crypto

Documentation

Overview

Package crypto provides functions to for cryptography and random numbers.

Index

• Constants
• func DeriveKey(secret, salt, info []byte, length uint) ([]byte, error)
• func GenerateCertificateSerialNumber() (*big.Int, error)
• func GenerateRandomBytes(length int) ([]byte, error)
• func PemToX509Cert(raw []byte) (*x509.Certificate, error)
• func X509CertToPem(cert *x509.Certificate) ([]byte, error)

Constants

const (
	// StateDiskKeyLength is key length in bytes for node state disk.
	StateDiskKeyLength = 32
	// DerivedKeyLengthDefault is the default length in bytes for KMS derived keys.
	DerivedKeyLengthDefault = 32
	// MasterSecretLengthDefault is the default length in bytes for CLI generated master secrets.
	MasterSecretLengthDefault = 32
	// MasterSecretLengthMin is the minimal length in bytes for user provided master secrets.
	MasterSecretLengthMin = 16
	// RNGLengthDefault is the number of bytes used for generating nonces.
	RNGLengthDefault = 32
	// DEKPrefix is the prefix used to prefix DEK IDs. Originally introduced as a requirement for the HKDF info parameter.
	DEKPrefix = "key-"
	// MeasurementSecretKeyID is name used for the measurementSecret DEK.
	MeasurementSecretKeyID = "measurementSecret"
)

Functions

func DeriveKey

func DeriveKey(secret, salt, info []byte, length uint) ([]byte, error)

DeriveKey derives a key from a secret.

func GenerateCertificateSerialNumber

func GenerateCertificateSerialNumber() (*big.Int, error)

GenerateCertificateSerialNumber generates a random serial number for an X.509 certificate.

func GenerateRandomBytes

func GenerateRandomBytes(length int) ([]byte, error)

GenerateRandomBytes reads length bytes from getrandom(2) if available, /dev/urandom otherwise.

func PemToX509Cert

func PemToX509Cert(raw []byte) (*x509.Certificate, error)

PemToX509Cert takes a list of PEM-encoded certificates, parses the first one and returns it as an x.509 certificate.

func X509CertToPem

func X509CertToPem(cert *x509.Certificate) ([]byte, error)

X509CertToPem takes an x.509 certificate and returns it as a PEM-encoded certificate.