func GenerateKey(rand io.Reader, name string) (skey, vkey string, err error)
GenerateKey generates a signer and verifier key pair for a named server. The signer key skey is private and must be kept secret.
func NewEd25519VerifierKey(name string, key ed25519.PublicKey) (string, error)
NewEd25519VerifierKey returns an encoded verifier key using the given name and Ed25519 public key.
func Sign(n *Note, signers ...Signer) ([]byte, error)
Sign signs the note with the given signers and returns the encoded message. The new signatures from signers are listed in the encoded message after the existing signatures already present in n.Sigs. If any signer uses the same key as an existing signature, the existing signature is elided from the output.
type InvalidSignatureError struct {
Name string
Hash uint32
}
An InvalidSignatureError indicates that the given key was known and the associated Verifier rejected the signature.
func (e *InvalidSignatureError) Error() string
type Note struct {
Text string // text of note
Sigs []Signature // verified signatures
UnverifiedSigs []Signature // unverified signatures
}
A Note is a text and signatures.
func Open(msg []byte, known Verifiers) (*Note, error)
Open opens and parses the message msg, checking signatures from the known verifiers.
For each signature in the message, Open calls known.Verifier to find a verifier. If known.Verifier returns a verifier and the verifier accepts the signature, Open records the signature in the returned note's Sigs field. If known.Verifier returns a verifier but the verifier rejects the signature, Open returns an InvalidSignatureError. If known.Verifier returns an UnknownVerifierError, Open records the signature in the returned note's UnverifiedSigs field. If known.Verifier returns any other error, Open returns that error.
If no known verifier has signed an otherwise valid note, Open returns an UnverifiedNoteError. In this case, the unverified note can be fetched from inside the error.
type Signature struct {
// Name and Hash give the name and key hash
// for the key that generated the signature.
Name string
Hash uint32
// Base64 records the base64-encoded signature bytes.
Base64 string
}
A Signature is a single signature found in a note.
type Signer interface {
// Name returns the server name associated with the key.
Name() string
// KeyHash returns the key hash.
KeyHash() uint32
// Sign returns a signature for the given message.
Sign(msg []byte) ([]byte, error)
}
A Signer signs messages using a specific key.
func NewSigner(skey string) (Signer, error)
NewSigner constructs a new Signer from an encoded signer key.
type UnknownVerifierError struct {
Name string
KeyHash uint32
}
An UnknownVerifierError indicates that the given key is not known. The Open function records signatures without associated verifiers as unverified signatures.
func (e *UnknownVerifierError) Error() string
type UnverifiedNoteError struct {
Note *Note
}
An UnverifiedNoteError indicates that the note successfully parsed but had no verifiable signatures.
func (e *UnverifiedNoteError) Error() string
type Verifier interface {
// Name returns the server name associated with the key.
Name() string
// KeyHash returns the key hash.
KeyHash() uint32
// Verify reports whether sig is a valid signature of msg.
Verify(msg, sig []byte) bool
}
A Verifier verifies messages signed with a specific key.
func NewVerifier(vkey string) (Verifier, error)
NewVerifier construct a new Verifier from an encoded verifier key.
type Verifiers interface {
// Verifier returns the Verifier associated with the key
// identified by the name and hash.
// If the name, hash pair is unknown, Verifier should return
// an UnknownVerifierError.
Verifier(name string, hash uint32) (Verifier, error)
}
A Verifiers is a collection of known verifier keys.
func VerifierList(list ...Verifier) Verifiers
VerifierList returns a Verifiers implementation that uses the given list of verifiers.