google

Documentation

Index

• Variables
• type Provider
  • func New() (*Provider, error)
  • func (p Provider) DecryptAES(ctx context.Context, ciphertext []byte) ([]byte, error)
  • func (p Provider) DecryptRSA(ctx context.Context, ciphertext []byte) ([]byte, error)
  • func (p Provider) EncryptAES(ctx context.Context, plaintext []byte) ([]byte, error)
  • func (p Provider) EncryptRSA(ctx context.Context, plaintext []byte) ([]byte, error)
  • func (p *Provider) RegisterAES(name string)
  • func (p *Provider) RegisterECDSA(name string)
  • func (p *Provider) RegisterRSA(name string)
  • func (p Provider) SignECDSA(ctx context.Context, plaintext []byte) ([]byte, error)
  • func (p Provider) VerifyECDSA(ctx context.Context, signature, plaintext []byte) error

Variables

var (
	// ErrECDSANotDefined defines error if name of ECDSA private key is not defined
	ErrECDSANotDefined = errors.New("name of ECDSA private key is not defined")
	// ErrECDSAVerifyFalse defines error if signature is not valid for given message
	ErrECDSAVerifyFalse = errors.New("signature is not valid for given message")
	// ErrECDSAUnknown defines error for unknown type of ECDSA public key
	ErrECDSAUnknown = errors.New("unknown type of ECDSA public key")

	// ErrKeyNotDefined defines error if name of private key is not defined
	ErrKeyNotDefined = errors.New("name of private key is not defined")

	// ErrRSANotDefined defines error if name of RSA private key is not defined
	ErrRSANotDefined = errors.New("name of RSA private key is not defined")
	// ErrRSAUnknown defines error for unknown type of RSA public key
	ErrRSAUnknown = errors.New("unknown type of RSA public key")

	// ErrAESNotDefined defines error if name of AES key is not defined
	ErrAESNotDefined = errors.New("name of AES key is not defined")
)

Types

type Provider

type Provider struct {
	// contains filtered or unexported fields
}

Provider implements GKM crypto provider

func New

func New() (*Provider, error)

New creates new Cloud KMS crypto provider

func (Provider) DecryptAES

func (p Provider) DecryptAES(ctx context.Context, ciphertext []byte) ([]byte, error)

DecryptAES will attempt to decrypt a given ciphertext with an 'AES_P256_SHA256' key stored on Cloud KMS

func (Provider) DecryptRSA

func (p Provider) DecryptRSA(ctx context.Context, ciphertext []byte) ([]byte, error)

DecryptRSA will attempt to decrypt a given ciphertext with an 'RSA_DECRYPT_OAEP_2048_SHA256' private key stored on Cloud KMS

func (Provider) EncryptAES

func (p Provider) EncryptAES(ctx context.Context, plaintext []byte) ([]byte, error)

EncryptAES will encrypt a plaintext using an 'AES_P256_SHA256' key retrieved from Cloud KMS,

func (Provider) EncryptRSA

func (p Provider) EncryptRSA(ctx context.Context, plaintext []byte) ([]byte, error)

EncryptRSA will encrypt a plaintext using an 'RSA_DECRYPT_OAEP_2048_SHA256' public key retrieved from Cloud KMS, message length is maximum 128 bytes

func (*Provider) RegisterAES

func (p *Provider) RegisterAES(name string)

RegisterAES accepts specified name/ID of AES symmetric key in Cloud KMS name format: projects/{id}/locations/{location}/keyRings/{name}/cryptoKeys/{name}

func (*Provider) RegisterECDSA

func (p *Provider) RegisterECDSA(name string)

RegisterECDSA accepts specified name/ID of ECDSA asymmetric key in Cloud KMS name format: projects/{id}/locations/{location}/keyRings/{name}/cryptoKeys/{name}/cryptoKeyVersions/{version}

func (*Provider) RegisterRSA

func (p *Provider) RegisterRSA(name string)

RegisterRSA accepts specified name/ID of RSA asymmetric key in Cloud KMS name format: projects/{id}/locations/{location}/keyRings/{name}/cryptoKeys/{name}/cryptoKeyVersions/{version}

func (Provider) SignECDSA

func (p Provider) SignECDSA(ctx context.Context, plaintext []byte) ([]byte, error)

SignECDSA will sign a plaintext message using an 'EC_SIGN_P384_SHA384' asymmetric private key retrieved from Cloud KMS

func (Provider) VerifyECDSA

func (p Provider) VerifyECDSA(ctx context.Context, signature, plaintext []byte) error

VerifyECDSA will verify that an 'EC_SIGN_P384_SHA384' signature is valid for a given message