crypto

Documentation

Index

• type AEAD
  • func DeriveKeysChacha20(version protocol.VersionNumber, forwardSecure bool, ...) (AEAD, error)
  • func NewAEADChacha20Poly1305(otherKey []byte, myKey []byte, otherIV []byte, myIV []byte) (AEAD, error)
• type KeyExchange
  • func NewCurve25519KEX() (KeyExchange, error)
• type NullAEAD
  • func (NullAEAD) Open(packetNumber protocol.PacketNumber, associatedData []byte, ciphertext []byte) ([]byte, error)
  • func (NullAEAD) Seal(packetNumber protocol.PacketNumber, associatedData []byte, plaintext []byte) []byte
• type Signer
  • func NewProofSource(tlsConfig *tls.Config) (Signer, error)
• type StkSource
  • func NewStkSource(secret []byte) (StkSource, error)

Types

type AEAD

type AEAD interface {
	Open(packetNumber protocol.PacketNumber, associatedData []byte, ciphertext []byte) ([]byte, error)
	Seal(packetNumber protocol.PacketNumber, associatedData []byte, plaintext []byte) []byte
}

An AEAD implements QUIC's authenticated encryption and associated data

func DeriveKeysChacha20

func DeriveKeysChacha20(version protocol.VersionNumber, forwardSecure bool, sharedSecret, nonces []byte, connID protocol.ConnectionID, chlo []byte, scfg []byte, cert []byte, divNonce []byte) (AEAD, error)

DeriveKeysChacha20 derives the client and server keys and creates a matching chacha20poly1305 instance

func NewAEADChacha20Poly1305

func NewAEADChacha20Poly1305(otherKey []byte, myKey []byte, otherIV []byte, myIV []byte) (AEAD, error)

NewAEADChacha20Poly1305 creates a AEAD using chacha20poly1305

type KeyExchange

type KeyExchange interface {
	PublicKey() []byte
	CalculateSharedKey(otherPublic []byte) ([]byte, error)
}

KeyExchange manages the exchange of keys

func NewCurve25519KEX

func NewCurve25519KEX() (KeyExchange, error)

NewCurve25519KEX creates a new KeyExchange using Curve25519, see https://cr.yp.to/ecdh.html

type NullAEAD

type NullAEAD struct{}

NullAEAD handles not-yet encrypted packets

func (NullAEAD) Open

func (NullAEAD) Open(packetNumber protocol.PacketNumber, associatedData []byte, ciphertext []byte) ([]byte, error)

Open and verify the ciphertext

func (NullAEAD) Seal

func (NullAEAD) Seal(packetNumber protocol.PacketNumber, associatedData []byte, plaintext []byte) []byte

Seal writes hash and ciphertext to the buffer

type Signer

type Signer interface {
	SignServerProof(sni string, chlo []byte, serverConfigData []byte) ([]byte, error)
	GetCertsCompressed(sni string, commonSetHashes, cachedHashes []byte) ([]byte, error)
	GetLeafCert(sni string) ([]byte, error)
}

A Signer holds a certificate and a private key

func NewProofSource

func NewProofSource(tlsConfig *tls.Config) (Signer, error)

NewProofSource loads the key and cert from files

type StkSource

type StkSource interface {
	// NewToken creates a new token for a given IP address
	NewToken(ip net.IP) ([]byte, error)
	// VerifyToken verifies if a token matches a given IP address and is not outdated
	VerifyToken(ip net.IP, data []byte) error
}

StkSource is used to create and verify source address tokens

func NewStkSource

func NewStkSource(secret []byte) (StkSource, error)

NewStkSource creates a source for source address tokens