nkeys.go 3.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100
  1. // Copyright 2018-2019 The NATS Authors
  2. // Licensed under the Apache License, Version 2.0 (the "License");
  3. // you may not use this file except in compliance with the License.
  4. // You may obtain a copy of the License at
  5. //
  6. // http://www.apache.org/licenses/LICENSE-2.0
  7. //
  8. // Unless required by applicable law or agreed to in writing, software
  9. // distributed under the License is distributed on an "AS IS" BASIS,
  10. // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  11. // See the License for the specific language governing permissions and
  12. // limitations under the License.
  13. // Package nkeys is an Ed25519 based public-key signature system that simplifies keys and seeds
  14. // and performs signing and verification.
  15. // It also supports encryption via x25519 keys and is compatible with https://pkg.go.dev/golang.org/x/crypto/nacl/box.
  16. package nkeys
  17. import "io"
  18. // Version is our current version
  19. const Version = "0.4.7"
  20. // KeyPair provides the central interface to nkeys.
  21. type KeyPair interface {
  22. Seed() ([]byte, error)
  23. PublicKey() (string, error)
  24. PrivateKey() ([]byte, error)
  25. // Sign is only supported on Non CurveKeyPairs
  26. Sign(input []byte) ([]byte, error)
  27. // Verify is only supported on Non CurveKeyPairs
  28. Verify(input []byte, sig []byte) error
  29. Wipe()
  30. // Seal is only supported on CurveKeyPair
  31. Seal(input []byte, recipient string) ([]byte, error)
  32. // SealWithRand is only supported on CurveKeyPair
  33. SealWithRand(input []byte, recipient string, rr io.Reader) ([]byte, error)
  34. // Open is only supported on CurveKey
  35. Open(input []byte, sender string) ([]byte, error)
  36. }
  37. // CreateUser will create a User typed KeyPair.
  38. func CreateUser() (KeyPair, error) {
  39. return CreatePair(PrefixByteUser)
  40. }
  41. // CreateAccount will create an Account typed KeyPair.
  42. func CreateAccount() (KeyPair, error) {
  43. return CreatePair(PrefixByteAccount)
  44. }
  45. // CreateServer will create a Server typed KeyPair.
  46. func CreateServer() (KeyPair, error) {
  47. return CreatePair(PrefixByteServer)
  48. }
  49. // CreateCluster will create a Cluster typed KeyPair.
  50. func CreateCluster() (KeyPair, error) {
  51. return CreatePair(PrefixByteCluster)
  52. }
  53. // CreateOperator will create an Operator typed KeyPair.
  54. func CreateOperator() (KeyPair, error) {
  55. return CreatePair(PrefixByteOperator)
  56. }
  57. // FromPublicKey will create a KeyPair capable of verifying signatures.
  58. func FromPublicKey(public string) (KeyPair, error) {
  59. raw, err := decode([]byte(public))
  60. if err != nil {
  61. return nil, err
  62. }
  63. pre := PrefixByte(raw[0])
  64. if err := checkValidPublicPrefixByte(pre); err != nil {
  65. return nil, ErrInvalidPublicKey
  66. }
  67. return &pub{pre, raw[1:]}, nil
  68. }
  69. // FromSeed will create a KeyPair capable of signing and verifying signatures.
  70. func FromSeed(seed []byte) (KeyPair, error) {
  71. prefix, _, err := DecodeSeed(seed)
  72. if err != nil {
  73. return nil, err
  74. }
  75. if prefix == PrefixByteCurve {
  76. return FromCurveSeed(seed)
  77. }
  78. copy := append([]byte{}, seed...)
  79. return &kp{copy}, nil
  80. }
  81. // FromRawSeed will create a KeyPair from the raw 32 byte seed for a given type.
  82. func FromRawSeed(prefix PrefixByte, rawSeed []byte) (KeyPair, error) {
  83. seed, err := EncodeSeed(prefix, rawSeed)
  84. if err != nil {
  85. return nil, err
  86. }
  87. return &kp{seed}, nil
  88. }