Documentation
¶
Overview ¶
Package ecdh provides implementations of payload encryption using ECDH-ES/1PU KW key wrapping with AEAD primitives.
The functionality of ecdh Encryption is represented as a pair of primitives (interfaces):
ECDHEncrypt for encryption of data and aad for a given cek (recipients cek wrapping is not done in this primitive)
ECDHDecrypt for decryption of data for a given cek and returning decrypted plaintext
Example:
package main
import (
"bytes"
"github.com/google/tink/go/keyset"
"github.com/hyperledger/aries-framework-go/pkg/crypto/tinkcrypto/primitive/composite"
"github.com/hyperledger/aries-framework-go/pkg/crypto/tinkcrypto/primitive/composite/ecdh"
)
func main() {
// create recipient side keyset handle
recKH, err := keyset.NewHandle(ecdh.ECDH256KWAES256GCMKeyTemplate())
if err != nil {
//handle error
}
// extract recipient public keyset handle and key
recPubKH, err := recKH.Public()
if err != nil {
//handle error
}
buf := new(bytes.Buffer)
pubKeyWriter := ecdh.NewWriter(buf)
err = recPubKH.WriteWithNoSecrets(pubKeyWriter)
if err != nil {
//handle error
}
// ecPubKey represents a recipient public key that can be used to wrap cek
ecPubKey := new(composite.VerificationMethod)
err := json.Unmarshal(buf.Bytes(), ecPubKey)
// see pkg/crypto/tinkcrypto to see how you can wrap a shared secret (cek)
// once a cek is created create an ECDH KH that can be used to encrypt plaintext as follows
kt := ecdh.AES256GCMKeyTemplateWithCEK(cek)
kh, err := keyset.NewHandle(kt)
if err != nil {
// handle error
}
pubKH, err := kh.Public()
if err != nil {
// handle error
}
// finally get the encryption primitive from the public key handle created above
e:= ecdh.NewECDHEncrypt(pubKH)
// and now encrypt using e
ct, err = e.Encrypt([]byte("secret message"), []byte("some aad"))
if err != nil {
// handle error
}
// to decrypt, recreate kh for the cek (once unwrapped from pkg/crypto)
kt = ecdh.AES256GCMKeyTemplateWithCEK(cek)
kh, err = keyset.NewHandle(kt)
if err != nil {
// handle error
}
// get the decryption primtive for kh
d := ecdh.NewECDHDecrypt(kh)
// and decrypt
pt, err := d.Decrypt(ct)
if err != nil {
// handle error
}
}
Index ¶
- func AES256GCMKeyTemplateWithCEK(cek []byte) *tinkpb.KeyTemplate
- func ECDH256KWAES256GCMKeyTemplate() *tinkpb.KeyTemplate
- func ECDH384KWAES256GCMKeyTemplate() *tinkpb.KeyTemplate
- func ECDH521KWAES256GCMKeyTemplate() *tinkpb.KeyTemplate
- func NewECDHDecrypt(h *keyset.Handle) (api.CompositeDecrypt, error)
- func NewECDHDecryptWithKeyManager(h *keyset.Handle, km registry.KeyManager) (api.CompositeDecrypt, error)
- func NewECDHEncrypt(h *keyset.Handle) (api.CompositeEncrypt, error)
- func NewECDHEncryptWithKeyManager(h *keyset.Handle, km registry.KeyManager) (api.CompositeEncrypt, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AES256GCMKeyTemplateWithCEK ¶
func AES256GCMKeyTemplateWithCEK(cek []byte) *tinkpb.KeyTemplate
AES256GCMKeyTemplateWithCEK is similar to ECDHAES256GCMKeyTemplate but adding the cek to execute the CompositeEncrypt primitive for encrypting a message targeted to one ore more recipients. Keys from this template offer valid CompositeEncrypt primitive execution only and should not be stored in the KMS. The key created from this template has no recipient key info linked to it. It is use exclusively used for primitive execution.
func ECDH256KWAES256GCMKeyTemplate ¶
func ECDH256KWAES256GCMKeyTemplate() *tinkpb.KeyTemplate
ECDH256KWAES256GCMKeyTemplate is a KeyTemplate that generates a key that accepts a CEK for AES256-GCM encryption. CEK wrapping is done outside of this Tink key (in the tinkcrypto service). It is used to represent a key to execute the CompositeDecrypt primitive with the following parameters:
- Content Encryption: AES256-GCM
Keys from this template represent a valid recipient public/private key pairs and can be stored in the KMS. The recipient key represented in this key template uses NIST curve P-256.
func ECDH384KWAES256GCMKeyTemplate ¶
func ECDH384KWAES256GCMKeyTemplate() *tinkpb.KeyTemplate
ECDH384KWAES256GCMKeyTemplate is a KeyTemplate that generates a key that accepts a CEK for AES256-GCM encryption. CEK wrapping is done outside of this Tink key (in the tinkcrypto service). It is used to represent a key to execute the CompositeDecrypt primitive with the following parameters:
- Content Encryption: AES256-GCM
Keys from this template represent a valid recipient public/private key pairs and can be stored in the KMS. The recipient key represented in this key template uses NIST curve P-384.
func ECDH521KWAES256GCMKeyTemplate ¶
func ECDH521KWAES256GCMKeyTemplate() *tinkpb.KeyTemplate
ECDH521KWAES256GCMKeyTemplate is a KeyTemplate that generates a key that accepts a CEK for AES256-GCM encryption. CEK wrapping is done outside of this Tink key (in the tinkcrypto service). It is used to represent a key to execute the CompositeDecrypt primitive with the following parameters:
- Content Encryption: AES256-GCM
Keys from this template represent a valid recipient public/private key pairs and can be stored in the KMS. The recipient key represented in this key template uses NIST curve P-521.
func NewECDHDecrypt ¶
func NewECDHDecrypt(h *keyset.Handle) (api.CompositeDecrypt, error)
NewECDHDecrypt returns an CompositeDecrypt primitive from the given keyset handle.
func NewECDHDecryptWithKeyManager ¶
func NewECDHDecryptWithKeyManager(h *keyset.Handle, km registry.KeyManager) (api.CompositeDecrypt, error)
NewECDHDecryptWithKeyManager returns an CompositeDecrypt primitive from the given keyset handle and custom key manager.
func NewECDHEncrypt ¶
func NewECDHEncrypt(h *keyset.Handle) (api.CompositeEncrypt, error)
NewECDHEncrypt returns an CompositeEncrypt primitive from the given keyset handle.
func NewECDHEncryptWithKeyManager ¶
func NewECDHEncryptWithKeyManager(h *keyset.Handle, km registry.KeyManager) (api.CompositeEncrypt, error)
NewECDHEncryptWithKeyManager returns an CompositeEncrypt primitive from the given h keyset handle and custom km key manager.
Types ¶
This section is empty.
Source Files
Directories