Table of Contents

Class Crypto

Provides access to advanced cryptographic functionalities.

Inheritance
Crypto

Remarks

The Crypto class provides access to advanced cryptographic functionalities.

Currently, this includes asymmetric key encryption/decryption, signing/verification, and generating cryptographically secure random bytes, RSA keys, HMAC digests, and self-signed X509Certificates.

var crypto = Crypto.new()

# Generate new RSA key.
var key = crypto.generate_rsa(4096)

# Generate new self-signed certificate with the given key.
var cert = crypto.generate_self_signed_certificate(key, "CN=mydomain.com,O=My Game Company,C=IT")

# Save key and certificate in the user folder.
key.save("user://generated.key")
cert.save("user://generated.crt")

# Encryption
var data = "Some data"
var encrypted = crypto.encrypt(key, data.to_utf8_buffer())

# Decryption
var decrypted = crypto.decrypt(key, encrypted)

# Signing
var signature = crypto.sign(HashingContext.HASH_SHA256, data.sha256_buffer(), key)

# Verifying
var verified = crypto.verify(HashingContext.HASH_SHA256, data.sha256_buffer(), signature, key)

# Checks
assert(verified)
assert(data.to_utf8_buffer() == decrypted)

Methods

constant_time_compare(PackedByteArray, PackedByteArray)

Compares two PackedByteArrays for equality without leaking timing information in order to prevent timing attacks.

See this blog post for more information.

bool constant_time_compare(PackedByteArray trusted, PackedByteArray received)

Parameters

trusted PackedByteArray
received PackedByteArray

decrypt(CryptoKey, PackedByteArray)

Decrypt the given ciphertext with the provided private key.

Note: The maximum size of accepted ciphertext is limited by the key size.

PackedByteArray decrypt(CryptoKey key, PackedByteArray ciphertext)

Parameters

key CryptoKey
ciphertext PackedByteArray

encrypt(CryptoKey, PackedByteArray)

Encrypt the given plaintext with the provided public key.

Note: The maximum size of accepted plaintext is limited by the key size.

PackedByteArray encrypt(CryptoKey key, PackedByteArray plaintext)

Parameters

key CryptoKey
plaintext PackedByteArray

generate_random_bytes(int)

Generates a PackedByteArray of cryptographically secure random bytes with given size.

PackedByteArray generate_random_bytes(int size)

Parameters

size int

generate_rsa(int)

Generates an RSA CryptoKey that can be used for creating self-signed certificates and passed to StreamPeerTLS.accept_stream.

CryptoKey generate_rsa(int size)

Parameters

size int

generate_self_signed_certificate(CryptoKey, String, String, String)

Generates a self-signed X509Certificate from the given CryptoKey and issuer_name. The certificate validity will be defined by not_before and not_after (first valid date and last valid date). The issuer_name must contain at least "CN=" (common name, i.e. the domain name), "O=" (organization, i.e. your company name), "C=" (country, i.e. 2 lettered ISO-3166 code of the country the organization is based in).

A small example to generate an RSA key and an X509 self-signed certificate.

var crypto = Crypto.new()
# Generate 4096 bits RSA key.
var key = crypto.generate_rsa(4096)
# Generate self-signed certificate using the given key.
var cert = crypto.generate_self_signed_certificate(key, "CN=example.com,O=A Game Company,C=IT")


X509Certificate generate_self_signed_certificate(CryptoKey key, String issuer_name, String not_before, String not_after)

Parameters

key CryptoKey
issuer_name String
not_before String
not_after String

hmac_digest(int, PackedByteArray, PackedByteArray)

Generates an HMAC digest of msg using key. The hash_type parameter is the hashing algorithm that is used for the inner and outer hashes.

Currently, only HashingContext.HASH_SHA256 and HashingContext.HASH_SHA1 are supported.

PackedByteArray hmac_digest(int hash_type, PackedByteArray key, PackedByteArray msg)

Parameters

hash_type int
key PackedByteArray
msg PackedByteArray

sign(int, PackedByteArray, CryptoKey)

Sign a given hash of type hash_type with the provided private key.

PackedByteArray sign(int hash_type, PackedByteArray hash, CryptoKey key)

Parameters

hash_type int
hash PackedByteArray
key CryptoKey

verify(int, PackedByteArray, PackedByteArray, CryptoKey)

Verify that a given signature for hash of type hash_type against the provided public key.

bool verify(int hash_type, PackedByteArray hash, PackedByteArray signature, CryptoKey key)

Parameters

hash_type int
hash PackedByteArray
signature PackedByteArray
key CryptoKey