Documentation
¶
Overview ¶
Package stmf implements Sovereign Form Encryption using X25519 ECDH + ChaCha20-Poly1305. STMF (STIM Form) enables client-side encryption of HTML form data using the server's public key, providing end-to-end encryption even against MITM proxies.
Index ¶
- Constants
- Variables
- func DecryptBase64ToMap(encoded string, serverPrivateKey []byte) (map[string]string, error)
- func DecryptToMap(stmfData []byte, serverPrivateKey []byte) (map[string]string, error)
- func Encrypt(data *FormData, serverPublicKey []byte) ([]byte, error)
- func EncryptBase64(data *FormData, serverPublicKey []byte) (string, error)
- func EncryptMap(fields map[string]string, serverPublicKey []byte) ([]byte, error)
- func EncryptMapBase64(fields map[string]string, serverPublicKey []byte) (string, error)
- func EncryptWithKey(data *FormData, serverPublicKey *ecdh.PublicKey) ([]byte, error)
- func LoadPrivateKey(data []byte) (*ecdh.PrivateKey, error)
- func LoadPrivateKeyBase64(encoded string) (*ecdh.PrivateKey, error)
- func LoadPublicKey(data []byte) (*ecdh.PublicKey, error)
- func LoadPublicKeyBase64(encoded string) (*ecdh.PublicKey, error)
- func ValidatePayload(stmfData []byte) error
- type FormData
- func (f *FormData) AddField(name, value string) *FormData
- func (f *FormData) AddFieldWithType(name, value, fieldType string) *FormData
- func (f *FormData) AddFile(name, value, filename, mimeType string) *FormData
- func (f *FormData) Get(name string) string
- func (f *FormData) GetAll(name string) []string
- func (f *FormData) GetField(name string) *FormField
- func (f *FormData) SetMetadata(key, value string) *FormData
- func (f *FormData) ToMap() map[string]string
- type FormField
- type Header
- type KeyPair
Constants ¶
const DefaultFieldName = "_stmf_payload"
DefaultFieldName is the form field name used for the encrypted payload
const Magic = "STMF"
Magic bytes for STMF format
const Version = "1.0"
Version of the STMF format
Variables ¶
var ( ErrInvalidMagic = errors.New("invalid STMF magic") ErrInvalidPayload = errors.New("invalid STMF payload") ErrDecryptionFailed = errors.New("decryption failed") ErrInvalidPublicKey = errors.New("invalid public key") ErrInvalidPrivateKey = errors.New("invalid private key") ErrKeyGenerationFailed = errors.New("key generation failed") )
Errors
Functions ¶
func DecryptBase64ToMap ¶
DecryptBase64ToMap decrypts base64 and returns a map
func DecryptToMap ¶
DecryptToMap is a convenience function that returns the form data as a simple map
func Encrypt ¶
Encrypt encrypts form data using the server's public key. It performs X25519 ECDH key exchange with an ephemeral keypair, derives a symmetric key, and encrypts with ChaCha20-Poly1305.
The result is a STMF container that can be base64-encoded for transmission.
func EncryptBase64 ¶
EncryptBase64 encrypts form data and returns a base64-encoded string
func EncryptMap ¶
EncryptMap is a convenience function to encrypt a simple key-value map
func EncryptMapBase64 ¶
EncryptMapBase64 encrypts a map and returns base64
func EncryptWithKey ¶
EncryptWithKey encrypts form data using a pre-loaded public key
func LoadPrivateKey ¶
func LoadPrivateKey(data []byte) (*ecdh.PrivateKey, error)
LoadPrivateKey loads a private key from raw bytes
func LoadPrivateKeyBase64 ¶
func LoadPrivateKeyBase64(encoded string) (*ecdh.PrivateKey, error)
LoadPrivateKeyBase64 loads a private key from a base64-encoded string
func LoadPublicKey ¶
LoadPublicKey loads a public key from raw bytes
func LoadPublicKeyBase64 ¶
LoadPublicKeyBase64 loads a public key from a base64-encoded string
func ValidatePayload ¶
ValidatePayload checks if the data is a valid STMF container without decrypting
Types ¶
type FormData ¶
type FormData struct {
Fields []FormField `json:"fields"`
Metadata map[string]string `json:"meta,omitempty"`
}
FormData represents the encrypted form payload
func Decrypt ¶
Decrypt decrypts a STMF payload using the server's private key. It extracts the ephemeral public key from the header, performs ECDH, and decrypts with ChaCha20-Poly1305.
func DecryptBase64 ¶
DecryptBase64 decrypts a base64-encoded STMF payload
func DecryptWithKey ¶
func DecryptWithKey(stmfData []byte, serverPrivateKey *ecdh.PrivateKey) (*FormData, error)
DecryptWithKey decrypts a STMF payload using a pre-loaded private key
func (*FormData) AddFieldWithType ¶
AddFieldWithType adds a typed field to the form data
func (*FormData) SetMetadata ¶
SetMetadata sets a metadata value
type FormField ¶
type FormField struct {
Name string `json:"name"`
Value string `json:"value"`
Type string `json:"type,omitempty"` // text, password, file, etc.
Filename string `json:"filename,omitempty"` // for file uploads
MimeType string `json:"mime,omitempty"` // for file uploads
}
FormField represents a single form field
type Header ¶
type Header struct {
Version string `json:"version"`
Algorithm string `json:"algorithm"`
EphemeralPK string `json:"ephemeral_pk"` // base64-encoded ephemeral public key
Nonce string `json:"nonce"` // base64-encoded nonce
}
Header represents the STMF container header
func GetPayloadInfo ¶
GetPayloadInfo extracts metadata from a STMF payload without decrypting
type KeyPair ¶
type KeyPair struct {
// contains filtered or unexported fields
}
KeyPair represents an X25519 keypair for STMF encryption
func GenerateKeyPair ¶
GenerateKeyPair generates a new X25519 keypair
func LoadKeyPair ¶
LoadKeyPair loads a keypair from raw private key bytes
func LoadKeyPairBase64 ¶
LoadKeyPairBase64 loads a keypair from a base64-encoded private key
func (*KeyPair) PrivateKey ¶
PrivateKey returns the raw private key bytes (32 bytes)
func (*KeyPair) PrivateKeyBase64 ¶
PrivateKeyBase64 returns the private key as a base64-encoded string
func (*KeyPair) PublicKeyBase64 ¶
PublicKeyBase64 returns the public key as a base64-encoded string
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package middleware provides HTTP middleware for automatic STMF decryption.
|
Package middleware provides HTTP middleware for automatic STMF decryption. |