jose

Documentation

Index

• Constants
• Variables
• func NewHMAC(key []byte, alg SignatureAlgorithm) (*hmacKey, error)
• func WithBase64(b64 bool) func(protected *Header)
• func WithContentType(cty string) func(protected *Header)
• func WithCritical(crit []string) func(protected *Header)
• func WithKeyID(kid string) func(protected *Header)
• func WithType(typ string) func(protected *Header)
• type Header
• type JWS
  • func NewJWS(payload []byte) *JWS
  • func ParseSignedCompact(signedPayload string) (*JWS, error)
  • func (jws *JWS) SerializeCompact() (string, error)
  • func (jws *JWS) Sign(key Signer, opts ...SignOption) (*JWS, error)
  • func (jws *JWS) Verify(key Verifier) ([]byte, error)
• type SignOption
• type SignVerifier
• type Signature
• type SignatureAlgorithm
• type Signer
• type Verifier

Constants

const (
	EdDSA SignatureAlgorithm = "EdDSA"
	HS256                    = "HS256" // HMAC using SHA-256
	HS384                    = "HS384" // HMAC using SHA-384
	HS512                    = "HS512" // HMAC using SHA-512
	RS256                    = "RS256" // RSASSA-PKCS-v1.5 using SHA-256
	RS384                    = "RS384" // RSASSA-PKCS-v1.5 using SHA-384
	RS512                    = "RS512" // RSASSA-PKCS-v1.5 using SHA-512
	ES256                    = "ES256" // ECDSA using P-256 and SHA-256
	ES384                    = "ES384" // ECDSA using P-384 and SHA-384
	ES512                    = "ES512" // ECDSA using P-521 and SHA-512
	PS256                    = "PS256" // RSASSA-PSS using SHA256 and MGF1-SHA256
	PS384                    = "PS384" // RSASSA-PSS using SHA384 and MGF1-SHA384
	PS512                    = "PS512" // RSASSA-PSS using SHA512 and MGF1-SHA512
)

Signature algorithms

Variables

var (
	// ErrJwsNotThreeParts is returned if a compact JWS has more or less than 3 parts
	ErrJwsNotThreeParts = errors.New("worstcrypto/jose/jwt: compact JWS must have three parts")
)

Functions

func NewHMAC

func NewHMAC(key []byte, alg SignatureAlgorithm) (*hmacKey, error)

NewHMAC returns an hmacKey, which implements both Verifier and Signer with the symmetric HMAC "signature" / MAC algorithm.

func WithBase64

func WithBase64(b64 bool) func(protected *Header)

WithContentType is a SignOption that sets the "b64" attribute on the header.

func WithContentType

func WithContentType(cty string) func(protected *Header)

WithContentType is a SignOption that adds the "cty" attribute to the header.

func WithCritical

func WithCritical(crit []string) func(protected *Header)

WithCritical is a SignOption that adds the "cit" attribute to the header.

func WithKeyID

func WithKeyID(kid string) func(protected *Header)

WithKeyID is a SignOption that adds the "kid" attribute to the header.

func WithType

func WithType(typ string) func(protected *Header)

WithType is a SignOption that adds the "typ" attribute to the header.

Types

type Header

type Header struct {
	// Algorithm is the only header that MUST be present
	Algorithm   SignatureAlgorithm `json:"alg"`
	Critical    []string           `json:"crit,omitempty"`
	KeyID       string             `json:"kid,omitempty"`
	ContentType string             `json:"cty,omitempty"`
	Type        string             `json:"typ,omitempty"`
	// RFC 7797, not implemented yet
	Base64 bool `json:"b64,omitempty"`
}

A Header is the protected header of a JWS

type JWS

type JWS struct {
	Signatures []Signature
	// contains filtered or unexported fields
}

A JWS represents a JSON Web Signature, as specified in RFC 7515.

func NewJWS

func NewJWS(payload []byte) *JWS

NewJWS creates a new (unsigned) JWS, which needs to be signed before serialization.

func ParseSignedCompact

func ParseSignedCompact(signedPayload string) (*JWS, error)

ParseSignedCompact parses a JWS in the compact serialization as defined by RFC 7515 Section 3.1.

func (*JWS) SerializeCompact

func (jws *JWS) SerializeCompact() (string, error)

SerializeCompact returns a jws in the JWS compact serialization as defined by RFC 7515 Section 3.1.

func (*JWS) Sign

func (jws *JWS) Sign(key Signer, opts ...SignOption) (*JWS, error)

Sign adds a new signature to a JWS by signing the payload with the key

func (*JWS) Verify

func (jws *JWS) Verify(key Verifier) ([]byte, error)

Verify verifies the signature of the JWS. Only works for JWS with a single signature. The algorithm in the protected header must match that of the verifier.

type SignOption

type SignOption func(protected *Header)

A SignOption allows you to add

type SignVerifier

type SignVerifier interface {
	Verifier
	Signer
}

A SignVerifier implements both Verifier and Signer. It uses either a symmetric algorithm or has both public and private keys available.

type Signature

type Signature struct {
	Protected   Header
	Unprotected map[string]*json.RawMessage
	Signature   []byte
	// contains filtered or unexported fields
}

A Signature represents the signature of a (separate) payload with a specific header

type SignatureAlgorithm

type SignatureAlgorithm string

type Signer

type Signer interface {
	// Sign generates a new signature from the payload
	Sign(payload []byte) ([]byte, error)
	GetAlgorithm() SignatureAlgorithm
}

A Signer can sign a JWT

type Verifier

type Verifier interface {
	// Verify checks if the signature matches the payload and returns an error if not
	Verify(payload []byte, signature []byte) error
	GetAlgorithm() SignatureAlgorithm
}

A Verifier can verify the signature of a JWT