crypto

package

v0.2.0 Latest Latest Go to latest Published: Apr 27, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/Basekick-Labs/memtrace

Links

Open Source Insights

Documentation ¶

Overview ¶

Package crypto provides envelope encryption for secrets stored at rest in the metadata database. Per-org Arc API keys are encrypted with AES-256-GCM using a master key supplied via the MEMTRACE_MASTER_KEY environment variable.

Index ¶

Constants
func GenerateMasterKey() (string, error)
type Cipher
- func NewCipher(key []byte) (*Cipher, error)
- func NewCipherFromEnv() (*Cipher, error)
- func (c *Cipher) Decrypt(ciphertext, nonce []byte) ([]byte, error)
- func (c *Cipher) Encrypt(plaintext []byte) (ciphertext, nonce []byte, err error)

Constants ¶

View Source

const (
	// MasterKeyEnvVar is the environment variable Memtrace reads to obtain the
	// 32-byte master key (base64-encoded) used for envelope encryption.
	MasterKeyEnvVar = "MEMTRACE_MASTER_KEY"
)

Variables ¶

This section is empty.

Functions ¶

func GenerateMasterKey ¶

func GenerateMasterKey() (string, error)

GenerateMasterKey returns a fresh, base64-encoded 32-byte master key. Used by `memtrace keygen master` to print a key for operators to set in their env.

Types ¶

type Cipher ¶

type Cipher struct {
	// contains filtered or unexported fields
}

Cipher encrypts and decrypts byte slices using AES-256-GCM.

func NewCipher ¶

func NewCipher(key []byte) (*Cipher, error)

NewCipher constructs a Cipher from a raw 32-byte key.

func NewCipherFromEnv ¶

func NewCipherFromEnv() (*Cipher, error)

NewCipherFromEnv reads the master key from MEMTRACE_MASTER_KEY (base64-encoded 32 bytes) and returns a Cipher. Returns a clear error if the variable is missing or malformed so the server can refuse to start.

func (*Cipher) Decrypt ¶

func (c *Cipher) Decrypt(ciphertext, nonce []byte) ([]byte, error)

Decrypt opens ciphertext using the supplied nonce. Returns an error if the ciphertext or nonce has been tampered with or the master key is wrong.

func (*Cipher) Encrypt ¶

func (c *Cipher) Encrypt(plaintext []byte) (ciphertext, nonce []byte, err error)

Encrypt seals plaintext with a fresh random 12-byte nonce. The nonce is returned alongside the ciphertext (which includes the GCM tag).

Source Files ¶

View all Source files

envelope.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL