piv

Documentation

Overview

Package piv implements the PIV keyservice.

Index

• type ECDHKey
  • func (k *ECDHKey) Decrypt(_ io.Reader, sexp []byte, _ crypto.DecrypterOpts) ([]byte, error)
  • func (k *ECDHKey) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error)
• type KeyService
  • func New(l *zap.Logger, pe *pinentry.PINEntry) *KeyService
  • func (p *KeyService) CloseAll()
  • func (p *KeyService) GetDecrypter(keygrip []byte) (crypto.Decrypter, error)
  • func (p *KeyService) GetSigner(keygrip []byte) (crypto.Signer, error)
  • func (p *KeyService) HaveKey(keygrips [][]byte) (bool, []byte, error)
  • func (p *KeyService) Keygrips() ([][]byte, error)
  • func (*KeyService) Name() string
  • func (p *KeyService) SecurityKeys() ([]SecurityKey, error)
• type SecurityKey

Types

type ECDHKey

type ECDHKey struct {
	*pivgo.ECDSAPrivateKey
	// contains filtered or unexported fields
}

ECDHKey implements ECDH using an underlying ECDSA key.

func (*ECDHKey) Decrypt

func (k *ECDHKey) Decrypt(_ io.Reader, sexp []byte,
	_ crypto.DecrypterOpts) ([]byte, error)

Decrypt performs ECDH as per gpg-agent, and implements the crypto.Decrypter interface.

func (*ECDHKey) Sign

func (k *ECDHKey) Sign(rand io.Reader, digest []byte,
	opts crypto.SignerOpts) ([]byte, error)

Sign wraps the underlying private key Sign operation in a mutex.

type KeyService

type KeyService struct {
	// contains filtered or unexported fields
}

KeyService represents a collection of tokens and slots accessed by the Personal Identity Verifaction card interface.

func New

func New(l *zap.Logger, pe *pinentry.PINEntry) *KeyService

New constructs a PIV and returns it.

func (*KeyService) CloseAll

func (p *KeyService) CloseAll()

CloseAll closes all security keys without checking for errors. This should be called to clean up connections to `pcscd`.

func (*KeyService) GetDecrypter

func (p *KeyService) GetDecrypter(keygrip []byte) (crypto.Decrypter, error)

GetDecrypter returns a crypto.Decrypter associated with the given keygrip.

func (*KeyService) GetSigner

func (p *KeyService) GetSigner(keygrip []byte) (crypto.Signer, error)

GetSigner returns a crypto.Signer associated with the given keygrip.

func (*KeyService) HaveKey

func (p *KeyService) HaveKey(keygrips [][]byte) (bool, []byte, error)

HaveKey takes a list of keygrips, and returns a boolean indicating if any of the given keygrips were found, the found keygrip, and an error, if any.

func (*KeyService) Keygrips

func (p *KeyService) Keygrips() ([][]byte, error)

Keygrips returns a single slice of concatenated keygrip byteslices - one for each cryptographic key available on the keyservice.

func (*KeyService) Name

func (*KeyService) Name() string

Name returns the name of the keyservice.

func (*KeyService) SecurityKeys

func (p *KeyService) SecurityKeys() ([]SecurityKey, error)

SecurityKeys returns a slice containing all available security keys.

type SecurityKey

type SecurityKey interface {
	AttestationCertificate() (*x509.Certificate, error)
	Card() string
	Close() error
	Comment(*securitykey.SlotSpec) string
	PrivateKey(*securitykey.CryptoKey) (crypto.PrivateKey, error)
	SigningKeys() []securitykey.SigningKey
	CryptoKeys() []securitykey.CryptoKey
	StringsGPG(string, string) ([]string, error)
	StringsSSH() []string
}

SecurityKey is a simple interface for security keys allowing abstraction over the securitykey implementation, and allowing generation of mocks for testing.