1// Copyright 2020 Google LLC 2// 3// Licensed under the Apache License, Version 2.0 (the "License"); 4// you may not use this file except in compliance with the License. 5// You may obtain a copy of the License at 6// 7// http://www.apache.org/licenses/LICENSE-2.0 8// 9// Unless required by applicable law or agreed to in writing, software 10// distributed under the License is distributed on an "AS IS" BASIS, 11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12// See the License for the specific language governing permissions and 13// limitations under the License. 14// 15//////////////////////////////////////////////////////////////////////////////// 16 17package streamingaead 18 19import ( 20 "fmt" 21 "io" 22 23 "github.com/google/tink/go/core/primitiveset" 24 "github.com/google/tink/go/keyset" 25 "github.com/google/tink/go/tink" 26) 27 28// New returns a StreamingAEAD primitive from the given keyset handle. 29func New(handle *keyset.Handle) (tink.StreamingAEAD, error) { 30 ps, err := handle.Primitives() 31 if err != nil { 32 return nil, fmt.Errorf("streamingaead_factory: cannot obtain primitive set: %s", err) 33 } 34 35 _, ok := (ps.Primary.Primitive).(tink.StreamingAEAD) 36 if !ok { 37 return nil, fmt.Errorf("streamingaead_factory: not a StreamingAEAD primitive") 38 } 39 40 for _, primitives := range ps.Entries { 41 for _, p := range primitives { 42 if _, ok := (p.Primitive).(tink.StreamingAEAD); !ok { 43 return nil, fmt.Errorf("streamingaead_factory: not a StreamingAEAD primitive") 44 } 45 } 46 } 47 48 ret := new(wrappedStreamingAEAD) 49 ret.ps = ps 50 return tink.StreamingAEAD(ret), nil 51} 52 53// wrappedStreamingAEAD is a StreamingAEAD implementation that uses the underlying primitive set 54// for streaming encryption and decryption. 55type wrappedStreamingAEAD struct { 56 ps *primitiveset.PrimitiveSet 57} 58 59// Asserts that wrappedStreamingAEAD implements the StreamingAEAD interface. 60var _ tink.StreamingAEAD = (*wrappedStreamingAEAD)(nil) 61 62// NewEncryptingWriter returns a wrapper around underlying io.Writer, such that any write-operation 63// via the wrapper results in AEAD-encryption of the written data, using aad 64// as associated authenticated data. The associated data is not included in the ciphertext 65// and has to be passed in as parameter for decryption. 66func (s *wrappedStreamingAEAD) NewEncryptingWriter(w io.Writer, aad []byte) (io.WriteCloser, error) { 67 primary := s.ps.Primary 68 p, ok := (primary.Primitive).(tink.StreamingAEAD) 69 if !ok { 70 return nil, fmt.Errorf("streamingaead_factory: not a StreamingAEAD primitive") 71 } 72 73 return p.NewEncryptingWriter(w, aad) 74} 75 76// NewDecryptingReader returns a wrapper around underlying io.Reader, such that any read-operation 77// via the wrapper results in AEAD-decryption of the underlying ciphertext, 78// using aad as associated authenticated data. 79func (s *wrappedStreamingAEAD) NewDecryptingReader(r io.Reader, aad []byte) (io.Reader, error) { 80 return &decryptReader{ 81 wrapped: s, 82 cr: r, 83 aad: aad, 84 }, nil 85} 86