security

type Config struct {
	Type string `yaml:"type" default:"standard"`
	// StandardConfig is the configuration for the standard key provider
	StandardConfig StandardConfig `yaml:"standard,omitempty" mapstructure:"standard"`
}

type CryptoProvider interface {
	// Gets some KID associated with a given algorithm.
	// Returns empty string if none are found.
	FindKID(alg string) string
	RSAPublicKey(keyID string) (string, error)
	RSAPublicKeyAsJSON(keyID string) (string, error)
	RSADecrypt(hash crypto.Hash, keyID string, keyLabel string, ciphertext []byte) ([]byte, error)

	ECPublicKey(keyID string) (string, error)
	ECCertificate(keyID string) (string, error)
	GenerateNanoTDFSymmetricKey(kasKID string, ephemeralPublicKeyBytes []byte, curve elliptic.Curve) ([]byte, error)
	GenerateEphemeralKasKeys() (any, []byte, error)
	GenerateNanoTDFSessionKey(privateKeyHandle any, ephemeralPublicKey []byte) ([]byte, error)
	Close()
}

type Error string

type KeyPairInfo struct {
	// Valid algorithm. May be able to be derived from Private but it is better to just say it.
	Algorithm string `mapstructure:"alg"`
	// Key identifier. Should be short
	KID string `mapstructure:"kid"`
	// Implementation specific locator for private key;
	// for 'standard' crypto service this is the path to a PEM file
	Private string `mapstructure:"private"`
	// Optional locator for the corresponding certificate.
	// If not found, only public key (derivable from Private) is available.
	Certificate string `mapstructure:"cert"`
	// Optional enumeration of intended usages of keypair
	Usage string `mapstructure:"usage"`
	// Optional long form description of key pair including purpose and life cycle information
	Purpose string `mapstructure:"purpose"`
}

type StandardConfig struct {
	Keys []KeyPairInfo `mapstructure:"keys"`
	// Deprecated
	RSAKeys map[string]StandardKeyInfo `yaml:"rsa,omitempty" mapstructure:"rsa"`
	// Deprecated
	ECKeys map[string]StandardKeyInfo `yaml:"ec,omitempty" mapstructure:"ec"`
}

type StandardCrypto struct {
	// contains filtered or unexported fields
}

type StandardECCrypto struct {
	KeyPairInfo
	// contains filtered or unexported fields
}

type StandardKeyInfo struct {
	PrivateKeyPath string `yaml:"private_key_path" mapstructure:"private_key_path"`
	PublicKeyPath  string `yaml:"public_key_path" mapstructure:"public_key_path"`
}

type StandardRSACrypto struct {
	KeyPairInfo
	// contains filtered or unexported fields
}