secure

Documentation

Overview

Package secure makes encrypted data can only be decrypted by selected recipients. It allows different types of public keys to secretly exchange data.

Suppose we have a opponent X, append 0 to the upper cased letter we get X0, it represents X's private key, similarly X1 represents X's public key. We have a pool of key pairs S, they are accessible by everyone, they are pregenerated key pairs with the combinations of commonly use key types and sizes, such as 1024bit rsa 1024, 2048bit rsa, 256bit ecdsa, etc. Now we have opponents X and Y, they may have different key types, such as X's is rsa, Y's is ecdsa, we want to encrypt data D with X and decrypt it with Y. X has access to Y1.

Encryption steps:

Find M0 from S that has the same key type and size as Y1.
Use Y1 and M0 to generate the shared secret key K.
Use K to encrypt the D to encrypted data E.
Send E to Y.

Decryption steps:

Find M1 from S that has the same key type and size as Y0.
Use Y0 and M1 to generate the shared secret key K.
Use K to decrypt E.

Index

• Constants
• Variables
• func Belongs(pub, prv []byte, passphrase string) (bool, error)
• func DecryptAES(key, data []byte, aesType, guard int) ([]byte, error)
• func DecryptSharedSecret(encryptedAESKey []byte, aesType int, prv crypto.PrivateKey) ([]byte, error)
• func EncryptAES(key, data []byte, aesType, guard int) ([]byte, error)
• func EncryptSharedSecret(aesKey []byte, aesType int, pub crypto.PublicKey) ([]byte, error)
• func FindPrvSharedKey(pub crypto.PublicKey) (crypto.PrivateKey, error)
• func FindPubSharedKey(prv crypto.PrivateKey) (crypto.PublicKey, error)
• func IsAuthErr(err error) bool
• func PrivateKeySize(prv crypto.PrivateKey) int
• func PublicKeyHash(pub crypto.PublicKey) []byte
• func PublicKeyHashByPrivateKey(prv crypto.PrivateKey) []byte
• func PublicKeySize(pub crypto.PublicKey) int
• func SSHPrvKey(keyData []byte, passphrase string) (crypto.PrivateKey, error)
• func SSHPubKey(publicKey []byte) (crypto.PublicKey, error)
• type Cipher
  • func NewCipher(prv crypto.PrivateKey, index int, pubs ...crypto.PublicKey) *Cipher
  • func NewCipherBytes(privateKey []byte, passphrase string, index int, publicKeys ...[]byte) (*Cipher, error)
  • func (c *Cipher) DecodeAESKey(encryptedKeys [][]byte) ([]byte, error)
  • func (c *Cipher) Decoder(r io.Reader) (io.ReadCloser, error)
  • func (c *Cipher) EncodeAESKey(aesKey []byte, pub crypto.PublicKey) ([]byte, error)
  • func (c *Cipher) Encoder(w io.Writer) (io.WriteCloser, error)
• type KeyInfo
• type Signer
  • func NewSigner(prv crypto.PrivateKey, pub crypto.PrivateKey) *Signer
  • func NewSignerBytes(privateKey []byte, passphrase string, publicKeys ...[]byte) (*Signer, error)
  • func (s *Signer) Decoder(r io.Reader) (io.ReadCloser, error)
  • func (s *Signer) Encoder(w io.Writer) (io.WriteCloser, error)
  • func (s *Signer) SigDigest(digest []byte) ([]byte, error)
  • func (s *Signer) Sign(data []byte) ([]byte, error)
  • func (s *Signer) Verify(data []byte) ([]byte, bool)
  • func (s *Signer) VerifyDigest(digest, sign []byte) bool

Constants

const (
	KEY_TYPE_RSA     = "rsa"
	KEY_TYPE_ECDSA   = "ecdsa"
	KEY_TYPE_ED25519 = "ed25519"
)

Variables

var ErrNotRecipient = fmt.Errorf("not a recipient, the data is not encrypted for your public key")

var ErrNotSupportedKey = errors.New("not an supported key")

var ErrSignNotMatch = errors.New("sign not match")

var SharedKeys embed.FS

var SupportedKeyTypes = []KeyInfo{
	{
		Type:    KEY_TYPE_RSA,
		BitSize: []int{1024, 2048, 3072},
	},
	{
		Type:    KEY_TYPE_ECDSA,
		BitSize: []int{256, 384, 521},
	},
	{
		Type:    KEY_TYPE_ED25519,
		BitSize: []int{256},
	},
}

Functions

func Belongs

func Belongs(pub, prv []byte, passphrase string) (bool, error)

Belongs checks if pub key belongs to prv key.

func DecryptAES

func DecryptAES(key, data []byte, aesType, guard int) ([]byte, error)

func DecryptSharedSecret

func DecryptSharedSecret(encryptedAESKey []byte, aesType int, prv crypto.PrivateKey) ([]byte, error)

func EncryptAES

func EncryptAES(key, data []byte, aesType, guard int) ([]byte, error)

func EncryptSharedSecret

func EncryptSharedSecret(aesKey []byte, aesType int, pub crypto.PublicKey) ([]byte, error)

func FindPrvSharedKey

func FindPrvSharedKey(pub crypto.PublicKey) (crypto.PrivateKey, error)

func FindPubSharedKey

func FindPubSharedKey(prv crypto.PrivateKey) (crypto.PublicKey, error)

func IsAuthErr

func IsAuthErr(err error) bool

func PrivateKeySize

func PrivateKeySize(prv crypto.PrivateKey) int

func PublicKeyHash

func PublicKeyHash(pub crypto.PublicKey) []byte

func PublicKeyHashByPrivateKey

func PublicKeyHashByPrivateKey(prv crypto.PrivateKey) []byte

func PublicKeySize

func PublicKeySize(pub crypto.PublicKey) int

func SSHPrvKey

func SSHPrvKey(keyData []byte, passphrase string) (crypto.PrivateKey, error)

SSHPrvKey returns a private key from a ssh private key.

func SSHPubKey

func SSHPubKey(publicKey []byte) (crypto.PublicKey, error)

Types

type Cipher

type Cipher struct {
	AESType int
	// contains filtered or unexported fields
}

Cipher to encrypt and decrypt data. The cipher will generate a random AES secret, each public key will be used to encrypt the AES secret into a key. The wire format of the output looks like this:

[n][key1][key2][key3]...[encrypted-data].

"n" is the number of keys. "key1" is the encrypted key for the first public key. "key2" is the encrypted key for the second public key. ... "encrypted-data" is the encrypted data by the AES secret.

func NewCipher

func NewCipher(prv crypto.PrivateKey, index int, pubs ...crypto.PublicKey) *Cipher

NewCipher to encrypt or decrypt data. The index indicates which key in the key list is for the prv to decrypt the data.

func NewCipherBytes

func NewCipherBytes(privateKey []byte, passphrase string, index int, publicKeys ...[]byte) (*Cipher, error)

func (*Cipher) DecodeAESKey

func (c *Cipher) DecodeAESKey(encryptedKeys [][]byte) ([]byte, error)

func (*Cipher) Decoder

func (c *Cipher) Decoder(r io.Reader) (io.ReadCloser, error)

func (*Cipher) EncodeAESKey

func (c *Cipher) EncodeAESKey(aesKey []byte, pub crypto.PublicKey) ([]byte, error)

func (*Cipher) Encoder

func (c *Cipher) Encoder(w io.Writer) (io.WriteCloser, error)

type KeyInfo

type KeyInfo struct {
	Type    string
	BitSize []int
}

type Signer

type Signer struct {
	// contains filtered or unexported fields
}

func NewSigner

func NewSigner(prv crypto.PrivateKey, pub crypto.PrivateKey) *Signer

func NewSignerBytes

func NewSignerBytes(privateKey []byte, passphrase string, publicKeys ...[]byte) (*Signer, error)

func (*Signer) Decoder

func (s *Signer) Decoder(r io.Reader) (io.ReadCloser, error)

func (*Signer) Encoder

func (s *Signer) Encoder(w io.Writer) (io.WriteCloser, error)

func (*Signer) SigDigest

func (s *Signer) SigDigest(digest []byte) ([]byte, error)

func (*Signer) Sign

func (s *Signer) Sign(data []byte) ([]byte, error)

func (*Signer) Verify

func (s *Signer) Verify(data []byte) ([]byte, bool)

func (*Signer) VerifyDigest

func (s *Signer) VerifyDigest(digest, sign []byte) bool