accountkeys

package
v0.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 1, 2026 License: AGPL-3.0 Imports: 12 Imported by: 0

Documentation

Overview

Package accountkeys implements Signal account-level key derivations.

It is a pure-Go port of upstream libsignal rust/account-keys at v0.96.4. The package deliberately contains no network or storage behavior.

Index

Constants

View Source 
const (

	// SVRKeyLen is the length in bytes of a derived SVR master key.
	SVRKeyLen = 32

	// BackupKeyLen is the length in bytes of an account backup key.
	BackupKeyLen = 32
	// LocalBackupMetadataKeyLen is the length in bytes of local backup metadata keys.
	LocalBackupMetadataKeyLen = 32
	// MediaIDLen is the length in bytes of a derived backup media ID.
	MediaIDLen = 15
	// BackupForwardSecrecyTokenLen is the length in bytes of backup forward secrecy tokens.
	BackupForwardSecrecyTokenLen = 32
	// MediaEncryptionKeyLen is the length in bytes of backup media encryption key data.
	MediaEncryptionKeyLen = 64
)

Variables

View Source 
var (
	// ErrInvalidAccountEntropyPool reports malformed account entropy input.
	ErrInvalidAccountEntropyPool = errors.New("invalid account entropy pool")
	// ErrInvalidPHCString reports malformed or unsupported PHC password hash input.
	ErrInvalidPHCString = errors.New("invalid PHC string")
)

Functions

func LocalPINHash 

func LocalPINHash(pin []byte) (string, error)

LocalPINHash creates a PHC-encoded local PIN hash with a random salt.

func LocalPINHashWithSalt 

func LocalPINHashWithSalt(pin []byte, salt [localPINSaltLen]byte) string

LocalPINHashWithSalt creates a PHC-encoded local PIN hash with salt.

func MakePINSalt 

func MakePINSalt(username string, groupID uint64) [32]byte

MakePINSalt derives a Signal PIN salt from a username and backup group ID.

func VerifyLocalPINHash 

func VerifyLocalPINHash(encoded string, pin []byte) (bool, error)

VerifyLocalPINHash verifies pin against a PHC-encoded local PIN hash.

Types

type AccountEntropyPool 

type AccountEntropyPool struct {
	// contains filtered or unexported fields
}

AccountEntropyPool stores the 64-character account entropy pool.

func GenerateAccountEntropyPool 

func GenerateAccountEntropyPool() (AccountEntropyPool, error)

GenerateAccountEntropyPool creates a new account entropy pool using crypto/rand.

func GenerateAccountEntropyPoolFrom 

func GenerateAccountEntropyPoolFrom(r io.Reader) (AccountEntropyPool, error)

GenerateAccountEntropyPoolFrom creates a new account entropy pool using r.

func ParseAccountEntropyPool 

func ParseAccountEntropyPool(s string) (AccountEntropyPool, error)

ParseAccountEntropyPool validates and parses a serialized account entropy pool.

func (AccountEntropyPool) Bytes 

func (p AccountEntropyPool) Bytes() [accountEntropyPoolLen]byte

Bytes returns the fixed-width byte representation of the account entropy pool.

func (AccountEntropyPool) DeriveSVRKey 

func (p AccountEntropyPool) DeriveSVRKey() [SVRKeyLen]byte

DeriveSVRKey derives the account SVR master key.

func (AccountEntropyPool) String 

func (p AccountEntropyPool) String() string

type BackupForwardSecrecyEncryptionKey 

type BackupForwardSecrecyEncryptionKey struct {
	CipherKey [32]byte
	HMACKey   [32]byte
}

BackupForwardSecrecyEncryptionKey contains cipher and HMAC keys for backup forward secrecy.

type BackupForwardSecrecyPassword 

type BackupForwardSecrecyPassword [32]byte

BackupForwardSecrecyPassword is the PIN-derived forward secrecy password value.

type BackupForwardSecrecyToken 

type BackupForwardSecrecyToken [BackupForwardSecrecyTokenLen]byte

BackupForwardSecrecyToken is the token input length used by backup forward secrecy derivations.

type BackupID 

type BackupID [16]byte

BackupID is the per-account identifier for backup storage.

type BackupKey 

type BackupKey [BackupKeyLen]byte

BackupKey is the root account backup key derived from account entropy.

func DeriveBackupKey 

func DeriveBackupKey(p AccountEntropyPool) BackupKey

DeriveBackupKey derives the root backup key from account entropy.

func (BackupKey) DeriveBackupID 

func (k BackupKey) DeriveBackupID(aci address.ServiceID) BackupID

DeriveBackupID derives the account backup ID for the given ACI.

func (BackupKey) DeriveECKey 

func (k BackupKey) DeriveECKey(aci address.ServiceID) (curve.PrivateKey, error)

DeriveECKey derives the backup identity private key for the given ACI.

func (BackupKey) DeriveForwardSecrecyEncryptionKey 

func (k BackupKey) DeriveForwardSecrecyEncryptionKey(salt []byte) BackupForwardSecrecyEncryptionKey

DeriveForwardSecrecyEncryptionKey derives backup forward secrecy encryption keys.

func (BackupKey) DeriveForwardSecrecyPassword 

func (k BackupKey) DeriveForwardSecrecyPassword(salt []byte) BackupForwardSecrecyPassword

DeriveForwardSecrecyPassword derives the backup forward secrecy PIN password.

func (BackupKey) DeriveLocalBackupMetadataKey 

func (k BackupKey) DeriveLocalBackupMetadataKey() [LocalBackupMetadataKeyLen]byte

DeriveLocalBackupMetadataKey derives the local backup metadata key.

func (BackupKey) DeriveMediaEncryptionKeyData 

func (k BackupKey) DeriveMediaEncryptionKeyData(mediaID [MediaIDLen]byte) [MediaEncryptionKeyLen]byte

DeriveMediaEncryptionKeyData derives backup media encryption key data.

func (BackupKey) DeriveMediaID 

func (k BackupKey) DeriveMediaID(mediaName string) [MediaIDLen]byte

DeriveMediaID derives a backup media ID for mediaName.

func (BackupKey) DeriveThumbnailTransitEncryptionKeyData 

func (k BackupKey) DeriveThumbnailTransitEncryptionKeyData(mediaID [MediaIDLen]byte) [MediaEncryptionKeyLen]byte

DeriveThumbnailTransitEncryptionKeyData derives backup thumbnail transit encryption key data.

type PinHash 

type PinHash struct {
	EncryptionKey [32]byte
	AccessKey     [32]byte
}

PinHash contains the two keys produced by Signal's Argon2id PIN hashing.

func CreatePinHash 

func CreatePinHash(pin []byte, salt [32]byte) PinHash

CreatePinHash derives Signal PIN encryption and access keys.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.