signature

Documentation

Overview

Package signature provides a mechanism for computing public key signatures, which are used to help identify public keys used in sealing TRISA envelopes and select the matching private key pair when a secure envelope is received.

TRISA strongly recommends that sealing/unsealing keys be distinct from identity certificates for improved security and to support differing retirement criteria. Some organizations may choose to use unique sealing/unsealing keys with each unique counterparty.

A PublicKeySignature takes the form of "ALG:base64data" where ALG is one of the valid hashing algorithms used by this package and base64data contains the hash of the key.

Example

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"fmt"

	"github.com/trisacrypto/trisa/pkg/trisa/keys/signature"
)

func main() {
	// Generate a new RSA key pair
	key, _ := rsa.GenerateKey(rand.Reader, 2048)

	// Sign the public key
	pks, _ := signature.New(&key.PublicKey)

	// Make sure the pks matches the original public key
	match := signature.Match(pks, &key.PublicKey)
	fmt.Printf("%t\n", match)
}

Output:

true

Index

• func Hash(pub interface{}, algorithm Algorithm) (_ []byte, err error)
• func Match(pks string, pub interface{}) bool
• func New(pub interface{}) (_ string, err error)
• func Sign(pub interface{}, algorithm Algorithm) (_ string, err error)
• type Algorithm
  • func Parse(pks string) (algorithm Algorithm, sum []byte, err error)
  • func ParseAlgorithm(s string) Algorithm
  • func (s Algorithm) String() string

Examples

• Package

Functions

func Hash

func Hash(pub interface{}, algorithm Algorithm) (_ []byte, err error)

Hash returns the checksum of the marshalled PKIX public key

func Match

func Match(pks string, pub interface{}) bool

Match determines if the public key signature matches the specified public key.

func New

func New(pub interface{}) (_ string, err error)

New creates a public key signature for an *rsa.PublicKey, *ecdsa.PublicKey or ed25519.PublicKey (or any key that can be marshalled by x509.MarshalPKIXPublicKey). It returns the default SHA256 signature that the package recommends for public key identification and matching.

func Sign

func Sign(pub interface{}, algorithm Algorithm) (_ string, err error)

Sign creates a public key signature from a public key that can be marshalled as an PKIX public key. It then takes the hash of the marshalled data using the specified signature algorithm and returns a string that concatenates the name of the hashing algorithm with the raw base64 encoded of the hash sum.

Types

type Algorithm

type Algorithm uint8

const (
	UnknownSignatureAlgorithm Algorithm = iota
	MD5
	SHA256
	SHA512
)

func Parse

func Parse(pks string) (algorithm Algorithm, sum []byte, err error)

Parse a public key signature into its algorithm and hash components

func ParseAlgorithm

func ParseAlgorithm(s string) Algorithm

func (Algorithm) String

func (s Algorithm) String() string