Documentation
¶
Overview ¶
Package keys parses, generates, describes and compares private and public keys in the formats SSLKnife supports.
Index ¶
- Constants
- Variables
- func DecryptPKCS8(der, password []byte) ([]byte, error)
- func EncryptPKCS8(pkcs8, password []byte) ([]byte, error)
- func Equal(a, b crypto.PublicKey) bool
- func Generate(a Algorithm) (crypto.Signer, error)
- func IsPrivateKeyBlock(t string) bool
- func MarshalPrivateKeyPEM(priv crypto.PrivateKey, password []byte) ([]byte, error)
- func MarshalPublicKeyPEM(pub crypto.PublicKey) ([]byte, error)
- func Public(priv crypto.PrivateKey) (crypto.PublicKey, error)
- func SPKI(pub crypto.PublicKey) ([]byte, error)
- func SPKIFingerprint(spki []byte) string
- type Algorithm
- type PasswordFunc
- type PrivateKey
- type PublicKey
- type PublicKeyInfo
Constants ¶
const ( FormatPKCS8 = "PKCS#8" FormatPKCS8Encrypted = "PKCS#8 (encrypted)" FormatPKCS1 = "PKCS#1" FormatSEC1 = "SEC1" FormatLegacyPEM = "PEM (legacy encryption)" FormatOpenSSH = "OpenSSH" FormatPKIX = "PKIX SubjectPublicKeyInfo" FormatPKCS1Public = "PKCS#1 public" FormatAuthorizedKey = "OpenSSH authorized_keys" FormatRFC4716 = "RFC 4716" )
Private key container formats.
const PBKDF2Iterations = 600_000
PBKDF2Iterations is used when writing encrypted PKCS#8 (OWASP 2023 recommendation for PBKDF2-HMAC-SHA256).
Variables ¶
var Algorithms = []Algorithm{ECDSAP256, ECDSAP384, ECDSAP521, Ed25519, RSA2048, RSA3072, RSA4096, MLDSA44, MLDSA65, MLDSA87}
Algorithms lists generatable algorithms in the order shown to users.
var ErrIncorrectPassword = errors.New("incorrect password or corrupted key")
ErrIncorrectPassword is returned when decryption fails.
var ErrNoKey = errors.New("no key found")
ErrNoKey means the input did not contain a key of the requested kind.
var ErrPasswordRequired = errors.New("key is encrypted and requires a password")
ErrPasswordRequired means the key is encrypted and no password was given.
Functions ¶
func DecryptPKCS8 ¶
DecryptPKCS8 unwraps an EncryptedPrivateKeyInfo and returns PKCS#8 DER.
func EncryptPKCS8 ¶
EncryptPKCS8 wraps an unencrypted PKCS#8 DER blob.
func IsPrivateKeyBlock ¶
IsPrivateKeyBlock reports whether a PEM block type holds private key material.
func MarshalPrivateKeyPEM ¶
func MarshalPrivateKeyPEM(priv crypto.PrivateKey, password []byte) ([]byte, error)
MarshalPrivateKeyPEM encodes priv as PKCS#8, encrypted when password is non-empty.
func MarshalPublicKeyPEM ¶
MarshalPublicKeyPEM encodes pub as a PKIX "PUBLIC KEY" block.
func Public ¶
func Public(priv crypto.PrivateKey) (crypto.PublicKey, error)
Public returns the public half of a private key.
func SPKIFingerprint ¶
SPKIFingerprint returns the lowercase hex SHA-256 of the SPKI.
Types ¶
type Algorithm ¶
type Algorithm string
Algorithm identifies a key type and size that SSLKnife can generate.
const ( Ed25519 Algorithm = "ed25519" ECDSAP256 Algorithm = "ecdsa-p256" ECDSAP384 Algorithm = "ecdsa-p384" ECDSAP521 Algorithm = "ecdsa-p521" RSA2048 Algorithm = "rsa-2048" RSA3072 Algorithm = "rsa-3072" RSA4096 Algorithm = "rsa-4096" MLDSA44 Algorithm = "ml-dsa-44" MLDSA65 Algorithm = "ml-dsa-65" MLDSA87 Algorithm = "ml-dsa-87" )
func ParseAlgorithm ¶
ParseAlgorithm accepts common spellings: "ed25519", "ecdsa", "p256", "ec-384", "rsa", "rsa4096", "RSA 3072", "mldsa65", ...
type PasswordFunc ¶
PasswordFunc supplies a password when an encrypted key is encountered. It is only called if needed.
type PrivateKey ¶
type PrivateKey struct {
Key crypto.PrivateKey
Format string
Encrypted bool
Comment string
}
PrivateKey is a parsed private key and where it came from.
func ParsePrivateKey ¶
func ParsePrivateKey(data []byte, password PasswordFunc) (*PrivateKey, error)
ParsePrivateKey returns the first private key in data.
func ParsePrivateKeys ¶
func ParsePrivateKeys(data []byte, password PasswordFunc) ([]*PrivateKey, error)
ParsePrivateKeys returns every private key in data (PEM or DER).
func (*PrivateKey) Public ¶
func (p *PrivateKey) Public() crypto.PublicKey
Public returns the public key.
type PublicKeyInfo ¶
type PublicKeyInfo struct {
Algorithm string `json:"algorithm"` // RSA, ECDSA, Ed25519, ML-DSA, X25519, DSA
Bits int `json:"bits"` // modulus or curve size
Curve string `json:"curve,omitempty"` // P-256, ...
Parameters string `json:"parameters,omitempty"`
Exponent int `json:"exponent,omitempty"` // RSA public exponent
Description string `json:"description"` // e.g. "ECDSA P-256"
SPKISHA256 string `json:"spki_sha256"`
Strength string `json:"strength"` // modern, acceptable, weak, insecure
Notes []string `json:"notes,omitempty"`
}
PublicKeyInfo is the stable, serialisable description of a public key.
func Describe ¶
func Describe(pub crypto.PublicKey) PublicKeyInfo
Describe returns a description of pub. Unsupported key types produce an "unknown" description rather than an error so certificates carrying them can still be inspected.
Source Files