jeddak_secure_channel

package
v1.2.43 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 16, 2026 License: Apache-2.0 Imports: 28 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	KEY_LEN   = 32
	NONCE_LEN = 12
	MAC_LEN   = 16
)
View Source 
const (
	RA_TYPE_LOCAL = "local"
	RA_TYPE_TCA   = "tca"
)

Constants for RA types

Variables

This section is empty.

Functions

This section is empty.

Types

type AesEncryptResult 

type AesEncryptResult struct {
	Nonce      []byte
	Ciphertext []byte // nil if generated via EncryptStream with concatted=false
	Mac        []byte
}

EncryptResult holds the output of encryption: nonce, ciphertext, and MAC.

type AesKey 

type AesKey struct {
	// contains filtered or unexported fields
}

AesKey holds an AES-256 key and a nonce source for encryption/decryption.

func AesKeyFromBytes 

func AesKeyFromBytes(key []byte) (*AesKey, error)

AesKeyFromBytes creates an AesKey from a 32-byte key.

func GenerateAesKey 

func GenerateAesKey() (*AesKey, error)

GenerateAesKey generates a new AES-256 key.

func (*AesKey) Decrypt 

func (a *AesKey) Decrypt(nonce, ciphertext, mac []byte) ([]byte, error)

Decrypt decrypts ciphertext using nonce and MAC, returning plaintext.

func (*AesKey) DecryptStream 

func (a *AesKey) DecryptStream(nonce, mac []byte, source io.Reader, sink io.Writer) error

DecryptStream decrypts ciphertext from source to sink using nonce and MAC.

func (*AesKey) Encrypt 

func (a *AesKey) Encrypt(plaintext []byte) (*AesEncryptResult, error)

Encrypt encrypts plaintext and returns the nonce, ciphertext, and MAC.

func (*AesKey) EncryptStream 

func (a *AesKey) EncryptStream(source io.Reader, sink io.Writer, concatted bool) (*AesEncryptResult, error)

EncryptStream encrypts data from source to sink, returning nonce and MAC. If concatted=true, nonce and (ciphertext+MAC) are written to sink.

func (*AesKey) GetEncoded 

func (a *AesKey) GetEncoded() []byte

GetEncoded returns the raw key bytes.

type Client 

type Client struct {
	// contains filtered or unexported fields
}

Client manages secure channel communication, including server attestation and encryption.

func NewClient 

func NewClient(config ClientConfig) *Client

NewClient creates a new Client with the given configuration. If AttestInterval is non-nil and positive, periodic server attestation is enabled.

func (*Client) AttestServer 

func (c *Client) AttestServer() error

AttestServer triggers immediate server attestation with an empty token.

func (*Client) AttestServerWithToken 

func (c *Client) AttestServerWithToken(token string) error

AttestServerWithToken triggers immediate server attestation with a specific token.

func (*Client) Close 

func (c *Client) Close() error

Close stops periodic attestation and cleans up resources.

func (*Client) EncryptBytes 

func (c *Client) EncryptBytes(plaintext []byte) (string, error)

EncryptBytes encrypts a byte slice and returns the ciphertext.

func (*Client) EncryptBytesWithResponse 

func (c *Client) EncryptBytesWithResponse(plaintext []byte) (*EncryptResult, error)

EncryptBytesWithResponse encrypts a byte slice and returns the full EncryptResult.

func (*Client) EncryptFile 

func (c *Client) EncryptFile(inputPath, outputPath string) (string, error)

EncryptFile encrypts a file and writes the ciphertext to another file.

func (*Client) EncryptFileWithResponse 

func (c *Client) EncryptFileWithResponse(inputPath, outputPath string) (*EncryptResult, error)

EncryptFileWithResponse encrypts a file and returns the full EncryptResult.

func (*Client) EncryptStream 

func (c *Client) EncryptStream(source io.Reader, sink io.Writer) (string, error)

EncryptStream encrypts data from a reader and writes ciphertext to a writer.

func (*Client) EncryptStreamWithResponse 

func (c *Client) EncryptStreamWithResponse(source io.Reader, sink io.Writer) (*EncryptResult, error)

EncryptStreamWithResponse encrypts a stream and returns the full EncryptResult.

func (*Client) EncryptString 

func (c *Client) EncryptString(plaintext string) (string, error)

EncryptString encrypts a string and returns the ciphertext.

func (*Client) EncryptStringWithResponse 

func (c *Client) EncryptStringWithResponse(plaintext string) (*EncryptResult, error)

EncryptStringWithResponse encrypts a string and returns the full EncryptResult.

type ClientConfig 

type ClientConfig struct {
	RaURL            string   `json:"ra_url"`             // Default: empty string
	RaType           string   `json:"ra_type"`            // Default: RA_TYPE_TCA
	RaServiceName    string   `json:"ra_service_name"`    // Default: empty string
	RaUID            string   `json:"ra_uid"`             // Default: empty string
	RaKeyNegotiation *bool    `json:"ra_key_negotiation"` // Default: true (nil means not set in JSON)
	RaNeedToken      *bool    `json:"ra_need_token"`      // Default: true (nil means not set in JSON)
	RaPolicyId       string   `json:"ra_policy_id"`       // Default: empty string
	BytedanceTopInfo string   `json:"bytedance_top_info"` // Default: empty string
	AttestInterval   *float64 `json:"attest_interval"`    // Default: nil (no periodic attestation)
}

ClientConfig holds configuration parameters for the secure channel client.

func ClientConfigFromFile 

func ClientConfigFromFile(path string) (ClientConfig, error)

ClientConfigFromFile reads a file and parses its contents into a ClientConfig.

func ClientConfigFromJson 

func ClientConfigFromJson(jsonStr string) (ClientConfig, error)

ClientConfigFromJson parses a JSON string into a ClientConfig.

func ClientConfigFromReader 

func ClientConfigFromReader(reader io.Reader) (ClientConfig, error)

ClientConfigFromReader parses a JSON stream from an io.Reader into a ClientConfig. Applies default values for missing fields.

type ClientSessionKey 

type ClientSessionKey struct {
	ServerPublicKey *rsa.PublicKey // RSA public key for encrypting AES keys
}

ClientSessionKey manages session encryption using a server's RSA public key.

func LoadClientSessionKey 

func LoadClientSessionKey(serverKeyPem string) (*ClientSessionKey, error)

LoadClientSessionKey parses an RSA public key from a PEM-encoded string. The PEM must contain a "PUBLIC KEY" block.

func (*ClientSessionKey) EncryptStreamWithResponse 

func (c *ClientSessionKey) EncryptStreamWithResponse(source io.Reader, sink io.Writer) (*EncryptResult, error)

EncryptStreamWithResponse encrypts a stream and returns an EncryptResult.

func (*ClientSessionKey) EncryptWithResponse 

func (c *ClientSessionKey) EncryptWithResponse(plaintext []byte) (*EncryptResult, error)

EncryptWithResponse encrypts plaintext and returns an EncryptResult containing: - Serialized encrypted message (AES ciphertext + RSA-encrypted AES key) - AES key for decrypting server responses

type EncryptResult 

type EncryptResult struct {
	Ciphertext  string
	ResponseKey ResponseKey
}

EncryptResult contains the serialized encrypted message and response decryption key.

type EncryptedMessage 

type EncryptedMessage struct {
	Nonce      []byte `json:"nonce"`
	Mac        []byte `json:"mac"`
	Key        []byte `json:"key"`        // Can be nil
	Ciphertext []byte `json:"ciphertext"` // Can be nil
}

EncryptedMessage represents an encrypted message containing nonce, mac, key, and ciphertext. All byte fields are serialized as Base64 strings in JSON.

func (*EncryptedMessage) Serialize 

func (e *EncryptedMessage) Serialize() (string, error)

Serialize converts the EncryptedMessage to a JSON string. Byte slices are automatically encoded as Base64 strings in JSON.

type RaRequest 

type RaRequest struct {
	PolicyId       string `json:"PolicyID"`
	ServiceName    string `json:"ServiceName"`
	KeyNegotiation bool   `json:"KeyNegotiation"`
	Token          bool   `json:"Token"`
	Nonce          string `json:"Nonce"`
}

RaRequest represents the JSON structure for RA attestation requests.

type ResponseKey 

type ResponseKey struct {
	// contains filtered or unexported fields
}

ResponseKey wraps an AES key with specific usage constraints

func (*ResponseKey) DecryptBytesReader 

func (r *ResponseKey) DecryptBytesReader(response io.Reader) ([]byte, error)

DecryptBytesReader decrypts a serialized response from reader to bytes (client use)

func (*ResponseKey) DecryptBytesString 

func (r *ResponseKey) DecryptBytesString(response string) ([]byte, error)

DecryptBytesString decrypts a serialized response string to bytes (client use)

func (*ResponseKey) DecryptFiles 

func (r *ResponseKey) DecryptFiles(response, input, output string) error

DecryptFiles decrypts input file to output file using response string (client use)

func (*ResponseKey) DecryptStream 

func (r *ResponseKey) DecryptStream(response io.Reader, source io.Reader, sink io.Writer) error

DecryptStream decrypts data from source to sink using serialized response (client use)

func (*ResponseKey) DecryptStreamString 

func (r *ResponseKey) DecryptStreamString(response string, source io.Reader, sink io.Writer) error

DecryptStreamString decrypts data from source to sink using response string (client use)

func (*ResponseKey) DecryptString 

func (r *ResponseKey) DecryptString(response string) (string, error)

DecryptString decrypts a serialized response string to UTF-8 string (client use)

func (*ResponseKey) DecryptStringReader 

func (r *ResponseKey) DecryptStringReader(response io.Reader) (string, error)

DecryptStringReader decrypts a serialized response from reader to UTF-8 string (client use)

func (*ResponseKey) EncryptBytes 

func (r *ResponseKey) EncryptBytes(response []byte) (string, error)

EncryptBytes encrypts a bytes response (server use)

func (*ResponseKey) EncryptFiles 

func (r *ResponseKey) EncryptFiles(input, output string) (string, error)

EncryptFiles encrypts input file to output file (server use)

func (*ResponseKey) EncryptStream 

func (r *ResponseKey) EncryptStream(source io.Reader, sink io.Writer) (string, error)

EncryptStream encrypts data from source to sink (server use)

func (*ResponseKey) EncryptString 

func (r *ResponseKey) EncryptString(response string) (string, error)

EncryptString encrypts a string response (server use)

func (*ResponseKey) Usage 

func (r *ResponseKey) Usage() Usage

Usage returns the key's intended usage

type TopInfo 

type TopInfo struct {
	AK          string `json:"ak"`            // Access Key
	SK          string `json:"sk"`            // Secret Key
	Service     string `json:"service"`       // Service name (required)
	Region      string `json:"region"`        // Region (default: "cn-beijing")
	Method      string `json:"method"`        // HTTP method (default: "POST")
	Action      string `json:"action"`        // Deprecated: Use action parameter in RequestTop
	Version     string `json:"version"`       // API version (default: "2024-12-24")
	URL         string `json:"url"`           // Base URL (for signing)
	URLRewrite  string `json:"url_rewrite"`   // Optional URL rewrite (for actual request)
	AiccSaaSTrn string `json:"aicc_saas_trn"` // Optional: STS AssumeRole TRN
	TargetUID   string `json:"target_uid"`    // Optional: Target UID for header
}

TopInfo holds configuration for the TOP API request.

type Usage 

type Usage int

Usage specifies the intended usage of the ResponseKey (encrypt or decrypt) 

const (
	// UsageEncrypt indicates the key is used for encryption (server side)
	UsageEncrypt Usage = iota
	// UsageDecrypt indicates the key is used for decryption (client side)
	UsageDecrypt
)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.