Documentation
¶
Index ¶
- func DecodePublicKey(data []byte) (*[32]byte, error)
- func DecodePublicKeyString(s string) (*[32]byte, error)
- func DecryptPrivateKey(data []byte, passphrase string) (*[32]byte, error)
- func EncodePublicKey(pub *[32]byte) []byte
- func EncodePublicKeyString(pub *[32]byte) string
- func EncryptPrivateKey(privKey *[32]byte, passphrase string) ([]byte, error)
- func GenerateKeyPair() (priv *[32]byte, pub *[32]byte, err error)
- func HasLocalKeys() bool
- func LoadPrivateKey() (*[32]byte, error)
- func LoadPublicKey() (*[32]byte, error)
- func PromptPassphrase(create bool) (string, error)
- func SaveKeyPair(priv *[32]byte, pub *[32]byte) error
- func ValidatePassphrase(passphrase string) error
- type Engine
- type NaClEngine
- func (n *NaClEngine) DecryptWithEnvelope(ciphertext []byte, envelope vault.Envelope, privateKey *[32]byte) ([]byte, error)
- func (n *NaClEngine) EncryptForRecipients(plaintext []byte, recipients map[string][32]byte) ([]byte, map[string]vault.Envelope, error)
- func (n *NaClEngine) UnwrapKey(envelope vault.Envelope, privateKey *[32]byte) (*[32]byte, error)
- func (n *NaClEngine) WrapKeyForRecipient(symKey *[32]byte, recipientPub *[32]byte) (vault.Envelope, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DecodePublicKey ¶
DecodePublicKey decodes a base64-encoded public key.
func DecodePublicKeyString ¶
DecodePublicKeyString decodes a base64-encoded public key string.
func DecryptPrivateKey ¶
DecryptPrivateKey decrypts a private key blob produced by EncryptPrivateKey.
func EncodePublicKey ¶
EncodePublicKey encodes a public key to base64 bytes for storage.
func EncodePublicKeyString ¶
EncodePublicKeyString encodes a public key to a base64 string.
func EncryptPrivateKey ¶
EncryptPrivateKey encrypts a private key with a passphrase using Argon2id + NaCl secretbox. Returns: salt (16 bytes) || nonce (24 bytes) || secretbox ciphertext
func GenerateKeyPair ¶
GenerateKeyPair creates a new X25519 keypair.
func LoadPrivateKey ¶
LoadPrivateKey loads the private key from local storage.
func LoadPublicKey ¶
LoadPublicKey loads the public key from local storage.
func PromptPassphrase ¶
PromptPassphrase prompts the user for a passphrase via the terminal. If create is true, asks for confirmation and validates the passphrase.
func SaveKeyPair ¶
SaveKeyPair saves the keypair to ~/.config/vaultenv/keys/
func ValidatePassphrase ¶
ValidatePassphrase checks that a passphrase meets the minimum requirements: - at least 12 characters - at least one uppercase letter - at least one digit - at least one special character
Types ¶
type Engine ¶
type Engine interface {
EncryptForRecipients(plaintext []byte, recipients map[string][32]byte) (ciphertext []byte, envelopes map[string]vault.Envelope, err error)
DecryptWithEnvelope(ciphertext []byte, envelope vault.Envelope, privateKey *[32]byte) (plaintext []byte, err error)
WrapKeyForRecipient(symKey *[32]byte, recipientPub *[32]byte) (vault.Envelope, error)
UnwrapKey(envelope vault.Envelope, privateKey *[32]byte) (*[32]byte, error)
}
Engine defines the encryption/decryption interface. Implementations can use different crypto backends (NaCl, age, KMS, etc.).
type NaClEngine ¶
type NaClEngine struct{}
func NewNaClEngine ¶
func NewNaClEngine() *NaClEngine
Source Files