Documentation
¶
Overview ¶
Package crypto provides the integrity and signing primitives gitdr relies on: SHA-256 checksums for every artifact and Ed25519 signatures for the run-manifest.
Index ¶
- Constants
- func Decrypt(dst io.Writer, src io.Reader, kek []byte) error
- func DecryptFile(srcPath, dstPath string, kek []byte) error
- func Encrypt(dst io.Writer, src io.Reader, kek []byte) error
- func EncryptFile(srcPath, dstPath string, kek []byte) error
- func GenerateKeyPair() (pubPEM, privPEM []byte, err error)
- func IsEncrypted(b []byte) bool
- func ParseEncryptionKey(data []byte) ([]byte, error)
- func ParsePrivateKey(data []byte) (ed25519.PrivateKey, error)
- func ParsePublicKey(data []byte) (ed25519.PublicKey, error)
- func SHA256Bytes(b []byte) string
- func SHA256File(path string) (string, int64, error)
- func SHA256Hex(r io.Reader) (string, int64, error)
- func Sign(priv ed25519.PrivateKey, msg []byte) []byte
- func Verify(pub ed25519.PublicKey, msg, sig []byte) error
Constants ¶
const EncryptionKeySize = 32
EncryptionKeySize is the required KEK length (AES-256).
Variables ¶
This section is empty.
Functions ¶
func DecryptFile ¶
DecryptFile streams an encrypted srcPath to a new plaintext dstPath.
func EncryptFile ¶
EncryptFile streams srcPath to a new encrypted dstPath.
func GenerateKeyPair ¶
GenerateKeyPair creates an Ed25519 keypair and returns PEM-encoded public (PKIX) and private (PKCS#8) keys. Primarily for tests and key bootstrap.
func IsEncrypted ¶
IsEncrypted reports whether b begins with the gitdr envelope magic, i.e. it is ciphertext produced by Encrypt/EncryptFile. Used to detect an encrypted artifact when no key was supplied, so restore can fail with a clear message.
func ParseEncryptionKey ¶
ParseEncryptionKey accepts a 32-byte key as 64-char hex, base64, or raw bytes.
func ParsePrivateKey ¶
func ParsePrivateKey(data []byte) (ed25519.PrivateKey, error)
ParsePrivateKey decodes an Ed25519 private key from PEM, raw, or base64 input.
func ParsePublicKey ¶
ParsePublicKey decodes an Ed25519 public key from PEM, raw, or base64 input.
func SHA256Bytes ¶
SHA256Bytes returns the lowercase hex SHA-256 of b.
func SHA256File ¶
SHA256File hashes the file at path.
func SHA256Hex ¶
SHA256Hex streams r through SHA-256 and returns the lowercase hex digest and the number of bytes hashed.
Types ¶
This section is empty.
Source Files