feat(tdf): implement tdf3 encrypt and decrypt

go.mod

@@ -8,6 +8,8 @@ require (
 	github.com/bufbuild/protovalidate-go v0.4.3
 	github.com/creasty/defaults v1.7.0
 	github.com/go-chi/cors v1.2.1
+	github.com/golang-jwt/jwt/v4 v4.5.0
+	github.com/google/uuid v1.4.0
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.1
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.1
 	github.com/jackc/pgx/v5 v5.5.0
@@ -51,7 +53,6 @@ require (
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/cel-go v0.18.2 // indirect
-	github.com/google/uuid v1.4.0 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/klauspost/compress v1.17.2 // indirect

internal/archive/tdf3_reader.go

@@ -9,8 +9,8 @@ type TDFReader struct {
 }
 
 const (
-	tdfManifestFileName = "0.manifest.json"
-	tdfPayloadFileName  = "0.payload"
+	TDFManifestFileName = "0.manifest.json"
+	TDFPayloadFileName  = "0.payload"
 )
 
 // NewTDFReader Create tdf reader instance.
@@ -28,7 +28,7 @@ func NewTDFReader(readSeeker io.ReadSeeker) (TDFReader, error) {
 
 // Manifest Return the manifest of the tdf.
 func (tdfReader TDFReader) Manifest() (string, error) {
-	fileContent, err := tdfReader.archiveReader.ReadAllFileData(tdfManifestFileName)
+	fileContent, err := tdfReader.archiveReader.ReadAllFileData(TDFManifestFileName)
 	if err != nil {
 		return "", err
 	}
@@ -37,7 +37,7 @@ func (tdfReader TDFReader) Manifest() (string, error) {
 
 // ReadPayload Return the payload of given length from index.
 func (tdfReader TDFReader) ReadPayload(index, length int64) ([]byte, error) {
-	buf, err := tdfReader.archiveReader.ReadFileData(tdfPayloadFileName, index, length)
+	buf, err := tdfReader.archiveReader.ReadFileData(TDFPayloadFileName, index, length)
 	if err != nil {
 		return nil, err
 	}
@@ -46,7 +46,7 @@ func (tdfReader TDFReader) ReadPayload(index, length int64) ([]byte, error) {
 
 // PayloadSize Return the size of the payload.
 func (tdfReader TDFReader) PayloadSize() (int64, error) {
-	size, err := tdfReader.archiveReader.ReadFileSize(tdfPayloadFileName)
+	size, err := tdfReader.archiveReader.ReadFileSize(TDFPayloadFileName)
 	if err != nil {
 		return -1, err
 	}

internal/archive/tdf3_writer.go

@@ -20,20 +20,20 @@ func (tdfWriter *TDFWriter) SetPayloadSize(payloadSize int64) error {
 		tdfWriter.archiveWriter.EnableZip64()
 	}
 
-	return tdfWriter.archiveWriter.AddHeader(tdfPayloadFileName, payloadSize)
+	return tdfWriter.archiveWriter.AddHeader(TDFPayloadFileName, payloadSize)
 }
 
-// AppendManifest Add the manifest to tdf3 archive.
+// AppendManifest Add the manifest to tdf archive.
 func (tdfWriter *TDFWriter) AppendManifest(manifest string) error {
-	err := tdfWriter.archiveWriter.AddHeader(tdfManifestFileName, int64(len(manifest)))
+	err := tdfWriter.archiveWriter.AddHeader(TDFManifestFileName, int64(len(manifest)))
 	if err != nil {
 		return err
 	}
 
 	return tdfWriter.archiveWriter.AddData([]byte(manifest))
 }
 
-// AppendPayload Add payload to tdf3 archive.
+// AppendPayload Add payload to sdk archive.
 func (tdfWriter *TDFWriter) AppendPayload(data []byte) error {
 	return tdfWriter.archiveWriter.AddData(data)
 }

internal/crypto/aes_gcm.go

@@ -31,14 +31,14 @@ func NewAESGcm(key []byte) (AesGcm, error) {
 }
 
 // Encrypt encrypts data with symmetric key.
-// NOTE: This method use nonce of 16 bytes and auth tag as aes block size(16 bytes).
+// NOTE: This method use nonce of 12 bytes and auth tag as aes block size(16 bytes).
 func (aesGcm AesGcm) Encrypt(data []byte) ([]byte, error) {
-	nonce, err := RandomBytes(DefaultNonceSize)
+	nonce, err := RandomBytes(GcmStandardNonceSize)
 	if err != nil {
 		return nil, err
 	}
 
-	gcm, err := cipher.NewGCMWithNonceSize(aesGcm.block, DefaultNonceSize)
+	gcm, err := cipher.NewGCMWithNonceSize(aesGcm.block, GcmStandardNonceSize)
 	if err != nil {
 		return nil, fmt.Errorf("cipher.NewGCMWithNonceSize failed: %w", err)
 	}
@@ -77,12 +77,12 @@ func (aesGcm AesGcm) EncryptWithIVAndTagSize(iv, data []byte, authTagSize int) (
 }
 
 // Decrypt decrypts data with symmetric key.
-// NOTE: This method use nonce of 16 bytes and auth tag as aes block size(16 bytes)
+// NOTE: This method use nonce of 12 bytes and auth tag as aes block size(16 bytes)
 // also expects IV as preamble of data.
 func (aesGcm AesGcm) Decrypt(data []byte) ([]byte, error) { // extract nonce and cipherText
-	nonce, cipherText := data[:DefaultNonceSize], data[DefaultNonceSize:]
+	nonce, cipherText := data[:GcmStandardNonceSize], data[GcmStandardNonceSize:]
 
-	gcm, err := cipher.NewGCMWithNonceSize(aesGcm.block, DefaultNonceSize)
+	gcm, err := cipher.NewGCMWithNonceSize(aesGcm.block, GcmStandardNonceSize)
 	if err != nil {
 		return nil, fmt.Errorf("cipher.NewGCMWithNonceSize failed: %w", err)
 	}

internal/crypto/aes_gcm_test.go

@@ -15,24 +15,23 @@ func TestCreateAesGcm_DecryptWithDefaults(t *testing.T) {
 	}{
 		{
 			"66af5c10753139c6161d0f0eee125bbc9545d6704d64890e396c5c8d4f4820d4",
-			"29a8b044b5b6ce00e18bc6fc78ff50c6",
-			"b3cf733137d865892e5af63dcbca08086ba1ac82aae2",
+			"d2c32fa42f97341e97a33b58",
+			"a89d8e00e3bacacc2ed13bbc602a191d60584af3a933",
 			"virtru",
 		},
 		{
 			"120fba31c537d99ade0a0a8c8e6df535f7de86fb6e1d5948317b4596982a5e1b",
-			"ec9074bc6c6b81d6520f5a7425f8977a",
-			"dabe8b28dd100eea2f58d71e3644b43d",
+			"591a6f1e947dd887d72610c8",
+			"83aaba876616c02bfaf5120c785ac92c",
 			"",
 		},
 		{
 			"9895f395913a3cfd974ea53c0735030c7df4602d699c986afdc5fdd10071c0a5",
-			"5142d90e8499f597802ca68cddb25ec1",
-			`01c1e44df776bfca60ed217e06421c7b945adaf3289849406ca5b7046c886050fe7
-2cc0ebc429f683f9cfe3a47613e2ca8a812ef9b75d361c32d042124d3dc5d84c75722521df65ed7829327b
-5adda0ae020a778b909328a48311cc705d4c0a8b83f49430aa80febba73e27e99b3006d6e768a092d5b9dc
-894e7a634235198b1a986a3624912dec108ef03055b319f59f25fc579eb08f01820ea19edc7f9896129c572
-c36440ed80fd61fc71df37`,
+			"71c291bc41aacde6e0b57e7d",
+			`7b19b61dc053c3ffeaba57195356025a05600b071a4618912917681480f1eb62afb9ecc
+ff7a90d6cba96275bd52bd8d6afa4fcbae6a400ce7033e7abd58e301ab9b4a9c3e7f4c0f55256d250faf8ce0c22bdd
+9b79654842a6186df98831289eeee66fac014390a4363034d64e44fc9a2c0e0231d69c78f0a8049d8b458579041858
+d4f6da9f39542d2287d20d19dd99db339c038e3b6e1720c97ff73adda5ca4fac7da70c7d53f97a5aa346e93af`,
 			`In cryptography, Galois/Counter Mode (GCM)[1] is a mode of operation
 for symmetric-key cryptographic block ciphers which is
 widely adopted for its performance`,

internal/crypto/asym_decryption.go

@@ -43,7 +43,7 @@ func (asymDecryption AsymDecryption) Decrypt(data []byte) ([]byte, error) {
 
 	bytes, err := asymDecryption.privateKey.Decrypt(nil,
 		data,
-		&rsa.OAEPOptions{Hash: crypto.SHA256})
+		&rsa.OAEPOptions{Hash: crypto.SHA1})
 	if err != nil {
 		return nil, fmt.Errorf("x509.ParsePKCS8PrivateKey failed: %w", err)
 	}

internal/crypto/asym_encrypt_decrypt_test.go

@@ -171,53 +171,48 @@ ufgiB73q6Fnh5QHf1HNAeMUCAwEAAQ==
 		},
 		{ // Test certificate
 			`-----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDNxPq9JCuazKAB
-0s+xTVqN2kiyDQ1OpJG08yQ7efnd5yinEyxesr008UvCo5+G5AKMbmajAY/weiry
-o2G4UVt37TyH0ODkAFS3dVDkLfh2MnwAXSppOadav1XRiYqGYjPPMRUJe/ueNewx
-XhknUm1Bn5EXgUnMS2V0XmZdAN0Fn1DxTKZvuPa50be0G+uRDWw+ZVFg1MDPt7TO
-/TScQx6ytIgfRbUMqC8dM9aVHOyfUvbdM39ZNjbyZIERSuMZJHOZdx28n7gfiScQ
-3ZqgDFQPRm0J6GDCkeXTjElD63X4P3qgrWVzAPZPuvdBiaQlfs+YQtjB345Tgg+B
-YJN/Kre5AgMBAAECggEABBDjX39qeSmX89FFl1xO8MSicRo+7BHmayvuyFoVrOPX
-cs23L7vab0RhWdw/17uDrWC1GH18aaUQWjEOSkUZSJpgetKOzxKOmf1wdsHNyhAf
-USaGIwQnoWxsdrKAET25hluS7dgMVcj8/NC+MH+5dvV/OXatjaLjw1PmM+pDc8v0
-DAGEO198w/gADYli8dQdrwFHWacklKURRhONTSXNvFmGZwB2OcrAQ+Flu5C6zAUt
-zaE+orLYUcvZvW5UjTABZ8yEQASsNh0mGddCMgKwidSG1grFrgHy3QmpJfiWR04T
-RdUJAr6si3+7/j3gXpd+aHvPcBYOrICWY8zYShr/gQKBgQDqGIsc3jHNBk8R0QCh
-f9FIDpXnZCLppsi3vxSkvR1fQgaNJfhg8OsZWyBaNO0gc0GgvUxsr2Yq6EzA6qZB
-86hCw2ykl2zWtMV+pihuxiyPsEX6GeI0ojgc5881H0yosw3HWOGQIxtq/j6xs4Kv
-CKmAsjqKMYTlERZq/mB/ACtEUQKBgQDhBeoD9NIOueHtV6cnbiJXXOO0hvnARUWX
-B3FIw9isoUIYIHhg6Fhz7aIXkIcaG9zJnAnQDiQPE1mru+FSXbb7sqvF8DwgUpNh
-c1Wu3KoWG/ll+cm8epFb//8RcsHwrU2oOn2U6SniqQEEhY11g6fXTfiB+2aR0nri
-tJKLtYBq6QKBgQCqoudMTJ5qf03Fg9582imX56HXQAO+4ubuISeQCZXOaNdTrbjG
-GPaVzfngJzIt9DWDUFjT5GqJnjjMan50FoKw37hipUodmzlWXxGb5XJ37pqjepiL
-my9hyoscgssjMRk7FQueQCjtLZRPfbUllx/PAptvPjdLrc/0f6WhDWN8cQKBgBH/
-oRoz6OFYqOONEUesHX8TZPs5mJxybgCIjd0eHSShuWGopzhJHVoYddCgtM230M8n
-dfl4SBYUnCWKX5lw+YPkZKzubEDBmhw/V2knKUufbTFk62fx/dJ4BXTl0vFnS0Db
-fNP+WmVQ004DSK9Pmos0J15uN2QOi9m6S8Z0/BKRAoGAPXVuUCakXJucjorc2Rnn
-TC4h73nhw127gNHT//V0Xok9PQkfCLyppPlhpSMQJ7IaMwIL28c4I/611CHDU8jb
-KjNDoTuL3yRqOQNz1zLub5m/+vti4+Sh0//kT5G1SjL7BWSxtGt7EvQiM6rxgihP
-Px0iQ2RGtzRV2ejyvAouYos=
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDOpiotrvV2i5h6
+clHMzDGgh3h/kMa0LoGx2OkDPd8jogycUh7pgE5GNiN2lpSmFkjxwYMXnyrwr9Ex
+yczBWJ7sRGDCDaQg5fjVUIloZ8FJVbn+sEcfQ9iX6vmI9/S++oGK79QM3V8M8cp4
+1r/T1YVmuzUHE1say/TLHGhjtGkxHDF8qFy6Z2rYFTCVJQHNqGmwNVGd0qG7gim8
+6Hawu/CMYj4jG9oITlj8rJtQOaJ6ZqemQVoNmb3j1LkyeUKzRIt+86aoBiz+T3Tf
+OEvXF6xgBj3XoiOhPYK+abFPYcrArvb6oubT8NjjQoj3j0sXWUnIIMg+e4f+XNVU
+54ZzDaLZAgMBAAECggEBALb0yK0PlMUyzHnEUwXV1y5AIoAWhsYp0qvJ1msHUVKz
++yQ/VJz4+tQQxI8OvGbbnhNkd5LnWdYkYzsIZl7b/kBCPcQw3Zo+4XLCzhUAn1E1
+M+n42c8le1LtN6Z7mVWoZh7DPONy7t+ABvm7b7S1+1i78DPmgCeWYZGeAhIcPXG6
+5AxWIV3jigxksE6kYY9Y7DmtsZgMRrdV7SU8VtgPtT7tua8z5/U3Av0WINyKBSoM
+0yDHsAg57KnM8znx2JWLtHd0Mk5bBuu2DLbtyKNrVUAUuMPzrLGBh9S9QRd934KU
+uFAi1TEfgEachnGgSHJpzVzr2ur1tifABnQ7GNXObe0CgYEA6KowK0subdDY+uGW
+ciP2XDAMerbJJeL0/UIGPb/LUmskniio2493UBGgY2FsRyvbzJ+/UAOjIPyIxhj7
+78ZyVG8BmIzKan1RRVh//O+5yvks/eTOYjWeQ1Lcgqs3q4YAO13CEBZgKWKTUomg
+mskFJq04tndeSIyhDaW+BuWaXA8CgYEA42ABz3pql+DH7oL5C4KYBymK6wFBBOqk
+dVk+ftyJQ6PzuZKpfsu4aPIjKm71lkTgK6O9o08s3SckAdu6vLukq2TZFF+a+9OI
+lu5ww7GvfdMTgLAaFchD4bPlOInh1KVjBc1MwGXpl0ROde5pi8+WUrv9QJuoQfB/
+4rhYdbJLSpcCgYA41mqSCPm8pgp7r2RbWeGzP6Gs0L5u3PTQcbKonxQCfF4jrPcj
+O/b/vm6aGJClClfVsyi/WUQeqNKY4j2Zo7cGXV/cbnh8b0TNVgNePQn8Rcbx91Vb
+tJGHDNUFruIYqtGfrxXbbDvtoEExJqHvbjAt9J8oJB0KSCCH/vdfI/QDjQKBgQCD
+xLPH5Y24js/O7aAeh4RLQkv7fTKNAt5kE2AgbPYveOhZ9yC7Fpy8VPcENGGmwCuZ
+nr7b0ZqSX4iCezBxB92aZktXf0B2CFT0AyLehi7JoHWA8o1rai/MsVB5v45ciawl
+RKDiLy18OF2wAoawO5FGSSOvOYX9EL9MSMEbFESF6QKBgCVlZ9pPC+55rGT6AcEL
+tUpDs+/wZvcmfsFd8xC5mMUN0DatAVzVAUI95+tQaWU3Uj+bqHq0lC6Wy2VceG0D
+D+7EicjdGFN/2WVPXiYX1fblkxasZY+wChYBrPLjA9g0qOzzmXbRBph5QxDuQjJ6
+qcddVKB624a93ZBssn7OivnR
 -----END PRIVATE KEY-----`,
 			`-----BEGIN CERTIFICATE-----
-MIIDazCCAlOgAwIBAgIUUySK3aFhC08WO9hOMq19tFurxeUwDQYJKoZIhvcNAQEL
-BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
-GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMzEyMTIxODQzNDZaFw0yNDEy
-MTExODQzNDZaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
-HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
-AQUAA4IBDwAwggEKAoIBAQDNxPq9JCuazKAB0s+xTVqN2kiyDQ1OpJG08yQ7efnd
-5yinEyxesr008UvCo5+G5AKMbmajAY/weiryo2G4UVt37TyH0ODkAFS3dVDkLfh2
-MnwAXSppOadav1XRiYqGYjPPMRUJe/ueNewxXhknUm1Bn5EXgUnMS2V0XmZdAN0F
-n1DxTKZvuPa50be0G+uRDWw+ZVFg1MDPt7TO/TScQx6ytIgfRbUMqC8dM9aVHOyf
-UvbdM39ZNjbyZIERSuMZJHOZdx28n7gfiScQ3ZqgDFQPRm0J6GDCkeXTjElD63X4
-P3qgrWVzAPZPuvdBiaQlfs+YQtjB345Tgg+BYJN/Kre5AgMBAAGjUzBRMB0GA1Ud
-DgQWBBTV1245NzOOCFSsUwWAsKdC/9fEnDAfBgNVHSMEGDAWgBTV1245NzOOCFSs
-UwWAsKdC/9fEnDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAU
-mJ6wTM0nlDfewYSOl6vkVHwL1LIXVEPnBhAAa3Hax9wtvUK+Tbg+7D3l7/Iq5Y/+
-UsHa/BQ9lktj/v2DAsaTVcO33IIyPrz1NCzB44hv+3G5HzUwKgDTY5tN8SCmy+Ti
-rx3c0AOqCfpKmuRhzYLbaHjbj7jwCzdelJr318x2dVOGXB5J1yWQ3TfKKicWqA+9
-pDtPNFJ3M79YVI+84gUN6YAeM0edJWOpZRoxui3DvzINVAd3W+p3v+HYc6d+SRTw
-Ac3Yy7hVSJCQjkgYm4dWNDSWFFz5TYkASjQiXhEyvofS37lf6p6qm77CAr/xfdKx
-rfa3TMt0K2Gs502yHMD4
+MIICmDCCAYACCQC3BCaSANRhYzANBgkqhkiG9w0BAQsFADAOMQwwCgYDVQQDDANr
+YXMwHhcNMjEwOTE1MTQxMTQ4WhcNMjIwOTE1MTQxMTQ4WjAOMQwwCgYDVQQDDANr
+YXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOpiotrvV2i5h6clHM
+zDGgh3h/kMa0LoGx2OkDPd8jogycUh7pgE5GNiN2lpSmFkjxwYMXnyrwr9ExyczB
+WJ7sRGDCDaQg5fjVUIloZ8FJVbn+sEcfQ9iX6vmI9/S++oGK79QM3V8M8cp41r/T
+1YVmuzUHE1say/TLHGhjtGkxHDF8qFy6Z2rYFTCVJQHNqGmwNVGd0qG7gim86Haw
+u/CMYj4jG9oITlj8rJtQOaJ6ZqemQVoNmb3j1LkyeUKzRIt+86aoBiz+T3TfOEvX
+F6xgBj3XoiOhPYK+abFPYcrArvb6oubT8NjjQoj3j0sXWUnIIMg+e4f+XNVU54Zz
+DaLZAgMBAAEwDQYJKoZIhvcNAQELBQADggEBABewfZOJ4/KNRE8IQ5TsW/AVn7C1
+l5ty6tUUBSVi8/df7WYts0bHEdQh9yl9agEU5i4rj43y8vMVZNzSeHcurtV/+C0j
+fbkHQHeiQ1xn7cq3Sbh4UVRyuu4C5PklEH4AN6gxmgXC3kT15uWw8I4nm/plzYLs
+I099IoRfC5djHUYYLMU/VkOIHuPC3sb7J65pSN26eR8bTMVNagk187V/xNwUuvkf
++NUxDO615/5BwQKnAu5xiIVagYnDZqKCOtYS5qhxF33Nlnwlm7hH8iVZ1RI+n52l
+wVyElqp317Ksz+GtTIc+DE6oryxK3tZd4hrj9fXT4KiJvQ4pcRjpePgH7B8=
 -----END CERTIFICATE-----`,
 		},
 	}

internal/crypto/asym_encryption.go

@@ -3,7 +3,7 @@ package crypto
 import (
 	"crypto/rand"
 	"crypto/rsa"
-	"crypto/sha256"
+	"crypto/sha1"
 	"crypto/x509"
 	"encoding/pem"
 	"errors"
@@ -57,10 +57,10 @@ func (asymEncryption AsymEncryption) Encrypt(data []byte) ([]byte, error) {
 		return nil, errors.New("failed to encrypt, public key is empty")
 	}
 
-	bytes, err := rsa.EncryptOAEP(sha256.New(), rand.Reader, asymEncryption.publicKey, data, nil)
+	bytes, err := rsa.EncryptOAEP(sha1.New(), rand.Reader, asymEncryption.publicKey, data, nil)
 	if err != nil {
 		return nil, fmt.Errorf("rsa.EncryptOAEP failed: %w", err)
 	}
 
 	return bytes, nil
-}
+}

sdk/assertion.go

@@ -0,0 +1,4 @@
+package sdk
+
+type Assertion struct {
+}

sdk/auth_config.go

@@ -0,0 +1,32 @@
+package sdk
+
+import (
+	"fmt"
+	"github.com/opentdf/opentdf-v2-poc/internal/crypto"
+)
+
+type AuthConfig struct {
+	signingPublicKey  string
+	signingPrivateKey string
+	authToken         string
+}
+
+// NewAuthConfig Create a new instance of authConfig
+func NewAuthConfig() (*AuthConfig, error) {
+	rsaKeyPair, err := crypto.NewRSAKeyPair(tdf3KeySize)
+	if err != nil {
+		return nil, fmt.Errorf("crypto.NewRSAKeyPair failed: %w", err)
+	}
+
+	publicKey, err := rsaKeyPair.PublicKeyInPemFormat()
+	if err != nil {
+		return nil, fmt.Errorf("crypto.PublicKeyInPemFormat failed: %w", err)
+	}
+
+	privateKey, err := rsaKeyPair.PublicKeyInPemFormat()
+	if err != nil {
+		return nil, fmt.Errorf("crypto.PublicKeyInPemFormat failed: %w", err)
+	}
+
+	return &AuthConfig{signingPublicKey: publicKey, signingPrivateKey: privateKey}, nil
+}

sdk/manifest.go

@@ -0,0 +1,73 @@
+package sdk
+
+type Segment struct {
+	Hash          string `json:"hash"`
+	Size          int64  `json:"segmentSize"`
+	EncryptedSize int64  `json:"encryptedSegmentSize"`
+}
+
+type RootSignature struct {
+	Algorithm string `json:"alg"`
+	Signature string `json:"sig"`
+}
+
+type IntegrityInformation struct {
+	RootSignature           `json:"rootSignature"`
+	SegmentHashAlgorithm    string    `json:"segmentHashAlg"`
+	DefaultSegmentSize      int64     `json:"segmentSizeDefault"`
+	DefaultEncryptedSegSize int64     `json:"encryptedSegmentSizeDefault"`
+	Segments                []Segment `json:"segments"`
+}
+
+type KeyAccess struct {
+	KeyType           string `json:"type"`
+	KasURL            string `json:"url"`
+	Protocol          string `json:"protocol"`
+	WrappedKey        string `json:"wrappedKey"`
+	PolicyBinding     string `json:"policyBinding"`
+	EncryptedMetadata string `json:"encryptedMetadata"`
+}
+
+type Method struct {
+	Algorithm    string `json:"algorithm"`
+	IV           string `json:"iv"`
+	IsStreamable bool   `json:"isStreamable"`
+}
+
+type Payload struct {
+	Type        string `json:"type"`
+	URL         string `json:"url"`
+	Protocol    string `json:"protocol"`
+	MimeType    string `json:"mimeType"`
+	IsEncrypted bool   `json:"isEncrypted"`
+	// IntegrityInformation IntegrityInformation `json:"integrityInformation"`
+}
+
+type EncryptionInformation struct {
+	KeyAccessType        string      `json:"type"`
+	Policy               string      `json:"policy"`
+	KeyAccessObjs        []KeyAccess `json:"keyAccess"`
+	Method               Method      `json:"method"`
+	IntegrityInformation `json:"integrityInformation"`
+}
+
+type Manifest struct {
+	EncryptionInformation `json:"encryptionInformation"`
+	Payload               `json:"payload"`
+}
+
+type attributeObject struct {
+	Attribute   string `json:"attribute"`
+	DisplayName string `json:"displayName"`
+	IsDefault   bool   `json:"isDefault"`
+	PubKey      string `json:"pubKey"`
+	KasURL      string `json:"kasURL"`
+}
+
+type policyObject struct {
+	UUID string `json:"uuid"`
+	Body struct {
+		DataAttributes []attributeObject `json:"dataAttributes"`
+		Dissem         []string          `json:"dissem"`
+	}
+}