mkc — Robust KalkanCrypt Wrapper for Go

A high-performance, production-ready Go binding for the KalkanCrypt library. Originally started as a proof-of-concept in April 2024, this project has evolved into a stable tool for handling digital signatures and certificates in Go environments.

Key Features

• Idiomatic Go API: Clean structures and methods instead of raw CGO calls.
• Production-Tested: Based on real-world implementation and refined for stability.
• Improved Resource Management: Proper handling of library initialization and memory.

Prerequisites

To use this wrapper, you need to obtain the KalkanCrypt SDK (specifically the C libraries). You can request the official SDK from the National Certification Authority of Kazakhstan (NCA RK).

The project expects the dynamic library (e.g., libkalkancryptwr-64.so) to be available in your library path or included in the project's include/lib directory.

Supported Functionality

The library currently covers the most essential features for production use:

• Initialization & Lifecycle: Init, Close, Finalize, XMLFinalize — managed library state and resource cleanup.
• Certificate Management: ExportCert, CertGetInfo — extracting public certificates and metadata (expiration dates, OIDs, etc.).
• Data Signing: SignData, SignXML — support for CMS and XMLDSIG formats with customizable flags.

Note: While the core functionality is fully operational, not all methods from the extensive Kalkan SDK are implemented yet.

Contributions

If you need a specific method that isn't covered or find a way to improve the current implementation:

• Feel free to open an Issue or submit a Pull Request.
• Contributions that expand the API coverage or improve documentation are highly welcome!

Installation

go get github.com/olegmlsn/mkc

Example Usage

package main

import (
    "fmt"
    "log"
    
    "github.com/olegmlsn/mkc"
)

func main() {
    // Initialize the provider
    client := new(mkc.Provider)
    
    err := client.Init(mkc.Test)
    if err != nil {
        log.Fatal(err)
    }
    
    // Ensure proper cleanup
    defer func() {
        client.XMLFinalize()
        client.Finalize()
        _ = client.Close()
    }()
    
    // Export certificate info
    b64Cert, err := client.ExportCert("alias")
    if err != nil {
        log.Fatal(err)
    }
    
    certNotBefore, err := client.CertGetInfo(b64Cert, mkc.KC_CERTPROP_NOTBEFORE)
    if err != nil {
        log.Fatal(err)
    }
    fmt.Printf("Certificate Valid From: %s\n", certNotBefore)
    
    // Sign data (Base64)
    signFlags := mkc.KC_SIGN_DRAFT | mkc.KC_OUT_BASE64
    signature, err := client.SignData("data", "alias", signFlags)
    if err != nil {
        log.Fatal(err)
    }
    fmt.Printf("Signature: %s\n", signature)
    
    // Sign XML
    signedXML, err := client.SignXML("<root>1</root>", "alias", 0)
    if err != nil {
        log.Fatal(err)
    }
    fmt.Printf("Signed XML: %s\n", signedXML)
}

Testing & Development

To run the automated tests, you need to provide the following assets from the Kalkan SDK:

1. Copy libkalkancryptwr-64.so → include/lib
2. Copy ca_certs → include/ca
3. Copy test_key → include/testdata

Then, run the tests using Docker:

docker build -f Dockerfile.test -t mkc-test .
docker run --rm mkc-test

License

This project is licensed under the MIT License - see the LICENSE file for details.

Disclaimer

This project is an independent, open-source implementation and is not an official product of the National Certification Authority of the Republic of Kazakhstan (NCA RK). All trademarks and SDK libraries belong to their respective owners. The software is provided "as is" without any warranties.