Documentation
¶
Overview ¶
Package storekey implements the client-held store key: its key file, deterministic sealing of blobs, name tokens and inline content, the digest blobs are named by, and passphrase escrow. The server never sees the key. It carries none of the object format, so a WebAssembly build can take it without the rest of goback.
Index ¶
- Constants
- Variables
- func ReadKeyset(data json.RawMessage) (*keyset.Handle, error)
- func WriteKeyset(h *keyset.Handle) (json.RawMessage, error)
- type Field
- type Key
- func (k *Key) Digest(plaintext []byte) []byte
- func (k *Key) Escrow(passphrase string) ([]byte, error)
- func (k *Key) ID() []byte
- func (k *Key) IDString() string
- func (k *Key) Marshal() ([]byte, error)
- func (k *Key) OpenBlob(sealed, ref []byte) ([]byte, error)
- func (k *Key) OpenField(parent []byte, field Field, token []byte) ([]byte, error)
- func (k *Key) OpenInline(ciphertext []byte) ([]byte, error)
- func (k *Key) Save(path string) error
- func (k *Key) SealBlob(stored, ref []byte) []byte
- func (k *Key) SealField(parent []byte, field Field, plaintext []byte) []byte
- func (k *Key) SealInline(plaintext []byte) []byte
- type Mode
- type Policy
Constants ¶
const IDSize = 8
IDSize is the width of a key id.
const MinPassphrase = 12
MinPassphrase is the fewest characters Escrow takes: anyone holding an agent key of the store can fetch the escrowed copy and guess at it offline.
Variables ¶
var ( // ErrWrongKey is returned when a token or sealed blob does not open // under the given key. ErrWrongKey = errors.New("wrong store key or corrupt ciphertext") // ErrNoKey is returned when an encrypted object is met without a key. ErrNoKey = errors.New("object is encrypted and no store key is loaded") )
Functions ¶
func ReadKeyset ¶
func ReadKeyset(data json.RawMessage) (*keyset.Handle, error)
ReadKeyset reads a keyset as a key file holds it.
func WriteKeyset ¶
func WriteKeyset(h *keyset.Handle) (json.RawMessage, error)
WriteKeyset writes a keyset as a key file holds it.
Types ¶
type Key ¶
Key is a store key, named after its store, with the policy the agent writes under. It is a pair of Tink keysets: deterministic AEAD seals, a PRF names blobs.
func New ¶
New makes a key from its keysets: deterministic AEAD to seal with and a PRF to name blobs with.
func (*Key) Digest ¶
Digest is the PRF of a blob's plaintext, which its ref is made from: equal under one key, unrelated under another.
func (*Key) Escrow ¶
Escrow wraps the key file under a passphrase of at least MinPassphrase characters with age, so the key's owner can keep it where the server cannot open it. The result is an armored age file; `age -d` opens it too.
func (*Key) OpenInline ¶
OpenInline reverses SealInline.
func (*Key) Save ¶
Save writes the key file, readable by its owner only. It refuses a path that exists, with an error matching fs.ErrExist, so no key is ever written over another.
func (*Key) SealBlob ¶
SealBlob seals a blob's stored bytes, bound to the blob's ref. Sealing is deterministic, so a blob stored twice is stored once.
func (*Key) SealField ¶
SealField makes the deterministic token of a name-like field within its parent directory. Equal names in one directory give equal tokens; the same name elsewhere gives a different one. An empty value stays empty.
func (*Key) SealInline ¶
SealInline seals a small file's whole content.
type Mode ¶
type Mode string
Mode is the store policy's encryption requirement for new writes. An agent holding a store key seals whatever the mode.
type Policy ¶
type Policy struct {
Version uint32 `json:"version"`
Mode Mode `json:"mode"`
PresenceScope string `json:"presence_scope"`
}
Policy is the store's write policy, as the agent holds it.
func DefaultPolicy ¶
func DefaultPolicy() Policy
DefaultPolicy seals everything and scopes presence to the store.
Source Files