signer

Documentation

Index

• Constants
• func GetPrimaryKey(ctx context.Context, kmsKey, hcVaultToken string) (tink.AEAD, error)
• func KeyHandleToSigner(kh *keyset.Handle) (crypto.Signer, error)
• func NewCryptoSigner(ctx context.Context, ...) (crypto.Signer, error)
• func NewTimestampingCertWithChain(signer crypto.Signer) ([]*x509.Certificate, error)
• func NewTinkSigner(ctx context.Context, tinkKeysetPath string, primaryKey tink.AEAD) (crypto.Signer, error)
• type File
  • func NewFileSigner(keyPath, keyPass string) (*File, error)

Constants

const FileScheme = "file"

const KMSScheme = "kms"

const MemoryScheme = "memory"

const TinkScheme = "tink"

Functions

func GetPrimaryKey

func GetPrimaryKey(ctx context.Context, kmsKey, hcVaultToken string) (tink.AEAD, error)

GetPrimaryKey returns a Tink AEAD encryption key from KMS Supports GCP, AWS, and Vault

func KeyHandleToSigner

func KeyHandleToSigner(kh *keyset.Handle) (crypto.Signer, error)

KeyHandleToSigner converts a key handle to the crypto.Signer interface. Heavily pulls from Tink's signature and subtle packages.

func NewCryptoSigner

func NewCryptoSigner(ctx context.Context, signer, kmsKey, tinkKmsKey, tinkKeysetPath, hcVaultToken, fileSignerPath, fileSignerPasswd string) (crypto.Signer, error)

func NewTimestampingCertWithChain

func NewTimestampingCertWithChain(signer crypto.Signer) ([]*x509.Certificate, error)

NewTimestampingCertWithChain generates an in-memory certificate chain.

func NewTinkSigner

func NewTinkSigner(ctx context.Context, tinkKeysetPath string, primaryKey tink.AEAD) (crypto.Signer, error)

NewTinkSigner creates a signer by decrypting a local Tink keyset with a remote KMS encryption key

Types

type File

type File struct {
	crypto.Signer
}

File returns a file-based signer and verifier, used for local testing

func NewFileSigner

func NewFileSigner(keyPath, keyPass string) (*File, error)