Documentation
¶
Overview ¶
Package storekey implements the client-held store key: its key file, deterministic sealing of blobs, name tokens and inline content, and passphrase escrow. The server never sees the key. It carries none of the object format, so a WebAssembly build can take it without the rest of goback.
Index ¶
- Constants
- Variables
- func ReadKeyset(data json.RawMessage) (*keyset.Handle, error)
- func WriteKeyset(h *keyset.Handle) (json.RawMessage, error)
- type Field
- type Key
- func (k *Key) Digest(plaintext []byte) []byte
- func (k *Key) Escrow(passphrase string) ([]byte, error)
- func (k *Key) ID() []byte
- func (k *Key) IDString() string
- func (k *Key) Marshal() ([]byte, error)
- func (k *Key) OpenBlob(sealed []byte) ([]byte, error)
- func (k *Key) OpenField(parent []byte, field Field, token []byte) ([]byte, error)
- func (k *Key) OpenInline(ciphertext []byte) ([]byte, error)
- func (k *Key) OpenPRFBlob(sealed, ref []byte) ([]byte, error)
- func (k *Key) Save(path string) error
- func (k *Key) SealBlob(stored []byte) []byte
- func (k *Key) SealField(parent []byte, field Field, plaintext []byte) []byte
- func (k *Key) SealInline(plaintext []byte) []byte
- type Mode
- type Policy
Constants ¶
const IDSize = 8
IDSize is the width of a key id.
const MinPassphrase = 12
MinPassphrase is the fewest characters Escrow takes: anyone holding an agent key of the store can fetch the escrowed copy and guess at it offline.
Variables ¶
var ( // ErrWrongKey is returned when a token or sealed blob does not open // under the given key. ErrWrongKey = errors.New("wrong store key or corrupt ciphertext") // ErrNoKey is returned when an encrypted object is met without a key. ErrNoKey = errors.New("object is encrypted and no store key is loaded") )
Functions ¶
func ReadKeyset ¶
func ReadKeyset(data json.RawMessage) (*keyset.Handle, error)
ReadKeyset reads a keyset as a key file holds it.
func WriteKeyset ¶
func WriteKeyset(h *keyset.Handle) (json.RawMessage, error)
WriteKeyset writes a keyset as a key file holds it.
Types ¶
type Field ¶
type Field string
Field names the FileInfo fields that are sealed.
const ( // FieldName is the entry name. FieldName Field = "name" // FieldUser is the owning user. FieldUser Field = "user" // FieldGroup is the owning group. FieldGroup Field = "group" // FieldTarget is a symlink's target. FieldTarget Field = "link_target" // FieldStream is an alternate stream's name, sealed within its entry. FieldStream Field = "stream" // FieldXattr is an extended attribute's name, sealed within its entry. FieldXattr Field = "xattr" // FieldHardLink is the path of the file a hard link shares its content // with. FieldHardLink Field = "hard_link" )
type Key ¶
Key is a store key, named after its store, with the policy the agent writes under. It is a pair of Tink keysets: deterministic AEAD seals, a PRF derives the key id and the digests PRF-named blobs carry.
func New ¶
New makes a key from its keysets: deterministic AEAD to seal with and a PRF to derive the key id and digests from.
func (*Key) Digest ¶
Digest is the PRF of a blob's plaintext, which a PRF-named blob's ref is made from: equal under one key, unrelated under another.
func (*Key) Escrow ¶
Escrow wraps the key file under a passphrase of at least MinPassphrase characters with age, so the key's owner can keep it where the server cannot open it. The result is an armored age file; `age -d` opens it too.
func (*Key) OpenInline ¶
OpenInline reverses SealInline.
func (*Key) OpenPRFBlob ¶ added in v1.96.0
OpenPRFBlob opens a PRF-named blob: stored bytes sealed bound to "blob" and the ref made from their plaintext's Digest, the form a store held sealed blobs in until it was resealed.
func (*Key) Save ¶
Save writes the key file, readable by its owner only. It refuses a path that exists, with an error matching fs.ErrExist, so no key is ever written over another.
func (*Key) SealBlob ¶
SealBlob seals a blob's stored bytes, bound to the key's id. Sealing is deterministic, so a blob stored twice is stored once.
func (*Key) SealField ¶
SealField makes the deterministic token of a name-like field within its parent directory. Equal names in one directory give equal tokens; the same name elsewhere gives a different one. An empty value stays empty.
func (*Key) SealInline ¶
SealInline seals a small file's whole content.
type Mode ¶
type Mode string
Mode is the store policy's encryption requirement for new writes. An agent holding a store key seals whatever the mode.
type Policy ¶
type Policy struct {
Version uint32 `json:"version"`
Mode Mode `json:"mode"`
PresenceScope string `json:"presence_scope"`
}
Policy is the store's write policy, as the agent holds it.
func DefaultPolicy ¶
func DefaultPolicy() Policy
DefaultPolicy seals everything and scopes presence to the store.
Source Files