credstash

Documentation

Index

• Constants
• Variables
• func ComputeHmac256(message, secret []byte) []byte
• func Decode(data map[string]*dynamodb.AttributeValue, rawVal interface{}) error
• func Decrypt(key, ciphertext []byte) ([]byte, error)
• func Encrypt(key, plaintext []byte) ([]byte, error)
• func GetHighestVersion(svc dynamoDB, tableName *string, name string) (string, error)
• type Client
  • func New(table string, sess *session.Session) *Client
  • func (c *Client) DecryptDataKey(ciphertext []byte, ctx *EncryptionContextValue) (*DataKey, error)
  • func (c *Client) DeleteSecret(tableName string, name string) error
  • func (c *Client) GenerateRandomSecret(length int, useSymbols bool, charsets []interface{}, ...) (string, error)
  • func (c *Client) GetHighestVersionSecret(table string, name string, encContext *EncryptionContextValue) (*DecryptedCredential, error)
  • func (c *Client) GetSecret(name string, table string, paddedVersion string, ctx *EncryptionContextValue) (*DecryptedCredential, error)
  • func (c *Client) PaddedInt(i int) string
  • func (c *Client) PutSecret(tableName string, name string, value string, paddedVersion string, ...) error
  • func (c *Client) ResolveVersion(tableName string, name string, version int) (string, error)
• type Credential
• type DataKey
• type DecryptedCredential
• type EncryptionContextValue
  • func NewEncryptionContextValue() *EncryptionContextValue
  • func (h *EncryptionContextValue) IsCumulative() bool
  • func (h *EncryptionContextValue) Set(value string) error
  • func (h *EncryptionContextValue) String() string

Constants

const (
	DefaultKmsKey = "alias/credstash"
)

const MaxPaddingLength = 19 // Number of digits in MaxInt64

Variables

var (
	ErrSecretNotFound = errors.New("Secret Not Found")

	// ErrHmacValidationFailed returned when the hmac signature validation fails
	ErrHmacValidationFailed = errors.New("Secret HMAC validation failed")
)

Functions

func ComputeHmac256

func ComputeHmac256(message, secret []byte) []byte

ComputeHmac256 compute a hmac256 signature of the supplied message and return the value hex encoded

func Decode

func Decode(data map[string]*dynamodb.AttributeValue, rawVal interface{}) error

Decode decode the supplied struct from the dynamodb result map

func Decrypt

func Decrypt(key, ciphertext []byte) ([]byte, error)

Decrypt AES encryption method which matches the pycrypto package using CTR and AES256. Note this routine seeds the counter/iv with a value of 1 then throws it away?!

func Encrypt

func Encrypt(key, plaintext []byte) ([]byte, error)

Encrypt AES encryption method which matches the pycrypto package using CTR and AES256. Note this routine seeds the counter/iv with a value of 1 then throws it away?!

func GetHighestVersion

func GetHighestVersion(svc dynamoDB, tableName *string, name string) (string, error)

GetHighestVersion look up the highest version for a given name

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

func New

func New(table string, sess *session.Session) *Client

func (*Client) DecryptDataKey

func (c *Client) DecryptDataKey(ciphertext []byte, ctx *EncryptionContextValue) (*DataKey, error)

DecryptDataKey ask kms to decrypt the supplied data key

func (*Client) DeleteSecret

func (c *Client) DeleteSecret(tableName string, name string) error

func (*Client) GenerateRandomSecret

func (c *Client) GenerateRandomSecret(length int, useSymbols bool, charsets []interface{}, minRuleMap map[string]interface{}) (string, error)

func (*Client) GetHighestVersionSecret

func (c *Client) GetHighestVersionSecret(table string, name string, encContext *EncryptionContextValue) (*DecryptedCredential, error)

GetHighestVersionSecret retrieves latest secret from dynamodb using the name

func (*Client) GetSecret

func (c *Client) GetSecret(name string, table string, paddedVersion string, ctx *EncryptionContextValue) (*DecryptedCredential, error)

func (*Client) PaddedInt

func (c *Client) PaddedInt(i int) string

PaddedInt returns an integer left-padded with zeroes to the max-int length

func (*Client) PutSecret

func (c *Client) PutSecret(tableName string, name string, value string, paddedVersion string, ctx *EncryptionContextValue) error

func (*Client) ResolveVersion

func (c *Client) ResolveVersion(tableName string, name string, version int) (string, error)

ResolveVersion converts an integer version to a string, or if a version isn't provided (0), returns "1" if the secret doesn't exist or the latest version plus one (auto-increment) if it does.

type Credential

type Credential struct {
	Name      string `dynamodbav:"name"`
	Version   string `dynamodbav:"version"`
	Key       string `dynamodbav:"key"`
	Contents  string `dynamodbav:"contents"`
	Hmac      []byte `dynamodbav:"hmac"`
	CreatedAt int64  `dynamodbav:"created_at"`
}

Credential managed credential information

type DataKey

type DataKey struct {
	CiphertextBlob []byte
	Plaintext      []byte
}

type DecryptedCredential

type DecryptedCredential struct {
	*Credential
	Secret string
}

type EncryptionContextValue

type EncryptionContextValue map[string]*string

EncryptionContextValue key value with helper methods for flag parser

func NewEncryptionContextValue

func NewEncryptionContextValue() *EncryptionContextValue

NewEncryptionContextValue create a new encryption context

func (*EncryptionContextValue) IsCumulative

func (h *EncryptionContextValue) IsCumulative() bool

IsCumulative flag this value as cumulative

func (*EncryptionContextValue) Set

func (h *EncryptionContextValue) Set(value string) error

Set converts a flag value into an encryption context key value

func (*EncryptionContextValue) String

func (h *EncryptionContextValue) String() string