pgp

func (*Service) Decrypt ¶

func (s *Service) Decrypt(privateKey, ciphertext []byte) ([]byte, error)

Decrypt decrypts data with a private key.

func (*Service) Encrypt ¶

func (s *Service) Encrypt(publicKey, data []byte) ([]byte, error)

Encrypt encrypts data with a public key.

func (*Service) GenerateKeyPair ¶

func (s *Service) GenerateKeyPair(name, email, comment string) (publicKey, privateKey []byte, err error)

GenerateKeyPair generates a new PGP key pair using the library's default algorithm (RSA-2048). Stays for back-compat with existing callers (server.key bootstrap, etc); new callers wanting modern algorithms should use GenerateKeyPairWithConfig.

func (*Service) GenerateKeyPairWithConfig ¶ added in v0.0.4

func (s *Service) GenerateKeyPairWithConfig(name, email, comment string, config *packet.Config) (publicKey, privateKey []byte, err error)

GenerateKeyPairWithConfig generates a new PGP key pair using the supplied packet.Config to select the public-key algorithm + curve. A nil config falls back to the openpgp library's default (RSA-2048), matching the legacy GenerateKeyPair behaviour.

For modern callers, the 2026 floor is Ed25519 + Curve25519:

cfg := &packet.Config{Algorithm: packet.PubKeyAlgoEdDSA, Curve: packet.Curve25519}
pub, priv, err := s.GenerateKeyPairWithConfig("user", "user@lthn.local", "first-run", cfg)

Ed25519 keypairs are ~50x faster to generate than RSA-2048 and ~20x smaller on the wire (192 bytes vs 4096 bytes serialised).

func (*Service) Sign ¶

func (s *Service) Sign(privateKey, data []byte) ([]byte, error)

Sign creates a detached signature for a message.

func (*Service) SymmetricallyDecrypt ¶ added in v0.0.2

func (s *Service) SymmetricallyDecrypt(passphrase, ciphertext []byte) ([]byte, error)

SymmetricallyDecrypt decrypts data with a passphrase.

func (*Service) SymmetricallyEncrypt ¶

func (s *Service) SymmetricallyEncrypt(passphrase, data []byte) ([]byte, error)

SymmetricallyEncrypt encrypts data with a passphrase using the library's default cipher (AES-128) + S2K KDF iteration count. Stays for back-compat with existing callers; new callers wanting modern cipher choice should use SymmetricallyEncryptWithConfig.

func (*Service) SymmetricallyEncryptWithConfig ¶ added in v0.0.4

func (s *Service) SymmetricallyEncryptWithConfig(passphrase, data []byte, config *packet.Config) ([]byte, error)

SymmetricallyEncryptWithConfig encrypts data with a passphrase using the supplied packet.Config to select the symmetric cipher + S2K iteration count. A nil config falls back to the openpgp library's default (AES-128 + 16777216 iterations), matching the legacy SymmetricallyEncrypt behaviour.

For modern callers, the 2026 floor is AES-256 + the highest standard iteration count:

cfg := &packet.Config{
    DefaultCipher: packet.CipherAES256,
    S2KConfig:     &s2k.Config{S2KCount: 65011712},
}
ct, err := s.SymmetricallyEncryptWithConfig(passphrase, plaintext, cfg)

Argon2 S2K (RFC 9580) is not yet exported by the openpgp library; iterated S2K at S2KCount=65011712 is the practical 2026 floor until Argon2 lands upstream.

func (*Service) Verify ¶

func (s *Service) Verify(publicKey, data, signature []byte) error

Verify verifies a detached signature for a message.