Documentation
¶
Overview ¶
Package awskmscrypto implements cryptoprov.Provider and cryptoprov.KeyManager over AWS KMS asymmetric signing keys (RSA 2048/3072/4096 and NIST P-256, P-384, P-521). It registers itself as manufacturer "AWSKMS"; the token config Attributes field carries "Endpoint=<url>,Region=<region>", both optional. Credentials, the default region and retries come from the default AWS SDK chain. Keys never leave KMS: ExportKey returns a pkcs11: URI and Sign calls kms:Sign with a digest, after checking the options against the algorithms KMS reports for the key. EnumKeys needs kms:ListKeys and kms:DescribeKey on every key it lists. Encryption keys (GenerateRSAKey purpose 2, ENCRYPT_DECRYPT) are not supported.
Index ¶
- Constants
- Variables
- func KmsLoader(tc cryptoprov.TokenConfig) (cryptoprov.Provider, error)
- func NewSigner(keyID string, label string, signingAlgorithms []types.SigningAlgorithmSpec, ...) crypto.Signer
- type KmsClient
- type Provider
- func (p *Provider) Close() error
- func (p *Provider) CurrentSlotID() uint
- func (p *Provider) DestroyKeyPairOnSlot(slotID uint, keyID string) error
- func (p *Provider) EnumKeys(slotID uint, prefix string) ([]cryptoprov.KeyInfo, error)
- func (p *Provider) EnumTokens(currentSlotOnly bool) ([]cryptoprov.TokenInfo, error)
- func (p *Provider) ExportKey(keyID string) (string, []byte, error)
- func (p *Provider) FindKeyPairOnSlot(slotID uint, keyID, label string) (crypto.PrivateKey, error)
- func (p *Provider) GenerateECDSAKey(label string, curve elliptic.Curve) (crypto.PrivateKey, error)
- func (p *Provider) GenerateRSAKey(label string, bits int, purpose int) (crypto.PrivateKey, error)
- func (p *Provider) GetKey(keyID string) (crypto.PrivateKey, error)
- func (p *Provider) IdentifyKey(priv crypto.PrivateKey) (keyID, label string, err error)
- func (p *Provider) KeyInfo(slotID uint, keyID string, includePublic bool) (*cryptoprov.KeyInfo, error)
- func (p *Provider) Manufacturer() string
- func (p *Provider) Model() string
- type Signer
- func (s *Signer) KeyID() string
- func (s *Signer) Label() string
- func (s *Signer) Public() crypto.PublicKey
- func (s *Signer) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error)
- func (s *Signer) SigningAlgorithms() []types.SigningAlgorithmSpec
- func (s *Signer) String() string
Constants ¶
const ProviderName = "AWSKMS"
ProviderName specifies a provider name
Variables ¶
var KmsClientFactory = func(cfg aws.Config, optFns ...func(*kms.Options)) KmsClient { return kms.NewFromConfig(cfg, optFns...) }
KmsClientFactory creates the KMS client for Init; tests override it.
Functions ¶
func KmsLoader ¶
func KmsLoader(tc cryptoprov.TokenConfig) (cryptoprov.Provider, error)
KmsLoader provides loader for KMS provider
func NewSigner ¶
func NewSigner(keyID string, label string, signingAlgorithms []types.SigningAlgorithmSpec, publicKey crypto.PublicKey, kmsClient KmsClient) crypto.Signer
NewSigner creates a signer for the KMS key keyID. signingAlgorithms are the algorithms KMS reports for the key (KeyMetadata.SigningAlgorithms or GetPublicKeyOutput.SigningAlgorithms); Sign accepts only those, so a key without any, such as an ENCRYPT_DECRYPT key, can not sign.
Types ¶
type KmsClient ¶
type KmsClient interface {
CreateKey(context.Context, *kms.CreateKeyInput, ...func(*kms.Options)) (*kms.CreateKeyOutput, error)
CreateAlias(context.Context, *kms.CreateAliasInput, ...func(*kms.Options)) (*kms.CreateAliasOutput, error)
ListKeys(context.Context, *kms.ListKeysInput, ...func(*kms.Options)) (*kms.ListKeysOutput, error)
ScheduleKeyDeletion(context.Context, *kms.ScheduleKeyDeletionInput, ...func(*kms.Options)) (*kms.ScheduleKeyDeletionOutput, error)
DescribeKey(context.Context, *kms.DescribeKeyInput, ...func(*kms.Options)) (*kms.DescribeKeyOutput, error)
GetPublicKey(context.Context, *kms.GetPublicKeyInput, ...func(*kms.Options)) (*kms.GetPublicKeyOutput, error)
Sign(context.Context, *kms.SignInput, ...func(*kms.Options)) (*kms.SignOutput, error)
}
KmsClient interface
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements Provider interface for KMS
func Init ¶
func Init(tc cryptoprov.TokenConfig) (*Provider, error)
Init creates a provider for tc, whose Attributes may carry "Endpoint=<url>" and "Region=<region>". Credentials, the default region and retries come from the default AWS SDK chain, which reads AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN before the shared config, so the provider does not copy them into a static provider of its own (XPKI-034). The client from KmsClientFactory makes no request until a key operation.
func (*Provider) CurrentSlotID ¶
CurrentSlotID returns current slot id. For KMS only one slot is assumed to be available.
func (*Provider) DestroyKeyPairOnSlot ¶
DestroyKeyPairOnSlot destroys key pair on slot. For KMS slotID is ignored and KMS retire API is used to destroy the key.
func (*Provider) EnumKeys ¶
EnumKeys lists the signing keys (usage SIGN_VERIFY, not pending deletion) whose label, the KMS key description, starts with prefix; an empty prefix lists all of them. slotID is ignored. KMS lists key ids only, so every key of the account is described (XPKI-032), describeConcurrency calls at a time, with the SDK retrying throttled calls; the caller needs kms:ListKeys and kms:DescribeKey. A key the caller may not describe (AccessDeniedException) is not listed and is logged. Any other ListKeys or DescribeKey failure ends the listing and is returned wrapped, so errors.As still finds the service error; there is no partial result (XPKI-033). Keys are returned in the KMS listing order.
func (*Provider) EnumTokens ¶
func (p *Provider) EnumTokens(currentSlotOnly bool) ([]cryptoprov.TokenInfo, error)
EnumTokens lists tokens. For KMS currentSlotOnly is ignored and only one slot is assumed to be available.
func (*Provider) ExportKey ¶
ExportKey returns PKCS#11 URI for specified key ID. It does not return key bytes
func (*Provider) FindKeyPairOnSlot ¶
FindKeyPairOnSlot retrieves a previously created asymmetric key, using a specified slot.
func (*Provider) GenerateECDSAKey ¶
GenerateECDSAKey creates a KMS signing key on curve (P-256, P-384 or P-521) with label as its description and alias, and returns its Signer.
func (*Provider) GenerateRSAKey ¶
GenerateRSAKey creates a KMS signing key of bits (2048, 3072 or 4096) with label as its description and alias, and returns its Signer. This provider has no decrypter, so the encryption purpose (2) is an error before any RPC (XPKI-031); any other purpose is a signing key.
func (*Provider) GetKey ¶
func (p *Provider) GetKey(keyID string) (crypto.PrivateKey, error)
GetKey returns the Signer of the KMS key keyID (a key id, ARN, alias name or alias ARN), labelled with the key description. The key usage must be SIGN_VERIFY and the key must not be pending deletion: neither can sign, so no signer is returned for them (XPKI-031). A disabled key gets a signer, since it can be enabled again; its Sign fails until then.
func (*Provider) IdentifyKey ¶
func (p *Provider) IdentifyKey(priv crypto.PrivateKey) (keyID, label string, err error)
IdentifyKey returns key id and label for the given private key
func (*Provider) KeyInfo ¶
func (p *Provider) KeyInfo(slotID uint, keyID string, includePublic bool) (*cryptoprov.KeyInfo, error)
KeyInfo retrieves info about key with the specified id
func (*Provider) Manufacturer ¶
Manufacturer returns manufacturer for the provider
type Signer ¶
type Signer struct {
// contains filtered or unexported fields
}
Signer implements crypto.Signer interface
func (*Signer) Sign ¶
func (s *Signer) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error)
Sign signs digest with the KMS key. opts is required (XPKI-025): its hash selects the KMS algorithm and digest must have that hash's length. *rsa.PSSOptions select RSASSA_PSS for an RSA key and are rejected for an ECDSA key; the salt must be rsa.PSSSaltLengthEqualsHash or the hash size, the only salt KMS produces (rsa.PSSSaltLengthAuto asks for a maximal salt and is rejected). The algorithm must be one the key supports, as KMS reported when the signer was created; for an ECDSA key that is the algorithm of its curve. Invalid options fail before any RPC.
func (*Signer) SigningAlgorithms ¶ added in v0.29.306
func (s *Signer) SigningAlgorithms() []types.SigningAlgorithmSpec
SigningAlgorithms returns the KMS signing algorithms the key supports.
Source Files