mirror of
https://github.com/godotengine/godot
synced 2024-09-15 22:48:13 +00:00
81064cc239
We don't use that info for anything, and it generates unnecessary diffs every time we bump the minor version (and CI failures if we forget to sync some files from opt-in modules (mono, text_server_fb).
176 lines
7.8 KiB
XML
176 lines
7.8 KiB
XML
<?xml version="1.0" encoding="UTF-8" ?>
|
|
<class name="Crypto" inherits="RefCounted" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="../class.xsd">
|
|
<brief_description>
|
|
Provides access to advanced cryptographic functionalities.
|
|
</brief_description>
|
|
<description>
|
|
The Crypto class provides access to advanced cryptographic functionalities.
|
|
Currently, this includes asymmetric key encryption/decryption, signing/verification, and generating cryptographically secure random bytes, RSA keys, HMAC digests, and self-signed [X509Certificate]s.
|
|
[codeblocks]
|
|
[gdscript]
|
|
extends Node
|
|
|
|
var crypto = Crypto.new()
|
|
var key = CryptoKey.new()
|
|
var cert = X509Certificate.new()
|
|
|
|
func _ready():
|
|
# Generate new RSA key.
|
|
key = crypto.generate_rsa(4096)
|
|
# Generate new self-signed certificate with the given key.
|
|
cert = crypto.generate_self_signed_certificate(key, "CN=mydomain.com,O=My Game Company,C=IT")
|
|
# Save key and certificate in the user folder.
|
|
key.save("user://generated.key")
|
|
cert.save("user://generated.crt")
|
|
# Encryption
|
|
var data = "Some data"
|
|
var encrypted = crypto.encrypt(key, data.to_utf8_buffer())
|
|
# Decryption
|
|
var decrypted = crypto.decrypt(key, encrypted)
|
|
# Signing
|
|
var signature = crypto.sign(HashingContext.HASH_SHA256, data.sha256_buffer(), key)
|
|
# Verifying
|
|
var verified = crypto.verify(HashingContext.HASH_SHA256, data.sha256_buffer(), signature, key)
|
|
# Checks
|
|
assert(verified)
|
|
assert(data.to_utf8_buffer() == decrypted)
|
|
[/gdscript]
|
|
[csharp]
|
|
using Godot;
|
|
using System.Diagnostics;
|
|
|
|
public partial class MyNode : Node
|
|
{
|
|
private Crypto _crypto = new Crypto();
|
|
private CryptoKey _key = new CryptoKey();
|
|
private X509Certificate _cert = new X509Certificate();
|
|
|
|
public override void _Ready()
|
|
{
|
|
// Generate new RSA key.
|
|
_key = _crypto.GenerateRsa(4096);
|
|
// Generate new self-signed certificate with the given key.
|
|
_cert = _crypto.GenerateSelfSignedCertificate(_key, "CN=mydomain.com,O=My Game Company,C=IT");
|
|
// Save key and certificate in the user folder.
|
|
_key.Save("user://generated.key");
|
|
_cert.Save("user://generated.crt");
|
|
// Encryption
|
|
string data = "Some data";
|
|
byte[] encrypted = _crypto.Encrypt(_key, data.ToUtf8Buffer());
|
|
// Decryption
|
|
byte[] decrypted = _crypto.Decrypt(_key, encrypted);
|
|
// Signing
|
|
byte[] signature = _crypto.Sign(HashingContext.HashType.Sha256, Data.Sha256Buffer(), _key);
|
|
// Verifying
|
|
bool verified = _crypto.Verify(HashingContext.HashType.Sha256, Data.Sha256Buffer(), signature, _key);
|
|
// Checks
|
|
Debug.Assert(verified);
|
|
Debug.Assert(data.ToUtf8Buffer() == decrypted);
|
|
}
|
|
}
|
|
[/csharp]
|
|
[/codeblocks]
|
|
</description>
|
|
<tutorials>
|
|
</tutorials>
|
|
<methods>
|
|
<method name="constant_time_compare">
|
|
<return type="bool" />
|
|
<param index="0" name="trusted" type="PackedByteArray" />
|
|
<param index="1" name="received" type="PackedByteArray" />
|
|
<description>
|
|
Compares two [PackedByteArray]s for equality without leaking timing information in order to prevent timing attacks.
|
|
See [url=https://paragonie.com/blog/2015/11/preventing-timing-attacks-on-string-comparison-with-double-hmac-strategy]this blog post[/url] for more information.
|
|
</description>
|
|
</method>
|
|
<method name="decrypt">
|
|
<return type="PackedByteArray" />
|
|
<param index="0" name="key" type="CryptoKey" />
|
|
<param index="1" name="ciphertext" type="PackedByteArray" />
|
|
<description>
|
|
Decrypt the given [param ciphertext] with the provided private [param key].
|
|
[b]Note:[/b] The maximum size of accepted ciphertext is limited by the key size.
|
|
</description>
|
|
</method>
|
|
<method name="encrypt">
|
|
<return type="PackedByteArray" />
|
|
<param index="0" name="key" type="CryptoKey" />
|
|
<param index="1" name="plaintext" type="PackedByteArray" />
|
|
<description>
|
|
Encrypt the given [param plaintext] with the provided public [param key].
|
|
[b]Note:[/b] The maximum size of accepted plaintext is limited by the key size.
|
|
</description>
|
|
</method>
|
|
<method name="generate_random_bytes">
|
|
<return type="PackedByteArray" />
|
|
<param index="0" name="size" type="int" />
|
|
<description>
|
|
Generates a [PackedByteArray] of cryptographically secure random bytes with given [param size].
|
|
</description>
|
|
</method>
|
|
<method name="generate_rsa">
|
|
<return type="CryptoKey" />
|
|
<param index="0" name="size" type="int" />
|
|
<description>
|
|
Generates an RSA [CryptoKey] that can be used for creating self-signed certificates and passed to [method StreamPeerTLS.accept_stream].
|
|
</description>
|
|
</method>
|
|
<method name="generate_self_signed_certificate">
|
|
<return type="X509Certificate" />
|
|
<param index="0" name="key" type="CryptoKey" />
|
|
<param index="1" name="issuer_name" type="String" default=""CN=myserver,O=myorganisation,C=IT"" />
|
|
<param index="2" name="not_before" type="String" default=""20140101000000"" />
|
|
<param index="3" name="not_after" type="String" default=""20340101000000"" />
|
|
<description>
|
|
Generates a self-signed [X509Certificate] from the given [CryptoKey] and [param issuer_name]. The certificate validity will be defined by [param not_before] and [param not_after] (first valid date and last valid date). The [param issuer_name] must contain at least "CN=" (common name, i.e. the domain name), "O=" (organization, i.e. your company name), "C=" (country, i.e. 2 lettered ISO-3166 code of the country the organization is based in).
|
|
A small example to generate an RSA key and a X509 self-signed certificate.
|
|
[codeblocks]
|
|
[gdscript]
|
|
var crypto = Crypto.new()
|
|
# Generate 4096 bits RSA key.
|
|
var key = crypto.generate_rsa(4096)
|
|
# Generate self-signed certificate using the given key.
|
|
var cert = crypto.generate_self_signed_certificate(key, "CN=example.com,O=A Game Company,C=IT")
|
|
[/gdscript]
|
|
[csharp]
|
|
var crypto = new Crypto();
|
|
// Generate 4096 bits RSA key.
|
|
CryptoKey key = crypto.GenerateRsa(4096);
|
|
// Generate self-signed certificate using the given key.
|
|
X509Certificate cert = crypto.GenerateSelfSignedCertificate(key, "CN=mydomain.com,O=My Game Company,C=IT");
|
|
[/csharp]
|
|
[/codeblocks]
|
|
</description>
|
|
</method>
|
|
<method name="hmac_digest">
|
|
<return type="PackedByteArray" />
|
|
<param index="0" name="hash_type" type="int" enum="HashingContext.HashType" />
|
|
<param index="1" name="key" type="PackedByteArray" />
|
|
<param index="2" name="msg" type="PackedByteArray" />
|
|
<description>
|
|
Generates an [url=https://en.wikipedia.org/wiki/HMAC]HMAC[/url] digest of [param msg] using [param key]. The [param hash_type] parameter is the hashing algorithm that is used for the inner and outer hashes.
|
|
Currently, only [constant HashingContext.HASH_SHA256] and [constant HashingContext.HASH_SHA1] are supported.
|
|
</description>
|
|
</method>
|
|
<method name="sign">
|
|
<return type="PackedByteArray" />
|
|
<param index="0" name="hash_type" type="int" enum="HashingContext.HashType" />
|
|
<param index="1" name="hash" type="PackedByteArray" />
|
|
<param index="2" name="key" type="CryptoKey" />
|
|
<description>
|
|
Sign a given [param hash] of type [param hash_type] with the provided private [param key].
|
|
</description>
|
|
</method>
|
|
<method name="verify">
|
|
<return type="bool" />
|
|
<param index="0" name="hash_type" type="int" enum="HashingContext.HashType" />
|
|
<param index="1" name="hash" type="PackedByteArray" />
|
|
<param index="2" name="signature" type="PackedByteArray" />
|
|
<param index="3" name="key" type="CryptoKey" />
|
|
<description>
|
|
Verify that a given [param signature] for [param hash] of type [param hash_type] against the provided public [param key].
|
|
</description>
|
|
</method>
|
|
</methods>
|
|
</class>
|