session_lock

package
v0.57.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 5, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Overview

Package session_lock provides shared lock/unlock operations for session private keys. Both local and spacewave providers use this package.

Index

Constants

This section is empty.

Variables

View Source 
var (
	SuffixPK         = []byte("/pk")
	SuffixEnvelope   = []byte("/env")
	SuffixLocked     = []byte("/locked")
	SuffixLockKey    = []byte("/lock-key")
	SuffixLockParams = []byte("/lock-params")
	SuffixSetupDone  = []byte("/setup-done")
)

ObjectStore key suffixes.

Functions

func DecryptAutoUnlock 

func DecryptAutoUnlock(storageKey [32]byte, encrypted []byte) ([]byte, error)

DecryptAutoUnlock decrypts session privkey PEM with the storage key.

func DeriveStorageKey 

func DeriveStorageKey(volPeerPrivKey crypto.PrivKey) ([32]byte, error)

DeriveStorageKey derives the auto-unlock storage key from the volume's persistent peer private key via blake3 key derivation.

func EncryptAutoUnlock 

func EncryptAutoUnlock(storageKey [32]byte, privPEM []byte) ([]byte, error)

EncryptAutoUnlock encrypts session privkey PEM with the storage key.

func MakeKey 

func MakeKey(sessionID string, suffix []byte) []byte

MakeKey constructs an ObjectStore key from a session ID and suffix.

func ReadAutoUnlockKey 

func ReadAutoUnlockKey(ctx context.Context, objStore object.ObjectStore, sessionID string) ([]byte, bool, error)

ReadAutoUnlockKey reads the encrypted privkey for auto-unlock mode.

func UnlockPIN 

func UnlockPIN(encPriv, encSymKey []byte, config *LockConfig, pin []byte) ([]byte, error)

UnlockPIN decrypts a PIN-locked session key.

func WriteAutoUnlock 

func WriteAutoUnlock(ctx context.Context, objStore object.ObjectStore, sessionID string, encPriv []byte) error

WriteAutoUnlock writes encrypted privkey for auto-unlock mode and deletes any PIN lock files.

func WriteEnvelope 

func WriteEnvelope(ctx context.Context, objStore object.ObjectStore, sessionID string, envData []byte) error

WriteEnvelope writes the Shamir envelope bytes to ObjectStore.

func WritePINLock 

func WritePINLock(ctx context.Context, objStore object.ObjectStore, sessionID string, encPriv, encSymKey []byte, config *LockConfig) error

WritePINLock writes PIN-encrypted lock files and deletes auto-unlock /pk file.

Types

type LockConfig 

type LockConfig struct {

	// ScryptN is the scrypt cost factor exponent; the work factor is 2^N.
	ScryptN uint32 `protobuf:"varint,1,opt,name=scrypt_n,json=scryptN,proto3" json:"scryptN,omitempty"`
	// Salt is the random salt for PIN key derivation.
	Salt []byte `protobuf:"bytes,2,opt,name=salt,proto3" json:"salt,omitempty"`
	// contains filtered or unexported fields
}

LockConfig is the persisted PIN-lock key-derivation configuration stored at {sessionID}/lock-params in the session ObjectStore.

func CreatePINLock 

func CreatePINLock(privPEM, pin []byte) (encPriv, encSymKey []byte, config *LockConfig, err error)

CreatePINLock creates PIN-encrypted lock files for a session private key. Returns encrypted privkey, encrypted symmetric key, and lock config.

func ReadPINLockFiles 

func ReadPINLockFiles(ctx context.Context, objStore object.ObjectStore, sessionID string) (encPriv, encSymKey []byte, config *LockConfig, err error)

ReadPINLockFiles reads the encrypted privkey, encrypted symkey, and lock config.

func (*LockConfig) CloneMessageVT added in v0.57.2 

func (m *LockConfig) CloneMessageVT() protobuf_go_lite.CloneMessage

func (*LockConfig) CloneVT added in v0.57.2 

func (m *LockConfig) CloneVT() *LockConfig

func (*LockConfig) EqualMessageVT added in v0.57.2 

func (this *LockConfig) EqualMessageVT(thatMsg any) bool

func (*LockConfig) EqualVT added in v0.57.2 

func (this *LockConfig) EqualVT(that *LockConfig) bool

func (*LockConfig) GetSalt added in v0.57.2 

func (x *LockConfig) GetSalt() []byte

func (*LockConfig) GetScryptN added in v0.57.2 

func (x *LockConfig) GetScryptN() uint32

func (*LockConfig) MarshalJSON added in v0.57.2 

func (x *LockConfig) MarshalJSON() ([]byte, error)

MarshalJSON marshals the LockConfig to JSON.

func (*LockConfig) MarshalProtoJSON added in v0.57.2 

func (x *LockConfig) MarshalProtoJSON(s *json.MarshalState)

MarshalProtoJSON marshals the LockConfig message to JSON.

func (*LockConfig) MarshalProtoText added in v0.57.2 

func (x *LockConfig) MarshalProtoText() string

func (*LockConfig) MarshalToSizedBufferVT added in v0.57.2 

func (m *LockConfig) MarshalToSizedBufferVT(dAtA []byte) (int, error)

func (*LockConfig) MarshalToVT added in v0.57.2 

func (m *LockConfig) MarshalToVT(dAtA []byte) (int, error)

func (*LockConfig) MarshalVT 

func (m *LockConfig) MarshalVT() (dAtA []byte, err error)

func (*LockConfig) ProtoMessage added in v0.57.2 

func (*LockConfig) ProtoMessage()

func (*LockConfig) Reset added in v0.57.2 

func (x *LockConfig) Reset()

func (*LockConfig) SizeVT added in v0.57.2 

func (m *LockConfig) SizeVT() (n int)

func (*LockConfig) String added in v0.57.2 

func (x *LockConfig) String() string

func (*LockConfig) UnmarshalJSON added in v0.57.2 

func (x *LockConfig) UnmarshalJSON(b []byte) error

UnmarshalJSON unmarshals the LockConfig from JSON.

func (*LockConfig) UnmarshalProtoJSON added in v0.57.2 

func (x *LockConfig) UnmarshalProtoJSON(s *json.UnmarshalState)

UnmarshalProtoJSON unmarshals the LockConfig message from JSON.

func (*LockConfig) UnmarshalVT 

func (m *LockConfig) UnmarshalVT(dAtA []byte) error

type SessionLockMode 

type SessionLockMode int32

SessionLockMode identifies how a session private key is protected at rest. 

const (
	// SessionLockMode_AUTO_UNLOCK is encrypted with volume-derived key.
	SessionLockMode_AUTO_UNLOCK SessionLockMode = 0
	// SessionLockMode_PIN_ENCRYPTED is encrypted with PIN-derived key.
	SessionLockMode_PIN_ENCRYPTED SessionLockMode = 1
)

func ReadLockMode 

func ReadLockMode(ctx context.Context, objStore object.ObjectStore, sessionID string) (SessionLockMode, error)

ReadLockMode checks ObjectStore to determine lock mode. Returns PIN_ENCRYPTED if lock-params exists, AUTO_UNLOCK otherwise.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.