crypto

Documentation

Overview

Package crypto provides access to secure encryption and signing methods

Index

• Constants
• func CreateMasterKeyObject(ctx context.Context, password []byte, masterKey *[]byte) (*primitive.MasterKey, error)
• func DeriveLoginHMAC(ctx context.Context, password []byte, salt, token string) (string, error)
• func EncryptPasswordObject(ctx context.Context, password string, currentMasterKey *[]byte) (*primitive.UserPassword, *primitive.MasterKey, error)
• func GenerateSalt(ctx context.Context) (*base64url.Value, error)
• type EncryptionKeyPair
• type Engine
  • func NewEngine(sess session.Session) *Engine
  • func (e *Engine) Box(ctx context.Context, pt []byte, privKP *EncryptionKeyPair, pubKey []byte) ([]byte, []byte, error)
  • func (e *Engine) BoxCredential(ctx context.Context, pt, encMec, mecNonce []byte, privKP *EncryptionKeyPair, ...) ([]byte, []byte, []byte, error)
  • func (e *Engine) ChangePassword(ctx context.Context, newPassword string) (*primitive.UserPassword, *primitive.MasterKey, error)
  • func (e *Engine) CloneMembership(ctx context.Context, encMec, mecNonce []byte, privKP *EncryptionKeyPair, ...) ([]byte, []byte, error)
  • func (e *Engine) GenerateKeyPairs(ctx context.Context) (*KeyPairs, error)
  • func (e *Engine) Seal(ctx context.Context, pt []byte) ([]byte, []byte, error)
  • func (e *Engine) Sign(ctx context.Context, s SignatureKeyPair, b []byte) ([]byte, error)
  • func (e *Engine) SignedEnvelope(ctx context.Context, body identity.Immutable, sigID *identity.ID, ...) (*envelope.Signed, error)
  • func (e *Engine) Unbox(ctx context.Context, ct, nonce []byte, privKP *EncryptionKeyPair, ...) ([]byte, error)
  • func (e *Engine) UnboxCredential(ctx context.Context, ct, encMec, mecNonce, cekNonce, ctNonce []byte, ...) ([]byte, error)
  • func (e *Engine) Unseal(ctx context.Context, ct, nonce []byte) ([]byte, error)
  • func (e *Engine) Verify(ctx context.Context, s SignatureKeyPair, b, sig []byte) (bool, error)
  • func (e *Engine) WithUnboxer(ctx context.Context, encMec, mecNonce []byte, privKP *EncryptionKeyPair, ...) error
• type KeyPairs
• type LoginKeypair
  • func DeriveLoginKeypair(ctx context.Context, secret, salt *base64url.Value) (*LoginKeypair, error)
  • func (k *LoginKeypair) PublicKey() *base64url.Value
  • func (k *LoginKeypair) Salt() *base64url.Value
  • func (k *LoginKeypair) Sign(token []byte) *base64url.Value
• type SignatureKeyPair
• type Unboxer

Constants

const (
	Triplesec  = "triplesec-v3"
	EdDSA      = "eddsa"
	Curve25519 = "curve25519"
	EasyBox    = "easybox"
	SecretBox  = "secretbox"
	Scrypt     = "scrypt"
)

Crypto Algorithm name constants.

Functions

func CreateMasterKeyObject

func CreateMasterKeyObject(ctx context.Context, password []byte, masterKey *[]byte) (*primitive.MasterKey, error)

CreateMasterKeyObject generates a 256 byte master key which is then encrypted using TripleSec-v3 using the given password.

func DeriveLoginHMAC

func DeriveLoginHMAC(ctx context.Context, password []byte, salt, token string) (string, error)

DeriveLoginHMAC HMACs the provided token with a key derived from password and the provided base64 encoded salt.

func EncryptPasswordObject

func EncryptPasswordObject(ctx context.Context, password string, currentMasterKey *[]byte) (*primitive.UserPassword, *primitive.MasterKey, error)

EncryptPasswordObject derives the master key (if necessary) and password hash from password and salt, returning the master and password objects

func GenerateSalt

func GenerateSalt(ctx context.Context) (*base64url.Value, error)

GenerateSalt returns a 16-byte (128 bit) salt used in password and secret key derivation.

Types

type EncryptionKeyPair

type EncryptionKeyPair struct {
	Public  [32]byte
	Private []byte
	PNonce  []byte
}

EncryptionKeyPair is a curve25519 encryption keypair. The private portion of the keypair is encrypted with triplesec.

PNonce contains the nonce used when deriving the password used to encrypt the private portion.

type Engine

type Engine struct {
	// contains filtered or unexported fields
}

Engine exposes methods to encrypt, unencrypt and sign values, using the logged in user's credentials.

func NewEngine

func NewEngine(sess session.Session) *Engine

NewEngine returns a new Engine

func (*Engine) Box

func (e *Engine) Box(ctx context.Context, pt []byte, privKP *EncryptionKeyPair,
	pubKey []byte) ([]byte, []byte, error)

Box encrypts the plaintext pt bytes with Box, using the private key found in privKP, first decrypted with the user's master key, and encrypted for the public key pubKey.

It returns the ciphertext, the nonce used for encrypting the plaintext, and an optional error.

func (*Engine) BoxCredential

func (e *Engine) BoxCredential(ctx context.Context, pt, encMec, mecNonce []byte,
	privKP *EncryptionKeyPair, pubKey []byte) ([]byte, []byte, []byte, error)

BoxCredential encrypts the credential value pt via symmetric secretbox encryption.

Doing so is a multistep process. First we use the user's session data to unseal their private encryption key. With their encryption key and the public encryption key provided, we can decrypt the keyring master key (mek). Using mek and a generated nonce, we derive the credential encryption key (cek) via blake2b. Finally, we use the cek and a generated nonce to encrypt the credential.

BoxCredential returns the nonce generated to derive the credential encryption key, the nonce generated for encrypting the credential, and the encrypted credential.

func (*Engine) ChangePassword

func (e *Engine) ChangePassword(ctx context.Context, newPassword string) (*primitive.UserPassword, *primitive.MasterKey, error)

ChangePassword creates a password object and re-encrypts the master key

func (*Engine) CloneMembership

func (e *Engine) CloneMembership(ctx context.Context, encMec, mecNonce []byte, privKP *EncryptionKeyPair, encPubKey, targetPubKey []byte) ([]byte, []byte, error)

CloneMembership decrypts the given KeyringMember object, and creates another for the targeted user.

func (*Engine) GenerateKeyPairs

func (e *Engine) GenerateKeyPairs(ctx context.Context) (*KeyPairs, error)

GenerateKeyPairs generates and ed25519 signing key pair, and a curve25519 encryption key pair for the user, encrypting the private keys in triplesec-v3 with the user's master key.

func (*Engine) Seal

func (e *Engine) Seal(ctx context.Context, pt []byte) ([]byte, []byte, error)

Seal encrypts the plaintext pt bytes with triplesec-v3 using a key derived via blake2b from the user's master key and a nonce (returned).

func (*Engine) Sign

func (e *Engine) Sign(ctx context.Context, s SignatureKeyPair, b []byte) ([]byte, error)

Sign signs b bytes using the provided Sealed ed25519 keypair.

func (*Engine) SignedEnvelope

func (e *Engine) SignedEnvelope(ctx context.Context, body identity.Immutable,
	sigID *identity.ID, sigKP *SignatureKeyPair) (*envelope.Signed, error)

SignedEnvelope returns a new SignedEnvelope containing body

func (*Engine) Unbox

func (e *Engine) Unbox(ctx context.Context, ct, nonce []byte,
	privKP *EncryptionKeyPair, pubKey []byte) ([]byte, error)

Unbox Decrypts and verifies ciphertext ct that was previously encrypted using the provided nonce, and the inverse parts of the provided keypairs.

func (*Engine) UnboxCredential

func (e *Engine) UnboxCredential(ctx context.Context, ct, encMec, mecNonce,
	cekNonce, ctNonce []byte, privKP *EncryptionKeyPair, pubKey []byte) ([]byte, error)

UnboxCredential does the inverse of BoxCredential to retrieve the plaintext version of a credential.

func (*Engine) Unseal

func (e *Engine) Unseal(ctx context.Context, ct, nonce []byte) ([]byte, error)

Unseal decrypts the ciphertext ct, encrypted with triplesec-v3, using the a key derived via blake2b from the user's master key and the provided nonce.

func (*Engine) Verify

func (e *Engine) Verify(ctx context.Context, s SignatureKeyPair, b, sig []byte) (bool, error)

Verify verifies that sig is the correct signature for b given SignatureKeyPair s.

func (*Engine) WithUnboxer

func (e *Engine) WithUnboxer(ctx context.Context, encMec, mecNonce []byte,
	privKP *EncryptionKeyPair, pubKey []byte, fn func(Unboxer) error) error

WithUnboxer returns an Unboxer for unboxing credentials within the context of the provided keypairs.

type KeyPairs

type KeyPairs struct {
	Signature  SignatureKeyPair
	Encryption EncryptionKeyPair
}

KeyPairs contains a signature and an encryption keypair for a user.

type LoginKeypair

type LoginKeypair struct {
	// contains filtered or unexported fields
}

LoginKeypair represents an Ed25519 Keypair used for generating a login token signature for Passphrase-Dervied Public Key Authentication.

func DeriveLoginKeypair

func DeriveLoginKeypair(ctx context.Context, secret, salt *base64url.Value) (
	*LoginKeypair, error)

DeriveLoginKeypair dervies the ed25519 login keypair used for machine authentication from the given salt and secret values.

func (*LoginKeypair) PublicKey

func (k *LoginKeypair) PublicKey() *base64url.Value

PublicKey returns the base64 value of the public key

func (*LoginKeypair) Salt

func (k *LoginKeypair) Salt() *base64url.Value

Salt returns the base64 representation of the salt used to derive the LoginKeypair

func (*LoginKeypair) Sign

func (k *LoginKeypair) Sign(token []byte) *base64url.Value

Sign returns a signature of the given token as a base64 string

type SignatureKeyPair

type SignatureKeyPair struct {
	Public  ed25519.PublicKey
	Private []byte
	PNonce  []byte
}

SignatureKeyPair is an ed25519/eddsa digital signature keypair. The private portion of the keypair is encrypted with triplesec.

PNonce contains the nonce used when deriving the password used to encrypt the private portion.

type Unboxer

type Unboxer interface {
	Unbox(context.Context, []byte, []byte, []byte) ([]byte, error)
}

Unboxer provides an interface to unbox credentials, within the context