signed

package
v0.4.3 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jan 3, 2017 License: Apache-2.0, BSD-3-Clause Imports: 19 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source
var (
	ErrMissingKey   = errors.New("tuf: missing key")
	ErrNoSignatures = errors.New("tuf: data has no signatures")
	ErrInvalid      = errors.New("tuf: signature verification failed")
	ErrWrongMethod  = errors.New("tuf: invalid signature type")
	ErrUnknownRole  = errors.New("tuf: unknown role")
	ErrWrongType    = errors.New("tuf: meta file has wrong type")
)

Various basic signing errors

Verifiers serves as a map of all verifiers available on the system and can be injected into a verificationService. For testing and configuration purposes, it will not be used by default.

Functions

func IsExpired

func IsExpired(t time.Time) bool

IsExpired checks if the given time passed before the present time

func RegisterVerifier

func RegisterVerifier(algorithm data.SigAlgorithm, v Verifier)

RegisterVerifier provides a convenience function for init() functions to register additional verifiers or replace existing ones.

func Sign

func Sign(service CryptoService, s *data.Signed, signingKeys []data.PublicKey,
	minSignatures int, otherWhitelistedKeys []data.PublicKey) error

Sign takes a data.Signed and a cryptoservice containing private keys, calculates and adds at least minSignature signatures using signingKeys the data.Signed. It will also clean up any signatures that are not in produced by either a signingKey or an otherWhitelistedKey. Note that in most cases, otherWhitelistedKeys should probably be null. They are for keys you don't want to sign with, but you also don't want to remove existing signatures by those keys. For instance, if you want to call Sign multiple times with different sets of signing keys without undoing removing signatures produced by the previous call to Sign.

func VerifyExpiry added in v0.3.0

func VerifyExpiry(s *data.SignedCommon, role string) error

VerifyExpiry returns ErrExpired if the metadata is expired

func VerifySignature added in v0.3.0

func VerifySignature(msg []byte, sig *data.Signature, pk data.PublicKey) error

VerifySignature checks a single signature and public key against a payload If the signature is verified, the signature's is valid field will actually be mutated to be equal to the boolean true

func VerifySignatures

func VerifySignatures(s *data.Signed, roleData data.BaseRole) error

VerifySignatures checks the we have sufficient valid signatures for the given role

func VerifyVersion added in v0.3.0

func VerifyVersion(s *data.SignedCommon, minVersion int) error

VerifyVersion returns ErrLowVersion if the metadata version is lower than the min version

Types

type CryptoService

type CryptoService interface {
	KeyService
}

CryptoService is deprecated and all instances of its use should be replaced with KeyService

type ECDSAVerifier

type ECDSAVerifier struct{}

ECDSAVerifier checks ECDSA signatures, decoding the keyType appropriately

func (ECDSAVerifier) Verify

func (v ECDSAVerifier) Verify(key data.PublicKey, sig []byte, msg []byte) error

Verify does the actual check.

type Ed25519

type Ed25519 struct {
	// contains filtered or unexported fields
}

Ed25519 implements a simple in memory cryptosystem for ED25519 keys

func NewEd25519

func NewEd25519() *Ed25519

NewEd25519 initializes a new empty Ed25519 CryptoService that operates entirely in memory

func (*Ed25519) AddKey added in v0.3.0

func (e *Ed25519) AddKey(role, gun string, k data.PrivateKey) error

AddKey allows you to add a private key

func (*Ed25519) Create

func (e *Ed25519) Create(role, gun, algorithm string) (data.PublicKey, error)

Create generates a new key and returns the public part

func (*Ed25519) GetKey

func (e *Ed25519) GetKey(keyID string) data.PublicKey

GetKey returns a single public key based on the ID

func (*Ed25519) GetPrivateKey

func (e *Ed25519) GetPrivateKey(keyID string) (data.PrivateKey, string, error)

GetPrivateKey returns a single private key and role if present, based on the ID

func (*Ed25519) ListAllKeys

func (e *Ed25519) ListAllKeys() map[string]string

ListAllKeys returns the map of keys IDs to role

func (*Ed25519) ListKeys

func (e *Ed25519) ListKeys(role string) []string

ListKeys returns the list of keys IDs for the role

func (*Ed25519) PublicKeys

func (e *Ed25519) PublicKeys(keyIDs ...string) (map[string]data.PublicKey, error)

PublicKeys returns a map of public keys for the ids provided, when those IDs are found in the store.

func (*Ed25519) RemoveKey

func (e *Ed25519) RemoveKey(keyID string) error

RemoveKey deletes a key from the signer

type Ed25519Verifier

type Ed25519Verifier struct{}

Ed25519Verifier used to verify Ed25519 signatures

func (Ed25519Verifier) Verify

func (v Ed25519Verifier) Verify(key data.PublicKey, sig []byte, msg []byte) error

Verify checks that an ed25519 signature is valid

type ErrExpired

type ErrExpired struct {
	Role    string
	Expired string
}

ErrExpired indicates a piece of metadata has expired

func (ErrExpired) Error

func (e ErrExpired) Error() string

type ErrInsufficientSignatures

type ErrInsufficientSignatures struct {
	FoundKeys     int
	NeededKeys    int
	MissingKeyIDs []string
}

ErrInsufficientSignatures - can not create enough signatures on a piece of metadata

func (ErrInsufficientSignatures) Error

type ErrInvalidKeyID added in v0.3.0

type ErrInvalidKeyID struct{}

ErrInvalidKeyID indicates the specified key ID was incorrect for its associated data

func (ErrInvalidKeyID) Error added in v0.3.0

func (e ErrInvalidKeyID) Error() string

type ErrInvalidKeyLength

type ErrInvalidKeyLength struct {
	// contains filtered or unexported fields
}

ErrInvalidKeyLength indicates that while we may support the cipher, the provided key length is not specifically supported, i.e. we support RSA, but not 1024 bit keys

func (ErrInvalidKeyLength) Error

func (e ErrInvalidKeyLength) Error() string

type ErrInvalidKeyType

type ErrInvalidKeyType struct{}

ErrInvalidKeyType indicates the types for the key and signature it's associated with are mismatched. Probably a sign of malicious behaviour

func (ErrInvalidKeyType) Error

func (e ErrInvalidKeyType) Error() string

type ErrLowVersion

type ErrLowVersion struct {
	Actual  int
	Current int
}

ErrLowVersion indicates the piece of metadata has a version number lower than a version number we're already seen for this role

func (ErrLowVersion) Error

func (e ErrLowVersion) Error() string

type ErrNoKeys

type ErrNoKeys struct {
	KeyIDs []string
}

ErrNoKeys indicates no signing keys were found when trying to sign

func (ErrNoKeys) Error

func (e ErrNoKeys) Error() string

type ErrRoleThreshold

type ErrRoleThreshold struct {
	Msg string
}

ErrRoleThreshold indicates we did not validate enough signatures to meet the threshold

func (ErrRoleThreshold) Error

func (e ErrRoleThreshold) Error() string

type KeyService

type KeyService interface {
	// Create issues a new key pair and is responsible for loading
	// the private key into the appropriate signing service.
	Create(role, gun, algorithm string) (data.PublicKey, error)

	// AddKey adds a private key to the specified role and gun
	AddKey(role, gun string, key data.PrivateKey) error

	// GetKey retrieves the public key if present, otherwise it returns nil
	GetKey(keyID string) data.PublicKey

	// GetPrivateKey retrieves the private key and role if present and retrievable,
	// otherwise it returns nil and an error
	GetPrivateKey(keyID string) (data.PrivateKey, string, error)

	// RemoveKey deletes the specified key, and returns an error only if the key
	// removal fails. If the key doesn't exist, no error should be returned.
	RemoveKey(keyID string) error

	// ListKeys returns a list of key IDs for the role, or an empty list or
	// nil if there are no keys.
	ListKeys(role string) []string

	// ListAllKeys returns a map of all available signing key IDs to role, or
	// an empty map or nil if there are no keys.
	ListAllKeys() map[string]string
}

KeyService provides management of keys locally. It will never accept or provide private keys. Communication between the KeyService and a SigningService happen behind the Create function.

type RSAPKCS1v15Verifier

type RSAPKCS1v15Verifier struct{}

RSAPKCS1v15Verifier checks RSA PKCS1v15 signatures

func (RSAPKCS1v15Verifier) Verify

func (v RSAPKCS1v15Verifier) Verify(key data.PublicKey, sig []byte, msg []byte) error

Verify does the actual verification

type RSAPSSVerifier

type RSAPSSVerifier struct{}

RSAPSSVerifier checks RSASSA-PSS signatures

func (RSAPSSVerifier) Verify

func (v RSAPSSVerifier) Verify(key data.PublicKey, sig []byte, msg []byte) error

Verify does the actual check.

type RSAPyCryptoVerifier

type RSAPyCryptoVerifier struct{}

RSAPyCryptoVerifier checks RSASSA-PSS signatures

func (RSAPyCryptoVerifier) Verify

func (v RSAPyCryptoVerifier) Verify(key data.PublicKey, sig []byte, msg []byte) error

Verify does the actual check. N.B. We have not been able to make this work in a way that is compatible with PyCrypto.

type Verifier

type Verifier interface {
	Verify(key data.PublicKey, sig []byte, msg []byte) error
}

Verifier defines an interface for verfying signatures. An implementer of this interface should verify signatures for one and only one signing scheme.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL