Documentation
¶
Index ¶
- Variables
- func DecodePublicKey(data []byte) (*[32]byte, error)
- func DecodePublicKeyString(s string) (*[32]byte, error)
- func DecryptPrivateKey(data []byte, passphrase string) (*[32]byte, error)
- func DerivePublicKey(priv *[32]byte) *[32]byte
- func EncodePublicKey(pub *[32]byte) []byte
- func EncodePublicKeyString(pub *[32]byte) string
- func EncryptPrivateKey(privKey *[32]byte, passphrase string) ([]byte, error)
- func GenerateKeyPair() (priv *[32]byte, pub *[32]byte, err error)
- func HasLocalKeys() bool
- func LoadPrivateKey() (*[32]byte, error)
- func LoadPublicKey() (*[32]byte, error)
- func NormalizePassphrase(s string) string
- func PromptPassphrase(create bool) (string, error)
- func PromptPassphraseCreate(primaryPrompt, confirmPrompt string) (string, error)
- func PromptPassphraseUnlock(prompt string) (string, error)
- func PublicKeysEqual(a, b *[32]byte) bool
- func SaveKeyPair(priv *[32]byte, pub *[32]byte) error
- func ValidatePassphrase(passphrase string) error
- type Engine
- type NaClEngine
- func (n *NaClEngine) DecryptWithEnvelope(ciphertext []byte, envelope vault.Envelope, privateKey *[32]byte) ([]byte, error)
- func (n *NaClEngine) EncryptForRecipients(plaintext []byte, recipients map[string][32]byte) ([]byte, map[string]vault.Envelope, error)
- func (n *NaClEngine) UnwrapKey(envelope vault.Envelope, privateKey *[32]byte) (*[32]byte, error)
- func (n *NaClEngine) WrapKeyForRecipient(symKey *[32]byte, recipientPub *[32]byte) (vault.Envelope, error)
Constants ¶
This section is empty.
Variables ¶
var ErrWrongPrivateKeyPassphrase = errors.New("wrong passphrase")
ErrWrongPrivateKeyPassphrase is returned when the passphrase does not decrypt the stored key blob.
Functions ¶
func DecodePublicKey ¶
DecodePublicKey decodes a base64-encoded public key.
func DecodePublicKeyString ¶
DecodePublicKeyString decodes a base64-encoded public key string.
func DecryptPrivateKey ¶
DecryptPrivateKey decrypts a private key blob produced by EncryptPrivateKey.
func DerivePublicKey ¶ added in v0.1.1
DerivePublicKey returns the X25519 public key for the given private key.
func EncodePublicKey ¶
EncodePublicKey encodes a public key to base64 bytes for storage.
func EncodePublicKeyString ¶
EncodePublicKeyString encodes a public key to a base64 string.
func EncryptPrivateKey ¶
EncryptPrivateKey encrypts a private key with a passphrase using Argon2id + NaCl secretbox. Returns: salt (16 bytes) || nonce (24 bytes) || secretbox ciphertext
func GenerateKeyPair ¶
GenerateKeyPair creates a new X25519 keypair.
func LoadPrivateKey ¶
LoadPrivateKey loads the private key from local storage.
func LoadPublicKey ¶
LoadPublicKey loads the public key from local storage.
func NormalizePassphrase ¶ added in v0.1.1
NormalizePassphrase trims leading and trailing Unicode whitespace as defined by strings.TrimSpace, including \r and \n. Use on every passphrase read from the terminal so pasted passphrases and Windows line endings do not break unlock. Intentional leading/trailing spaces in a passphrase are not supported after normalization.
func PromptPassphrase ¶
PromptPassphrase prompts the user for a passphrase via the terminal. If create is true, asks for confirmation and validates the passphrase.
func PromptPassphraseCreate ¶ added in v0.1.1
PromptPassphraseCreate prompts for a new passphrase with validation and confirmation. Empty primaryPrompt / confirmPrompt use defaults "Vault passphrase: " and "Confirm passphrase: ".
func PromptPassphraseUnlock ¶ added in v0.1.1
PromptPassphraseUnlock prompts once for the vault passphrase (normalized). If prompt is empty, uses "Vault passphrase: ".
func PublicKeysEqual ¶ added in v0.1.1
PublicKeysEqual returns true if a and b are the same 32-byte X25519 public key.
func SaveKeyPair ¶
SaveKeyPair saves the keypair to ~/.config/vaultenv/keys/
func ValidatePassphrase ¶
ValidatePassphrase checks that a passphrase meets the minimum requirements: - at least 12 characters - at least one uppercase letter - at least one digit - at least one special character
Types ¶
type Engine ¶
type Engine interface {
EncryptForRecipients(plaintext []byte, recipients map[string][32]byte) (ciphertext []byte, envelopes map[string]vault.Envelope, err error)
DecryptWithEnvelope(ciphertext []byte, envelope vault.Envelope, privateKey *[32]byte) (plaintext []byte, err error)
WrapKeyForRecipient(symKey *[32]byte, recipientPub *[32]byte) (vault.Envelope, error)
UnwrapKey(envelope vault.Envelope, privateKey *[32]byte) (*[32]byte, error)
}
Engine defines the encryption/decryption interface. Implementations can use different crypto backends (NaCl, age, KMS, etc.).
type NaClEngine ¶
type NaClEngine struct{}
func NewNaClEngine ¶
func NewNaClEngine() *NaClEngine
Source Files