145 lines
4.1 KiB
Go
145 lines
4.1 KiB
Go
/*-
|
|
* Copyright 2018 Square Inc.
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
package jose
|
|
|
|
// OpaqueSigner is an interface that supports signing payloads with opaque
|
|
// private key(s). Private key operations performed by implementers may, for
|
|
// example, occur in a hardware module. An OpaqueSigner may rotate signing keys
|
|
// transparently to the user of this interface.
|
|
type OpaqueSigner interface {
|
|
// Public returns the public key of the current signing key.
|
|
Public() *JSONWebKey
|
|
// Algs returns a list of supported signing algorithms.
|
|
Algs() []SignatureAlgorithm
|
|
// SignPayload signs a payload with the current signing key using the given
|
|
// algorithm.
|
|
SignPayload(payload []byte, alg SignatureAlgorithm) ([]byte, error)
|
|
}
|
|
|
|
type opaqueSigner struct {
|
|
signer OpaqueSigner
|
|
}
|
|
|
|
func newOpaqueSigner(alg SignatureAlgorithm, signer OpaqueSigner) (recipientSigInfo, error) {
|
|
var algSupported bool
|
|
for _, salg := range signer.Algs() {
|
|
if alg == salg {
|
|
algSupported = true
|
|
break
|
|
}
|
|
}
|
|
if !algSupported {
|
|
return recipientSigInfo{}, ErrUnsupportedAlgorithm
|
|
}
|
|
|
|
return recipientSigInfo{
|
|
sigAlg: alg,
|
|
publicKey: signer.Public,
|
|
signer: &opaqueSigner{
|
|
signer: signer,
|
|
},
|
|
}, nil
|
|
}
|
|
|
|
func (o *opaqueSigner) signPayload(payload []byte, alg SignatureAlgorithm) (Signature, error) {
|
|
out, err := o.signer.SignPayload(payload, alg)
|
|
if err != nil {
|
|
return Signature{}, err
|
|
}
|
|
|
|
return Signature{
|
|
Signature: out,
|
|
protected: &rawHeader{},
|
|
}, nil
|
|
}
|
|
|
|
// OpaqueVerifier is an interface that supports verifying payloads with opaque
|
|
// public key(s). An OpaqueSigner may rotate signing keys transparently to the
|
|
// user of this interface.
|
|
type OpaqueVerifier interface {
|
|
VerifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error
|
|
}
|
|
|
|
type opaqueVerifier struct {
|
|
verifier OpaqueVerifier
|
|
}
|
|
|
|
func (o *opaqueVerifier) verifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error {
|
|
return o.verifier.VerifyPayload(payload, signature, alg)
|
|
}
|
|
|
|
// OpaqueKeyEncrypter is an interface that supports encrypting keys with an opaque key.
|
|
type OpaqueKeyEncrypter interface {
|
|
// KeyID returns the kid
|
|
KeyID() string
|
|
// Algs returns a list of supported key encryption algorithms.
|
|
Algs() []KeyAlgorithm
|
|
// encryptKey encrypts the CEK using the given algorithm.
|
|
encryptKey(cek []byte, alg KeyAlgorithm) (recipientInfo, error)
|
|
}
|
|
|
|
type opaqueKeyEncrypter struct {
|
|
encrypter OpaqueKeyEncrypter
|
|
}
|
|
|
|
func newOpaqueKeyEncrypter(alg KeyAlgorithm, encrypter OpaqueKeyEncrypter) (recipientKeyInfo, error) {
|
|
var algSupported bool
|
|
for _, salg := range encrypter.Algs() {
|
|
if alg == salg {
|
|
algSupported = true
|
|
break
|
|
}
|
|
}
|
|
if !algSupported {
|
|
return recipientKeyInfo{}, ErrUnsupportedAlgorithm
|
|
}
|
|
|
|
return recipientKeyInfo{
|
|
keyID: encrypter.KeyID(),
|
|
keyAlg: alg,
|
|
keyEncrypter: &opaqueKeyEncrypter{
|
|
encrypter: encrypter,
|
|
},
|
|
}, nil
|
|
}
|
|
|
|
func (oke *opaqueKeyEncrypter) encryptKey(cek []byte, alg KeyAlgorithm) (recipientInfo, error) {
|
|
return oke.encrypter.encryptKey(cek, alg)
|
|
}
|
|
|
|
//OpaqueKeyDecrypter is an interface that supports decrypting keys with an opaque key.
|
|
type OpaqueKeyDecrypter interface {
|
|
DecryptKey(encryptedKey []byte, header Header) ([]byte, error)
|
|
}
|
|
|
|
type opaqueKeyDecrypter struct {
|
|
decrypter OpaqueKeyDecrypter
|
|
}
|
|
|
|
func (okd *opaqueKeyDecrypter) decryptKey(headers rawHeader, recipient *recipientInfo, generator keyGenerator) ([]byte, error) {
|
|
mergedHeaders := rawHeader{}
|
|
mergedHeaders.merge(&headers)
|
|
mergedHeaders.merge(recipient.header)
|
|
|
|
header, err := mergedHeaders.sanitized()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return okd.decrypter.DecryptKey(recipient.encryptedKey, header)
|
|
}
|