Crypto

Inherits: Reference < Object

Access to advanced cryptographic functionalities.

Description

The Crypto class allows you to access some more advanced cryptographic functionalities in Godot.

For now, this includes generating cryptographically secure random bytes, RSA keys and self-signed X509 certificates generation, asymmetric key encryption/decryption, and signing/verification.

  1. extends Node
  2. var crypto = Crypto.new()
  3. var key = CryptoKey.new()
  4. var cert = X509Certificate.new()
  5. func _ready():
  6. # Generate new RSA key.
  7. key = crypto.generate_rsa(4096)
  8. # Generate new self-signed certificate with the given key.
  9. cert = crypto.generate_self_signed_certificate(key, "CN=mydomain.com,O=My Game Company,C=IT")
  10. # Save key and certificate in the user folder.
  11. key.save("user://generated.key")
  12. cert.save("user://generated.crt")
  13. # Encryption
  14. var data = "Some data"
  15. var encrypted = crypto.encrypt(key, data.to_utf8())
  16. # Decryption
  17. var decrypted = crypto.decrypt(key, encrypted)
  18. # Signing
  19. var signature = crypto.sign(HashingContext.HASH_SHA256, data.sha256_buffer(), key)
  20. # Verifying
  21. var verified = crypto.verify(HashingContext.HASH_SHA256, data.sha256_buffer(), signature, key)
  22. # Checks
  23. assert(verified)
  24. assert(data.to_utf8() == decrypted)

Note: Not available in HTML5 exports.

Methods

bool

constant_time_compare ( PoolByteArray trusted, PoolByteArray received )

PoolByteArray

decrypt ( CryptoKey key, PoolByteArray ciphertext )

PoolByteArray

encrypt ( CryptoKey key, PoolByteArray plaintext )

PoolByteArray

generate_random_bytes ( int size )

CryptoKey

generate_rsa ( int size )

X509Certificate

generate_self_signed_certificate ( CryptoKey key, String issuer_name=”CN=myserver,O=myorganisation,C=IT”, String not_before=”20140101000000”, String not_after=”20340101000000” )

PoolByteArray

hmac_digest ( HashType hash_type, PoolByteArray key, PoolByteArray msg )

PoolByteArray

sign ( HashType hash_type, PoolByteArray hash, CryptoKey key )

bool

verify ( HashType hash_type, PoolByteArray hash, PoolByteArray signature, CryptoKey key )

Method Descriptions

Compares two PoolByteArrays for equality without leaking timing information in order to prevent timing attacks.

See this blog post for more information.


Decrypt the given ciphertext with the provided private key.

Note: The maximum size of accepted ciphertext is limited by the key size.


Encrypt the given plaintext with the provided public key.

Note: The maximum size of accepted plaintext is limited by the key size.


Generates a PoolByteArray of cryptographically secure random bytes with given size.


Generates an RSA CryptoKey that can be used for creating self-signed certificates and passed to StreamPeerSSL.accept_stream.


Generates a self-signed X509Certificate from the given CryptoKey and issuer_name. The certificate validity will be defined by not_before and not_after (first valid date and last valid date). The issuer_name must contain at least “CN=” (common name, i.e. the domain name), “O=” (organization, i.e. your company name), “C=” (country, i.e. 2 lettered ISO-3166 code of the country the organization is based in).

A small example to generate an RSA key and a X509 self-signed certificate.

  1. var crypto = Crypto.new()
  2. # Generate 4096 bits RSA key.
  3. var key = crypto.generate_rsa(4096)
  4. # Generate self-signed certificate using the given key.
  5. var cert = crypto.generate_self_signed_certificate(key, "CN=example.com,O=A Game Company,C=IT")

Generates an HMAC digest of msg using key. The hash_type parameter is the hashing algorithm that is used for the inner and outer hashes.

Currently, only HashingContext.HASH_SHA256 and HashingContext.HASH_SHA1 are supported.


Sign a given hash of type hash_type with the provided private key.


Verify that a given signature for hash of type hash_type against the provided public key.