go.bigb.es/go-bitwarden

v1.0.0
Doc Versions Source

Index

Functions

f func DecryptRSA

src 
func DecryptRSA(cs *CipherString, privKey *rsa.PrivateKey) ([]byte, error)

DecryptRSA decrypts a CipherString using an RSA private key.

f func DecryptString

src 
func DecryptString(s string, key *SymmetricKey) (string, error)

DecryptString is a convenience wrapper that decrypts a CipherString notation to a string.

f func DeriveMasterKey

src 
func DeriveMasterKey(password, email string, cfg DeriveKeyConfig) ([]byte, error)

DeriveMasterKey derives the master key from the master password and email.

f func GenerateRSAKeyPair

src 
func GenerateRSAKeyPair() (*rsa.PrivateKey, error)

GenerateRSAKeyPair generates a 2048-bit RSA key pair.

f func GenerateUserKeys

src 
func GenerateUserKeys(stretchedKey *SymmetricKey) (encSymKey string, pubKeyB64 string, encPrivKey string, err error)

GenerateUserKeys generates a new random symmetric key and RSA key pair, encrypting them with the stretched master key. Used for registration.

f func HKDFExpandSlice

src 
func HKDFExpandSlice(key, info []byte, length int) []byte

HKDFExpandSlice performs HKDF-expand using HMAC-SHA256 to derive a key of the given length. Supports multi-block expansion for lengths > 32 bytes.

f func HashMasterPassword

src 
func HashMasterPassword(masterKey []byte, password string) []byte

HashMasterPassword hashes the master key with the password for server auth. This is what gets sent to the server as the "master password hash".

f func MarshalPrivateKey

src 
func MarshalPrivateKey(key *rsa.PrivateKey) ([]byte, error)

MarshalPrivateKey marshals an RSA private key to PKCS8 DER format.

f func MarshalPublicKey

src 
func MarshalPublicKey(key *rsa.PublicKey) ([]byte, error)

MarshalPublicKey marshals an RSA public key to PKIX DER format.

f func ParsePrivateKey

src 
func ParsePrivateKey(der []byte) (*rsa.PrivateKey, error)

ParsePrivateKey parses a PKCS8 DER-encoded RSA private key.

f func StretchMasterKey

src 
func StretchMasterKey(masterKey []byte) (encKey, macKey []byte)

StretchMasterKey expands the 32-byte master key to 64 bytes (32 enc + 32 mac) using HKDF-expand with SHA256.

Types

T type CipherString

src 
type CipherString struct {
	Type EncType
	IV   []byte // nil for RSA types
	CT   []byte // ciphertext
	MAC  []byte // nil for type 0 and RSA types without HMAC
}

CipherString represents an encrypted value in Bitwarden's format.

f func EncryptRSA

src 
func EncryptRSA(plaintext []byte, pubKey *rsa.PublicKey) (*CipherString, error)

EncryptRSA encrypts plaintext with an RSA public key using OAEP-SHA1 (type 4).

f func ParseCipherString

src 
func ParseCipherString(s string) (*CipherString, error)

ParseCipherString parses a string like "2.iv_b64|ct_b64|mac_b64".

f func ParseRawCipherString

src 
func ParseRawCipherString(data []byte) (*CipherString, error)

ParseRawCipherString parses a raw binary CipherString (used for encrypted file content). Format: 1 byte type | IV (16 bytes) | MAC (32 bytes) | CT (rest)

m func (*CipherString) MarshalRaw

src 
func (cs *CipherString) MarshalRaw() []byte

MarshalRaw serializes the CipherString to raw binary format (used for file encryption). Format: 1 byte type | IV | MAC | CT

m func (*CipherString) String

src 
func (cs *CipherString) String() string

String serializes the CipherString back to its wire format.

T type DeriveKeyConfig

src 
type DeriveKeyConfig struct {
	KdfType        KdfType
	KdfIterations  int
	KdfMemory      int // Argon2id only, in MB
	KdfParallelism int // Argon2id only
}

DeriveKeyConfig holds KDF parameters returned by prelogin.

T type EncType

src 
type EncType int

EncType represents the encryption type used in a CipherString. 

const (
	EncAesCbc256_B64                     EncType = 0 // Legacy, no HMAC
	EncAesCbc128_HmacSha256_B64          EncType = 1
	EncAesCbc256_HmacSha256_B64          EncType = 2 // Standard
	EncRsa2048_OaepSha256_B64            EncType = 3
	EncRsa2048_OaepSha1_B64              EncType = 4 // Org key sharing
	EncRsa2048_OaepSha256_HmacSha256_B64 EncType = 5
	EncRsa2048_OaepSha1_HmacSha256_B64   EncType = 6
)

T type KdfType

src 
type KdfType int

KdfType represents the key derivation function type. 

const (
	KdfPBKDF2   KdfType = 0
	KdfArgon2id KdfType = 1
)

T type KeyChain

src 
type KeyChain struct {
	// contains filtered or unexported fields
}

KeyChain holds all derived keys for an authenticated session.

f func NewKeyChain

src 
func NewKeyChain(email, password string, cfg DeriveKeyConfig, protectedSymKeyStr, encPrivateKeyStr string) (*KeyChain, error)

NewKeyChain derives all keys from the master password and server-provided encrypted keys.

m func (*KeyChain) AddOrgKey

src 
func (kc *KeyChain) AddOrgKey(orgID, encOrgKeyStr string) error

AddOrgKey decrypts and stores an organization's symmetric key. The orgKey is RSA-encrypted with the user's public key.

m func (*KeyChain) Clear

src 
func (kc *KeyChain) Clear()

Clear zeros out all sensitive key material.

m func (*KeyChain) KeyForCipher

src 
func (kc *KeyChain) KeyForCipher(orgID, encCipherKey string) (*SymmetricKey, error)

KeyForCipher returns the appropriate decryption key for a cipher. If the cipher has a per-item key, it decrypts and returns that. Otherwise returns the user key (personal) or org key (organization item).

m func (*KeyChain) MasterPasswordHash

src 
func (kc *KeyChain) MasterPasswordHash(password string) string

MasterPasswordHash returns the hash to send to the server for authentication.

m func (*KeyChain) OrgKey

src 
func (kc *KeyChain) OrgKey(orgID string) *SymmetricKey

OrgKey returns the symmetric key for an organization.

m func (*KeyChain) RSAPrivateKey

src 
func (kc *KeyChain) RSAPrivateKey() *rsa.PrivateKey

RSAPrivateKey returns the user's RSA private key.

m func (*KeyChain) UserKey

src 
func (kc *KeyChain) UserKey() *SymmetricKey

UserKey returns the user's symmetric key.

T type SymmetricKey

src 
type SymmetricKey struct {
	EncKey []byte // 32 bytes
	MacKey []byte // 32 bytes
}

SymmetricKey holds a 64-byte key split into encryption and MAC halves.

f func DeriveSendKey

src 
func DeriveSendKey(sendKeyRaw []byte) (*SymmetricKey, error)

DeriveSendKey derives the encryption key for a Send from the raw send key bytes. The send key (stored encrypted in Send.Key) is expanded via HKDF to a 64-byte symmetric key (32 enc + 32 mac) using info="bitwarden-send".

f func NewSymmetricKey

src 
func NewSymmetricKey(key []byte) (*SymmetricKey, error)

NewSymmetricKey creates a SymmetricKey from a 64-byte key.

m func (*SymmetricKey) Decrypt

src 
func (sk *SymmetricKey) Decrypt(cs *CipherString) ([]byte, error)

Decrypt decrypts a CipherString using this symmetric key.

m func (*SymmetricKey) Encrypt

src 
func (sk *SymmetricKey) Encrypt(plaintext []byte) (*CipherString, error)

Encrypt encrypts plaintext with AES-256-CBC + HMAC-SHA256 (type 2).

m func (*SymmetricKey) EncryptString

src 
func (sk *SymmetricKey) EncryptString(s string) (string, error)

EncryptString is a convenience wrapper that encrypts a string and returns the CipherString notation.

Source Files