Documentation
¶
Overview ¶
Package sign implements HTTP Message Signatures (RFC 9421) with Ed25519, as used by the Web Bot Auth proposal for cryptographically identifying automated clients.
Index ¶
- Constants
- func Base(req *http.Request, components []string, p Params) (string, error)
- func Directory(pubs ...ed25519.PublicKey) ([]byte, error)
- func EncodePrivateKey(key ed25519.PrivateKey) ([]byte, error)
- func GenerateKey() (ed25519.PrivateKey, error)
- func LoadPrivateKey(path string) (ed25519.PrivateKey, error)
- func ParsePrivateKey(data []byte) (ed25519.PrivateKey, error)
- func Sign(req *http.Request, key ed25519.PrivateKey, label string, components []string, ...) error
- func Thumbprint(pub ed25519.PublicKey) string
- func Verify(req *http.Request, pub ed25519.PublicKey, label string, components []string, ...) error
- type JWK
- type Params
- type Signer
Constants ¶
const WebBotAuthTag = "web-bot-auth"
WebBotAuthTag is the signature tag Web Bot Auth verifiers look for.
Variables ¶
This section is empty.
Functions ¶
func Directory ¶
Directory returns the JSON key directory a signing agent publishes at /.well-known/http-message-signatures-directory.
func EncodePrivateKey ¶
func EncodePrivateKey(key ed25519.PrivateKey) ([]byte, error)
EncodePrivateKey returns key as a PKCS #8 PEM block.
func GenerateKey ¶
func GenerateKey() (ed25519.PrivateKey, error)
GenerateKey returns a new Ed25519 private key.
func LoadPrivateKey ¶
func LoadPrivateKey(path string) (ed25519.PrivateKey, error)
LoadPrivateKey reads a PEM private key file.
func ParsePrivateKey ¶
func ParsePrivateKey(data []byte) (ed25519.PrivateKey, error)
ParsePrivateKey parses a PKCS #8 PEM Ed25519 private key.
func Sign ¶
func Sign(req *http.Request, key ed25519.PrivateKey, label string, components []string, p Params) error
Sign signs req and sets the Signature-Input and Signature headers under label (for example "sig1").
func Thumbprint ¶
Thumbprint returns the RFC 7638 JWK SHA-256 thumbprint of pub, base64url-encoded. Web Bot Auth uses it as the signature keyid.
Types ¶
type JWK ¶
type JWK struct {
Kty string `json:"kty"`
Crv string `json:"crv"`
X string `json:"x"`
Kid string `json:"kid,omitempty"`
}
JWK is an Ed25519 public key in JSON Web Key form (RFC 8037).
type Params ¶
type Params struct {
Created time.Time
Expires time.Time // zero means none
KeyID string
Alg string // e.g. "ed25519"; empty omits the parameter
Nonce string
Tag string
}
Params are the signature parameters of RFC 9421 §2.3.
type Signer ¶
type Signer struct {
Key ed25519.PrivateKey
// Agent is the Signature-Agent URL where the key directory is published,
// e.g. "https://bot.example". Empty omits the header.
Agent string
// Validity is how long a signature is valid. Default one minute.
Validity time.Duration
// contains filtered or unexported fields
}
Signer signs requests the way Web Bot Auth agents do: an Ed25519 signature over @authority and Signature-Agent, with a short validity window, a nonce and the web-bot-auth tag.
Source Files