Documentation
¶
Index ¶
- Constants
- Variables
- func ComputeHMACSHA256(data []byte, secret string) string
- func DecryptAESGCM(encoded string, key []byte) ([]byte, error)
- func DeriveKey(master []byte, label string) []byte
- func EncryptAESGCM(plaintext, key []byte) (string, error)
- func GeneratePKCE() (verifier string, challenge string, err error)
- func RandomBase64URL(n int) string
- func RandomHex(n int) string
- func SHA256Hex(data []byte) string
- func VerifyHMACSHA256(data []byte, secret, expectedHex string) bool
Constants ¶
const MinHMACKeyBytes = 16
MinHMACKeyBytes is the imported signing-key floor; generated keys use 32 bytes.
Variables ¶
var ErrCiphertextTooShort = errors.New("crypto: ciphertext too short")
ErrCiphertextTooShort reports a payload shorter than the AES-GCM nonce it must start with.
var ErrKeyLength = errors.New("crypto: AES-256-GCM key must be exactly 32 bytes")
ErrKeyLength reports an AES-256-GCM key that is not exactly 32 bytes.
Functions ¶
func ComputeHMACSHA256 ¶
ComputeHMACSHA256 computes HMAC-SHA256 hex string.
func DecryptAESGCM ¶
DecryptAESGCM reverses EncryptAESGCM.
func DeriveKey ¶
DeriveKey derives a 32-byte key from master for one specific use, so a value encrypted under one derived key never decrypts under another even if master is shared.
func EncryptAESGCM ¶
EncryptAESGCM encrypts plaintext with AES-256-GCM under a 32-byte key and a random 12-byte nonce, returning nonce||ciphertext as raw base64url.
func GeneratePKCE ¶
GeneratePKCE creates a PKCE code_verifier and code_challenge (S256).
func RandomBase64URL ¶
RandomBase64URL generates a cryptographically secure URL-safe base64 string.
func RandomHex ¶
RandomHex generates a cryptographically secure random hex string of 2*n characters.
func VerifyHMACSHA256 ¶
VerifyHMACSHA256 verifies HMAC-SHA256 signature in constant time.
Types ¶
This section is empty.
Source Files