Documentation
¶
Overview ¶
Package privacy holds the per-install privacy key (spec §7.6) and what it derives: pseudonyms that follow masked values, and keyed digests of audit-log values (spec Appendix C). The key itself is never used directly, printed or returned.
Index ¶
Constants ¶
const EnvKey = "TAILKEEPER_PRIVACY_KEY"
EnvKey is the variable that carries the key, beside the read credential.
Variables ¶
This section is empty.
Functions ¶
func Normalize ¶
Normalize is what the pseudonym of text is computed over: JSON escapes decoded, since a policy file may spell a login with them, and email addresses lower-cased. It is applied once, to text read from a policy; Pseudonym applies it itself, so a caller does not, and a login the API returned never goes through it (see APIPseudonym).
Types ¶
type Key ¶
type Key struct {
// contains filtered or unexported fields
}
Key names values under the two keys derived from the privacy key: a pseudonym key and a digest key. The derived bytes are captured by two functions and held in no field, because fmt prints a struct's fields itself, without calling Format, in two cases: a bad verb (%p or %w on a value, %s on a field that is a pointer) prints what a pointer points to, and an unexported field of another struct is printed field by field. A function prints as an address under every verb, so no verb, on a Key, a pointer to one, a struct field, a slice element or a map value, can reach the bytes, and a Key copied or compared holds nothing to read.
func Parse ¶
Parse reads a key written as 64 hexadecimal characters. Its error never quotes the input.
func (*Key) APIPseudonym ¶ added in v0.6.0
APIPseudonym names a value the Tailscale API returned (a login name, a display name) as Pseudonym names text, except that it decodes nothing: such a value is not text, and a login that holds a backslash sequence is not the address the sequence spells. An address is lower-cased, so the pseudonym of a login is the one of the same address in a policy.
func (*Key) Digest ¶
Digest is a keyed digest of b, which confirms nothing to whoever lacks the key.
func (Key) Format ¶
Format keeps key material out of every format verb. fmt calls it before any other way of printing, so the numeric verbs (%d %o %b %c %U %e %t), which expand a struct's fields and a byte slice's elements and would print the derived keys, print the same "privacy key" as %v. It has a value receiver: with a pointer receiver, printing a Key by value (a copy, a struct field, a slice element) would not call it.
func (*Key) Pseudonym ¶
Pseudonym names text without revealing it: "p:" and the first ten base32 characters of its HMAC under the pseudonym key, after Normalize. It is for text read from a policy or from a result's free text, where a login may be spelled with JSON escapes; a value the API returned is named by APIPseudonym.
Source Files