authorize

Documentation

Overview

Package authorize contains logic for signing and verifying a given timestamp and for signing & verifying certificate request info. This package is designed for usage with the authorizer to prevent DDoS attacks

Index

• func Sign(rand io.Reader, now time.Time, privKey *rsa.PrivateKey) ([]byte, error)
• func SignCertRequest(rng io.Reader, gwRsa *rsa.PrivateKey, acmeToken string, now time.Time) ([]byte, error)
• func Verify(now time.Time, signedTS time.Time, pubKey *rsa.PublicKey, nid *id.ID, ...) error
• func VerifyCertRequest(gwPub *rsa.PublicKey, sig []byte, acmeToken string, now, signedTS time.Time, ...) error

Functions

func Sign

func Sign(rand io.Reader, now time.Time, privKey *rsa.PrivateKey) ([]byte, error)

Sign takes in a node's current timestamp and signs that with its own private key

func SignCertRequest

func SignCertRequest(rng io.Reader, gwRsa *rsa.PrivateKey,
	acmeToken string, now time.Time) ([]byte, error)

SignCertRequest signs the ACME token & other info sent with an AuthorizerCertRequest

func Verify

func Verify(now time.Time, signedTS time.Time,
	pubKey *rsa.PublicKey, nid *id.ID, salt []byte,
	delta time.Duration, signature []byte) error

Verify confirms the node's signed timestamp. It performs a series of checks prior to doing so: First it will determine that signedTS is within +/- delta of now. Second it will check that the public key and salt make the passed in node ID Finally it will verify the signature on the signedTS using the public key

func VerifyCertRequest

func VerifyCertRequest(gwPub *rsa.PublicKey, sig []byte,
	acmeToken string, now, signedTS time.Time, delta time.Duration) error

VerifyCertRequest verifies the signature on an ACME token & other info sent with an AuthorizerCertRequest