encryption

func NewEncryptor ¶

func NewEncryptor(key string) (*Encryptor, error)

NewEncryptor creates a new encryptor.

SECURITY WARNING: The KDF used here is an ad-hoc iterated SHA-256 scheme. It is NOT equivalent to PBKDF2, bcrypt, scrypt, or argon2. Specifically:

• No random salt: identical passwords produce identical keys.
• SHA-256 iterations are GPU-friendly and offer weaker brute-force resistance than memory-hard functions (argon2id, scrypt).

This is acceptable for low-risk local data (CLI token tracking) but MUST be replaced with golang.org/x/crypto/argon2 before protecting user credentials, API keys, or data exposed to network attackers.