Documentation
¶
Overview ¶
Package public_key reads the public keys accounts register for API access.
Public keys arrive as PEM, which is what openssl, ssh-keygen, WebCrypto and every key manager emit and what a person can paste: parsing them is this package's job, and everything downstream works on the parsed key rather than on text.
Index ¶
Constants ¶
const ( AlgorithmEddsa = "EdDSA" AlgorithmEs256 = "ES256" )
The JOSE names of what a registered key signs with. Two, deliberately: Ed25519 is the one to reach for, and P-256 is the one a key manager can hold -- GCP, AWS, Azure and a YubiKey all do P-256 and none of them does Ed25519, so a build runner that keeps its key in a manager rather than in a file needs it. Everything else is refused: RSA keys are large and easy to misuse, and the larger curves buy nothing here.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Key ¶
type Key struct {
// Id is the key's RFC 7638 thumbprint, base64url without padding. It is derived from the key
// material alone, so a client computes the same id with any JOSE library and two registrations
// of one key cannot disagree about what to call it.
Id string
// Algorithm is one of the two above, settled from the key rather than from anything the holder
// says: what an assertion claims in its header is checked against this, never the reverse.
Algorithm string
// Der is the key as a PKIX SubjectPublicKeyInfo, which is what the PEM carried and what is
// stored, so that a key read back from the database is the key that was registered.
Der []byte
// contains filtered or unexported fields
}
Key is a registered public key: what it is, what it signs with, and the id it is known by.
func FromPublicKey ¶
FromPublicKey reads a key a holder has in hand, as a crypto.Signer's public half, refusing anything that is not an Ed25519 or P-256 one: what a client computes its key's id from.
func Parse ¶
Parse reads a PEM public key, refusing anything that is not an Ed25519 or P-256 one.
Everything it refuses is a client error: the text came from whoever is registering the key.
func (*Key) NamedVerifier ¶
func (k *Key) NamedVerifier() (altshiftCryptoInterfaces.NamedVerifier, error)
NamedVerifier is what verifies a JWS signed by this key. Its name is the key's algorithm, which is what refuses an assertion whose header claims to have been signed with another.
Source Files