eat

package module
v0.0.0-...-289c6e7 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 9, 2026 License: Apache-2.0 Imports: 15 Imported by: 32

README

Entity Attestation Token

The eat package provides a golang API for manipulating Entity Attestation Tokens defined in RFC 9711.

Supported EAT Features

See eat.go for more detail.

claim CBOR key id Supported?
eat_nonce 10 ✅
ueid 256 ✅
sueids 257 ❌
oemid 258 ⚠ currently oemid-pem (int) is not supported
hwmodel 259 ✅
hwversion 260 ✅
uptime 261 ✅
oemboot 262 ✅
dbgstat 263 ✅
location 264 ✅
eat_profile 265 ✅
submods 266 ✅
bootcount 267 ✅
bootseed 268 ✅
dloas 269 ❌
swname 270 ✅
swversion 271 ✅
manifests 272 ⚠️ (see Supported Type for Manifests and Measurements)
measurements 273 ⚠️ (see Supported Type for Manifests and Measurements)
measres 274 ❌
intuse 275 ❌

Supported CWT Features

See cwt.go for more detail.

claim CBOR key id Supported?
iss 1 ✅
sub 2 ✅
aud 3 ✅
exp 4 ✅
nbf 5 ✅
iat 6 ✅
cti 7 ⚠️ no jti support
cnf 8 ⚠️ supports only OKP and EC2 COSE_Key, no EncryptedKey support

Supported Type for Manifests and Measurements

RFC 9711 defines extensible Manifests and Measurements.

The measured_component.go experimentally provides encoding/decoding feature for EAT Measured Component (v05). The untagged-coswid encoder/decoder is provided by veraison/swid.

coap-conent-type id Supported?
application/swid+cbor (untagged-coswid) 258 ✅
application/measured-component+cbor TBD1 in draft-ietf-rats-eat-measured-component ✅ e.g. cbor.Unmarshal(measurement.Format, &mc)
application/measured-component+json TBD2 in draft-ietf-rats-eat-measured-component ✅ e.g. json.Unmarshal(measurement.Format, &mc)

Documentation

Overview

Package eat provides an API for creating and interacting with Entity Attestation Tokens defined by draft-ietf-rats-eat.

Index

Examples

Constants

View Source 
const (
	// DebugEnabledValue is asserted if any debug facility, even manufacturer
	// hardware diagnostics, is currently enabled
	DebugEnabledValue = iota

	// DebugDisabledValue indicates all debug facilities are currently disabled. It
	// may be possible to enable them in the future, and it may also be possible
	// that they were enabled in the past after the target device/sub-system
	// booted/started, but they are currently disabled.
	DebugDisabledValue

	// DebugDisabledSinceBootValue indicates all debug facilities are currently
	// disabled and have been so since the target device/sub-system
	// booted/started.
	DebugDisabledSinceBootValue

	// DebugPermanentDisableValue indicates all non-manufacturer facilities are
	// permanently disabled such that no end user or developer cannot enable
	// them. Only the manufacturer indicated in the OEMID claim can enable them.
	// This also indicates that all debug facilities are currently disabled and
	// have been so since boot/start.
	DebugPermanentDisableValue

	// DebugFullPermanentDisableValue indicates that all debug capabilities for the
	// target device/sub-module are permanently disabled.
	DebugFullPermanentDisableValue
)
View Source 
const (
	Shake256   int = -45
	Sha512     int = -44
	Sha384     int = -43
	Shake128   int = -18
	Sha512_256 int = -17
	Sha256     int = -16
	Sha256_64  int = -15
	Sha1       int = -14
)

COSE Algorithm Registry https://www.iana.org/assignments/cose#algorithms

View Source 
const (
	CWTTaggedMessageTag    uint64 = 61
	BUNDLETaggedMessageTag uint64 = 602
)
View Source 
const (
	MinNonceSize = 8
	MaxNonceSize = 64
)

nonce-type = bstr .size (8..64)

View Source 
const (
	// MaxASN1OIDLen is the maximum OID length accepted by the implementation
	MaxASN1OIDLen = 255
	// MinNumOIDArcs represents the minimum required arcs for a valid OID
	MinNumOIDArcs = 3
)
View Source 
const (
	// There is some expectation that implementer will protect the
	// attestation signing keys at this level.  Otherwise, the EAT
	// provides no meaningful security assurance.
	SecLevelUnrestricted = iota

	// Enties at this level should not be general-purpose operating
	// environments that host features such as app download systems, web
	// browsers, and complex productivity applications. It is akin to the
	// Secure Restricted level (see below) without the security orientation.
	// E.g. a Wi-Fi subsystem, an IoT camera, or a sensor device.
	SecLevelRestricted

	// Entities at this level must meet the criteria defined by FIDO
	// Allowed Restricted Operating Environments [1]. Examples include TEE's
	// and schemes using virtualization-based security. Like the FIDO
	// security goal, security at this level is aimed defending well
	// against large-scale network / remote attacks against the device.
	//
	// [1] https://fidoalliance.org/specs/fido-security-requirements-v1.0-fd-20170524/
	// fido-authenticator-allowed-restricted-operating-environments-list_20170524.pdf
	SecLevelSecureRestricted

	// Entities at this level must include substantial defense against
	// physical or electrical attacks against the device itself. It is
	// assumed any potential attacker has captured the device and can
	// disassemble it. Examples include TPMs and Secure Elements.
	SecLevelHardware
)

security-level-type = &( 

unrestricted: 1,
restricted: 2,
secure-restricted: 3,
hardware: 4

)

View Source 
const (
	UEIDTypeInvalid = iota

	// This is a 128, 192 or 256 bit random number generated once and
	// stored in the device. This may be constructed by concatenating
	// enough identifiers to make up an equivalent number of random bits
	// and then feeding the concatenation through a cryptographic hash
	// function. It may also be a cryptographic quality random number
	// generated once at the beginning of the life of the device and
	// stored. It may not be smaller than 128 bits.
	UEIDTypeRAND

	// This makes use of the IEEE company identification registry. An EUI
	// is either an EUI-48, EUI-60 or EUI-64 and made up of an OUI, OUI-36
	// or a CID, different registered company identifiers, and some unique
	// per-device identifier. EUIs are often the same as or similar to MAC
	// addresses. This type includes MAC-48, an obsolete name for EUI-48.
	// (Note that while devices with multiple network interfaces may have
	// multiple MAC addresses, there is only one UEID for a device)
	UEIDTypeEUI

	// This is a 14-digit identifier consisting of an 8-digit Type
	// Allocation Code and a 6-digit serial number allocated by the
	// manufacturer, which SHALL be encoded as byte string of length 14
	// with each byte as the digit's value (not the ASCII encoding of the
	// digit; the digit 3 encodes as 0x03, not 0x33). The IMEI value
	// encoded SHALL NOT include Luhn checksum or SVN information.
	UEIDTypeIMEI
)
View Source 
const DetachedEatBundleTag = 602

Variables

View Source 
var (

	// DebugEnabled is asserted if any debug facility, even manufacturer
	// hardware diagnostics, is currently enabled
	DebugEnabled = Debug{DebugEnabledValue}

	// DebugDisabled indicates all debug facilities are currently disabled. It
	// may be possible to enable them in the future, and it may also be possible
	// that they were enabled in the past after the target device/sub-system
	// booted/started, but they are currently disabled.
	DebugDisabled = Debug{DebugDisabledValue}

	// DebugDisabledSinceBoot indicates all debug facilities are currently
	// disabled and have been so since the target device/sub-system
	// booted/started.
	DebugDisabledSinceBoot = Debug{DebugDisabledSinceBootValue}

	// DebugPermanentDisable indicates all non-manufacturer facilities are
	// permanently disabled such that no end user or developer cannot enable
	// them. Only the manufacturer indicated in the OEMID claim can enable them.
	// This also indicates that all debug facilities are currently disabled and
	// have been so since boot/start.
	DebugPermanentDisable = Debug{DebugPermanentDisableValue}

	// DebugFullPermanentDisable indicates that all debug capabilities for the
	// target device/sub-module are permanently disabled.
	DebugFullPermanentDisable = Debug{DebugFullPermanentDisableValue}
)
View Source 
var (
	HashAlgorithmShake256   = MustHashAlgorithmFromInt(Shake256)
	HashAlgorithmSha512     = MustHashAlgorithmFromInt(Sha512)
	HashAlgorithmSha384     = MustHashAlgorithmFromInt(Sha384)
	HashAlgorithmShake128   = MustHashAlgorithmFromInt(Shake128)
	HashAlgorithmSha512_256 = MustHashAlgorithmFromInt(Sha512_256)
	HashAlgorithmSha256     = MustHashAlgorithmFromInt(Sha256)
	HashAlgorithmSha256_64  = MustHashAlgorithmFromInt(Sha256_64)
	HashAlgorithmSha1       = MustHashAlgorithmFromInt(Sha1)
)

Functions

This section is empty.

Types

type Audience 

type Audience []StringOrURI

In the general case, the "aud" value is an array of case- sensitive strings, each containing a StringOrURI value. In the special case when the JWT has one audience, the "aud" value MAY be a single case-sensitive string containing a StringOrURI value.

func (Audience) MarshalCBOR 

func (a Audience) MarshalCBOR() ([]byte, error)

MarshalCBOR encodes Audience as a StringOrURI, in case there is only one, or an array of StringOrURI's if there are multiple.

func (Audience) MarshalJSON 

func (a Audience) MarshalJSON() ([]byte, error)

MarshalJSON encodes the receiver Audience as a JSON string

func (*Audience) UnmarshalCBOR 

func (a *Audience) UnmarshalCBOR(data []byte) error

UnmarshalCBOR decodes audience claim data. This may be a single StringOrURI, or an array of such.

func (*Audience) UnmarshalJSON 

func (a *Audience) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes a JSON string into the receiver Audience

type BinaryData 

type BinaryData []byte

BinaryData is a []byte that encodes as base64url_nopad in JSON (normally a []byte is encoded as base64std).

func (BinaryData) MarshalJSON 

func (o BinaryData) MarshalJSON() ([]byte, error)

func (*BinaryData) UnmarshalJSON 

func (o *BinaryData) UnmarshalJSON(data []byte) error

type COSEKey 

type COSEKey struct {
	Type      cose.KeyType   `cbor:"1,keyasint" json:"kty"`
	ID        []byte         `cbor:"2,keyasint,omitempty" json:"kid,omitempty"`
	Algorithm cose.Algorithm `cbor:"3:keyasint,omitempty" json:"alg,omitempty"`
	Ops       []cose.KeyOp   `cbor:"4,keyasint,omitempty" json:"ops,omitempty"`
	BaseIV    []byte         `cbor:"5,keyasint,omitempty"`

	// Additional parameter pairs for OKP and EC2.
	Crv cose.Curve `cbor:"-1,keyasint,omitempty" json:"crv,omitempty"`
	X   []byte     `cbor:"-2,keyasint,omitempty" json:"x,omitempty"`
	Y   []byte     `cbor:"-3,keyasint,omitempty" json:"y,omitempty"`
	D   []byte     `cbor:"-4,keyasint,omitempty" json:"d,omitempty"`
}

NOTE: supports only OKP and EC2 key 

COSE_Key = {
    1 => tstr / int,          ; kty
    ? 2 => bstr,              ; kid
    ? 3 => tstr / int,        ; alg
    ? 4 => [+ (tstr / int) ], ; key_ops
    ? 5 => bstr,              ; Base IV
    * label => values
}

type ClaimsSet 

type ClaimsSet struct {
	Nonce *Nonce `cbor:"10,keyasint,omitempty" json:"eat_nonce,omitempty"`
	UEID  *UEID  `cbor:"256,keyasint,omitempty" json:"ueid,omitempty"`
	// TODO: support SUEIDs
	// TODO: support oemid-pem = int type
	OemID           *OemID      `cbor:"258,keyasint,omitempty" json:"oemid,omitempty"`
	HardwareModel   *BinaryData `cbor:"259,keyasint,omitempty" json:"hwmodel,omitempty"`
	HardwareVersion *Version    `cbor:"260,keyasint,omitempty" json:"hwversion,omitempty"`
	Uptime          *uint       `cbor:"261,keyasint,omitempty" json:"uptime,omitempty"`
	OemBoot         *bool       `cbor:"262,keyasint,omitempty" json:"oemboot,omitempty"`
	DebugStatus     *Debug      `cbor:"263,keyasint,omitempty" json:"dbgstat,omitempty"`
	Location        *Location   `cbor:"264,keyasint,omitempty" json:"location,omitempty"`
	Profile         *Profile    `cbor:"265,keyasint,omitempty" json:"eat-profile,omitempty"`
	Submods         *Submods    `cbor:"266,keyasint,omitempty" json:"submods,omitempty"`
	BootCount       *uint       `cbor:"267,keyasint,omitempty" json:"bootcount,omitempty"`
	BootSeed        *BinaryData `cbor:"268,keyasint,omitempty" json:"bootseed,omitempty"`
	// TODO: DLOAs
	SoftwareName    *StringOrURI   `cbor:"270,keyasint,omitempty" json:"swname,omitempty"`
	SoftwareVersion *Version       `cbor:"271,keyasint,omitempty" json:"swversion,omitempty"`
	Manifests       *[]Manifest    `cbor:"272,keyasint,omitempty" json:"manifests,omitempty"`
	Measurements    *[]Measurement `cbor:"273,keyasint,omitempty" json:"measurements,omitempty"`

	// CWT/JWT claims
	Issuer     *string          `cbor:"1,keyasint,omitempty" json:"iss,omitempty"`
	Subject    *string          `cbor:"2,keyasint,omitempty" json:"sub,omitempty"`
	Audience   *Audience        `cbor:"3,keyasint,omitempty" json:"aud,omitempty"`
	Expiration *NumericDate     `cbor:"4,keyasint,omitempty" json:"exp,omitempty"`
	NotBefore  *NumericDate     `cbor:"5,keyasint,omitempty" json:"nbf,omitempty"`
	IssuedAt   *NumericDate     `cbor:"6,keyasint,omitempty" json:"iat,omitempty"`
	CwtID      *BinaryData      `cbor:"7,keyasint,omitempty" json:"cti,omitempty"`
	Cnf        *KeyConfirmation `cbor:"8,keyasint,omitempty" json:"cnf,omitempty"`
	// contains filtered or unexported fields
}

ClaimsSet is the internal representation of a EAT Claim-Set

func NewClaimsSet 

func NewClaimsSet() *ClaimsSet

NewClaimsSet returns a pointer to a new empty ClaimsSet

func (*ClaimsSet) GetPrivate 

func (o *ClaimsSet) GetPrivate(key IntOrString) any

GetPrivate returns the value of the specified private claims key. If the key has not been set, nil is returned.

func (*ClaimsSet) MarshalCBOR 

func (o *ClaimsSet) MarshalCBOR() ([]byte, error)

func (*ClaimsSet) MarshalJSON 

func (o *ClaimsSet) MarshalJSON() ([]byte, error)

func (*ClaimsSet) SetPrivate 

func (o *ClaimsSet) SetPrivate(key IntOrString, value any) error

SetPrivate sets the value of the specified private claims key. If the specified key clashes with one of the standard EAT claims, an error is returned.

func (*ClaimsSet) ToEat 

func (o *ClaimsSet) ToEat() *Eat

ToEat returns a new *Eat that wraps this ClaimsSet.

func (*ClaimsSet) UnmarshalCBOR 

func (o *ClaimsSet) UnmarshalCBOR(data []byte) error

func (*ClaimsSet) UnmarshalJSON 

func (o *ClaimsSet) UnmarshalJSON(data []byte) error

type ComponentID 

type ComponentID struct {
	Name    string   `cbor:"0,keyasint"`
	Version *Version `cbor:"1,keyasint,omitempty"`
	// contains filtered or unexported fields
}

func (ComponentID) MarshalJSON 

func (c ComponentID) MarshalJSON() ([]byte, error)

func (*ComponentID) UnmarshalJSON 

func (c *ComponentID) UnmarshalJSON(data []byte) error

type Debug 

type Debug struct {
	// contains filtered or unexported fields
}

Debug models the debug-disable type

func DebugFromString 

func DebugFromString(text string) (*Debug, error)

DebugFromString converts the provided string to a pointer to the corresponding Debug value. An error is returned if the provided string does not correspond to a Debug value.

func DebugFromUint 

func DebugFromUint(value uint) (*Debug, error)

DebugFromString converts the provided uint to a pointer to the corresponding Debug value. An error is returned if the provided uint does not correspond to a Debug value.

func (*Debug) MarshalCBOR 

func (o *Debug) MarshalCBOR() ([]byte, error)

func (*Debug) MarshalJSON 

func (o *Debug) MarshalJSON() ([]byte, error)

func (*Debug) String 

func (o *Debug) String() string

String returns the string corresponding to this Debug's value.

func (*Debug) Uint 

func (o *Debug) Uint() uint

Uint returns the uint corresponding to this Debug's value.

func (*Debug) UnmarshalCBOR 

func (o *Debug) UnmarshalCBOR(data []byte) error

func (*Debug) UnmarshalJSON 

func (o *Debug) UnmarshalJSON(data []byte) error

type DetachedEatBundle 

type DetachedEatBundle struct {
	// contains filtered or unexported fields
}

DetachedEatBundle is a message that conveys an EAT (a NestedToken) plus detached claims sets setcured by that EAT.

func NewDetachedEatBundle 

func NewDetachedEatBundle(mainToken *NestedToken) *DetachedEatBundle

NewDetachedEatBundle returns a pointer to a new bundle that contains the provided NestedToken as its main token.

func (*DetachedEatBundle) AddDetachedClaimSet 

func (o *DetachedEatBundle) AddDetachedClaimSet(name string, claims *ClaimsSet) *DetachedEatBundle

AddDetachedClaimSet adds the provided ClaimsSet to the bundle under the specified name. A pointer to the bundle is returned to allow chaining.

func (*DetachedEatBundle) DetachedClaimSets 

func (o *DetachedEatBundle) DetachedClaimSets() map[string]*ClaimsSet

DetachedClaimSets returns a map containing this bundle's detached claims sets.

func (*DetachedEatBundle) MainToken 

func (o *DetachedEatBundle) MainToken() *NestedToken

MainToken returns a pointer to this bundle's main token.

func (*DetachedEatBundle) MarshalCBOR 

func (o *DetachedEatBundle) MarshalCBOR() ([]byte, error)

func (*DetachedEatBundle) MarshalJSON 

func (o *DetachedEatBundle) MarshalJSON() ([]byte, error)

func (*DetachedEatBundle) SetDetachedClaimSets 

func (o *DetachedEatBundle) SetDetachedClaimSets(dcs map[string]*ClaimsSet) *DetachedEatBundle

SetDetachedClaimSets sets this bundle's detached claims sets to the provided map. A pointer to the bundle is returned to allow chaining.

func (*DetachedEatBundle) ToTaggedMessageCBOR 

func (o *DetachedEatBundle) ToTaggedMessageCBOR() ([]byte, error)

ToTaggedMessageCBOR is like MarshalCBOR but wraps the resulting CBOR in tag 602.

func (*DetachedEatBundle) UnmarshalCBOR 

func (o *DetachedEatBundle) UnmarshalCBOR(data []byte) error

func (*DetachedEatBundle) UnmarshalJSON 

func (o *DetachedEatBundle) UnmarshalJSON(data []byte) error

type DetachedSubmodDigest 

type DetachedSubmodDigest struct {
	Algorithm HashAlgorithm
	Value     []byte
	// contains filtered or unexported fields
}

DetachedSubmodDigest implements Detached-Submodule-Digest as defined in https://www.rfc-editor.org/rfc/rfc9711.html#name-submods-submodules-claim Detached-Submodule-Digest contains a digest of a Claim-Set detached from an EAT.

func DetachedSubmodDigestFromString 

func DetachedSubmodDigestFromString(val string) (*DetachedSubmodDigest, error)

DetachedSubmodDigestFromString returns a DetachedSubmodDigest costructed from the provided string formatted as "<algorithm-name>;<base64-encoded-digest>". This is an inviser of DetachedSubmodDigest.String().

func MustNewDetachedSubmodDigest 

func MustNewDetachedSubmodDigest(alg HashAlgorithm, value []byte) *DetachedSubmodDigest

MustNewDetachedSubmodDigest creates a new DetachedSubmodDigest as NewDetachedSubmodDigest, except it panics on error.

func MustNewDetachedSubmodDigestIntAlg 

func MustNewDetachedSubmodDigestIntAlg(algID int, value []byte) *DetachedSubmodDigest

MustNewDetachedSubmodDigestIntAlg creates a new DetachedSubmodDigest as MustNewDetachedSubmodDigestIntAlg, except it panics on error.

func NewDetachedSubmodDigest 

func NewDetachedSubmodDigest(alg HashAlgorithm, value []byte) (*DetachedSubmodDigest, error)

NewDetachedSubmodDigest returns a new DetachedSubmodDigest constructed from the provided hash algorithm and []byte value. An error is returned if the length of the value is not consistent with the specified algorithm.

func NewDetachedSubmodDigestIntAlg 

func NewDetachedSubmodDigestIntAlg(algID int, value []byte) (*DetachedSubmodDigest, error)

NewDetachedSubmodDigestIntAlg returns a new DetatchedSubmodDigest constructed from the provided int aglorithm idnetifier and []byte data. An error is returned if the identifier does not correspond to an algorithm from the COSE Algorithm Registry, or if the length of data is inconsitent with the specified algorithm.

func (DetachedSubmodDigest) MarshalJSON 

func (o DetachedSubmodDigest) MarshalJSON() ([]byte, error)

func (DetachedSubmodDigest) String 

func (o DetachedSubmodDigest) String() string

String returns a string representation of the DetachedSubmodDigest. This representation is in the form "<algorithm-name>;<base64-encoded-digest>" (consistent with https://datatracker.ietf.org/doc/rfc6920).

func (*DetachedSubmodDigest) UnmarshalJSON 

func (o *DetachedSubmodDigest) UnmarshalJSON(data []byte) error

func (DetachedSubmodDigest) Validate 

func (o DetachedSubmodDigest) Validate() error

Validate returns an error if either the algorithm of the value have not been initialized or if the length of the value does not match that expected by the algorithm.

type Digest 

type Digest struct {

	// The number used as a value for hash-alg-id is an integer-based
	// hash algorithm identifier who's value MUST refer to an ID in the
	// IANA "Named Information Hash Algorithm Registry" [IANA.named-information]
	// with a Status of "current" (at the time the generator software was built
	// or later); other hash algorithms MUST NOT be used. If the hash-alg-id is
	// not known, then the integer value "0" MUST be used. This allows for
	// conversion from ISO SWID tags [SWID], which do not allow an algorithm to
	// be identified for this field.
	Alg int `cbor:"0,keyasint"`

	// The digest value will be base64-url encoded for JSON.
	Val BinaryData `cbor:"1,keyasint"`
	// contains filtered or unexported fields
}

Based on https://github.com/veraison/swid Digest does not support stringify() generating "sha-256;ABC..." and encodes/decodes the digest value with base64-url for JSON.

func (Digest) MarshalJSON 

func (d Digest) MarshalJSON() ([]byte, error)

func (*Digest) UnmarshalJSON 

func (d *Digest) UnmarshalJSON(data []byte) error

type Eat 

type Eat struct {
	// contains filtered or unexported fields
}

Eat is the internal representation of an Entity Attestation Token.

func (*Eat) Claims 

func (o *Eat) Claims() *ClaimsSet

Claims returns a pointer to the Eat's contained ClaimsSet

func (*Eat) MarshalCBOR 

func (o *Eat) MarshalCBOR() ([]byte, error)

func (*Eat) MarshalJSON 

func (o *Eat) MarshalJSON() ([]byte, error)
Example 
nonce := Nonce{}

if err := nonce.AddHex("0000000000000000"); err != nil {
	panic(err)
}

// if required by the use case, add more nonces

t := Eat{
	ClaimsSet{
		Nonce: &nonce,
	},
}

j, err := t.MarshalJSON()
if err != nil {
	panic(err)
}

fmt.Println(string(j))

Output:
{"eat_nonce":"AAAAAAAAAAA"}

func (*Eat) UnmarshalCBOR 

func (o *Eat) UnmarshalCBOR(data []byte) error

func (*Eat) UnmarshalJSON 

func (o *Eat) UnmarshalJSON(data []byte) error
Example 
t := Eat{}

data := []byte(`{"eat_nonce":"AAAAAAAAAAA"}`)

if err := t.UnmarshalJSON(data); err != nil {
	panic(err)
}

fmt.Printf("nonces found: %d\n", t.Claims().Nonce.Len())
fmt.Printf("nonce: %x\n", t.Claims().Nonce.Get(0))

Output:
nonces found: 1
nonce: 0000000000000000

type HashAlgorithm 

type HashAlgorithm struct {
	// contains filtered or unexported fields
}

HashAlgorithm identifies the hashing algorithm used by a DetachedSubmodDigest.

func HashAlgorithmFromAny 

func HashAlgorithmFromAny(val any) (HashAlgorithm, error)

HashAlgorithmFromAny converts the specfied value into corresponding HashAlgorithm. If the value is an int, int64, or float64 (without a fractional part), it behaves as HashAlgorithmFromInt; if the value is a string, it behaves as HashAlgorithmFromString; an error is returned in all other cases.

func HashAlgorithmFromInt 

func HashAlgorithmFromInt(val int) (HashAlgorithm, error)

HashAlgorithmFromInt returns the HashAlgorithm corresponding to the provided int. An error is returned is the provided int does not correspond to an algorithm inside the COSE Algorithm Registry: https://www.iana.org/assignments/cose#algorithms

func HashAlgorithmFromString 

func HashAlgorithmFromString(val string) (HashAlgorithm, error)

HashAlgorithmFromInt returns the HashAlgorithm corresponding to the provided string. At the time of writing, no algorithm inside the COSE algorithm register has a string identifier. Currently, this function returns algorithms corresponding the the informal name (as obtained by calling HashAlgorithm.String()). An error is returned is the provided string does not correspond to an algorithm.

func MustHashAlgorithmFromInt 

func MustHashAlgorithmFromInt(val int) HashAlgorithm

MustHashAlgorithmFromInt returns the HashAlgorithm corresponding to the provided int (as HashAlgorithmFromInt). It panics if the provided int does not correspond to an algorithm.

func MustHashAlgorithmFromString 

func MustHashAlgorithmFromString(val string) HashAlgorithm

MustHashAlgorithmFromString converts an informal algorithm name to the corresponding HashAlgorithm (as HashAlgorithmFromString). It panics on error.

func (HashAlgorithm) Int 

func (o HashAlgorithm) Int() int

Int returns the integer identifier corresponding to the HashAlgorithm. If the underlying identifier is a string (currently, there are none), 0 is returned.

func (HashAlgorithm) IsInt 

func (o HashAlgorithm) IsInt() bool

IsInt true if the underlying identifier is an int. (Note: all current COSE Algorithm Regiter entries are identified by integer values, this always returns true)

func (HashAlgorithm) IsString 

func (o HashAlgorithm) IsString() bool

IsString true if the underlying identifier is a string. (Note: all current COSE Algorithm Regiter entries are identified by integer values, this always returns false)

func (HashAlgorithm) MarshalCBOR 

func (o HashAlgorithm) MarshalCBOR() ([]byte, error)

func (HashAlgorithm) MarshalJSON 

func (o HashAlgorithm) MarshalJSON() ([]byte, error)

func (HashAlgorithm) String 

func (o HashAlgorithm) String() string

String returns the string representation of the HashAlgorithm. If the underlying identifier is a string (currently, there are none), that idnetifier is returned, otherwise an informal name corresponding to the identifier is returned.

func (*HashAlgorithm) UnmarshalCBOR 

func (o *HashAlgorithm) UnmarshalCBOR(data []byte) error

func (*HashAlgorithm) UnmarshalJSON 

func (o *HashAlgorithm) UnmarshalJSON(data []byte) error

type IntOrString 

type IntOrString struct {
	// contains filtered or unexported fields
}

IntOrString has an underlying value that is either an int or string.

func IntOrStringFromAny 

func IntOrStringFromAny(val any) (IntOrString, error)

IntOrStringFromAny creates a new IntOrString with the provided underlying value. If the provided value is not a string or an integer type, an error is returned.

func IntOrStringFromInt 

func IntOrStringFromInt(val int) IntOrString

IntOrStringFromInt creates a new IntOrString with the specified int as the underlying value.

func IntOrStringFromString 

func IntOrStringFromString(val string) IntOrString

IntOrStringFromInt creates a new IntOrString with the specified string as the underlying value.

func (*IntOrString) Int 

func (o *IntOrString) Int() int

Int returns an integer representation of the underlying value. If the underlying value is a string that cannot be parsed as an int, 0 is returned.

func (*IntOrString) IsInt 

func (o *IntOrString) IsInt() bool

IsString returns true if the underlying value is an int.

func (*IntOrString) IsString 

func (o *IntOrString) IsString() bool

IsString returns true if the underlying value is a string.

func (*IntOrString) MarshalCBOR 

func (o *IntOrString) MarshalCBOR() ([]byte, error)

func (*IntOrString) MarshalJSON 

func (o *IntOrString) MarshalJSON() ([]byte, error)

func (*IntOrString) String 

func (o *IntOrString) String() string

String returns the string representation of the underlying value.

func (*IntOrString) UnmarshalCBOR 

func (o *IntOrString) UnmarshalCBOR(data []byte) error

func (*IntOrString) UnmarshalJSON 

func (o *IntOrString) UnmarshalJSON(data []byte) error

type KeyConfirmation 

type KeyConfirmation struct {
	Key *COSEKey `cbor:"1,keyasint,omitempty" json:"jwk,omitempty"`
	// TODO: EncryptedKey (currently go-cose doesn't support COSE_Encrypt0 / COSE_Encrypt)
	Kid           *[]byte `cbor:"3,keyasint,omitempty" json:"kid,omitempty"`
	KeyThumbprint *[]byte `cbor:"5,keyasint,omitempty" json:"jkt,omitempty"`
}

type Location 

type Location struct {
	Latitude         Number       `cbor:"1,keyasint" json:"lat"`
	Longitude        Number       `cbor:"2,keyasint" json:"long"`
	Altitude         *Number      `cbor:"3,keyasint,omitempty" json:"alt,omitempty"`
	Accuracy         *Number      `cbor:"4,keyasint,omitempty" json:"accry,omitempty"`
	AltitudeAccuracy *Number      `cbor:"5,keyasint,omitempty" json:"alt-accry,omitempty"`
	Heading          *Number      `cbor:"6,keyasint,omitempty" json:"heading,omitempty"`
	Speed            *Number      `cbor:"7,keyasint,omitempty" json:"speed,omitempty"`
	Timestamp        *NumericDate `cbor:"8,keyasint,omitempty" json:"timestamp,omitempty"`
	Age              *uint        `cbor:"9,keyasint,omitempty" json:"age,omitempty"`
}

Location models the location claim

type Manifest 

type Manifest struct {
	Type   int        // coap-content-format, see https://www.iana.org/assignments/core-parameters/core-parameters.xhtml
	Format BinaryData // bstr wrapped untagged-coswid, ...
	// contains filtered or unexported fields
}

type MeasuredComponent 

type MeasuredComponent struct {
	Id             ComponentID   `cbor:"1,keyasint" json:"id"`
	Measurement    *Digest       `cbor:"2,keyasint,omitempty" json:"measurement,omitempty"`
	Signers        *[]BinaryData `cbor:"3,keyasint,omitempty" json:"signers,omitempty"`
	Flags          *BinaryData   `cbor:"4,keyasint,omitempty" json:"flags,omitempty"`
	RawMeasurement *BinaryData   `cbor:"5,keyasint,omitempty" json:"raw-measurement,omitempty"`
}

type Measurement 

type Measurement struct {
	Type   int        // coap-content-format, see https://www.iana.org/assignments/core-parameters/core-parameters.xhtml
	Format BinaryData // bstr wrapped untagged-coswid, measured-component, ...
	// contains filtered or unexported fields
}

type NestedToken 

type NestedToken struct {
	// Type identifes the format of Data
	Type NestedTokenType
	// Data contains the actual nested contents. Its format is determined by Type.
	Data []byte
}

NestedToken implements Nested-Token submod type as defined in https://www.rfc-editor.org/rfc/rfc9711.html#name-submods-submodules-claim A Nested-Token represents another EAT token nested as a submod inside an outer EAT token. The encoding of the inner token need not match the outer token.

func NewNestedToken 

func NewNestedToken(typ string, data []byte) (*NestedToken, error)

NewNestedToken returns a new NestedToken from the provided type and data. An error is returned if either the type or the data are invalid, or if they don't match.

func (*NestedToken) MarshalCBOR 

func (o *NestedToken) MarshalCBOR() ([]byte, error)

func (*NestedToken) MarshalJSON 

func (o *NestedToken) MarshalJSON() ([]byte, error)

func (*NestedToken) UnmarshalCBOR 

func (o *NestedToken) UnmarshalCBOR(data []byte) error

func (*NestedToken) UnmarshalJSON 

func (o *NestedToken) UnmarshalJSON(data []byte) error

func (*NestedToken) UnwrapBundle 

func (o *NestedToken) UnwrapBundle() (*DetachedEatBundle, error)

UnwrapBundle returns a pointer to a DetachedEatBundle constructed from the NestedToken's data. An error is returned if the token's type is not NestedTokenBundle or if the data contained invalid DetachedEatBundle JSON.

func (*NestedToken) UnwrapDigest 

func (o *NestedToken) UnwrapDigest() (*DetachedSubmodDigest, error)

UnwrapDigest returns a pointer to a DetachedSubmodDigest constructed from the NestedToken's data. An error is returned if the token's type is not NestedTokenDigest or if the data contained invalid DetachedSubmodDigest JSON.

type NestedTokenType 

type NestedTokenType int8

NestedTokenType enumerates the valid types of the nested contents of a NestedToken 

const (
	NestedTokenInvalid NestedTokenType = iota
	NestedTokenCBOR
	NestedTokenJWT
	NestedTokenBundle
	NestedTokenDigest
)

func NestedTokenTypeFromString 

func NestedTokenTypeFromString(typ string) (NestedTokenType, error)

NestedTokenTypeFromString returns a NestedToknType corresponding to the provided string. An error is returned if the provided string does not correspond to a type.

func (NestedTokenType) String 

func (o NestedTokenType) String() string

type Nonce 

type Nonce struct {
	// contains filtered or unexported fields
}

A nonce-claim may be single Nonce or an array of two or more. 

nonce-claim = (
    nonce => nonce-type / [ 2* nonce-type ]
)

func MustNewNonceFromBytes 

func MustNewNonceFromBytes(values ...[]byte) *Nonce

MustNewNonceFromBytes creates a new Nonce containing a single entry created from the provided bytes. If the provided bytes do not constitute a valid nonce, this function panics.

func NewNonceFromBytes 

func NewNonceFromBytes(values ...[]byte) (*Nonce, error)

NewNonceFromBytes creates a new Nonce containing a single entry created from the provided bytes. If the provided bytes do not constitute a valid nonce, an error is returned.

func (*Nonce) Add 

func (o *Nonce) Add(v []byte) error

Add the supplied nonce, provided as a byte array, to the Nonce receiver.

func (*Nonce) AddHex 

func (o *Nonce) AddHex(text string) error

AddHex provides the same functionality as Add except it takes the nonce value as a hex-encoded string.

func (Nonce) Get 

func (o Nonce) Get(index int) []byte

Get returns the nonce found at the supplied index (counting from 0) or nil if the index is out of bounds.

func (Nonce) Len 

func (o Nonce) Len() int

Len returns the number of nonce values carried in the Nonce receiver.

func (Nonce) MarshalCBOR 

func (o Nonce) MarshalCBOR() ([]byte, error)

MarshalCBOR provides a suitable CBOR encoding for the receiver Nonce. In case there is only one nonce, the encoded produces a single bstr. If there are multiple, the encoder produces an array of bstr, one for each nonce.

func (Nonce) MarshalJSON 

func (o Nonce) MarshalJSON() ([]byte, error)

MarshalJSON encodes the receiver Nonce as either a JSON string containing the base64 encoding of the binary nonce (if the array comprises only one element) or as an array of base64-encoded JSON strings.

NOTE: While RFC 9711 (EAT) does not restrict the nonce format to base64-encoded JSON strings, VERAISON/eat imposes a narrower interpretation for JSON <-> CBOR conversion. See discussion: https://github.com/ietf-rats-wg/eat/pull/421

func (*Nonce) UnmarshalCBOR 

func (o *Nonce) UnmarshalCBOR(data []byte) error

UnmarshalCBOR decodes a EAT nonce. This may be a single byte string between 8 and 64 bytes long, or an array of two or more such strings.

func (*Nonce) UnmarshalJSON 

func (o *Nonce) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes a EAT nonce in JSON format.

type Number 

type Number float64

Number models a CDDL number, i.e.: 

uint / nint / float16 / float32 / float64

func (Number) MarshalCBOR 

func (n Number) MarshalCBOR() ([]byte, error)

MarshalCBOR encodes a Number using the smallest possible encoding. Note that choosing the smallest fitting float variant is decided by the encoding mode defined in cbor.go which is configured to use ShortestFloat == ShortestFloat16. What remains to be done here is intercepting the uint / nint cases and dispatch them to the default int marshaler.

type NumericDate 

type NumericDate time.Time

NumericDate models RFC7519 NumericDate, i.e., the number of seconds since UNIX epoch

func (NumericDate) MarshalCBOR 

func (nd NumericDate) MarshalCBOR() ([]byte, error)

MarshalCBOR unwraps the receiver NumericDate exposing its underlying Time and dispatches it to our custom encoding mode, which automatically adds the required tag (TimeTag == cbor.EncTagRequired)

func (NumericDate) MarshalJSON 

func (nd NumericDate) MarshalJSON() ([]byte, error)

MarshalJSON unwraps the receiver NumericDate exposing its underlying Time and converts it to UNIX time.

func (*NumericDate) UnmarshalCBOR 

func (nd *NumericDate) UnmarshalCBOR(data []byte) error

UnmarshalCBOR decodes the data into a Time and sets the receiver NumericDate to the decoded value.

func (*NumericDate) UnmarshalJSON 

func (nd *NumericDate) UnmarshalJSON(data []byte) error

UnmarshalJSON populates the receiver NumericDate by interpreting the supplied data as UTF-8-encoded Unix timestamp.

type OemID 

type OemID struct {
	// contains filtered or unexported fields
}

OemID is the Original Equipment Manufacturer identifier. It comes in three flavors:

  • Random number-based. This is a 16-byte random values. This allows OEMs to generate their own IDs using a cryptographic-quality random number generator.
  • IEEE-based. Obtained from the IEEE global registry of MAC addresses and company IDs. This is a 3-byte value.
  • IANA Private Enterprise Number-based. Taken from the IANA PEN registry. This is an integer value (taken from the OID in the 1.3.6.1.4.1 namespace managed by IANA).

func NewIeeeOemID 

func NewIeeeOemID(value [3]byte) *OemID

NewIeeeOemID returns a pointer to a new OemID containing the specified IEEE-based ID.

func NewPenOemID 

func NewPenOemID(value int) *OemID

NewPenOemID returns a pointer to a new OemID containing the specified PEN ID.

func NewRandomOemID 

func NewRandomOemID(value [16]byte) *OemID

NewRandomOemID returns a pointer to a new OemID containing the specified random ID.

func (*OemID) Bytes 

func (o *OemID) Bytes() []byte

Bytes returns the underlying []byte value. If the underlying value is an int, nil is returned instead.

func (*OemID) Int 

func (o *OemID) Int() int

Int returns the underlying int value. If the underlying value is a []byte, 0 is returned instead.

func (*OemID) IsBytes 

func (o *OemID) IsBytes() bool

IsBytes returns true if the underlying value is a []byte.

func (*OemID) IsIEEE 

func (o *OemID) IsIEEE() bool

IsIEEE returns true if the underlying is taken from the IEEE global registry.

func (*OemID) IsInt 

func (o *OemID) IsInt() bool

IsInt return true if the underlying value is an int.

func (*OemID) IsPEN 

func (o *OemID) IsPEN() bool

IsPEN returns true if the underlying value is an AINA Private Enterprise Number ID.

func (*OemID) IsRandom 

func (o *OemID) IsRandom() bool

IsRandom returns true if the underlying value is randomly generated.

func (*OemID) MarshalCBOR 

func (o *OemID) MarshalCBOR() ([]byte, error)

func (*OemID) MarshalJSON 

func (o *OemID) MarshalJSON() ([]byte, error)

func (*OemID) UnmarshalCBOR 

func (o *OemID) UnmarshalCBOR(data []byte) error

func (*OemID) UnmarshalJSON 

func (o *OemID) UnmarshalJSON(data []byte) error

type Profile 

type Profile struct {
	// contains filtered or unexported fields
}

Profile is either an absolute URI (RFC3986) or an ASN.1 Object Identifier

func NewProfile 

func NewProfile(urlOrOID string) (*Profile, error)

NewProfile instantiates a Profile object from the given input string The string can either be an absolute URI or an ASN.1 Object Identifier in dotted-decimal notation. Relative Object Identifiers (e.g., .1.1.29) are not accepted.

func (Profile) Get 

func (s Profile) Get() (string, error)

Get returns the profile as string (URI or dotted-decimal OID)

func (Profile) IsOID 

func (s Profile) IsOID() bool

IsOID checks whether a stored profile is an OID

func (Profile) IsURI 

func (s Profile) IsURI() bool

IsURI checks whether a stored profile is a URI

func (Profile) MarshalCBOR 

func (s Profile) MarshalCBOR() ([]byte, error)

MarshalCBOR encodes the Profile object as a CBOR text string (if it is a URL), or as CBOR byte string (if it is an ASN.1 OID)

func (Profile) MarshalJSON 

func (s Profile) MarshalJSON() ([]byte, error)

MarshalJSON encodes the receiver Profile into a JSON string

func (*Profile) Set 

func (s *Profile) Set(urlOrOID string) error

Set sets the internal value of the Profile object to the given urlOrOID string

func (*Profile) UnmarshalCBOR 

func (s *Profile) UnmarshalCBOR(data []byte) error

UnmarshalCBOR attempts to initialize the Profile from the presented CBOR data. The data must be a CBOR text string, representing a URL or a CBOR byte string representing an Object Identifier

func (*Profile) UnmarshalJSON 

func (s *Profile) UnmarshalJSON(data []byte) error

UnmarshalJSON attempts at decoding the supplied JSON data into the receiver Profile

type SecurityLevel 

type SecurityLevel uint

Security Level claim type

func (SecurityLevel) Validate 

func (s SecurityLevel) Validate() error

Validate SecLevel to make sure is with thin bounds allowed by the spec.

type StringOrURI 

type StringOrURI struct {
	// contains filtered or unexported fields
}

StringOrURI is either an arbitrary text string or a RFC3986 compliant URI. 

string-or-uri = tstr / uri

func (*StringOrURI) FromString 

func (s *StringOrURI) FromString(value string) error

FromString initializes the StringOrURI value from the specified string, overwriting any existing value. If the value contains a colon (":"), then an attempt will be made to parse it as a URI (see RFC7519, section 2), otherwise, the value is assumed to be a non-URI string.

func (*StringOrURI) FromURL 

func (s *StringOrURI) FromURL(value *url.URL)

FromURL initializes the StringOrURI value from the specified url.URL, overwriting any existing value.

func (StringOrURI) IsURI 

func (s StringOrURI) IsURI() bool

IsURI returns true iff the underlying value is a URI and not a string. NOTE: this only indicates whether the value was set as such -- it possible 

that the arbitrary string value happens to be a valid URI, however, if
it was not set as such, this will return false.

func (StringOrURI) MarshalCBOR 

func (s StringOrURI) MarshalCBOR() ([]byte, error)

MarshalCBOR will encode the StringOrURI value as a CBOR text string, wrapping it in Tag 32, if it's a URI. See RFC7049, Section 2.4.4.3.

func (StringOrURI) MarshalJSON 

func (s StringOrURI) MarshalJSON() ([]byte, error)

MarshalJSON encodes the receiver StringOrURI into a JSON string

func (StringOrURI) String 

func (s StringOrURI) String() string

String returns the string representation of the StringOrURI value.

func (StringOrURI) ToURL 

func (s StringOrURI) ToURL() (*url.URL, error)

ToURL will return the url.URL representation of the underlying value, if possible. This will attempt to parse the underlying string value as a URL if it isn't one already.

func (*StringOrURI) UnmarshalCBOR 

func (s *StringOrURI) UnmarshalCBOR(data []byte) error

UnmarshalCBOR attempts to initializes the StringOrURI from the presented CBOR data. The data must be a text string, possibly wrapped in a Tag with the value 32 (URI). See RFC7049, Section 2.4.4.3.

func (*StringOrURI) UnmarshalJSON 

func (s *StringOrURI) UnmarshalJSON(data []byte) error

UnmarshalJSON attempts at decoding the supplied JSON data into the receiver StringOrURI

type Submod 

type Submod struct {
	// contains filtered or unexported fields
}

Submod is the type of a submod: either a raw EAT (wrapped in a Sign1 CWT), or a map of EAT claims

func (*Submod) MarshalCBOR 

func (o *Submod) MarshalCBOR() ([]byte, error)

func (*Submod) MarshalJSON 

func (o *Submod) MarshalJSON() ([]byte, error)

func (*Submod) UnmarshalCBOR 

func (o *Submod) UnmarshalCBOR(data []byte) error

func (*Submod) UnmarshalJSON 

func (o *Submod) UnmarshalJSON(data []byte) error

type Submods 

type Submods map[string]*Submod

Submods is a collection of named submodule claims. Each submodule is either a ClaimsSet, a NestedToken, or a DetachedSubmodDigest.

func NewSubmods 

func NewSubmods() *Submods

NewSubmods returns a pointer to an empty Submods:

func (*Submods) AddClaimsSet 

func (o *Submods) AddClaimsSet(name string, claimsSet *ClaimsSet) *Submods

AddClaimsSet adds the provided *ClaimsSet to the Submods under the specified name, overwritting any existing submod under that name. Pointer to the Submods is returned to allow chaing with other adds. Panics if the provided *ClaimsSet is nil.

func (*Submods) AddDigest 

func (o *Submods) AddDigest(name string, digest *DetachedSubmodDigest) *Submods

AddDigest adds the provided *DetachedSubmodDigest to the Submods under the specified name, overwritting any existing submod under that name. Pointer to the Submods is returned to allow chaing with other adds. Panics if the provided *DetachedSubmodDigest is nil or is invalid.

func (*Submods) AddNestedToken 

func (o *Submods) AddNestedToken(name string, token *NestedToken) *Submods

AddClaimsSet adds the provided *NestedToken to the Submods under the specified name, overwritting any existing submod under that name. Pointer to the Submods is returned to allow chaing with other adds. Panics if the provided *NestedToken is nil.

func (Submods) Get 

func (o Submods) Get(name string) any

Get retrieves a submod's value by name. If name is not in the collection, nil is returned.

func (Submods) GetClaimsSet 

func (o Submods) GetClaimsSet(name string) (*ClaimsSet, error)

GetClaimsSet returns the *ClaimsSet associated with the provided name. If the name is not in Submods or the associated submod is not a *ClaimsSet, an error is returned.

func (Submods) GetDigest 

func (o Submods) GetDigest(name string) (*DetachedSubmodDigest, error)

GetDigest returns the *DetachedSubmodDigest associated with the provided name. If the name is not in Submods or the associated submod is not a *DetachedSubmodDigest, an error is returned.

func (Submods) GetNestedToken 

func (o Submods) GetNestedToken(name string) (*NestedToken, error)

GetNestedToken returns the *DetachedNestedToken associated with the provided name. If the name is not in Submods or the associated submod is not a *DetachedNestedToken, an error is returned.

type UEID 

type UEID struct {
	// contains filtered or unexported fields
}

func MustUEIDFromBytes 

func MustUEIDFromBytes(value []byte) *UEID

func UEIDFromBytes 

func UEIDFromBytes(value []byte) (*UEID, error)

func (*UEID) MarshalCBOR 

func (o *UEID) MarshalCBOR() ([]byte, error)

func (*UEID) MarshalJSON 

func (o *UEID) MarshalJSON() ([]byte, error)

func (*UEID) UnmarshalCBOR 

func (o *UEID) UnmarshalCBOR(data []byte) error

func (*UEID) UnmarshalJSON 

func (o *UEID) UnmarshalJSON(data []byte) error

type Version 

type Version struct {
	Version string
	Scheme  *swid.VersionScheme
	// contains filtered or unexported fields
}

func (Version) MarshalCBOR 

func (v Version) MarshalCBOR() ([]byte, error)

func (Version) MarshalJSON 

func (v Version) MarshalJSON() ([]byte, error)

func (*Version) UnmarshalCBOR 

func (v *Version) UnmarshalCBOR(data []byte) error

func (*Version) UnmarshalJSON 

func (v *Version) UnmarshalJSON(data []byte) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.