go/libkb/generickey.go - master - githubmirror/client

go/libkb/generickey.go
117 строк3 KB
chrisnojima-zoom
Version 670 - clean2 (#29122)
08 июн 2026, 19:31
08 июн 2026, 19:311943197
// Copyright 2015 Keybase, Inc. All rights reserved. Use of
// this source code is governed by the included BSD license.

package libkb

import (
	"strings"

	"github.com/keybase/client/go/kbcrypto"
	keybase1 "github.com/keybase/client/go/protocol/keybase1"
)

type VerifyContext interface {
	Debug(format string, args ...any)
}

type (
	RawPublicKey  []byte
	RawPrivateKey []byte
)

type GenericKey interface {
	GetKID() keybase1.KID
	GetBinaryKID() keybase1.BinaryKID
	GetAlgoType() kbcrypto.AlgoType

	// Sign to an ASCII signature (which includes the message
	// itself) and return it, along with a derived ID.
	SignToString(msg []byte) (sig string, id keybase1.SigIDBase, err error)

	// Verify that the given signature is valid and extracts the
	// embedded message from it. Also returns the signature ID.
	VerifyStringAndExtract(ctx VerifyContext, sig string) (msg []byte, id keybase1.SigIDBase, err error)

	// Verify that the given signature is valid and that its
	// embedded message matches the given one. Also returns the
	// signature ID.
	VerifyString(ctx VerifyContext, sig string, msg []byte) (id keybase1.SigIDBase, err error)

	// Encrypt to an ASCII armored encryption; optionally include a sender's
	// (private) key so that we can provably see who sent the message.
	EncryptToString(plaintext []byte, sender GenericKey) (ciphertext string, err error)

	// Decrypt the output of Encrypt above; provide the plaintext and also
	// the KID of the key that sent the message (if applicable).
	DecryptFromString(ciphertext string) (msg []byte, sender keybase1.KID, err error)

	// Derive a secret key from a DH secret key
	SecretSymmetricKey(reason EncryptionReason) (NaclSecretBoxKey, error)

	VerboseDescription() string
	CheckSecretKey() error
	CanSign() bool
	CanEncrypt() bool
	CanDecrypt() bool
	HasSecretKey() bool
	Encode() (string, error) // encode public key to string

	// ExportPublicAndPrivate to special-purpose types so there is no way we can
	// accidentally reverse them.
	ExportPublicAndPrivate() (public RawPublicKey, private RawPrivateKey, err error)
}

func CanEncrypt(key GenericKey) bool {
	switch key.(type) {
	case NaclDHKeyPair:
		return true
	case *PGPKeyBundle:
		return true
	default:
		return false
	}
}

func skbPushAndSave(m MetaContext, skb *SKB) (err error) {
	defer m.Trace("skbPushAndSave", &err)()
	ring, err := m.Keyring()
	if err != nil {
		return err
	}
	err = ring.PushAndSave(skb)
	if err != nil {
		return err
	}
	return nil
}

// Any valid key matches the empty string.
func KeyMatchesQuery(key GenericKey, q string, exact bool) bool {
	if key.GetKID().Match(q, exact) {
		return true
	}
	return GetPGPFingerprintFromGenericKey(key).Match(q, exact)
}

func IsPGP(key GenericKey) bool {
	_, ok := key.(*PGPKeyBundle)
	return ok
}

func ParseGenericKey(bundle string) (GenericKey, *Warnings, error) {
	if isPGPBundle(bundle) {
		// PGP key
		return ReadOneKeyFromStringLiberal(bundle)
	}
	// NaCl key
	key, err := ImportKeypairFromKID(keybase1.KIDFromString(bundle))
	return key, &Warnings{}, err
}

func isPGPBundle(armored string) bool {
	return strings.HasPrefix(armored, "-----BEGIN PGP")
}

func GenericKeyEqual(k1, k2 GenericKey) bool {
	return k1.GetKID().Equal(k2.GetKID())
}