Documentation
¶
Index ¶
- Variables
- func DecodePublicKey(data []byte) (*[32]byte, error)
- func DecodePublicKeyString(s string) (*[32]byte, error)
- func DecryptPrivateKey(data []byte, passphrase string) (*[32]byte, error)
- func DerivePublicKey(priv *[32]byte) *[32]byte
- func EncodePublicKey(pub *[32]byte) []byte
- func EncodePublicKeyString(pub *[32]byte) string
- func EncryptPrivateKey(privKey *[32]byte, passphrase string) ([]byte, error)
- func GenerateKeyPair() (priv *[32]byte, pub *[32]byte, err error)
- func HasLocalKeys() bool
- func LoadPrivateKey() (*[32]byte, error)
- func LoadPublicKey() (*[32]byte, error)
- func NormalizePassphrase(s string) string
- func PassphraseFingerprint(passphrase string) (length int, sha256Hex string)
- func PrintBlobFingerprint(label string, data []byte)
- func PrintPassphraseFingerprint(label string, passphrase string)
- func PromptPassphrase(create bool) (string, error)
- func PromptPassphraseCreate(primaryPrompt, confirmPrompt string) (string, error)
- func PromptPassphraseUnlock(prompt string) (string, error)
- func PublicKeysEqual(a, b *[32]byte) bool
- func SaveKeyPair(priv *[32]byte, pub *[32]byte) error
- func ValidatePassphrase(passphrase string) error
- type Engine
- type NaClEngine
- func (n *NaClEngine) DecryptWithEnvelope(ciphertext []byte, envelope vault.Envelope, privateKey *[32]byte) ([]byte, error)
- func (n *NaClEngine) EncryptForRecipients(plaintext []byte, recipients map[string][32]byte) ([]byte, map[string]vault.Envelope, error)
- func (n *NaClEngine) UnwrapKey(envelope vault.Envelope, privateKey *[32]byte) (*[32]byte, error)
- func (n *NaClEngine) WrapKeyForRecipient(symKey *[32]byte, recipientPub *[32]byte) (vault.Envelope, error)
Constants ¶
This section is empty.
Variables ¶
var ErrWrongPrivateKeyPassphrase = errors.New("wrong passphrase")
ErrWrongPrivateKeyPassphrase is returned when the passphrase does not decrypt the stored key blob.
Functions ¶
func DecodePublicKey ¶
DecodePublicKey decodes a base64-encoded public key.
func DecodePublicKeyString ¶
DecodePublicKeyString decodes a base64-encoded public key string.
func DecryptPrivateKey ¶
DecryptPrivateKey decrypts a private key blob produced by EncryptPrivateKey.
func DerivePublicKey ¶ added in v0.1.1
DerivePublicKey returns the X25519 public key for the given private key.
func EncodePublicKey ¶
EncodePublicKey encodes a public key to base64 bytes for storage.
func EncodePublicKeyString ¶
EncodePublicKeyString encodes a public key to a base64 string.
func EncryptPrivateKey ¶
EncryptPrivateKey encrypts a private key with a passphrase using Argon2id + NaCl secretbox. Returns: salt (16 bytes) || nonce (24 bytes) || secretbox ciphertext
func GenerateKeyPair ¶
GenerateKeyPair creates a new X25519 keypair.
func LoadPrivateKey ¶
LoadPrivateKey loads the private key from local storage.
func LoadPublicKey ¶
LoadPublicKey loads the public key from local storage.
func NormalizePassphrase ¶ added in v0.1.1
NormalizePassphrase prepares a passphrase read from the terminal for use with Argon2 and storage. It:
- Trims leading/trailing Unicode whitespace (strings.TrimSpace).
- Strips a leading UTF-8 BOM (U+FEFF) if present (not removed by TrimSpace).
- Applies Unicode NFC so the same visual string yields the same UTF-8 bytes across OS/IME normalization differences (NFD vs NFC).
Intentional leading/trailing spaces in a passphrase are not supported. Rare passphrases that depend on a specific non-NFC byte sequence for non-ASCII characters may need passphrase rotate after upgrading.
func PassphraseFingerprint ¶ added in v0.1.5
PassphraseFingerprint returns the UTF-8 byte length and hex-encoded SHA-256 of the passphrase bytes (after the caller has applied NormalizePassphrase).
func PrintBlobFingerprint ¶ added in v0.1.8
PrintBlobFingerprint writes length and SHA-256 of an arbitrary byte slice to stderr. Use to verify encrypted key blobs match between write (recover/rotate) and read (login).
func PrintPassphraseFingerprint ¶ added in v0.1.5
PrintPassphraseFingerprint writes length and SHA-256 of the passphrase to stderr for cross-machine verification without printing the secret.
func PromptPassphrase ¶
PromptPassphrase prompts the user for a passphrase via the terminal. If create is true, asks for confirmation and validates the passphrase.
func PromptPassphraseCreate ¶ added in v0.1.1
PromptPassphraseCreate prompts for a new passphrase with validation and confirmation. Empty primaryPrompt / confirmPrompt use defaults "Vault passphrase: " and "Confirm passphrase: ".
func PromptPassphraseUnlock ¶ added in v0.1.1
PromptPassphraseUnlock prompts once for the vault passphrase (normalized). If prompt is empty, uses "Vault passphrase: ".
func PublicKeysEqual ¶ added in v0.1.1
PublicKeysEqual returns true if a and b are the same 32-byte X25519 public key.
func SaveKeyPair ¶
SaveKeyPair saves the keypair to ~/.config/vaultenv/keys/
func ValidatePassphrase ¶
ValidatePassphrase checks that a passphrase meets the minimum requirements: - at least 12 characters - at least one uppercase letter - at least one digit - at least one special character
Types ¶
type Engine ¶
type Engine interface {
EncryptForRecipients(plaintext []byte, recipients map[string][32]byte) (ciphertext []byte, envelopes map[string]vault.Envelope, err error)
DecryptWithEnvelope(ciphertext []byte, envelope vault.Envelope, privateKey *[32]byte) (plaintext []byte, err error)
WrapKeyForRecipient(symKey *[32]byte, recipientPub *[32]byte) (vault.Envelope, error)
UnwrapKey(envelope vault.Envelope, privateKey *[32]byte) (*[32]byte, error)
}
Engine defines the encryption/decryption interface. Implementations can use different crypto backends (NaCl, age, KMS, etc.).
type NaClEngine ¶
type NaClEngine struct{}
func NewNaClEngine ¶
func NewNaClEngine() *NaClEngine
Source Files