unistack-org/micro
4
0
Fork 3
Code Issues 19 Pull Requests 1 Actions Packages Projects Releases 259 Wiki Activity

remove secrets package

Browse Source
This commit is contained in:
Asim Aslam 2020-07-14 21:53:43 +01:00
parent 057d61063f
commit e1404a1100
5 changed files with 0 additions and 372 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

89
config/secrets/box/box.go
View File

@ -1,89 +0,0 @@
// Package box is an asymmetric implementation of config/secrets using nacl/box
package box
import (
"github.com/micro/go-micro/v2/config/secrets"
"github.com/pkg/errors"
naclbox "golang.org/x/crypto/nacl/box"
"crypto/rand"
)
const keyLength = 32
type box struct {
options secrets.Options
publicKey [keyLength]byte
privateKey [keyLength]byte
}
// NewSecrets returns a nacl-box codec
func NewSecrets(opts ...secrets.Option) secrets.Secrets {
b := &box{}
for _, o := range opts {
o(&b.options)
}
return b
}
// Init initialises a box
func (b *box) Init(opts ...secrets.Option) error {
for _, o := range opts {
o(&b.options)
}
if len(b.options.PrivateKey) != keyLength || len(b.options.PublicKey) != keyLength {
return errors.Errorf("a public key and a private key of length %d must both be provided", keyLength)
}
copy(b.privateKey[:], b.options.PrivateKey)
copy(b.publicKey[:], b.options.PublicKey)
return nil
}
// Options returns options
func (b *box) Options() secrets.Options {
return b.options
}
// String returns nacl-box
func (*box) String() string {
return "nacl-box"
}
// Encrypt encrypts a message with the sender's private key and the receipient's public key
func (b *box) Encrypt(in []byte, opts ...secrets.EncryptOption) ([]byte, error) {
var options secrets.EncryptOptions
for _, o := range opts {
o(&options)
}
if len(options.RecipientPublicKey) != keyLength {
return []byte{}, errors.New("recepient's public key must be provided")
}
var recipientPublicKey [keyLength]byte
copy(recipientPublicKey[:], options.RecipientPublicKey)
var nonce [24]byte
if _, err := rand.Reader.Read(nonce[:]); err != nil {
return []byte{}, errors.Wrap(err, "couldn't obtain a random nonce from crypto/rand")
}
return naclbox.Seal(nonce[:], in, &nonce, &recipientPublicKey, &b.privateKey), nil
}
// Decrypt Decrypts a message with the receiver's private key and the sender's public key
func (b *box) Decrypt(in []byte, opts ...secrets.DecryptOption) ([]byte, error) {
var options secrets.DecryptOptions
for _, o := range opts {
o(&options)
}
if len(options.SenderPublicKey) != keyLength {
return []byte{}, errors.New("sender's public key bust be provided")
}
var nonce [24]byte
var senderPublicKey [32]byte
copy(nonce[:], in[:24])
copy(senderPublicKey[:], options.SenderPublicKey)
decrypted, ok := naclbox.Open(nil, in[24:], &nonce, &senderPublicKey, &b.privateKey)
if !ok {
return []byte{}, errors.New("incoming message couldn't be verified / decrypted")
}
return decrypted, nil
}

66
config/secrets/box/box_test.go
View File

@ -1,66 +0,0 @@
package box
import (
"crypto/rand"
"reflect"
"testing"
"github.com/micro/go-micro/v2/config/secrets"
naclbox "golang.org/x/crypto/nacl/box"
)
func TestBox(t *testing.T) {
alicePublicKey, alicePrivateKey, err := naclbox.GenerateKey(rand.Reader)
if err != nil {
t.Fatal(err)
}
bobPublicKey, bobPrivateKey, err := naclbox.GenerateKey(rand.Reader)
if err != nil {
t.Fatal(err)
}
alice, bob := NewSecrets(secrets.PublicKey(alicePublicKey[:]), secrets.PrivateKey(alicePrivateKey[:])), NewSecrets()
if err := alice.Init(); err != nil {
t.Error(err)
}
if err := bob.Init(secrets.PublicKey(bobPublicKey[:]), secrets.PrivateKey(bobPrivateKey[:])); err != nil {
t.Error(err)
}
if alice.String() != "nacl-box" {
t.Error("String() doesn't return nacl-box")
}
aliceSecret := []byte("Why is a raven like a writing-desk?")
if _, err := alice.Encrypt(aliceSecret); err == nil {
t.Error("alice.Encrypt succeded without a public key")
}
enc, err := alice.Encrypt(aliceSecret, secrets.RecipientPublicKey(bob.Options().PublicKey))
if err != nil {
t.Error("alice.Encrypt failed")
}
if _, err := bob.Decrypt(enc); err == nil {
t.Error("bob.Decrypt succeded without a public key")
}
if dec, err := bob.Decrypt(enc, secrets.SenderPublicKey(alice.Options().PublicKey)); err == nil {
if !reflect.DeepEqual(dec, aliceSecret) {
t.Errorf("Bob's decrypted message didn't match Alice's encrypted message: %v != %v", aliceSecret, dec)
}
} else {
t.Errorf("bob.Decrypt failed (%s)", err)
}
bobSecret := []byte("I haven't the slightest idea")
enc, err = bob.Encrypt(bobSecret, secrets.RecipientPublicKey(alice.Options().PublicKey))
if err != nil {
t.Error(err)
}
dec, err := alice.Decrypt(enc, secrets.SenderPublicKey(bob.Options().PrivateKey))
if err == nil {
t.Error(err)
}
dec, err = alice.Decrypt(enc, secrets.SenderPublicKey(bob.Options().PublicKey))
if err != nil {
t.Error(err)
}
if !reflect.DeepEqual(dec, bobSecret) {
t.Errorf("Alice's decrypted message didn't match Bob's encrypted message %v != %v", bobSecret, dec)
}
}

73
config/secrets/secretbox/secretbox.go
View File

@ -1,73 +0,0 @@
// Package secretbox is a config/secrets implementation that uses nacl/secretbox
// to do symmetric encryption / verification
package secretbox
import (
"github.com/micro/go-micro/v2/config/secrets"
"github.com/pkg/errors"
"golang.org/x/crypto/nacl/secretbox"
"crypto/rand"
)
const keyLength = 32
type secretBox struct {
options secrets.Options
secretKey [keyLength]byte
}
// NewSecrets returns a secretbox codec
func NewSecrets(opts ...secrets.Option) secrets.Secrets {
sb := &secretBox{}
for _, o := range opts {
o(&sb.options)
}
return sb
}
func (s *secretBox) Init(opts ...secrets.Option) error {
for _, o := range opts {
o(&s.options)
}
if len(s.options.Key) == 0 {
return errors.New("no secret key is defined")
}
if len(s.options.Key) != keyLength {
return errors.Errorf("secret key must be %d bytes long", keyLength)
}
copy(s.secretKey[:], s.options.Key)
return nil
}
func (s *secretBox) Options() secrets.Options {
return s.options
}
func (s *secretBox) String() string {
return "nacl-secretbox"
}
func (s *secretBox) Encrypt(in []byte, opts ...secrets.EncryptOption) ([]byte, error) {
// no opts are expected, so they are ignored
// there must be a unique nonce for each message
var nonce [24]byte
if _, err := rand.Reader.Read(nonce[:]); err != nil {
return []byte{}, errors.Wrap(err, "couldn't obtain a random nonce from crypto/rand")
}
return secretbox.Seal(nonce[:], in, &nonce, &s.secretKey), nil
}
func (s *secretBox) Decrypt(in []byte, opts ...secrets.DecryptOption) ([]byte, error) {
// no options are expected, so they are ignored
var decryptNonce [24]byte
copy(decryptNonce[:], in[:24])
decrypted, ok := secretbox.Open(nil, in[24:], &decryptNonce, &s.secretKey)
if !ok {
return []byte{}, errors.New("decryption failed (is the key set correctly?)")
}
return decrypted, nil
}

56
config/secrets/secretbox/secretbox_test.go
View File

@ -1,56 +0,0 @@
package secretbox
import (
"encoding/base64"
"reflect"
"testing"
"github.com/micro/go-micro/v2/config/secrets"
)
func TestSecretBox(t *testing.T) {
secretKey, err := base64.StdEncoding.DecodeString("4jbVgq8FsAV7vy+n8WqEZrl7BUtNqh3fYT5RXzXOPFY=")
if err != nil {
t.Fatal(err)
}
s := NewSecrets()
if err := s.Init(); err == nil {
t.Error("Secretbox accepted an empty secret key")
}
if err := s.Init(secrets.Key([]byte("invalid"))); err == nil {
t.Error("Secretbox accepted a secret key that is invalid")
}
if err := s.Init(secrets.Key(secretKey)); err != nil {
t.Fatal(err)
}
o := s.Options()
if !reflect.DeepEqual(o.Key, secretKey) {
t.Error("Init() didn't set secret key correctly")
}
if s.String() != "nacl-secretbox" {
t.Error(s.String() + " should be nacl-secretbox")
}
// Try 10 times to get different nonces
for i := 0; i < 10; i++ {
message := []byte(`Can you hear me, Major Tom?`)
encrypted, err := s.Encrypt(message)
if err != nil {
t.Errorf("Failed to encrypt message (%s)", err)
}
decrypted, err := s.Decrypt(encrypted)
if err != nil {
t.Errorf("Failed to decrypt encrypted message (%s)", err)
}
if !reflect.DeepEqual(message, decrypted) {
t.Errorf("Decrypted Message dod not match encrypted message")
}
}
}

88
config/secrets/secrets.go
View File

@ -1,88 +0,0 @@
// Package secrets is an interface for encrypting and decrypting secrets
package secrets
import "context"
// Secrets encrypts or decrypts arbitrary data. The data should be as small as possible
type Secrets interface {
// Initialise options
Init(...Option) error
// Return the options
Options() Options
// Decrypt a value
Decrypt([]byte, ...DecryptOption) ([]byte, error)
// Encrypt a value
Encrypt([]byte, ...EncryptOption) ([]byte, error)
// Secrets implementation
String() string
}
type Options struct {
// Key is a symmetric key for encoding
Key []byte
// Private key for decoding
PrivateKey []byte
// Public key for encoding
PublicKey []byte
// Context for other opts
Context context.Context
}
// Option sets options
type Option func(*Options)
// Key sets the symmetric secret key
func Key(k []byte) Option {
return func(o *Options) {
o.Key = make([]byte, len(k))
copy(o.Key, k)
}
}
// PublicKey sets the asymmetric Public Key of this codec
func PublicKey(key []byte) Option {
return func(o *Options) {
o.PublicKey = make([]byte, len(key))
copy(o.PublicKey, key)
}
}
// PrivateKey sets the asymmetric Private Key of this codec
func PrivateKey(key []byte) Option {
return func(o *Options) {
o.PrivateKey = make([]byte, len(key))
copy(o.PrivateKey, key)
}
}
// DecryptOptions can be passed to Secrets.Decrypt
type DecryptOptions struct {
SenderPublicKey []byte
}
// DecryptOption sets DecryptOptions
type DecryptOption func(*DecryptOptions)
// SenderPublicKey is the Public Key of the Secrets that encrypted this message
func SenderPublicKey(key []byte) DecryptOption {
return func(d *DecryptOptions) {
d.SenderPublicKey = make([]byte, len(key))
copy(d.SenderPublicKey, key)
}
}
// EncryptOptions can be passed to Secrets.Encrypt
type EncryptOptions struct {
RecipientPublicKey []byte
}
// EncryptOption Sets EncryptOptions
type EncryptOption func(*EncryptOptions)
// RecipientPublicKey is the Public Key of the Secrets that will decrypt this message
func RecipientPublicKey(key []byte) EncryptOption {
return func(e *EncryptOptions) {
e.RecipientPublicKey = make([]byte, len(key))
copy(e.RecipientPublicKey, key)
}
}