Attention: Here be dragons

This is the latest (unstable) version of this documentation, which may document features not available in or compatible with released stable versions of Godot.

Checking the stable version of the documentation...

Crypto¶

Inherits: RefCounted < Object

Provides access to advanced cryptographic functionalities.

描述¶

The Crypto class provides access to advanced cryptographic functionalities.

Currently, this includes asymmetric key encryption/decryption, signing/verification, and generating cryptographically secure random bytes, RSA keys, HMAC digests, and self-signed X509Certificates.

extends Node

var crypto = Crypto.new()
var key = CryptoKey.new()
var cert = X509Certificate.new()

func _ready():
    # Generate new RSA key.
    key = crypto.generate_rsa(4096)
    # Generate new self-signed certificate with the given key.
    cert = crypto.generate_self_signed_certificate(key, "CN=mydomain.com,O=My Game Company,C=IT")
    # Save key and certificate in the user folder.
    key.save("user://generated.key")
    cert.save("user://generated.crt")
    # Encryption
    var data = "Some data"
    var encrypted = crypto.encrypt(key, data.to_utf8_buffer())
    # Decryption
    var decrypted = crypto.decrypt(key, encrypted)
    # Signing
    var signature = crypto.sign(HashingContext.HASH_SHA256, data.sha256_buffer(), key)
    # Verifying
    var verified = crypto.verify(HashingContext.HASH_SHA256, data.sha256_buffer(), signature, key)
    # Checks
    assert(verified)
    assert(data.to_utf8_buffer() == decrypted)

using Godot;
using System.Diagnostics;

public partial class MyNode : Node
{
    private Crypto _crypto = new Crypto();
    private CryptoKey _key = new CryptoKey();
    private X509Certificate _cert = new X509Certificate();

    public override void _Ready()
    {
        // Generate new RSA key.
        _key = _crypto.GenerateRsa(4096);
        // Generate new self-signed certificate with the given key.
        _cert = _crypto.GenerateSelfSignedCertificate(_key, "CN=mydomain.com,O=My Game Company,C=IT");
        // Save key and certificate in the user folder.
        _key.Save("user://generated.key");
        _cert.Save("user://generated.crt");
        // Encryption
        string data = "Some data";
        byte[] encrypted = _crypto.Encrypt(_key, data.ToUtf8Buffer());
        // Decryption
        byte[] decrypted = _crypto.Decrypt(_key, encrypted);
        // Signing
        byte[] signature = _crypto.Sign(HashingContext.HashType.Sha256, Data.Sha256Buffer(), _key);
        // Verifying
        bool verified = _crypto.Verify(HashingContext.HashType.Sha256, Data.Sha256Buffer(), signature, _key);
        // Checks
        Debug.Assert(verified);
        Debug.Assert(data.ToUtf8Buffer() == decrypted);
    }
}

Methods¶

bool	constant_time_compare ( PackedByteArray trusted, PackedByteArray received )
PackedByteArray	decrypt ( CryptoKey key, PackedByteArray ciphertext )
PackedByteArray	encrypt ( CryptoKey key, PackedByteArray plaintext )
PackedByteArray	generate_random_bytes ( int size )
CryptoKey	generate_rsa ( int size )
X509Certificate	generate_self_signed_certificate ( CryptoKey key, String issuer_name="CN=myserver,O=myorganisation,C=IT", String not_before="20140101000000", String not_after="20340101000000" )
PackedByteArray	hmac_digest ( HashType hash_type, PackedByteArray key, PackedByteArray msg )
PackedByteArray	sign ( HashType hash_type, PackedByteArray hash, CryptoKey key )
bool	verify ( HashType hash_type, PackedByteArray hash, PackedByteArray signature, CryptoKey key )

Method Descriptions¶

bool constant_time_compare ( PackedByteArray trusted, PackedByteArray received )

Compares two PackedByteArrays for equality without leaking timing information in order to prevent timing attacks.

See this blog post for more information.

PackedByteArray decrypt ( CryptoKey key, PackedByteArray ciphertext )

Decrypt the given ciphertext with the provided private key.

Note: The maximum size of accepted ciphertext is limited by the key size.

PackedByteArray encrypt ( CryptoKey key, PackedByteArray plaintext )

Encrypt the given plaintext with the provided public key.

Note: The maximum size of accepted plaintext is limited by the key size.

PackedByteArray generate_random_bytes ( int size )

Generates a PackedByteArray of cryptographically secure random bytes with given size.

CryptoKey generate_rsa ( int size )

Generates an RSA CryptoKey that can be used for creating self-signed certificates and passed to StreamPeerTLS.accept_stream.

X509Certificate generate_self_signed_certificate ( CryptoKey key, String issuer_name="CN=myserver,O=myorganisation,C=IT", String not_before="20140101000000", String not_after="20340101000000" )

Generates a self-signed X509Certificate from the given CryptoKey and issuer_name. The certificate validity will be defined by not_before and not_after (first valid date and last valid date). The issuer_name must contain at least "CN=" (common name, i.e. the domain name), "O=" (organization, i.e. your company name), "C=" (country, i.e. 2 lettered ISO-3166 code of the country the organization is based in).

A small example to generate an RSA key and a X509 self-signed certificate.

var crypto = Crypto.new()
# Generate 4096 bits RSA key.
var key = crypto.generate_rsa(4096)
# Generate self-signed certificate using the given key.
var cert = crypto.generate_self_signed_certificate(key, "CN=example.com,O=A Game Company,C=IT")

var crypto = new Crypto();
// Generate 4096 bits RSA key.
CryptoKey key = crypto.GenerateRsa(4096);
// Generate self-signed certificate using the given key.
X509Certificate cert = crypto.GenerateSelfSignedCertificate(key, "CN=mydomain.com,O=My Game Company,C=IT");

PackedByteArray hmac_digest ( HashType hash_type, PackedByteArray key, PackedByteArray msg )

Generates an HMAC digest of msg using key. The hash_type parameter is the hashing algorithm that is used for the inner and outer hashes.

Currently, only HashingContext.HASH_SHA256 and HashingContext.HASH_SHA1 are supported.

PackedByteArray sign ( HashType hash_type, PackedByteArray hash, CryptoKey key )

Sign a given hash of type hash_type with the provided private key.

bool verify ( HashType hash_type, PackedByteArray hash, PackedByteArray signature, CryptoKey key )

Verify that a given signature for hash of type hash_type against the provided public key.