b68dd2e189
This makes it easier to spot syntax errors when editing the class reference. The schema is referenced locally so validation can still work offline. Each class XML's schema conformance is also checked on GitHub Actions.
175 lines
8.0 KiB
XML
175 lines
8.0 KiB
XML
<?xml version="1.0" encoding="UTF-8" ?>
|
|
<class name="Crypto" inherits="RefCounted" version="4.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="../class.xsd">
|
|
<brief_description>
|
|
Access to advanced cryptographic functionalities.
|
|
</brief_description>
|
|
<description>
|
|
The Crypto class allows you to access some more advanced cryptographic functionalities in Godot.
|
|
For now, this includes generating cryptographically secure random bytes, RSA keys and self-signed X509 certificates generation, asymmetric key encryption/decryption, and signing/verification.
|
|
[codeblocks]
|
|
[gdscript]
|
|
extends Node
|
|
var crypto = Crypto.new()
|
|
var key = CryptoKey.new()
|
|
var cert = X509Certificate.new()
|
|
func _ready():
|
|
# Generate new RSA key.
|
|
key = crypto.generate_rsa(4096)
|
|
# Generate new self-signed certificate with the given key.
|
|
cert = crypto.generate_self_signed_certificate(key, "CN=mydomain.com,O=My Game Company,C=IT")
|
|
# Save key and certificate in the user folder.
|
|
key.save("user://generated.key")
|
|
cert.save("user://generated.crt")
|
|
# Encryption
|
|
var data = "Some data"
|
|
var encrypted = crypto.encrypt(key, data.to_utf8())
|
|
# Decryption
|
|
var decrypted = crypto.decrypt(key, encrypted)
|
|
# Signing
|
|
var signature = crypto.sign(HashingContext.HASH_SHA256, data.sha256_buffer(), key)
|
|
# Verifying
|
|
var verified = crypto.verify(HashingContext.HASH_SHA256, data.sha256_buffer(), signature, key)
|
|
# Checks
|
|
assert(verified)
|
|
assert(data.to_utf8() == decrypted)
|
|
[/gdscript]
|
|
[csharp]
|
|
using Godot;
|
|
using System;
|
|
using System.Diagnostics;
|
|
|
|
public class CryptoNode : Node
|
|
{
|
|
public Crypto Crypto = new Crypto();
|
|
public CryptoKey Key = new CryptoKey();
|
|
public X509Certificate Cert = new X509Certificate();
|
|
public override void _Ready()
|
|
{
|
|
// Generate new RSA key.
|
|
Key = Crypto.GenerateRsa(4096);
|
|
// Generate new self-signed certificate with the given key.
|
|
Cert = Crypto.GenerateSelfSignedCertificate(Key, "CN=mydomain.com,O=My Game Company,C=IT");
|
|
// Save key and certificate in the user folder.
|
|
Key.Save("user://generated.key");
|
|
Cert.Save("user://generated.crt");
|
|
// Encryption
|
|
string data = "Some data";
|
|
byte[] encrypted = Crypto.Encrypt(Key, data.ToUTF8());
|
|
// Decryption
|
|
byte[] decrypted = Crypto.Decrypt(Key, encrypted);
|
|
// Signing
|
|
byte[] signature = Crypto.Sign(HashingContext.HashType.Sha256, Data.SHA256Buffer(), Key);
|
|
// Verifying
|
|
bool verified = Crypto.Verify(HashingContext.HashType.Sha256, Data.SHA256Buffer(), signature, Key);
|
|
// Checks
|
|
Debug.Assert(verified);
|
|
Debug.Assert(data.ToUTF8() == decrypted);
|
|
}
|
|
}
|
|
[/csharp]
|
|
[/codeblocks]
|
|
[b]Note:[/b] Not available in HTML5 exports.
|
|
</description>
|
|
<tutorials>
|
|
</tutorials>
|
|
<methods>
|
|
<method name="constant_time_compare">
|
|
<return type="bool" />
|
|
<argument index="0" name="trusted" type="PackedByteArray" />
|
|
<argument index="1" name="received" type="PackedByteArray" />
|
|
<description>
|
|
Compares two [PackedByteArray]s for equality without leaking timing information in order to prevent timing attacks.
|
|
See [url=https://paragonie.com/blog/2015/11/preventing-timing-attacks-on-string-comparison-with-double-hmac-strategy]this blog post[/url] for more information.
|
|
</description>
|
|
</method>
|
|
<method name="decrypt">
|
|
<return type="PackedByteArray" />
|
|
<argument index="0" name="key" type="CryptoKey" />
|
|
<argument index="1" name="ciphertext" type="PackedByteArray" />
|
|
<description>
|
|
Decrypt the given [code]ciphertext[/code] with the provided private [code]key[/code].
|
|
[b]Note:[/b] The maximum size of accepted ciphertext is limited by the key size.
|
|
</description>
|
|
</method>
|
|
<method name="encrypt">
|
|
<return type="PackedByteArray" />
|
|
<argument index="0" name="key" type="CryptoKey" />
|
|
<argument index="1" name="plaintext" type="PackedByteArray" />
|
|
<description>
|
|
Encrypt the given [code]plaintext[/code] with the provided public [code]key[/code].
|
|
[b]Note:[/b] The maximum size of accepted plaintext is limited by the key size.
|
|
</description>
|
|
</method>
|
|
<method name="generate_random_bytes">
|
|
<return type="PackedByteArray" />
|
|
<argument index="0" name="size" type="int" />
|
|
<description>
|
|
Generates a [PackedByteArray] of cryptographically secure random bytes with given [code]size[/code].
|
|
</description>
|
|
</method>
|
|
<method name="generate_rsa">
|
|
<return type="CryptoKey" />
|
|
<argument index="0" name="size" type="int" />
|
|
<description>
|
|
Generates an RSA [CryptoKey] that can be used for creating self-signed certificates and passed to [method StreamPeerSSL.accept_stream].
|
|
</description>
|
|
</method>
|
|
<method name="generate_self_signed_certificate">
|
|
<return type="X509Certificate" />
|
|
<argument index="0" name="key" type="CryptoKey" />
|
|
<argument index="1" name="issuer_name" type="String" default=""CN=myserver,O=myorganisation,C=IT"" />
|
|
<argument index="2" name="not_before" type="String" default=""20140101000000"" />
|
|
<argument index="3" name="not_after" type="String" default=""20340101000000"" />
|
|
<description>
|
|
Generates a self-signed [X509Certificate] from the given [CryptoKey] and [code]issuer_name[/code]. The certificate validity will be defined by [code]not_before[/code] and [code]not_after[/code] (first valid date and last valid date). The [code]issuer_name[/code] must contain at least "CN=" (common name, i.e. the domain name), "O=" (organization, i.e. your company name), "C=" (country, i.e. 2 lettered ISO-3166 code of the country the organization is based in).
|
|
A small example to generate an RSA key and a X509 self-signed certificate.
|
|
[codeblocks]
|
|
[gdscript]
|
|
var crypto = Crypto.new()
|
|
# Generate 4096 bits RSA key.
|
|
var key = crypto.generate_rsa(4096)
|
|
# Generate self-signed certificate using the given key.
|
|
var cert = crypto.generate_self_signed_certificate(key, "CN=example.com,O=A Game Company,C=IT")
|
|
[/gdscript]
|
|
[csharp]
|
|
var crypto = new Crypto();
|
|
// Generate 4096 bits RSA key.
|
|
CryptoKey key = crypto.GenerateRsa(4096);
|
|
// Generate self-signed certificate using the given key.
|
|
X509Certificate cert = crypto.GenerateSelfSignedCertificate(key, "CN=mydomain.com,O=My Game Company,C=IT");
|
|
[/csharp]
|
|
[/codeblocks]
|
|
</description>
|
|
</method>
|
|
<method name="hmac_digest">
|
|
<return type="PackedByteArray" />
|
|
<argument index="0" name="hash_type" type="int" enum="HashingContext.HashType" />
|
|
<argument index="1" name="key" type="PackedByteArray" />
|
|
<argument index="2" name="msg" type="PackedByteArray" />
|
|
<description>
|
|
Generates an [url=https://en.wikipedia.org/wiki/HMAC]HMAC[/url] digest of [code]msg[/code] using [code]key[/code]. The [code]hash_type[/code] parameter is the hashing algorithm that is used for the inner and outer hashes.
|
|
Currently, only [constant HashingContext.HASH_SHA256] and [constant HashingContext.HASH_SHA1] are supported.
|
|
</description>
|
|
</method>
|
|
<method name="sign">
|
|
<return type="PackedByteArray" />
|
|
<argument index="0" name="hash_type" type="int" enum="HashingContext.HashType" />
|
|
<argument index="1" name="hash" type="PackedByteArray" />
|
|
<argument index="2" name="key" type="CryptoKey" />
|
|
<description>
|
|
Sign a given [code]hash[/code] of type [code]hash_type[/code] with the provided private [code]key[/code].
|
|
</description>
|
|
</method>
|
|
<method name="verify">
|
|
<return type="bool" />
|
|
<argument index="0" name="hash_type" type="int" enum="HashingContext.HashType" />
|
|
<argument index="1" name="hash" type="PackedByteArray" />
|
|
<argument index="2" name="signature" type="PackedByteArray" />
|
|
<argument index="3" name="key" type="CryptoKey" />
|
|
<description>
|
|
Verify that a given [code]signature[/code] for [code]hash[/code] of type [code]hash_type[/code] against the provided public [code]key[/code].
|
|
</description>
|
|
</method>
|
|
</methods>
|
|
</class>
|