token

package
v0.0.0-...-7f5ad21 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 22, 2026 License: LGPL-2.1 Imports: 23 Imported by: 0

Documentation

Overview

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/AbstractKeyStoreTokenConnection.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/AbstractSignatureTokenConnection.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/predicate/AllKeyEntryPredicate.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/AppleSignatureToken.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/digest/DigestInfoEncoder.java (DSS 6.5.RC1).

Package token ports dss-token (eu.europa.esig.dss.token), the signing-key access layer: connections to PKCS#11 devices, PKCS#12/JKS keystores, and (where the platform supports it) the OS-native MSCAPI and Apple keychain stores, all exposed through one common interface so signing services do not need to know which key storage backend produced a private key.

The main entry types are SignatureTokenConnection (the common connection interface), DSSPrivateKeyEntry (a selected signing key plus its certificate chain), and the concrete connections: Pkcs11SignatureToken, Pkcs12SignatureToken, JKSSignatureToken, KeyStoreSignatureTokenConnection, and the platform-specific MSCAPISignatureToken/AppleSignatureToken.

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/predicate/DSSKeyEntryPredicate.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/DSSPrivateKeyAccessEntry.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/DSSPrivateKeyEntry.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/predicate/ExtendedKeyUsageKeyEntryPredicate.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/JKSSignatureToken.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/KeyStoreSignatureTokenConnection.java (DSS 6.5.RC1).

DEVIATION - java.security.KeyStore: upstream defers entirely to the JCA/JCE KeyStore SPI, which dispatches on ksType ("PKCS12", "JKS", ...) to a registered provider. Go has no such SPI. Of the two ksType values this port's own callers use (JKSSignatureToken, Pkcs12SignatureToken), only PKCS12 has a usable implementation. JKS's proprietary binary format has no Go implementation either in the standard library or under golang.org/x/... (PORTING.md's dependency policy), so every other ksType, including "JKS", reports that gap from keyStoreSignatureTokenConnectionLoad.

DEVIATION - chain preservation: PORTING.md's brief calls for "ToPEM or DecodeChain". Neither exists in a form that preserves both a certificate chain and every key type: this port used to be pinned to golang.org/x/crypto/pkcs12, whose ToPEM re-encodes a private key through x509.MarshalPKCS1PrivateKey/MarshalECPrivateKey and therefore rejects any key type that isn't RSA or ECDSA (Ed25519 and DSA both fail this way), and whose Decode is chain-agnostic but refuses a PFX PDU holding anything but exactly one key bag and one cert bag. Both gaps closed with internal/pfx, a native SafeBag reader/decryptor built directly on internal/asn1ber (see its package doc for the RFC 7292 subset it covers): it decrypts and parses every SafeBag itself - RSA, EC and Ed25519 PKCS#8 keys through crypto/x509, DSA by hand since neither x509.ParsePKCS8PrivateKey nor crypto/dsa parses it - so pkcs12BuildKeyStore below only has to correlate certificates with keys (by localKeyId, then by issuer/subject linkage across the remaining certificates) and never re-encodes a key. golang.org/x/crypto/pkcs12 (see go.mod) is no longer used by this file; dss/spi and dss/spi/validation still use its ToPEM for their own, narrower needs and are unaffected by this change.

DEVIATION - DSA signing: crypto/dsa predates the crypto.Signer interface (it exposes dsa.Sign(rand, *dsa.PrivateKey, hash) directly, not a Sign method), so a *dsa.PrivateKey extracted by internal/pfx is wrapped in dsaPrivateKeySigner below, which signs through dsa.Sign and DER-encodes the (r, s) pair as a Dss-Sig-Value SEQUENCE, exactly as ECDSA's own crypto.Signer implementation encodes its (r, s) pair (RFC 3279 section 2.3.2). DSA itself remains cryptographically supported by the Go standard library, deprecated but present.

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/predicate/KeyUsageKeyEntryPredicate.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/KSPrivateKeyEntry.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/MSCAPISignatureToken.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/PasswordInputCallback.java (DSS 6.5.RC1).

PasswordProtection stands in for java.security.KeyStore.PasswordProtection, a JDK class (not a DSS source file) that every dss-token constructor threads through: KeyStoreSignatureTokenConnection takes it to unlock the store and, by default, every entry within it; AbstractKeyStoreTokenConnection exposes it as the getKeyProtectionParameter() contract; Pkcs11SignatureToken wraps it in a PrefilledPasswordCallback.

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/Pkcs11SignatureToken.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/Pkcs12SignatureToken.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/PrefilledPasswordCallback.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/SignatureTokenConnection.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/SunPKCS11Initializer.java (DSS 6.5.RC1).

Ported from dss-token/src/main/java/eu/europa/esig/dss/token/predicate/ValidAtTimeKeyEntryPredicate.java (DSS 6.5.RC1).

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func DigestInfoEncoderEncode 

func DigestInfoEncoderEncode(algorithmOid string, digest []byte) ([]byte, error)

DigestInfoEncoderEncode encodes the algorithmOid and digest combination into its ASN.1 DigestInfo representation: 

DigestInfo ::= SEQUENCE {
   digestAlgorithm DigestAlgorithmIdentifier,
   digest Digest }

This class is used to encode a given digest to its ASN.1 DigestInfo representation. NOTE: This is used on RSA signing.

Panics with the Java message if algorithmOid is "" or digest is nil (Objects.requireNonNull). A malformed OID - Java's IllegalArgumentException, caught and rewrapped as a DSSException - is returned as an error.

DEVIATION: the BER/DER engine of internal/asn1ber builds the SEQUENCE/OCTET STRING/NULL/OID encodings instead of the manual byte-buffer arithmetic upstream performs (see PORTING.md); the produced bytes are identical since both write the same DER TLV structure.

func DigestInfoEncoderIsEncoded 

func DigestInfoEncoderIsEncoded(data []byte) (result bool)

DigestInfoEncoderIsEncoded verifies whether data is ASN.1 DigestInfo encoded.

DEVIATION: ported statement-by-statement from the Java byte-walk, including its implicit assumption that every length octet is a single byte (no long-form length encoding): a DigestInfo whose SEQUENCE, AlgorithmIdentifier or OCTET STRING length exceeds 127 bytes - unreachable for the digest sizes DSS supports - is reported as not encoded, exactly as upstream's identical arithmetic would.

func SunPKCS11InitializerGetProvider 

func SunPKCS11InitializerGetProvider(configString string) (any, error)

SunPKCS11InitializerGetProvider initializes the JCA SunPKCS11 provider from the given configuration. Port of the static getProvider(String).

DEVIATION: upstream instantiates sun.security.pkcs11.SunPKCS11 through reflection (Class.forName + a Constructor<Provider>(InputStream)) precisely because there is no compile-time API for it; Go has neither that class nor a PKCS11 provider mechanism to reflect into (no cgo, no unmaintained third-party crypto - see PORTING.md), so this always reports the gap instead of attempting anything. See Pkcs11SignatureToken, whose KeyStore() override is the only caller.

Types

type AbstractKeyStoreTokenConnection 

type AbstractKeyStoreTokenConnection struct {
	AbstractSignatureTokenConnection
	// contains filtered or unexported fields
}

AbstractKeyStoreTokenConnection is the keyStore token connection, embedded by every concrete key-store-backed SignatureTokenConnection (AppleSignatureToken, KeyStoreSignatureTokenConnection, MSCAPISignatureToken, Pkcs11SignatureToken).

func (*AbstractKeyStoreTokenConnection) InitAbstractKeyStoreTokenConnection 

func (a *AbstractKeyStoreTokenConnection) InitAbstractKeyStoreTokenConnection(overrides AbstractKeyStoreTokenConnectionOverrides)

InitAbstractKeyStoreTokenConnection wires overrides into the base struct and sets the default key entry predicate, standing in for the default constructor plus field initializer, following the model.TokenBase.InitToken dispatch pattern (see PORTING.md).

func (*AbstractKeyStoreTokenConnection) Key 

func (a *AbstractKeyStoreTokenConnection) Key(alias string) (DSSPrivateKeyEntry, error)

Key allows retrieval of a DSSPrivateKeyEntry by alias. Returns nil if the alias does not exist. Port of getKey(String).

func (*AbstractKeyStoreTokenConnection) KeyWithPassword 

func (a *AbstractKeyStoreTokenConnection) KeyWithPassword(alias string, passwordProtection *PasswordProtection) (DSSPrivateKeyEntry, error)

KeyWithPassword allows retrieval of a DSSPrivateKeyEntry by alias, unlocked with the given passwordProtection. Returns nil if the alias does not exist. Port of getKey(String, PasswordProtection).

func (*AbstractKeyStoreTokenConnection) Keys 

func (a *AbstractKeyStoreTokenConnection) Keys() ([]DSSPrivateKeyEntry, error)

Keys implements SignatureTokenConnection. Port of getKeys().

func (*AbstractKeyStoreTokenConnection) SetKeyEntryPredicate 

func (a *AbstractKeyStoreTokenConnection) SetKeyEntryPredicate(keyEntryPredicate DSSKeyEntryPredicate)

SetKeyEntryPredicate sets a predicate to filter keys to be returned by the Keys() method. Default: NewAllKeyEntryPredicate() - returns all keys extracted from the token connection. Port of setKeyEntryPredicate(Predicate<DSSPrivateKeyEntry>).

Panics with the Java message if keyEntryPredicate is nil (Objects.requireNonNull).

type AbstractKeyStoreTokenConnectionOverrides 

type AbstractKeyStoreTokenConnectionOverrides interface {
	// KeyStore gets the key store. Port of the protected abstract getKeyStore().
	KeyStore() (*keyStore, error)

	// KeyProtectionParameter gets the password protection. Port of the protected abstract
	// getKeyProtectionParameter().
	KeyProtectionParameter() *PasswordProtection
}

AbstractKeyStoreTokenConnectionOverrides is the contract a concrete key-store token connection implements, standing in for the two protected abstract methods AbstractKeyStoreTokenConnection declares.

type AbstractSignatureTokenConnection 

type AbstractSignatureTokenConnection struct{}

AbstractSignatureTokenConnection is the abstract implementation of a remote token connection, embedded by every concrete SignatureTokenConnection to provide the shared sign()/signDigest() machinery.

DEVIATION: Java drives java.security.Signature through JCE algorithm name strings (signatureAlgorithm.getJCEId()) and an optional AlgorithmParameterSpec; Go has no such provider indirection; signing is dispatched directly on EncryptionAlgorithm/DigestAlgorithm and carried out through crypto.Signer (see abstractSignatureTokenConnectionSignRaw and abstractSignatureTokenConnectionPrepareMessage).

func (*AbstractSignatureTokenConnection) Sign 

func (a *AbstractSignatureTokenConnection) Sign(toBeSigned *model.ToBeSigned, digestAlgorithm enumerations.DigestAlgorithm,
	keyEntry DSSPrivateKeyEntry) (*model.SignatureValue, error)

Sign implements SignatureTokenConnection. Port of sign(ToBeSigned, DigestAlgorithm, DSSPrivateKeyEntry).

func (*AbstractSignatureTokenConnection) SignDigest 

func (a *AbstractSignatureTokenConnection) SignDigest(digest model.Digest, keyEntry DSSPrivateKeyEntry) (*model.SignatureValue, error)

SignDigest implements SignatureTokenConnection. Port of signDigest(Digest, DSSPrivateKeyEntry).

func (*AbstractSignatureTokenConnection) SignDigestWithSignatureAlgorithm 

func (a *AbstractSignatureTokenConnection) SignDigestWithSignatureAlgorithm(digest model.Digest,
	signatureAlgorithm enumerations.SignatureAlgorithm, keyEntry DSSPrivateKeyEntry) (*model.SignatureValue, error)

SignDigestWithSignatureAlgorithm implements SignatureTokenConnection. Port of signDigest(Digest, SignatureAlgorithm, DSSPrivateKeyEntry).

func (*AbstractSignatureTokenConnection) SignWithSignatureAlgorithm 

func (a *AbstractSignatureTokenConnection) SignWithSignatureAlgorithm(toBeSigned *model.ToBeSigned,
	signatureAlgorithm enumerations.SignatureAlgorithm, keyEntry DSSPrivateKeyEntry) (*model.SignatureValue, error)

SignWithSignatureAlgorithm implements SignatureTokenConnection. Port of sign(ToBeSigned, SignatureAlgorithm, DSSPrivateKeyEntry).

type AppleSignatureToken 

type AppleSignatureToken struct {
	AbstractKeyStoreTokenConnection
}

AppleSignatureToken provides an API for MacOS Keychain access.

For more details please refer to the used documentation: https://github.com/openjdk/jdk17u/blob/master/src/java.base/macosx/classes/apple/security/KeychainStore.java

DEVIATION: the MacOS Keychain is only reachable through the JCA "KeychainStore" provider, which has no Go counterpart (no cgo, no unmaintained third-party crypto - see PORTING.md); this is therefore never functional in the Go port. KeyStore() always reports so.

func NewAppleSignatureToken 

func NewAppleSignatureToken() *AppleSignatureToken

NewAppleSignatureToken creates the token. Port of the default constructor.

func (*AppleSignatureToken) Close 

func (t *AppleSignatureToken) Close()

Close implements SignatureTokenConnection. Port of close() (nothing to close).

func (*AppleSignatureToken) KeyProtectionParameter 

func (t *AppleSignatureToken) KeyProtectionParameter() *PasswordProtection

KeyProtectionParameter implements AbstractKeyStoreTokenConnectionOverrides. Port of the protected getKeyProtectionParameter().

func (*AppleSignatureToken) KeyStore 

func (t *AppleSignatureToken) KeyStore() (*keyStore, error)

KeyStore implements AbstractKeyStoreTokenConnectionOverrides. Port of the protected getKeyStore().

type DSSKeyEntryPredicate 

type DSSKeyEntryPredicate func(entry DSSPrivateKeyEntry) bool

DSSKeyEntryPredicate filters DSSPrivateKeyEntry values considered by AbstractKeyStoreTokenConnection.Keys.

DEVIATION: Java declares a marker interface extending java.util.function.Predicate<T>. Go represents that single-method functional interface directly as a function type, its Test(T) method becoming a plain call.

func NewAllKeyEntryPredicate 

func NewAllKeyEntryPredicate() DSSKeyEntryPredicate

NewAllKeyEntryPredicate creates the default predicate used as a default implementation which accepts all keys. Port of the AllKeyEntryPredicate class and its test(DSSPrivateKeyEntry).

func NewExtendedKeyUsageKeyEntryPredicate 

func NewExtendedKeyUsageKeyEntryPredicate(extendedKeyUsages ...enumerations.ExtendedKeyUsage) DSSKeyEntryPredicate

NewExtendedKeyUsageKeyEntryPredicate creates a predicate filtering private keys based on the certificate ExtendedKeyUsage attribute value, accepting the given ExtendedKeyUsages. Port of the ExtendedKeyUsage... constructor.

Panics with the Java message if extendedKeyUsages is nil (Objects.requireNonNull); a nil element within it is silently dropped, matching the Java Stream#filter(Objects::nonNull).

func NewExtendedKeyUsageKeyEntryPredicateForOIDs 

func NewExtendedKeyUsageKeyEntryPredicateForOIDs(extendedKeyUsageOIDs ...string) DSSKeyEntryPredicate

NewExtendedKeyUsageKeyEntryPredicateForOIDs creates a predicate filtering private keys based on the certificate ExtendedKeyUsage attribute value, accepting the given ExtendedKeyUsage OIDs. Port of the String... constructor.

Panics with the Java message if extendedKeyUsageOIDs is nil (Objects.requireNonNull).

func NewKeyUsageKeyEntryPredicate 

func NewKeyUsageKeyEntryPredicate(keyUsages ...enumerations.KeyUsageBit) DSSKeyEntryPredicate

NewKeyUsageKeyEntryPredicate creates a predicate filtering private keys based on the certificate KeyUsage attribute value, accepting the given KeyUsageBits.

Panics with the Java message if keyUsages is nil (Objects.requireNonNull).

func NewValidAtTimeKeyEntryPredicate 

func NewValidAtTimeKeyEntryPredicate() DSSKeyEntryPredicate

NewValidAtTimeKeyEntryPredicate creates a predicate filtering keys based on the validity range of the certificate, instantiated with the current time. Port of the empty constructor.

func NewValidAtTimeKeyEntryPredicateAt 

func NewValidAtTimeKeyEntryPredicateAt(validationTime time.Time) DSSKeyEntryPredicate

NewValidAtTimeKeyEntryPredicateAt creates a predicate filtering keys based on the validity range of the certificate (i.e. notBefore - notAfter), checked against the given validationTime. If the time is outside the validity range for the corresponding certificate, the key is not returned. Port of the ValidAtTimeKeyEntryPredicate(Date) constructor.

type DSSPrivateKeyAccessEntry 

type DSSPrivateKeyAccessEntry interface {
	DSSPrivateKeyEntry

	// PrivateKey gets the private key. Port of getPrivateKey().
	PrivateKey() crypto.Signer
}

DSSPrivateKeyAccessEntry provides an interface to a token connection with an exposed (accessible) private key entry. NOTE: That does not mean that the cryptographic private key can be extracted. The interface is meant to only provide direct access to the private key. It is up to the underlying implementation to determine a way the private key can be accessed.

DEVIATION: Java exposes the opaque java.security.PrivateKey, handed to the JCA Signature API for the actual signing. Go has no such indirection: a key capable of signing implements crypto.Signer directly, so PrivateKey() returns that instead.

type DSSPrivateKeyEntry 

type DSSPrivateKeyEntry interface {
	// Certificate retrieves the signing certificate. Port of getCertificate().
	Certificate() *model.CertificateToken

	// CertificateChain retrieves the linked certificate chain. Port of getCertificateChain().
	CertificateChain() []*model.CertificateToken

	// EncryptionAlgorithm gets the EncryptionAlgorithm corresponding to the PrivateKey
	// (RSA, ECDSA,...). Port of getEncryptionAlgorithm().
	EncryptionAlgorithm() enumerations.EncryptionAlgorithm
}

DSSPrivateKeyEntry is the interface for a private key entry retrieved from a SignatureTokenConnection.

type JKSSignatureToken 

type JKSSignatureToken struct {
	KeyStoreSignatureTokenConnection
}

JKSSignatureToken holds all Java KeyStore file access logic.

DEVIATION: JKS is Java's own proprietary key store format; no Go package (stdlib or golang.org/x/...) parses it (see key_store_signature_token_connection.go's file header), so every constructor below returns the same "not supported in the Go port" error keyStoreSignatureTokenConnectionLoad reports for any ksType other than PKCS12.

func NewJKSSignatureToken 

func NewJKSSignatureToken(ksStream io.Reader, password *PasswordProtection) (*JKSSignatureToken, error)

NewJKSSignatureToken creates a SignatureTokenConnection with the provided InputStream to a Java KeyStore file and password. Port of JKSSignatureToken(InputStream, PasswordProtection).

func NewJKSSignatureTokenFromBytes 

func NewJKSSignatureTokenFromBytes(ksBytes []byte, password *PasswordProtection) (*JKSSignatureToken, error)

NewJKSSignatureTokenFromBytes creates a SignatureTokenConnection with the provided binaries to a Java KeyStore and password. Port of JKSSignatureToken(byte[], PasswordProtection).

func NewJKSSignatureTokenFromFile 

func NewJKSSignatureTokenFromFile(ksFile *os.File, password *PasswordProtection) (*JKSSignatureToken, error)

NewJKSSignatureTokenFromFile creates a SignatureTokenConnection with the provided File to a Java KeyStore and password. Port of JKSSignatureToken(File, PasswordProtection).

func NewJKSSignatureTokenFromFilepath 

func NewJKSSignatureTokenFromFilepath(filepath string, password *PasswordProtection) (*JKSSignatureToken, error)

NewJKSSignatureTokenFromFilepath creates a SignatureTokenConnection with the provided filepath to a Java KeyStore file and password. Port of JKSSignatureToken(String, PasswordProtection).

type KSPrivateKeyEntry 

type KSPrivateKeyEntry struct {
	// contains filtered or unexported fields
}

KSPrivateKeyEntry is a wrapper of a private key entry coming from a KeyStore.

DEVIATION: Java wraps a java.security.KeyStore.PrivateKeyEntry, which already bundles the certificate, its chain and the java.security.PrivateKey. Go has no KeyStore abstraction, so the constructor takes the three parsed pieces directly - see KeyStoreSignatureTokenConnection, which is the only caller.

func NewKSPrivateKeyEntry 

func NewKSPrivateKeyEntry(alias string, certificate *x509.Certificate, certificateChain []*x509.Certificate,
	privateKey crypto.Signer) (*KSPrivateKeyEntry, error)

NewKSPrivateKeyEntry creates a KSPrivateKeyEntry for the given alias, certificate, certificate chain and private key. Port of the default constructor KSPrivateKeyEntry(String, KeyStore.PrivateKeyEntry), split into its three constituent parts.

func (*KSPrivateKeyEntry) Alias 

func (e *KSPrivateKeyEntry) Alias() string

Alias gets the entry alias. Port of getAlias().

func (*KSPrivateKeyEntry) Certificate 

func (e *KSPrivateKeyEntry) Certificate() *model.CertificateToken

Certificate implements DSSPrivateKeyEntry. Port of getCertificate().

func (*KSPrivateKeyEntry) CertificateChain 

func (e *KSPrivateKeyEntry) CertificateChain() []*model.CertificateToken

CertificateChain implements DSSPrivateKeyEntry. Port of getCertificateChain().

func (*KSPrivateKeyEntry) EncryptionAlgorithm 

func (e *KSPrivateKeyEntry) EncryptionAlgorithm() enumerations.EncryptionAlgorithm

EncryptionAlgorithm implements DSSPrivateKeyEntry. Port of getEncryptionAlgorithm(), i.e. EncryptionAlgorithm.forKey(certificate.getPublicKey()).

func (*KSPrivateKeyEntry) PrivateKey 

func (e *KSPrivateKeyEntry) PrivateKey() crypto.Signer

PrivateKey implements DSSPrivateKeyAccessEntry. Port of getPrivateKey().

type KeyStoreSignatureTokenConnection 

type KeyStoreSignatureTokenConnection struct {
	AbstractKeyStoreTokenConnection
	// contains filtered or unexported fields
}

KeyStoreSignatureTokenConnection is a connection to a key store.

func NewKeyStoreSignatureTokenConnection 

func NewKeyStoreSignatureTokenConnection(ksStream io.Reader, ksType string,
	password *PasswordProtection) (*KeyStoreSignatureTokenConnection, error)

NewKeyStoreSignatureTokenConnection constructs a KeyStoreSignatureTokenConnection. Please note that the keystore password will also be used to retrieve the private key. For each keystore entry (identifiable by alias) the same private key password will be used. If you want to specify a separate private key password use the KeyWithPassword method. Port of KeyStoreSignatureTokenConnection(InputStream, String, PasswordProtection).

func NewKeyStoreSignatureTokenConnectionFromBytes 

func NewKeyStoreSignatureTokenConnectionFromBytes(ksBytes []byte, ksType string,
	ksPassword *PasswordProtection) (*KeyStoreSignatureTokenConnection, error)

NewKeyStoreSignatureTokenConnectionFromBytes creates a connection from a keyStore's binaries. Port of KeyStoreSignatureTokenConnection(byte[], String, PasswordProtection).

func NewKeyStoreSignatureTokenConnectionFromFile 

func NewKeyStoreSignatureTokenConnectionFromFile(ksFile *os.File, ksType string,
	ksPassword *PasswordProtection) (*KeyStoreSignatureTokenConnection, error)

NewKeyStoreSignatureTokenConnectionFromFile creates a connection from a KeyStore file. Port of KeyStoreSignatureTokenConnection(File, String, PasswordProtection).

func NewKeyStoreSignatureTokenConnectionFromFilepath 

func NewKeyStoreSignatureTokenConnectionFromFilepath(filepath string, ksType string,
	ksPassword *PasswordProtection) (*KeyStoreSignatureTokenConnection, error)

NewKeyStoreSignatureTokenConnectionFromFilepath creates a connection with a path to a KeyStore. Port of KeyStoreSignatureTokenConnection(String, String, PasswordProtection).

func (*KeyStoreSignatureTokenConnection) Close 

func (c *KeyStoreSignatureTokenConnection) Close()

Close implements SignatureTokenConnection. Port of close().

func (*KeyStoreSignatureTokenConnection) KeyProtectionParameter 

func (c *KeyStoreSignatureTokenConnection) KeyProtectionParameter() *PasswordProtection

KeyProtectionParameter implements AbstractKeyStoreTokenConnectionOverrides. Port of the protected getKeyProtectionParameter().

func (*KeyStoreSignatureTokenConnection) KeyStore 

func (c *KeyStoreSignatureTokenConnection) KeyStore() (*keyStore, error)

KeyStore implements AbstractKeyStoreTokenConnectionOverrides. Port of the protected getKeyStore().

type MSCAPISignatureToken 

type MSCAPISignatureToken struct {
	AbstractKeyStoreTokenConnection
}

MSCAPISignatureToken provides all MS CAPI API access logic.

DEVIATION: the Windows certificate store is only reachable through the JCA "Windows-MY" provider, which has no Go counterpart (no cgo, no unmaintained third-party crypto - see PORTING.md); this is therefore never functional in the Go port. KeyStore() always reports so.

func NewMSCAPISignatureToken 

func NewMSCAPISignatureToken() *MSCAPISignatureToken

NewMSCAPISignatureToken creates the token. Port of the default constructor.

func (*MSCAPISignatureToken) Close 

func (t *MSCAPISignatureToken) Close()

Close implements SignatureTokenConnection. Port of close() (nothing to close).

func (*MSCAPISignatureToken) KeyProtectionParameter 

func (t *MSCAPISignatureToken) KeyProtectionParameter() *PasswordProtection

KeyProtectionParameter implements AbstractKeyStoreTokenConnectionOverrides. Port of the protected getKeyProtectionParameter().

func (*MSCAPISignatureToken) KeyStore 

func (t *MSCAPISignatureToken) KeyStore() (*keyStore, error)

KeyStore implements AbstractKeyStoreTokenConnectionOverrides. Port of the protected getKeyStore().

type PasswordInputCallback 

type PasswordInputCallback interface {
	// Password retrieves the password (from the user). Port of getPassword().
	Password() []byte
}

PasswordInputCallback is created in order to retrieve the password from the user when accessing the Key Store.

DEVIATION: Java returns char[] (mutable, zeroable in place); Go strings are immutable, so this returns []byte instead, which callers may zero after use the same way.

type PasswordProtection 

type PasswordProtection struct {
	// contains filtered or unexported fields
}

PasswordProtection is a password holder that can be destroyed (zeroed) once it is no longer needed, mirroring java.security.KeyStore.PasswordProtection implementing javax.security.auth.Destroyable.

DEVIATION: Java stores a char[]; Go has no char type, so the password is held as []byte.

func NewPasswordProtection 

func NewPasswordProtection(password []byte) *PasswordProtection

NewPasswordProtection creates a PasswordProtection wrapping the given password. Port of PasswordProtection(char[] password).

func (*PasswordProtection) Destroy 

func (p *PasswordProtection) Destroy()

Destroy destroys (zeroes) this object's sensitive information, i.e. clears the password. Port of destroy().

func (*PasswordProtection) IsDestroyed 

func (p *PasswordProtection) IsDestroyed() bool

IsDestroyed reports whether this object has been destroyed. Port of isDestroyed().

func (*PasswordProtection) Password 

func (p *PasswordProtection) Password() []byte

Password gets the password. Port of getPassword().

type Pkcs11SignatureToken 

type Pkcs11SignatureToken struct {
	AbstractKeyStoreTokenConnection
}

Pkcs11SignatureToken is a PKCS11 token with callback.

DEVIATION: PKCS11 hardware tokens are only reachable through the JCA SunPKCS11 provider (see SunPKCS11Initializer), which has no Go counterpart; every constructor therefore returns the documented "not supported in the Go port" error instead of a usable token, matching the JKSSignatureToken precedent. The pure configuration-string builder (buildConfig/escapePath) is still ported below as free functions for fidelity, even though nothing in this port can consume their output.

func NewPkcs11SignatureToken 

func NewPkcs11SignatureToken(pkcs11Path string) (*Pkcs11SignatureToken, error)

NewPkcs11SignatureToken creates the SignatureTokenConnection, using the provided path for the library. Port of Pkcs11SignatureToken(String).

func NewPkcs11SignatureTokenWithCallback 

func NewPkcs11SignatureTokenWithCallback(pkcs11Path string, callback PasswordInputCallback) (*Pkcs11SignatureToken, error)

NewPkcs11SignatureTokenWithCallback creates the SignatureTokenConnection, using the provided path for the library and a way of retrieving the password from the user. Port of Pkcs11SignatureToken(String, PasswordInputCallback).

func NewPkcs11SignatureTokenWithCallbackAndConfig 

func NewPkcs11SignatureTokenWithCallbackAndConfig(pkcs11Path string, callback PasswordInputCallback,
	extraPkcs11Config string) (*Pkcs11SignatureToken, error)

NewPkcs11SignatureTokenWithCallbackAndConfig creates the SignatureTokenConnection, using the provided path for the library and a way of retrieving the password from the user. Port of Pkcs11SignatureToken(String, PasswordInputCallback, String).

func NewPkcs11SignatureTokenWithCallbackAndSlot 

func NewPkcs11SignatureTokenWithCallbackAndSlot(pkcs11Path string, callback PasswordInputCallback, slotID int) (*Pkcs11SignatureToken, error)

NewPkcs11SignatureTokenWithCallbackAndSlot creates a SignatureTokenConnection on a specific SmartCard reader (multiple readers may be connected), the keys being accessed using the provided callback. Port of Pkcs11SignatureToken(String, PasswordInputCallback, int).

func NewPkcs11SignatureTokenWithCallbackSlotAndConfig 

func NewPkcs11SignatureTokenWithCallbackSlotAndConfig(pkcs11Path string, callback PasswordInputCallback, slotID int,
	extraPkcs11Config string) (*Pkcs11SignatureToken, error)

NewPkcs11SignatureTokenWithCallbackSlotAndConfig creates a SignatureTokenConnection on a specific SmartCard reader (multiple readers may be connected), the keys being accessed using the provided callback. Port of Pkcs11SignatureToken(String, PasswordInputCallback, int, String).

func NewPkcs11SignatureTokenWithCallbackSlotListIndexAndConfig 

func NewPkcs11SignatureTokenWithCallbackSlotListIndexAndConfig(pkcs11Path string, callback PasswordInputCallback,
	slotID int, slotListIndex int, extraPkcs11Config string) (*Pkcs11SignatureToken, error)

NewPkcs11SignatureTokenWithCallbackSlotListIndexAndConfig creates a SignatureTokenConnection on a specific SmartCard reader identified by its slotListIndex (multiple readers may be connected), the keys being accessed using the provided callback. Port of Pkcs11SignatureToken(String, PasswordInputCallback, int, int, String), the fully parameterized constructor every other overload above delegates to upstream.

func NewPkcs11SignatureTokenWithConfig 

func NewPkcs11SignatureTokenWithConfig(pkcs11Path string, extraPkcs11Config string) (*Pkcs11SignatureToken, error)

NewPkcs11SignatureTokenWithConfig creates the SignatureTokenConnection, using the provided path for the library. Port of Pkcs11SignatureToken(String, String).

func NewPkcs11SignatureTokenWithPassword 

func NewPkcs11SignatureTokenWithPassword(pkcs11Path string, password *PasswordProtection) (*Pkcs11SignatureToken, error)

NewPkcs11SignatureTokenWithPassword creates a SignatureTokenConnection whose keys will be accessed using the provided password, known in advance. Port of Pkcs11SignatureToken(String, PasswordProtection).

func NewPkcs11SignatureTokenWithPasswordAndConfig 

func NewPkcs11SignatureTokenWithPasswordAndConfig(pkcs11Path string, password *PasswordProtection,
	extraPkcs11Config string) (*Pkcs11SignatureToken, error)

NewPkcs11SignatureTokenWithPasswordAndConfig creates a SignatureTokenConnection whose keys will be accessed using the provided password, known in advance. Port of Pkcs11SignatureToken(String, PasswordProtection, String).

func NewPkcs11SignatureTokenWithPasswordAndSlot 

func NewPkcs11SignatureTokenWithPasswordAndSlot(pkcs11Path string, password *PasswordProtection, slotID int) (*Pkcs11SignatureToken, error)

NewPkcs11SignatureTokenWithPasswordAndSlot creates a SignatureTokenConnection on a specific SmartCard reader (multiple readers may be connected), the keys being accessed using the provided password. Port of Pkcs11SignatureToken(String, PasswordProtection, int).

func NewPkcs11SignatureTokenWithPasswordSlotAndConfig 

func NewPkcs11SignatureTokenWithPasswordSlotAndConfig(pkcs11Path string, password *PasswordProtection, slotID int,
	extraPkcs11Config string) (*Pkcs11SignatureToken, error)

NewPkcs11SignatureTokenWithPasswordSlotAndConfig creates a SignatureTokenConnection on a specific SmartCard reader (multiple readers may be connected), the keys being accessed using the provided password. Port of Pkcs11SignatureToken(String, PasswordProtection, int, String).

func (*Pkcs11SignatureToken) Close 

func (t *Pkcs11SignatureToken) Close()

Close implements SignatureTokenConnection. Port of close().

func (*Pkcs11SignatureToken) KeyProtectionParameter 

func (t *Pkcs11SignatureToken) KeyProtectionParameter() *PasswordProtection

KeyProtectionParameter implements AbstractKeyStoreTokenConnectionOverrides. Port of the protected getKeyProtectionParameter() (returns nil: the password is supplied through the PasswordInputCallback instead).

func (*Pkcs11SignatureToken) KeyStore 

func (t *Pkcs11SignatureToken) KeyStore() (*keyStore, error)

KeyStore implements AbstractKeyStoreTokenConnectionOverrides. Port of the protected getKeyStore(), i.e. of getProvider() + KeyStore.getInstance("PKCS11", provider).load(...).

type Pkcs12SignatureToken 

type Pkcs12SignatureToken struct {
	KeyStoreSignatureTokenConnection
}

Pkcs12SignatureToken holds all PKCS#12 file access logic.

func NewPkcs12SignatureToken 

func NewPkcs12SignatureToken(ksStream io.Reader, password *PasswordProtection) (*Pkcs12SignatureToken, error)

NewPkcs12SignatureToken creates a SignatureTokenConnection with the provided InputStream to a PKCS#12 KeyStore file and password. Port of Pkcs12SignatureToken(InputStream, PasswordProtection).

func NewPkcs12SignatureTokenFromBytes 

func NewPkcs12SignatureTokenFromBytes(ksBytes []byte, password *PasswordProtection) (*Pkcs12SignatureToken, error)

NewPkcs12SignatureTokenFromBytes creates a SignatureTokenConnection with the provided binaries to a PKCS#12 KeyStore and password. Port of Pkcs12SignatureToken(byte[], PasswordProtection).

func NewPkcs12SignatureTokenFromFile 

func NewPkcs12SignatureTokenFromFile(ksFile *os.File, password *PasswordProtection) (*Pkcs12SignatureToken, error)

NewPkcs12SignatureTokenFromFile creates a SignatureTokenConnection with the provided File to a PKCS#12 KeyStore and password. Port of Pkcs12SignatureToken(File, PasswordProtection).

func NewPkcs12SignatureTokenFromFilepath 

func NewPkcs12SignatureTokenFromFilepath(filepath string, password *PasswordProtection) (*Pkcs12SignatureToken, error)

NewPkcs12SignatureTokenFromFilepath creates a SignatureTokenConnection with the provided filepath to a PKCS#12 KeyStore file and password. Port of Pkcs12SignatureToken(String, PasswordProtection).

type PrefilledPasswordCallback 

type PrefilledPasswordCallback struct {
	// contains filtered or unexported fields
}

PrefilledPasswordCallback holds a simple, pre-known password.

func NewPrefilledPasswordCallback 

func NewPrefilledPasswordCallback(password *PasswordProtection) *PrefilledPasswordCallback

NewPrefilledPasswordCallback creates a PrefilledPasswordCallback wrapping the given password. Port of the default constructor PrefilledPasswordCallback(PasswordProtection).

func (*PrefilledPasswordCallback) Destroy 

func (c *PrefilledPasswordCallback) Destroy()

Destroy destroys this object's sensitive information, i.e. destroys the wrapped password. Port of destroy(), implementing javax.security.auth.Destroyable.

func (*PrefilledPasswordCallback) IsDestroyed 

func (c *PrefilledPasswordCallback) IsDestroyed() bool

IsDestroyed reports whether this object has been destroyed. Port of isDestroyed().

func (*PrefilledPasswordCallback) Password 

func (c *PrefilledPasswordCallback) Password() []byte

Password implements PasswordInputCallback. Port of getPassword().

type SignatureTokenConnection 

type SignatureTokenConnection interface {
	// Close closes the connection. Port of close().
	Close()

	// Keys retrieves all the available keys (private keys entries) from the token. Port of
	// getKeys().
	Keys() ([]DSSPrivateKeyEntry, error)

	// Sign signs the toBeSigned data with the digest digestAlgorithm and the given keyEntry.
	// Port of sign(ToBeSigned, DigestAlgorithm, DSSPrivateKeyEntry).
	Sign(toBeSigned *model.ToBeSigned, digestAlgorithm enumerations.DigestAlgorithm,
		keyEntry DSSPrivateKeyEntry) (*model.SignatureValue, error)

	// SignWithSignatureAlgorithm signs the toBeSigned data with the pre-defined signature
	// algorithm signatureAlgorithm, and the given keyEntry. Port of
	// sign(ToBeSigned, SignatureAlgorithm, DSSPrivateKeyEntry).
	SignWithSignatureAlgorithm(toBeSigned *model.ToBeSigned, signatureAlgorithm enumerations.SignatureAlgorithm,
		keyEntry DSSPrivateKeyEntry) (*model.SignatureValue, error)

	// SignDigest signs the digest data with the given keyEntry. Port of
	// signDigest(Digest, DSSPrivateKeyEntry).
	SignDigest(digest model.Digest, keyEntry DSSPrivateKeyEntry) (*model.SignatureValue, error)

	// SignDigestWithSignatureAlgorithm signs the digest data with the pre-defined
	// signatureAlgorithm and the given keyEntry. Port of
	// signDigest(Digest, SignatureAlgorithm, DSSPrivateKeyEntry).
	SignDigestWithSignatureAlgorithm(digest model.Digest, signatureAlgorithm enumerations.SignatureAlgorithm,
		keyEntry DSSPrivateKeyEntry) (*model.SignatureValue, error)
}

SignatureTokenConnection is a connection through available API to the QSCD (SmartCard, MSCAPI, PKCS#12).

DEVIATION: Java overloads sign/signDigest by parameter type (DigestAlgorithm vs. SignatureAlgorithm); Go has no overloading, so the SignatureAlgorithm-taking variants carry the "WithSignatureAlgorithm" suffix. Java's `void close()` (an AutoCloseable override that declares no exception) becomes Close() with no error return.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.