pkcs11

Documentation

Index

• Constants
• type P11
• type PKCS11
  • func New(ctx context.Context, opts apiv1.Options) (*PKCS11, error)
  • func (k *PKCS11) Close() (err error)
  • func (k *PKCS11) CreateKey(req *apiv1.CreateKeyRequest) (*apiv1.CreateKeyResponse, error)
  • func (k *PKCS11) CreateSigner(req *apiv1.CreateSignerRequest) (crypto.Signer, error)
  • func (k *PKCS11) DeleteCertificate(u string) error
  • func (k *PKCS11) DeleteKey(u string) error
  • func (k *PKCS11) GetPublicKey(req *apiv1.GetPublicKeyRequest) (crypto.PublicKey, error)
  • func (k *PKCS11) LoadCertificate(req *apiv1.LoadCertificateRequest) (*x509.Certificate, error)
  • func (k *PKCS11) StoreCertificate(req *apiv1.StoreCertificateRequest) error

Constants

const DefaultRSASize = 3072

DefaultRSASize is the number of bits of a new RSA key if no size has been specified.

const Scheme = "pkcs11"

Scheme is the scheme used in uris.

Types

type P11

type P11 interface {
	FindKeyPair(id, label []byte) (crypto11.Signer, error)
	FindCertificate(id, label []byte, serial *big.Int) (*x509.Certificate, error)
	ImportCertificateWithLabel(id, label []byte, cert *x509.Certificate) error
	DeleteCertificate(id, label []byte, serial *big.Int) error
	GenerateRSAKeyPairWithLabel(id, label []byte, bits int) (crypto11.SignerDecrypter, error)
	GenerateECDSAKeyPairWithLabel(id, label []byte, curve elliptic.Curve) (crypto11.Signer, error)
	Close() error
}

P11 defines the methods on crypto11.Context that this package will use. This interface will be used for unit testing.

type PKCS11

type PKCS11 struct {
	// contains filtered or unexported fields
}

PKCS11 is the implementation of a KMS using the PKCS #11 standard.

func New

func New(ctx context.Context, opts apiv1.Options) (*PKCS11, error)

New returns a new PKCS11 KMS.

func (*PKCS11) Close

func (k *PKCS11) Close() (err error)

Close releases the connection to the PKCS#11 module.

func (*PKCS11) CreateKey

func (k *PKCS11) CreateKey(req *apiv1.CreateKeyRequest) (*apiv1.CreateKeyResponse, error)

CreateKey generates a new key in the PKCS#11 module and returns the public key.

func (*PKCS11) CreateSigner

func (k *PKCS11) CreateSigner(req *apiv1.CreateSignerRequest) (crypto.Signer, error)

CreateSigner creates a signer using the key present in the PKCS#11 MODULE signature slot.

func (*PKCS11) DeleteCertificate

func (k *PKCS11) DeleteCertificate(u string) error

DeleteCertificate is a utility function to delete a certificate given an uri.

func (*PKCS11) DeleteKey

func (k *PKCS11) DeleteKey(u string) error

DeleteKey is a utility function to delete a key given an uri.

func (*PKCS11) GetPublicKey

func (k *PKCS11) GetPublicKey(req *apiv1.GetPublicKeyRequest) (crypto.PublicKey, error)

GetPublicKey returns the public key ....

func (*PKCS11) LoadCertificate

func (k *PKCS11) LoadCertificate(req *apiv1.LoadCertificateRequest) (*x509.Certificate, error)

LoadCertificate implements kms.CertificateManager and loads a certificate from the YubiKey.

func (*PKCS11) StoreCertificate

func (k *PKCS11) StoreCertificate(req *apiv1.StoreCertificateRequest) error

StoreCertificate implements kms.CertificateManager and stores a certificate in the YubiKey.