cryptography

Documentation

Index

• Constants
• Variables
• func Attenuate(rootKeyID string, secretKey string, caveats map[string]string) (aKeyID string, aSecretKey string, err error)
• func DecodeKeyID(keyID string) (rootKeyID string, caveats map[string]string, err error)
• func DecryptMessage(encryptionKey [32]byte, encryptedField []byte, nonce []byte) (string, error)
• func EncryptMessage(encryptionKey [32]byte, field []byte) (encrypted []byte, nonceString [24]byte, err error)
• type HMACHasher
  • func (hmh *HMACHasher) HMACSha384(payload []byte) ([]byte, error)
• type HMACKey
  • func NewHMACHasher(secret []byte) HMACKey
• type Presignable
  • func NewPresigner(sig []byte) Presignable
• type Presigner
  • func (ps Presigner) HMACSha384(payload []byte) ([]byte, error)
• type TimeLimitedSecret
  • func NewTimeLimitedSecret(secret []byte) TimeLimitedSecret
  • func (secret TimeLimitedSecret) Derive(metadata []byte, date time.Time, expirationDate time.Time) (string, error)
  • func (secret TimeLimitedSecret) Verify(metadata []byte, date time.Time, expirationDate time.Time, token string) (bool, error)

Constants

const SecretTokenPrefix = "secret-token:"

SecretTokenPrefix all secret keys will be contain

Variables

var (
	// ErrEncryptedFieldTooLarge - the sku was invalid
	ErrEncryptedFieldTooLarge = errors.New("encrypted field is greater than 4 KB - this must be chunked")
)

Functions

func Attenuate

func Attenuate(rootKeyID string, secretKey string, caveats map[string]string) (aKeyID string, aSecretKey string, err error)

Attenuate a root keyID and secretKey usign the provided caveats

func DecodeKeyID

func DecodeKeyID(keyID string) (rootKeyID string, caveats map[string]string, err error)

DecodeKeyID into the root keyID and any caveats, which will be null otherwise

func DecryptMessage

func DecryptMessage(encryptionKey [32]byte, encryptedField []byte, nonce []byte) (string, error)

DecryptMessage uses SecretBox to decrypt the message

func EncryptMessage

func EncryptMessage(encryptionKey [32]byte, field []byte) (encrypted []byte, nonceString [24]byte, err error)

EncryptMessage uses SecretBox to encrypt the message

Types

type HMACHasher

type HMACHasher struct {
	// contains filtered or unexported fields
}

HMACHasher is an in process signer implementation for HMACKey

func (*HMACHasher) HMACSha384

func (hmh *HMACHasher) HMACSha384(payload []byte) ([]byte, error)

HMACSha384 hashes using an in process secret

type HMACKey

type HMACKey interface {
	// HMACSha384 does the appropriate hashing
	HMACSha384(payload []byte) ([]byte, error)
}

HMACKey an interface for hashing to hmac-sha384

func NewHMACHasher

func NewHMACHasher(secret []byte) HMACKey

NewHMACHasher creates a new HMACKey for hashing

type Presignable

type Presignable interface {
	HMACSha384(payload []byte) ([]byte, error)
}

Presignable duplicates the hmac interface for signing

func NewPresigner

func NewPresigner(sig []byte) Presignable

NewPresigner creates a new presigner

type Presigner

type Presigner struct {
	// contains filtered or unexported fields
}

Presigner returns the same value always

func (Presigner) HMACSha384

func (ps Presigner) HMACSha384(payload []byte) ([]byte, error)

HMACSha384 presigns a request

type TimeLimitedSecret

type TimeLimitedSecret struct {
	// contains filtered or unexported fields
}

TimeLimitedSecret represents a secret used to derive Time Limited Credentials

func NewTimeLimitedSecret

func NewTimeLimitedSecret(secret []byte) TimeLimitedSecret

NewTimeLimitedSecret - create a new time limited secret structure

func (TimeLimitedSecret) Derive

func (secret TimeLimitedSecret) Derive(metadata []byte, date time.Time, expirationDate time.Time) (string, error)

Derive - derive time limited credential based on date and expiration date

func (TimeLimitedSecret) Verify

func (secret TimeLimitedSecret) Verify(metadata []byte, date time.Time, expirationDate time.Time, token string) (bool, error)

Verify - verify time limited credential based on date being bound within the expiration date of the credential