Documentation
¶
Overview ¶
Package secrets provides application-level encryption for sensitive data stored in RQLite. Uses AES-256-GCM with HKDF key derivation from the cluster secret.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Decrypt ¶
Decrypt decrypts an "enc:"-prefixed ciphertext string with AES-256-GCM. If the input is not prefixed with "enc:", it is returned as-is (plaintext passthrough for backward compatibility during migration).
func DeriveKey ¶
DeriveKey derives a 32-byte AES-256 key from the cluster secret using HKDF-SHA256. The purpose string provides domain separation (e.g., "turn-encryption").
func Encrypt ¶
Encrypt encrypts plaintext with AES-256-GCM using the given key. Returns a base64-encoded string prefixed with "enc:" for identification.
func IsEncrypted ¶
IsEncrypted returns true if the value has the "enc:" prefix.
Types ¶
This section is empty.
Source Files