Documentation
¶
Overview ¶
Package crypto implements the IKEv2 cryptographic primitives and proposal negotiation.
Index ¶
- Variables
- func ComputeIntegrity(id IntegrityID, key, data []byte) ([]byte, error)
- func DecryptAESCBC(key, data []byte) ([]byte, error)
- func DecryptAESCBCRaw(key, data []byte) ([]byte, error)
- func DecryptAESGCM(key, data, aad []byte) ([]byte, error)
- func DecryptIKEAEAD(keyWithSalt, data, aad []byte) ([]byte, error)
- func DeriveRekeyedSKEYSEED(prfID PRFID, skDOld, newSharedSecret, ni, nr []byte) ([]byte, error)
- func DeriveSKEYSEED(prfID PRFID, ni, nr, sharedSecret []byte) ([]byte, error)
- func EncryptAESCBC(key, plaintext []byte) ([]byte, error)
- func EncryptAESGCM(key, plaintext, aad []byte) ([]byte, error)
- func EncryptIKEAEAD(keyWithSalt, plaintext, aad []byte) ([]byte, error)
- func PRF(id PRFID, key, data []byte) ([]byte, error)
- func PRFPlus(id PRFID, key, seed []byte, length int) ([]byte, error)
- func VerifyIntegrity(id IntegrityID, key, data, expected []byte) error
- type ChildSAKeys
- type DHExchange
- type DHGroupID
- type DHGroupTransform
- type ESPProposal
- type EncryptionID
- type EncryptionTransform
- type IKEProposal
- type IntegrityID
- type IntegrityTransform
- type PRFID
- type PRFTransform
- type SKKeys
- type TransformType
Constants ¶
This section is empty.
Variables ¶
var ( ErrDecryptionFailed = errors.New("decryption failed: authentication tag mismatch") ErrInvalidKeyLength = errors.New("invalid key length") ErrIntegrityFailed = errors.New("integrity verification failed") )
var ( ErrInvalidPublicKey = errors.New("invalid DH public key") ErrUnsupportedGroup = errors.New("unsupported DH group") )
var ErrNoProposalChosen = errors.New("NO_PROPOSAL_CHOSEN")
var ErrUnsupportedAlgorithm = errors.New("unsupported algorithm")
Functions ¶
func ComputeIntegrity ¶
func ComputeIntegrity(id IntegrityID, key, data []byte) ([]byte, error)
ComputeIntegrity computes a truncated HMAC for the given data.
func DecryptAESCBC ¶
DecryptAESCBC decrypts data produced by EncryptAESCBC (iv || ciphertext).
func DecryptAESCBCRaw ¶
DecryptAESCBCRaw decrypts without unpadding (caller handles IKEv2 padding). Input is iv(blockSize) || ciphertext.
func DecryptAESGCM ¶
DecryptAESGCM decrypts data produced by EncryptAESGCM (nonce || ciphertext || tag).
func DecryptIKEAEAD ¶
DecryptIKEAEAD decrypts using the IKEv2 AEAD construction (RFC 5282). keyWithSalt is the AEAD key material: AES key || 4-byte salt. data is IV(8) || ciphertext || tag(16) from the wire.
func DeriveRekeyedSKEYSEED ¶
DeriveRekeyedSKEYSEED computes the seed key for a rekeyed IKE SA. RFC 7296 Section 2.18: SKEYSEED = prf(SK_d_old, g^ir_new | Ni | Nr).
func DeriveSKEYSEED ¶
DeriveSKEYSEED computes the initial IKE SA seed key. RFC 7296 Section 2.14: SKEYSEED = prf(Ni | Nr, g^ir).
func EncryptAESCBC ¶
EncryptAESCBC encrypts plaintext using AES-CBC with PKCS#7 padding. Returns iv || ciphertext.
func EncryptAESGCM ¶
EncryptAESGCM encrypts plaintext using AES-GCM with a 16-byte authentication tag. Returns nonce || ciphertext || tag.
func EncryptIKEAEAD ¶
EncryptIKEAEAD encrypts using the IKEv2 AEAD construction (RFC 5282). keyWithSalt is the AEAD key material: AES key || 4-byte salt. Returns IV(8) || ciphertext || tag(16) for the wire.
func PRFPlus ¶
PRFPlus implements RFC 7296 Section 2.13 prf+ key expansion. T1 = prf(K, S | 0x01) T2 = prf(K, T1 | S | 0x02) T3 = prf(K, T2 | S | 0x03) ... prf+(K, S) = T1 | T2 | T3 | ...
func VerifyIntegrity ¶
func VerifyIntegrity(id IntegrityID, key, data, expected []byte) error
VerifyIntegrity checks a truncated HMAC using constant-time comparison.
Types ¶
type ChildSAKeys ¶
ChildSAKeys holds ESP keying material for one direction.
func DeriveChildSAKeys ¶
func DeriveChildSAKeys(prfID PRFID, skD, ni, nr []byte, enc EncryptionTransform, integ IntegrityTransform) (*ChildSAKeys, error)
DeriveChildSAKeys derives ESP keys from SK_d and nonces. RFC 7296 Section 2.17: KEYMAT = prf+(SK_d, Ni | Nr).
func DeriveChildSAKeysPFS ¶
func DeriveChildSAKeysPFS(prfID PRFID, skD, dhSharedSecret, ni, nr []byte, enc EncryptionTransform, integ IntegrityTransform) (*ChildSAKeys, error)
DeriveChildSAKeysPFS derives ESP keys with Perfect Forward Secrecy. RFC 7296 Section 2.17: KEYMAT = prf+(SK_d, g^ir | Ni | Nr).
func (*ChildSAKeys) Clear ¶
func (k *ChildSAKeys) Clear()
type DHExchange ¶
type DHExchange struct {
GroupID DHGroupID
PublicKey []byte
// contains filtered or unexported fields
}
func NewDHExchange ¶
func NewDHExchange(groupID DHGroupID) (*DHExchange, error)
func (*DHExchange) Clear ¶
func (ex *DHExchange) Clear()
func (*DHExchange) SharedSecret ¶
func (ex *DHExchange) SharedSecret(remotePublic []byte) ([]byte, error)
type DHGroupTransform ¶
type DHGroupTransform struct {
ID DHGroupID
}
func LookupDHGroup ¶
func LookupDHGroup(id uint8) (DHGroupTransform, error)
type ESPProposal ¶
type ESPProposal struct {
Number uint16
Encryption EncryptionTransform
Integrity IntegrityTransform
}
ESPProposal represents a single ESP/Child SA crypto proposal.
func NegotiateESP ¶
func NegotiateESP(remote, local []ESPProposal) (ESPProposal, error)
NegotiateESP selects the first remote ESP proposal acceptable to local policy.
type EncryptionID ¶
type EncryptionID uint16
RFC 7296 Section 3.3.3: Encryption Algorithm Transform IDs.
const ( ENCR_AES_CBC EncryptionID = 12 ENCR_AES_GCM_16 EncryptionID = 20 )
func (EncryptionID) String ¶
func (id EncryptionID) String() string
type EncryptionTransform ¶
type EncryptionTransform struct {
ID EncryptionID
KeyLength uint16 // in bits
IsAEAD bool
}
func LookupEncryption ¶
func LookupEncryption(name string) (EncryptionTransform, error)
type IKEProposal ¶
type IKEProposal struct {
Number uint16
Encryption EncryptionTransform
PRF PRFTransform
Integrity IntegrityTransform
DHGroup DHGroupTransform
}
IKEProposal represents a single IKE SA crypto proposal.
func NegotiateIKE ¶
func NegotiateIKE(remote, local []IKEProposal) (IKEProposal, error)
NegotiateIKE selects the first remote proposal acceptable to local policy. RFC 7296 Section 2.7: responder picks exactly one proposal.
type IntegrityID ¶
type IntegrityID uint16
RFC 7296 Section 3.3.5: Integrity Algorithm Transform IDs.
const ( AUTH_NONE IntegrityID = 0 AUTH_HMAC_SHA2_256_128 IntegrityID = 12 AUTH_HMAC_SHA2_384_192 IntegrityID = 13 AUTH_HMAC_SHA2_512_256 IntegrityID = 14 )
func (IntegrityID) String ¶
func (id IntegrityID) String() string
type IntegrityTransform ¶
type IntegrityTransform struct {
ID IntegrityID
KeyLength uint16 // in bytes
TruncatedLength uint16 // ICV length in bytes
}
func LookupIntegrity ¶
func LookupIntegrity(name string) (IntegrityTransform, error)
type PRFTransform ¶
func LookupPRF ¶
func LookupPRF(name string) (PRFTransform, error)
type SKKeys ¶
type SKKeys struct {
SK_d []byte // Key derivation key for Child SA KEYMAT.
SK_ai []byte // Initiator integrity key.
SK_ar []byte // Responder integrity key.
SK_ei []byte // Initiator encryption key.
SK_er []byte // Responder encryption key.
SK_pi []byte // Initiator AUTH payload key.
SK_pr []byte // Responder AUTH payload key.
}
SKKeys holds the IKE SA key hierarchy derived from SKEYSEED.
func DeriveSKKeys ¶
func DeriveSKKeys(prfID PRFID, skeyseed, ni, nr, spiI, spiR []byte, enc EncryptionTransform, integ IntegrityTransform) (*SKKeys, error)
DeriveSKKeys expands SKEYSEED into the full SK_* key hierarchy. RFC 7296 Section 2.14: {SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr} =
prf+(SKEYSEED, Ni | Nr | SPIi | SPIr).
type TransformType ¶
type TransformType uint8
RFC 7296 Section 3.3.2: Transform Type Values.
const ( TransformTypeENCR TransformType = 1 TransformTypePRF TransformType = 2 TransformTypeINTEG TransformType = 3 TransformTypeDH TransformType = 4 TransformTypeESN TransformType = 5 )
Source Files