cryptoutil

package
v3.11.4 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Apr 15, 2021 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source
var EmptyKeyVault crypto.KeyVault = emptyKeyVault{}

EmptyKeyVault is an empty key vault.

Functions

func NewCacheKeyVault added in v3.9.0

func NewCacheKeyVault(main crypto.KeyVault, ttl time.Duration, size int) crypto.KeyVault

func UnwrapAES128Key

func UnwrapAES128Key(ctx context.Context, wrapped *ttnpb.KeyEnvelope, v crypto.KeyVault) (key types.AES128Key, err error)

UnwrapAES128Key performs the RFC 3394 Unwrap algorithm on the given key envelope using the given key vault. If the KEK label is empty, the key is assumed to be stored in the clear.

func UnwrapKeyEnvelope added in v3.10.0

func UnwrapKeyEnvelope(ctx context.Context, ke *ttnpb.KeyEnvelope, v crypto.KeyVault) (*ttnpb.KeyEnvelope, error)

UnwrapKeyEnvelope calls UnwrapAES128Key on the given key envelope using the given key vault if necessary and returns the result as a key envelope. NOTE: UnwrapKeyEnvelope returns ke if unwrapping is not necessary.

func UnwrapSelectedSessionKeys

func UnwrapSelectedSessionKeys(ctx context.Context, keyVault crypto.KeyVault, sk ttnpb.SessionKeys, prefix string, paths ...string) (ttnpb.SessionKeys, error)

func WrapAES128Key

func WrapAES128Key(ctx context.Context, key types.AES128Key, kekLabel string, v crypto.KeyVault) (*ttnpb.KeyEnvelope, error)

WrapAES128Key performs the RFC 3394 Wrap algorithm on the given key using the given key vault and KEK label. If the KEK label is empty, the key will be returned in the clear.

func WrapAES128KeyWithKEK added in v3.10.0

func WrapAES128KeyWithKEK(ctx context.Context, key types.AES128Key, kekLabel string, kek types.AES128Key) (*ttnpb.KeyEnvelope, error)

WrapAES128KeyWithKEK is like WrapAES128Key, but takes a KEK instead of key vault.

Types

type ComponentPrefixKEKLabeler

type ComponentPrefixKEKLabeler struct {
	// Separator is the string to join parts.
	Separator string
	// ReplaceOldNew is a set of old and new string pairs to replace in parts.
	ReplaceOldNew []string
}

ComponentPrefixKEKLabeler is a ComponentKEKLabeler that joins the component prefix, separators and host.

func (ComponentPrefixKEKLabeler) AsKEKLabel

func (c ComponentPrefixKEKLabeler) AsKEKLabel(ctx context.Context, addr string) string

AsKEKLabel returns a KEK label in the form `as:host` from the given address, where `:` is the default separator. Empty parts are omitted.

func (ComponentPrefixKEKLabeler) NsKEKLabel

func (c ComponentPrefixKEKLabeler) NsKEKLabel(ctx context.Context, netID *types.NetID, addr string) string

NsKEKLabel returns a KEK label in the form `ns:netID:host` from the given NetID and address, where `:` is the default separator. Empty parts are omitted.

type MemKeyVault

type MemKeyVault struct {
	ComponentPrefixKEKLabeler
	// contains filtered or unexported fields
}

MemKeyVault is a KeyVault that uses secrets from memory. This implementation does not provide any security as secrets are stored in the clear.

func NewMemKeyVault

func NewMemKeyVault(m map[string][]byte) *MemKeyVault

NewMemKeyVault returns a MemKeyVault. Certificates keys can be appended as PEM block.

func (MemKeyVault) Decrypt added in v3.9.0

func (v MemKeyVault) Decrypt(ctx context.Context, ciphertext []byte, id string) ([]byte, error)

Decrypt implements KeyVault.

func (MemKeyVault) Encrypt added in v3.9.0

func (v MemKeyVault) Encrypt(ctx context.Context, plaintext []byte, id string) ([]byte, error)

Encrypt implements KeyVault.

func (MemKeyVault) ExportCertificate

func (v MemKeyVault) ExportCertificate(ctx context.Context, id string) (*tls.Certificate, error)

ExportCertificate implements KeyVault.

func (MemKeyVault) GetCertificate

func (v MemKeyVault) GetCertificate(ctx context.Context, id string) (*x509.Certificate, error)

GetCertificate implements KeyVault.

func (MemKeyVault) Unwrap

func (v MemKeyVault) Unwrap(ctx context.Context, ciphertext []byte, kekLabel string) ([]byte, error)

Unwrap implements KeyVault.

func (MemKeyVault) Wrap

func (v MemKeyVault) Wrap(ctx context.Context, plaintext []byte, kekLabel string) ([]byte, error)

Wrap implements KeyVault.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL