1// Copyright 2018 Google LLC 2// 3// Licensed under the Apache License, Version 2.0 (the "License"); 4// you may not use this file except in compliance with the License. 5// You may obtain a copy of the License at 6// 7// http://www.apache.org/licenses/LICENSE-2.0 8// 9// Unless required by applicable law or agreed to in writing, software 10// distributed under the License is distributed on an "AS IS" BASIS, 11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12// See the License for the specific language governing permissions and 13// limitations under the License. 14// 15//////////////////////////////////////////////////////////////////////////////// 16 17package signature 18 19import ( 20 "crypto/ed25519" 21 "fmt" 22 23 "google.golang.org/protobuf/proto" 24 "github.com/google/tink/go/keyset" 25 "github.com/google/tink/go/signature/subtle" 26 ed25519pb "github.com/google/tink/go/proto/ed25519_go_proto" 27 tinkpb "github.com/google/tink/go/proto/tink_go_proto" 28) 29 30const ( 31 ed25519VerifierKeyVersion = 0 32 ed25519VerifierTypeURL = "type.googleapis.com/google.crypto.tink.Ed25519PublicKey" 33) 34 35// common errors 36var errInvalidED25519VerifierKey = fmt.Errorf("ed25519_verifier_key_manager: invalid key") 37var errED25519VerifierNotImplemented = fmt.Errorf("ed25519_verifier_key_manager: not implemented") 38 39// ed25519VerifierKeyManager is an implementation of KeyManager interface. 40// It doesn't support key generation. 41type ed25519VerifierKeyManager struct{} 42 43// Primitive creates an ED25519Verifier subtle for the given serialized ED25519PublicKey proto. 44func (km *ed25519VerifierKeyManager) Primitive(serializedKey []byte) (interface{}, error) { 45 if len(serializedKey) == 0 { 46 return nil, errInvalidED25519VerifierKey 47 } 48 key := new(ed25519pb.Ed25519PublicKey) 49 if err := proto.Unmarshal(serializedKey, key); err != nil { 50 return nil, errInvalidED25519VerifierKey 51 } 52 if err := km.validateKey(key); err != nil { 53 return nil, fmt.Errorf("ed25519_verifier_key_manager: %s", err) 54 } 55 ret, err := subtle.NewED25519Verifier(key.KeyValue) 56 if err != nil { 57 return nil, fmt.Errorf("ed25519_verifier_key_manager: invalid key: %s", err) 58 } 59 return ret, nil 60} 61 62// NewKey is not implemented. 63func (km *ed25519VerifierKeyManager) NewKey(serializedKeyFormat []byte) (proto.Message, error) { 64 return nil, errED25519VerifierNotImplemented 65} 66 67// NewKeyData creates a new KeyData according to specification in the given 68// serialized ED25519KeyFormat. It should be used solely by the key management API. 69func (km *ed25519VerifierKeyManager) NewKeyData(serializedKeyFormat []byte) (*tinkpb.KeyData, error) { 70 return nil, errED25519VerifierNotImplemented 71} 72 73// DoesSupport indicates if this key manager supports the given key type. 74func (km *ed25519VerifierKeyManager) DoesSupport(typeURL string) bool { 75 return typeURL == ed25519VerifierTypeURL 76} 77 78// TypeURL returns the key type of keys managed by this key manager. 79func (km *ed25519VerifierKeyManager) TypeURL() string { 80 return ed25519VerifierTypeURL 81} 82 83// validateKey validates the given ED25519PublicKey. 84func (km *ed25519VerifierKeyManager) validateKey(key *ed25519pb.Ed25519PublicKey) error { 85 if err := keyset.ValidateKeyVersion(key.Version, ed25519VerifierKeyVersion); err != nil { 86 return fmt.Errorf("ed25519_verifier_key_manager: %s", err) 87 } 88 if len(key.KeyValue) != ed25519.PublicKeySize { 89 return fmt.Errorf("ed25519_verifier_key_manager: invalid key length, required :%d", ed25519.PublicKeySize) 90 } 91 return nil 92} 93