kbcmf

package
v1.0.4-0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 30, 2015 License: BSD-3-Clause, BSD-3-Clause Imports: 15 Imported by: 0

Documentation

Index

Constants

View Source 
const EncryptionArmorFooter = "END KEYBASE ENCRYPTED MESSAGE"

EncryptionArmorFooter is the footer that marks the end of an encrypted armored KB message

View Source 
const EncryptionArmorHeader = "BEGIN KEYBASE ENCRYPTED MESSAGE"

EncryptionArmorHeader is the header that marks the start of an encrypted armored KB message

View Source 
const EncryptionBlockSize int = 1048576

EncryptionBlockSize is by default 1MB and can't currently be tweaked.

Variables

View Source 
var (
	// ErrNoDecryptionKey is an error indicating no decryption key was found for the
	// incoming message. You'll get one of these if you respond to a Keyring.LookupSecretBoxKey
	// request with a (-1,nil) return value.
	ErrNoDecryptionKey = errors.New("no decryption key found for message")

	// ErrNoSenderKey indicates that on decryption we couldn't find a public key
	// for the sender.
	ErrNoSenderKey = errors.New("no sender key found for message")

	// ErrTrailingGarbage indicates that additional msgpack packets were found after the
	// end of the encryption stream.
	ErrTrailingGarbage = errors.New("trailing garbage found at end of message")

	// ErrPacketOverflow indicates that more than (2^64-2) packets were found in an encryption
	// stream.  This would indicate a very big message, and results in an error here.
	ErrPacketOverflow = errors.New("no more than 2^32 packets in a message are supported")

	// ErrBadFrame indiciates improper msgpack framing
	ErrBadFrame = errors.New("bad msgpack framing byte")

	// ErrInsufficientRandomness is generated when the encryption fails to collect
	// enough randomness to proceed.  We're using the standard crypto/rand source
	// of randomness, so this should never happen
	ErrInsufficientRandomness = errors.New("could not collect enough randomness")

	// ErrNoGroupMACKey is produced when we lack a group MAC key but the authenticated
	// ciphertexts indicated that one was required.
	ErrNoGroupMACKey = errors.New("no group MAC key, but we needed one")

	// ErrBadArmorFrame shows up when the ASCII armor frame has non-ASCII
	ErrBadArmorFrame = errors.New("bad frame found; had non-ASCII")

	// ErrBadEphemeralKey is for when an ephemeral key fails to be properly
	// imported.
	ErrBadEphemeralKey = errors.New("bad ephermal key in header")

	// ErrBadReceivers shows up when you pass a bad receivers object -- either one
	// that was empty, or one that had an empty group.
	ErrBadReceivers = errors.New("bad receivers argument")

	// ErrBadSenderKey is returned if a key with the wrong number of bytes
	// is discovered in the encryption header.
	ErrBadSenderKey = errors.New("bad sender key; must be 32 bytes")
)
View Source 
var Armor62Params = ArmorParams{
	BytesPerWord: 15,
	WordsPerLine: 200,
	Punctuation:  byte('.'),
	Encoding:     basex.Base62StdEncoding,
}

Armor62Params are the armoring parameters we recommend for use with a generic armorer. It specifies the spaces between words, the spacing between lines, some simple punctuation, and an encoding alphabet.

View Source 
var ErrOverflow = errors.New("buffer was overflowed before we found punctuation")

ErrOverflow is returned if we were looking for punctuation but our quota was overflowed before we found the needed character.

View Source 
var ErrPunctuated = errors.New("found punctuation in stream")

ErrPunctuated is produced when a punctuation character is found in the stream. It can be returned along with data, unlike usual errors.

Functions

func Armor62Open 

func Armor62Open(msg string) (body []byte, header string, footer string, err error)

Armor62Open runs armor stream decoding, but on a string, and it outputs a string.

func Armor62Seal 

func Armor62Seal(plaintext []byte, header string, footer string) (string, error)

Armor62Seal takes an input plaintext and returns and output armor encoding as a string, or an error if a problem was encountered. Also provide a header and a footer to frame the message. Uses Base62 encoding scheme

func ArmorOpen 

func ArmorOpen(msg string, params ArmorParams) (body []byte, header string, footer string, err error)

ArmorOpen runs armor stream decoding, but on a string, and it outputs a string.

func ArmorSeal 

func ArmorSeal(plaintext []byte, header string, footer string, params ArmorParams) (string, error)

ArmorSeal takes an input plaintext and returns and output armor encoding as a string, or an error if a problem was encountered. Also provide a header and a footer to frame the message.

func CheckArmor62Frame 

func CheckArmor62Frame(frame Frame) error

func Dearmor62DecryptOpen 

func Dearmor62DecryptOpen(ciphertext string, kr Keyring) (plaintext []byte, err error)

Dearmor62DecryptOpen takes an armor62'ed, encrypted ciphertext and attempts to dearmor and decrypt it, using the provided keyring. Checks that the frames in the armor are as expected.

func EncryptArmor62Seal 

func EncryptArmor62Seal(plaintext []byte, sender BoxSecretKey, receivers [][]BoxPublicKey) (string, error)

EncryptArmor62Seal is the non-streaming version of NewEncryptArmor62Stream, which inputs a plaintext (in bytes) and output a ciphertext (as a string).

func NewArmor62EncoderStream 

func NewArmor62EncoderStream(encoded io.Writer, header string, footer string) (io.WriteCloser, error)

NewArmor62EncoderStream makes a new Armor 62 encoding stream, using the base62-alphabet and a 32/43 encoding rate strategy. Pass it an `encoded` stream writer to write the encoded stream to. Also pass a header, and a footer string. It will return an io.WriteCloser on success, that you can write raw (unencoded) data to. An error will be returned if there is trouble writing the header to encoded.

To make the output look pretty, a space is inserted every 15 characters of output, and a newline is inserted every 200 words.

func NewArmorEncoderStream 

func NewArmorEncoderStream(encoded io.Writer, header string, footer string, params ArmorParams) (io.WriteCloser, error)

NewArmorEncoderStream makes a new Armor encoding stream, using the given encoding Pass it an `encoded` stream writer to write the encoded stream to. Also pass a header, and a footer string. It will return an io.WriteCloser on success, that you can write raw (unencoded) data to. An error will be returned if there is trouble writing the header to encoded.

To make the output look pretty, a space is inserted every 15 characters of output, and a newline is inserted every 200 words.

func NewDecryptStream 

func NewDecryptStream(r io.Reader, keyring Keyring) (ds io.Reader, err error)

NewDecryptStream starts a streaming decryption. You should give it an io.Writer to write plaintext output to, and also a Keyring to lookup private and public keys as necessary. The stream will only ever write validated data. It returns an io.Writer that you can write the ciphertext stream to, and an error if anything goes wrong in the construction process.

func NewEncryptArmor62Stream 

func NewEncryptArmor62Stream(ciphertext io.Writer, sender BoxSecretKey, receivers [][]BoxPublicKey) (plaintext io.WriteCloser, err error)

NewEncryptArmor62Stream creates a stream that consumes plaintext data. It will write out encrypted data to the io.Writer passed in as ciphertext. The encryption is from the specified sender, and is encrypted for the given receivers. Note that receivers as specified as two-dimensional array. Each inner group of receivers shares the same pairwise MAC-key, so should represent a logic receiver split across multiple devices. Each group of receivers represents a mutually distrustful set of receivers, and will each get their own pairwise-MAC keys.

The ciphertext is additionally armored with the recommended armor62-style format.

Returns an io.WriteCloser that accepts plaintext data to be encrypted; and also returns an error if initialization failed.

func NewEncryptStream 

func NewEncryptStream(ciphertext io.Writer, sender BoxSecretKey, receivers [][]BoxPublicKey) (plaintext io.WriteCloser, err error)

NewEncryptStream creates a stream that consumes plaintext data. It will write out encrypted data to the io.Writer passed in as ciphertext. The encryption is from the specified sender, and is encrypted for the given receivers. Note that receivers as specified as two-dimensional array. Each inner group of receivers shares the same pairwise MAC-key, so should represent a logic receiver split across multiple devices. Each group of receivers represents a mutually distrustful set of receivers, and will each get their own pairwise-MAC keys.

Returns an io.WriteClose that accepts plaintext data to be encrypted; and also returns an error if initialization failed.

func Open 

func Open(ciphertext []byte, keyring Keyring) (plaintext []byte, err error)

Open simply opens a ciphertext given the set of keys in the specified keyring. It return a plaintext on sucess, and an error on failure.

func Seal 

func Seal(plaintext []byte, sender BoxSecretKey, receivers [][]BoxPublicKey) (out []byte, err error)

Seal a plaintext from the given sender, for the specified receiver groups. Returns a ciphertext, or an error if something bad happened.

Types

type ArmorParams 

type ArmorParams struct {
	// BytesPerWord is the number of characters in each "word" of output.
	// We'll put spaces between words.
	BytesPerWord int
	// WordsPerLine is the number of words for each line of output. We'll
	// put newlines between two subsequent lines of output.
	WordsPerLine int
	// Punctuation is the byte inserted after the three "sentences" of
	// our encoding -- the header, the body and the footer.
	Punctuation byte
	// Encoding is the basex encoding to use, including strictness parameters
	Encoding *basex.Encoding
}

ArmorParams specify armor formatting, encoding and punctuation.

type BoxPrecomputedSharedKey 

type BoxPrecomputedSharedKey interface {
	Unbox(nonce *Nonce, msg []byte) ([]byte, error)
}

BoxPrecomputedSharedKey results from a Precomputation below.

type BoxPublicKey 

type BoxPublicKey interface {

	// ToKID outputs the "key ID" that corresponds to this BoxPublicKey.
	// You can do whatever you'd like here, but probably it makes sense just
	// to output the public key as is.
	ToKID() []byte

	// ToRawBoxKeyPointer returns this public key as a *[32]byte,
	// for use with nacl.box.Seal
	ToRawBoxKeyPointer() *RawBoxKey

	// CreateEmphemeralKey creates an ephemeral key of the same type,
	// but totally random.
	CreateEphemeralKey() (BoxSecretKey, error)

	// HideIdentity returns true if we should hide the identity of this
	// key in our output message format.
	HideIdentity() bool
}

BoxPublicKey is an generic interface to NaCl's public key Box function.

type BoxSecretKey 

type BoxSecretKey interface {

	// Box boxes up data, sent from this secret key, and to the receiver
	// specified.
	Box(receiver BoxPublicKey, nonce *Nonce, msg []byte) ([]byte, error)

	// Unobx opens up the box, using this secret key as the receiver key
	// abd the give public key as the sender key.
	Unbox(sender BoxPublicKey, nonce *Nonce, msg []byte) ([]byte, error)

	// GetPublicKey gets the public key associated with this secret key.
	GetPublicKey() BoxPublicKey

	// Precompute computes a DH with the given key
	Precompute(sender BoxPublicKey) BoxPrecomputedSharedKey
}

BoxSecretKey is the secret key corresponding to a BoxPublicKey

type EncryptionBlock 

type EncryptionBlock struct {
	Ciphertext []byte        `codec:"ctext"`
	MACs       [][]byte      `codec:"macs"`
	Tag        PacketTag     `codec:"tag"`
	Version    PacketVersion `codec:"vers"`
	// contains filtered or unexported fields
}

EncryptionBlock contains a block of encrypted data. It cointains the ciphertext, and any necessary MACs.

type EncryptionHeader 

type EncryptionHeader struct {
	Nonce     []byte                    `codec:"nonce"`
	Receivers []receiverKeysCiphertexts `codec:"rcvrs"`
	Sender    []byte                    `codec:"sender"`
	Tag       PacketTag                 `codec:"tag"`
	Version   PacketVersion             `codec:"vers"`
	// contains filtered or unexported fields
}

EncryptionHeader is the first packet in an encrypted message. It contains the encryptions of the session keys, and various message metadata.

type ErrBadArmorFooter 

type ErrBadArmorFooter struct {
	// contains filtered or unexported fields
}

ErrBadArmorFooter shows up when we get the wrong value for our header

func (ErrBadArmorFooter) Error 

func (e ErrBadArmorFooter) Error() string

type ErrBadArmorHeader 

type ErrBadArmorHeader struct {
	// contains filtered or unexported fields
}

ErrBadArmorHeader shows up when we get the wrong value for our header

func (ErrBadArmorHeader) Error 

func (e ErrBadArmorHeader) Error() string

type ErrBadCiphertext 

type ErrBadCiphertext PacketSeqno

ErrBadCiphertext is generated when decryption fails due to improper authentication. It specifies which Packet sequence number the bad packet was in.

func (ErrBadCiphertext) Error 

func (e ErrBadCiphertext) Error() string

type ErrBadGroupID 

type ErrBadGroupID int

ErrBadGroupID is produced if a GroupID is encountered that out-of-range

func (ErrBadGroupID) Error 

func (e ErrBadGroupID) Error() string

type ErrBadNonce 

type ErrBadNonce struct {
	// contains filtered or unexported fields
}

ErrBadNonce is produced when a header nonce is of the wrong size; it should be 20 bytes.

func (ErrBadNonce) Error 

func (e ErrBadNonce) Error() string

type ErrBadVersion 

type ErrBadVersion struct {
	// contains filtered or unexported fields
}

ErrBadVersion is returned if a packet of an unsupported version is found. Current, only Version1 is supported.

func (ErrBadVersion) Error 

func (e ErrBadVersion) Error() string

type ErrMACMismatch 

type ErrMACMismatch PacketSeqno

ErrMACMismatch is generated when a MAC fails to check properly. It specifies which Packet sequence number the bad packet was in.

func (ErrMACMismatch) Error 

func (e ErrMACMismatch) Error() string

type ErrRepeatedKey 

type ErrRepeatedKey []byte

ErrRepeatedKey is produced during encryption if a key is repeated; keys must be unique.

func (ErrRepeatedKey) Error 

func (e ErrRepeatedKey) Error() string

type ErrUnexpectedMAC 

type ErrUnexpectedMAC PacketSeqno

ErrUnexpectedMAC is produced when an encryption includes an additional MAC but none was needed.

func (ErrUnexpectedMAC) Error 

func (e ErrUnexpectedMAC) Error() string

type ErrWrongPacketTag 

type ErrWrongPacketTag struct {
	// contains filtered or unexported fields
}

ErrWrongPacketTag is produced if one packet tag was expected, but a packet of another tag was found.

func (ErrWrongPacketTag) Error 

func (e ErrWrongPacketTag) Error() string

type Frame 

type Frame interface {
	// GetHeader() returns the frame associated with this stream, or an error
	GetHeader() (string, error)
	// GetFooter() returns the frame associated with this stream, or an error
	GetFooter() (string, error)
}

Frame is a way to read the frame out of a Decoder stream.

func NewArmor62DecoderStream 

func NewArmor62DecoderStream(r io.Reader) (io.Reader, Frame, error)

NewArmor62DecoderStream is used to decode input base62-armoring format. It returns a stream you can read from, and also a Frame you can query to see what the open/close frame markers were.

func NewArmorDecoderStream 

func NewArmorDecoderStream(r io.Reader, params ArmorParams) (io.Reader, Frame, error)

NewArmorDecoderStream is used to decode armored encoding. It returns a stream you can read from, and also a Frame you can query to see what the open/close frame markers were.

func NewDearmor62DecryptStream 

func NewDearmor62DecryptStream(ciphertext io.Reader, kr Keyring) (plaintext io.Reader, frame Frame, err error)

NewDearmor62DecryptStream makes a new stream that dearmors and decrypts the given Reader stream. Pass it a keyring so that it can lookup private and public keys as necessary

type Keyring 

type Keyring interface {
	// LookupBoxSecretKey looks in the Keyring for the secret key corresponding
	// to one of the given Key IDs.  Returns the index and the key on success,
	// or -1 and nil on failure.
	LookupBoxSecretKey(kids [][]byte) (int, BoxSecretKey)

	// LookupBoxPublicKey returns a public key given the specified key ID.
	// For most cases, the key ID will be the key itself.
	LookupBoxPublicKey(kid []byte) BoxPublicKey

	// GetAllSecretKeys returns all keys, needed if we want to support
	// "hidden" receivers via trial and error
	GetAllSecretKeys() []BoxSecretKey

	// ImportEphemeralKey imports the ephemeral key into
	// BoxPublicKey format. This key has never been seen before, so
	// will be ephemeral.
	ImportEphemeralKey(kid []byte) BoxPublicKey
}

Keyring is an interface used with decryption; it is call to recover public or private keys during the decryption process. Calls can block on network action.

type Nonce 

type Nonce [24]byte

Nonce is a NaCl-style nonce, with 24 bytes of data, some of which can be counter values, and some of which can be truly random values.

type PacketSeqno 

type PacketSeqno int

PacketSeqno is a special int type used to describe which packet in the sequence we're dealing with. The header is always at seqno=0. Other packets follow. Note that there is a distinction between PacketSeqno and EncryptionBlockNumber. In general, the former is one more than the latter.

type PacketTag 

type PacketTag int

PacketTag is an int used to describe what "tag" or "type" of packet it is. 

const PacketTagEncryptionBlock PacketTag = 2

PacketTagEncryptionBlock is a packet tag to describe the body of an encryption. 

const PacketTagEncryptionHeader PacketTag = 1

PacketTagEncryptionHeader is a packet tag to describe the first packet in an encryption message. 

const PacketTagSignature PacketTag = 3

PacketTagSignature is a packet tag for describing a signature packet

type PacketVersion 

type PacketVersion int

PacketVersion is an int used to capture the packet version. Right now, only Version=1 is supported 

const PacketVersion1 PacketVersion = 1

PacketVersion1 is currently the only supported packet version

type PunctuatedReader 

type PunctuatedReader struct {
	// contains filtered or unexported fields
}

PunctuatedReader is a stream reader that reads until it hits a usual error OR until it hits a punctuation character. In that latter case it returns an `ErrPunctuation` "error" so that way callers can tell the difference between a normal EOF and a "punctuated" EOF.

func NewPunctuatedReader 

func NewPunctuatedReader(r io.Reader, p byte) *PunctuatedReader

NewPunctuatedReader returns a new PunctuatedReader given an underlying read stream and a punctuation byte.

func (*PunctuatedReader) Read 

func (p *PunctuatedReader) Read(out []byte) (n int, err error)

Read from the PunctuatedReader, potentially returning an `ErrPunctuation` if a punctuation character was found.

func (*PunctuatedReader) ReadUntilPunctuation 

func (p *PunctuatedReader) ReadUntilPunctuation(lim int) (res []byte, err error)

ReadUntilPunctuation reads from the stream until it find a desired punctuation byte. If it wasn't found before EOF, it will return io.ErrUnexpectedEOF. If it wasn't found before lim bytes are consumed, then it will return ErrOverflow.

type RawBoxKey 

type RawBoxKey [32]byte

RawBoxKey is the raw byte-representation of what a box key should look like --- a static 32-byte buffer

type SymmetricKey 

type SymmetricKey [32]byte

SymmetricKey is a template for a symmetric key, a 32-byte static buffer. Used for both NaCl SecretBox and also HMAC keys.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.