Documentation
¶
Overview ¶
Package keystoretest writes PKCS12 key stores for tests, in the layout the JDK's PKCS12KeyStore writes since JDK 12: each AES secret key in a secret bag (a PKCS #8 PrivateKeyInfo shrouded under PBES2: PBKDF2 with HmacSHA256, AES-256-CBC), the bags in one unencrypted data safe, and an HmacSHA256 MAC keyed by the PKCS #12 KDF.
It exists because no key store file may be committed (cmd/secretscan refuses one by name, whatever it holds), so a test that needs one writes it. It is NOT the compatibility evidence: Go's reader is pinned against stores the JDK itself writes by the JVM spec "TransformedRecordSerializer records are read and written as Java's" (conformance). This writer only gives the key manager's logic tests, and the Java corpus run, a store.
Index ¶
- func EncodePKCS12(storePassword, entryPassword string, entries []Entry) ([]byte, error)
- func SealPBEWithMD5AndTripleDES(plain []byte, password string, salt []byte, iterations int) ([]byte, error)
- func WriteJCEKS(path, storePassword, keyPassword string, iterations int, entries []JCEKSEntry) error
- func WritePKCS12(path, storePassword, entryPassword string, entries []Entry) error
- type Entry
- type JCEKSEntry
- type JCEKSKind
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EncodePKCS12 ¶
EncodePKCS12 is WritePKCS12's bytes.
func SealPBEWithMD5AndTripleDES ¶
func SealPBEWithMD5AndTripleDES(plain []byte, password string, salt []byte, iterations int) ([]byte, error)
SealPBEWithMD5AndTripleDES encrypts plain as SunJCE's PBEWithMD5AndTripleDES does, for tests that build a sealed key themselves.
func WriteJCEKS ¶
func WriteJCEKS(path, storePassword, keyPassword string, iterations int, entries []JCEKSEntry) error
WriteJCEKS writes a JCEKS key store holding entries, each secret key sealed under keyPassword with PBEWithMD5AndTripleDES over iterations rounds (the JDK uses 200000; a test may use fewer), and the store's digest keyed by storePassword. It is not compatibility evidence: Go's reader is pinned against stores the JDK writes by the JVM spec (conformance).
func WritePKCS12 ¶
WritePKCS12 writes the entries to path, the store under storePassword and each key under entryPassword. Aliases are stored lower-cased, as the JDK stores them.
Types ¶
type JCEKSEntry ¶
JCEKSEntry is one entry of a JCEKS store WriteJCEKS writes: a secret key (its algorithm "AES" when empty, serialized as a KeyRep when KeyRep is set, as a key class that replaces itself is), or, with Kind, a private key or trusted certificate entry holding Key as its opaque bytes.
Source Files