box.go 3.2 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586
  1. // Copyright 2012 The Go Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style
  3. // license that can be found in the LICENSE file.
  4. /*
  5. Package box authenticates and encrypts messages using public-key cryptography.
  6. Box uses Curve25519, XSalsa20 and Poly1305 to encrypt and authenticate
  7. messages. The length of messages is not hidden.
  8. It is the caller's responsibility to ensure the uniqueness of nonces—for
  9. example, by using nonce 1 for the first message, nonce 2 for the second
  10. message, etc. Nonces are long enough that randomly generated nonces have
  11. negligible risk of collision.
  12. This package is interoperable with NaCl: https://nacl.cr.yp.to/box.html.
  13. */
  14. package box // import "golang.org/x/crypto/nacl/box"
  15. import (
  16. "io"
  17. "golang.org/x/crypto/curve25519"
  18. "golang.org/x/crypto/nacl/secretbox"
  19. "golang.org/x/crypto/salsa20/salsa"
  20. )
  21. // Overhead is the number of bytes of overhead when boxing a message.
  22. const Overhead = secretbox.Overhead
  23. // GenerateKey generates a new public/private key pair suitable for use with
  24. // Seal and Open.
  25. func GenerateKey(rand io.Reader) (publicKey, privateKey *[32]byte, err error) {
  26. publicKey = new([32]byte)
  27. privateKey = new([32]byte)
  28. _, err = io.ReadFull(rand, privateKey[:])
  29. if err != nil {
  30. publicKey = nil
  31. privateKey = nil
  32. return
  33. }
  34. curve25519.ScalarBaseMult(publicKey, privateKey)
  35. return
  36. }
  37. var zeros [16]byte
  38. // Precompute calculates the shared key between peersPublicKey and privateKey
  39. // and writes it to sharedKey. The shared key can be used with
  40. // OpenAfterPrecomputation and SealAfterPrecomputation to speed up processing
  41. // when using the same pair of keys repeatedly.
  42. func Precompute(sharedKey, peersPublicKey, privateKey *[32]byte) {
  43. curve25519.ScalarMult(sharedKey, privateKey, peersPublicKey)
  44. salsa.HSalsa20(sharedKey, &zeros, sharedKey, &salsa.Sigma)
  45. }
  46. // Seal appends an encrypted and authenticated copy of message to out, which
  47. // will be Overhead bytes longer than the original and must not overlap. The
  48. // nonce must be unique for each distinct message for a given pair of keys.
  49. func Seal(out, message []byte, nonce *[24]byte, peersPublicKey, privateKey *[32]byte) []byte {
  50. var sharedKey [32]byte
  51. Precompute(&sharedKey, peersPublicKey, privateKey)
  52. return secretbox.Seal(out, message, nonce, &sharedKey)
  53. }
  54. // SealAfterPrecomputation performs the same actions as Seal, but takes a
  55. // shared key as generated by Precompute.
  56. func SealAfterPrecomputation(out, message []byte, nonce *[24]byte, sharedKey *[32]byte) []byte {
  57. return secretbox.Seal(out, message, nonce, sharedKey)
  58. }
  59. // Open authenticates and decrypts a box produced by Seal and appends the
  60. // message to out, which must not overlap box. The output will be Overhead
  61. // bytes smaller than box.
  62. func Open(out, box []byte, nonce *[24]byte, peersPublicKey, privateKey *[32]byte) ([]byte, bool) {
  63. var sharedKey [32]byte
  64. Precompute(&sharedKey, peersPublicKey, privateKey)
  65. return secretbox.Open(out, box, nonce, &sharedKey)
  66. }
  67. // OpenAfterPrecomputation performs the same actions as Open, but takes a
  68. // shared key as generated by Precompute.
  69. func OpenAfterPrecomputation(out, box []byte, nonce *[24]byte, sharedKey *[32]byte) ([]byte, bool) {
  70. return secretbox.Open(out, box, nonce, sharedKey)
  71. }