shares

Documentation

Overview

Package shares contains functions for processing DEK shares.

Index

• Constants
• func CombineShares(shares [][]byte) ([]byte, error)
• func CombineUnwrappedShares(keyCfg *configpb.KeyConfig, unwrappedShares []UnwrappedShare) ([]byte, error)
• func CreateDEKShares(dek DEK, keyCfg *configpb.KeyConfig) ([][]byte, error)
• func HashShare(share []byte) []byte
• func SplitShares(data []byte, shares, threshold int) ([][]byte, error)
• func ValidateShare(share []byte, expectedHash []byte) bool
• type DEK
  • func NewDEK() DEK
• type UnwrappedShare

Constants

const DEKBytes uint32 = 32

DEKBytes is the size of the DEK in bytes.

Functions

func CombineShares

func CombineShares(shares [][]byte) ([]byte, error)

CombineShares takes a list of shares and reconstitutes the original data. Note that this does not guarantee the shares are correct (SSS will succeed at "reconstructing" data from even faulty shares), so integrity checks are done separately.

func CombineUnwrappedShares

func CombineUnwrappedShares(keyCfg *configpb.KeyConfig, unwrappedShares []UnwrappedShare) ([]byte, error)

CombineUnwrappedShares reconstitutes and returns the DEK from the provided shares.

func CreateDEKShares

func CreateDEKShares(dek DEK, keyCfg *configpb.KeyConfig) ([][]byte, error)

CreateDEKShares generates a DEK and - if applicable - splits it into shares.

func HashShare

func HashShare(share []byte) []byte

HashShare performs a SHA-256 hash on the provided share.

func SplitShares

func SplitShares(data []byte, shares, threshold int) ([][]byte, error)

SplitShares takes a DEK as `data`, and returns a slice of byte slices, each representing one of the n shares.

func ValidateShare

func ValidateShare(share []byte, expectedHash []byte) bool

ValidateShare performs HashShare on the provided share, then returns whether the result is equal to the provided hash.

Types

type DEK

type DEK [DEKBytes]byte

DEK represents a byte array that serves as a Data Encryption Key.

func NewDEK

func NewDEK() DEK

NewDEK randomly generates and returns a DEK.

type UnwrappedShare

type UnwrappedShare struct {
	Share []byte
	URI   string
}

UnwrappedShare represents an unwrapped share and its associated external URI.