Example #1
0
// Current implements storage.Vault.
func (v *vault) Current() (*sf.KeyPair, error) {
	var keyPair sf.KeyPair
	err := v.db.View(func(tx *bolt.Tx) error {
		logBucket := tx.Bucket([]byte("log"))
		if logBucket == nil {
			return errgo.New("empty vault")
		}

		seqBytes, encBytes := logBucket.Cursor().Last()
		if seqBytes == nil {
			return errgo.New("empty vault")
		}
		seq := new(sf.Nonce)
		copy(seq[:], seqBytes)
		keyPairBytes, ok := secretbox.Open(nil, encBytes, (*[24]byte)(seq), (*[32]byte)(v.secretKey))
		if !ok {
			seq := new(big.Int)
			seq.SetBytes(seqBytes)
			return errgo.Newf("error opening key pair #%s", seq.String())
		}
		keyPair.PublicKey = new(sf.PublicKey)
		copy(keyPair.PublicKey[:], keyPairBytes[:32])
		keyPair.PrivateKey = new(sf.PrivateKey)
		copy(keyPair.PrivateKey[:], keyPairBytes[32:])
		// TODO: mprotect private key
		// TODO: zeroize keyPairBytes

		return nil
	})
	if err != nil {
		return nil, errgo.Mask(err)
	}
	return &keyPair, nil
}
Example #2
0
// Get implements storage.Vault.
func (v *vault) Get(key *sf.PublicKey) (*sf.KeyPair, error) {
	var keyPair sf.KeyPair
	err := v.db.View(func(tx *bolt.Tx) error {
		keysBucket := tx.Bucket([]byte("keys"))
		if keysBucket == nil {
			return errgo.New("empty vault")
		}
		logBucket := tx.Bucket([]byte("log"))
		if logBucket == nil {
			return errgo.New("empty vault")
		}

		seqBytes := keysBucket.Get(key[:])
		if seqBytes == nil {
			return errgo.Newf("key pair not found for %q", key.Encode())
		}
		seqInt := new(big.Int)
		seqInt.SetBytes(seqBytes)
		encBytes := logBucket.Get(seqBytes)
		if encBytes == nil {
			return errgo.Newf("missing expected key #%s", seqInt.String())
		}
		seq := new(sf.Nonce)
		copy(seq[:], seqBytes)

		keyPairBytes, ok := secretbox.Open(nil, encBytes, (*[24]byte)(seq), (*[32]byte)(v.secretKey))
		if !ok {
			return errgo.Newf("error opening key pair #%s", seqInt.String())
		}
		keyPair.PublicKey = new(sf.PublicKey)
		copy(keyPair.PublicKey[:], keyPairBytes[:32])
		keyPair.PrivateKey = new(sf.PrivateKey)
		copy(keyPair.PrivateKey[:], keyPairBytes[32:])
		// TODO: mprotect private key
		// TODO: zeroize keyPairBytes

		return nil
	})
	if err != nil {
		return nil, errgo.Mask(err)
	}
	return &keyPair, nil
}
Example #3
0
// Each implements storage.Each.
func (v *vault) Each(kpf func(keyPair *sf.KeyPair) error) error {
	err := v.db.View(func(tx *bolt.Tx) error {
		logBucket := tx.Bucket([]byte("log"))
		if logBucket == nil {
			return errgo.New("empty vault")
		}

		c := logBucket.Cursor()
		for seqBytes, encBytes := c.First(); seqBytes != nil; seqBytes, encBytes = c.Next() {
			if v == nil {
				// TODO: warning, empty value for key not expected
				continue
			}
			// TODO: mprotect private key?
			var keyPair sf.KeyPair

			seq := new(sf.Nonce)
			copy(seq[:], seqBytes)
			keyPairBytes, ok := secretbox.Open(nil, encBytes, (*[24]byte)(seq), (*[32]byte)(v.secretKey))
			if !ok {
				seq := new(big.Int)
				seq.SetBytes(seqBytes)
				return errgo.Newf("error opening key pair #%s", seq.String())
			}
			keyPair.PublicKey = new(sf.PublicKey)
			copy(keyPair.PublicKey[:], keyPairBytes[:32])
			keyPair.PrivateKey = new(sf.PrivateKey)
			copy(keyPair.PrivateKey[:], keyPairBytes[32:])

			err := kpf(&keyPair)
			if err != nil {
				return errgo.Mask(err)
			}

			// TODO: zeroize keyPairBytes
		}

		return nil
	})
	return errgo.Mask(err)
}
Example #4
0
func loadKeyPair() (*sf.KeyPair, error) {
	f, err := os.Open(*keypairFlag)
	if os.IsNotExist(err) {
		return newKeyPair()
	} else if err != nil {
		return nil, errgo.Mask(err)
	}
	defer f.Close()

	var keyPair sf.KeyPair
	keyPair.PublicKey = new(sf.PublicKey)
	keyPair.PrivateKey = new(sf.PrivateKey)
	_, err = io.ReadFull(f, keyPair.PublicKey[:])
	if err != nil {
		return nil, errgo.Mask(err)
	}
	_, err = io.ReadFull(f, keyPair.PrivateKey[:])
	if err != nil {
		return nil, errgo.Mask(err)
	}
	return &keyPair, nil
}