers = map[data.SigAlgorithm]Verifier{
	data.RSAPSSSignature:      RSAPSSVerifier{},
	data.RSAPKCS1v15Signature: RSAPKCS1v15Verifier{},
	data.PyCryptoSignature:    RSAPyCryptoVerifier{},
	data.ECDSASignature:       ECDSAVerifier{},
	data.EDDSASignature:       Ed25519Verifier{},
}

Verifiers serves as a map of all verifiers available on the system and can be injected into a verificationService. For testing and configuration purposes, it will not be used by default.

Functions

func RegisterVerifier

func RegisterVerifier(algorithm data.SigAlgorithm, v Verifier)

RegisterVerifier provides a convenience function for init() functions to register additional verifiers or replace existing ones.

func Sign

func Sign(service CryptoService, s *data.Signed, keys ...data.PublicKey) error

Sign takes a data.Signed and a key, calculated and adds the signature to the data.Signed

func Unmarshal

func Unmarshal(b []byte, v interface{}, role string, minVersion int, db *keys.KeyDB) error

func UnmarshalTrusted

func UnmarshalTrusted(b []byte, v interface{}, role string, db *keys.KeyDB) error

func Verify

func Verify(s *data.Signed, role string, minVersion int, db *keys.KeyDB) error

func VerifyRoot

func VerifyRoot(s *data.Signed, minVersion int, keys map[string]data.PublicKey) error

VerifyRoot checks if a given root file is valid against a known set of keys. Threshold is always assumed to be 1

func VerifySignatures

func VerifySignatures(s *data.Signed, role string, db *keys.KeyDB) error

Types

type CryptoService

type CryptoService interface {
	SigningService
	KeyService
}

CryptoService defines a unified Signing and Key Service as this will be most useful for most applications.

type ECDSAVerifier

type ECDSAVerifier struct{}

ECDSAVerifier checks ECDSA signatures, decoding the keyType appropriately

func (ECDSAVerifier) Verify

func (v ECDSAVerifier) Verify(key data.PublicKey, sig []byte, msg []byte) error

Verify does the actual check.

type Ed25519

type Ed25519 struct {
	// contains filtered or unexported fields
}

Ed25519 implements a simple in memory cryptosystem for ED25519 keys

func NewEd25519

func NewEd25519() *Ed25519

func (*Ed25519) Create

func (e *Ed25519) Create(role string, algorithm data.KeyAlgorithm) (data.PublicKey, error)

func (*Ed25519) GetKey

func (e *Ed25519) GetKey(keyID string) data.PublicKey

func (*Ed25519) PublicKeys

func (e *Ed25519) PublicKeys(keyIDs ...string) (map[string]data.PublicKey, error)

func (*Ed25519) RemoveKey

func (e *Ed25519) RemoveKey(keyID string) error

func (*Ed25519) Sign

func (e *Ed25519) Sign(keyIDs []string, toSign []byte) ([]data.Signature, error)

type Ed25519Verifier

type Ed25519Verifier struct{}

func (Ed25519Verifier) Verify

func (v Ed25519Verifier) Verify(key data.PublicKey, sig []byte, msg []byte) error

type ErrExpired

type ErrExpired struct {
	Role    string
	Expired string
}

func (ErrExpired) Error

func (e ErrExpired) Error() string

type ErrInvalidKeyLength

type ErrInvalidKeyLength struct {
	// contains filtered or unexported fields
}

func (ErrInvalidKeyLength) Error

func (e ErrInvalidKeyLength) Error() string

type ErrInvalidKeyType

type ErrInvalidKeyType struct{}

func (ErrInvalidKeyType) Error

func (e ErrInvalidKeyType) Error() string

type ErrLowVersion

type ErrLowVersion struct {
	Actual  int
	Current int
}

func (ErrLowVersion) Error

func (e ErrLowVersion) Error() string

type ErrRoleThreshold

type ErrRoleThreshold struct{}

func (ErrRoleThreshold) Error

func (e ErrRoleThreshold) Error() string

type KeyService

type KeyService interface {
	// Create issues a new key pair and is responsible for loading
	// the private key into the appropriate signing service.
	// The role isn't currently used for anything, but it's here to support
	// future features
	Create(role string, algorithm data.KeyAlgorithm) (data.PublicKey, error)

	// GetKey retrieves the public key if present, otherwise it returns nil
	GetKey(keyID string) data.PublicKey

	// RemoveKey deletes the specified key
	RemoveKey(keyID string) error
}

KeyService provides management of keys locally. It will never accept or provide private keys. Communication between the KeyService and a SigningService happen behind the Create function.

type RSAPKCS1v15Verifier

type RSAPKCS1v15Verifier struct{}

RSAPKCS1v15SVerifier checks RSA PKCS1v15 signatures

func (RSAPKCS1v15Verifier) Verify

func (v RSAPKCS1v15Verifier) Verify(key data.PublicKey, sig []byte, msg []byte) error

type RSAPSSVerifier

type RSAPSSVerifier struct{}

RSAPSSVerifier checks RSASSA-PSS signatures

func (RSAPSSVerifier) Verify

func (v RSAPSSVerifier) Verify(key data.PublicKey, sig []byte, msg []byte) error

Verify does the actual check.

type RSAPyCryptoVerifier

type RSAPyCryptoVerifier struct{}

RSAPSSVerifier checks RSASSA-PSS signatures

func (RSAPyCryptoVerifier) Verify

func (v RSAPyCryptoVerifier) Verify(key data.PublicKey, sig []byte, msg []byte) error

Verify does the actual check. N.B. We have not been able to make this work in a way that is compatible with PyCrypto.

type SigningService

type SigningService interface {
	// Sign takes a slice of keyIDs and a piece of data to sign
	// and returns a slice of signatures and an error
	Sign(keyIDs []string, data []byte) ([]data.Signature, error)
}

SigningService defines the necessary functions to determine if a user is able to sign with a key, and to perform signing.

type Verifier

type Verifier interface {
	Verify(key data.PublicKey, sig []byte, msg []byte) error
}

Verifier defines an interface for verfying signatures. An implementer of this interface should verify signatures for one and only one signing scheme.