Documentation
¶
Overview ¶
Package crypto holds envelope encryption for mailbox credentials and password hashing.
Index ¶
- Variables
- func HashPassword(password string) (string, error)
- func LoadMasterKey(value, keyFile, dataDir string) ([]byte, error)
- func Open(master []byte, rowID int64, secretEnc, dekEnc []byte) ([]byte, error)
- func Seal(master []byte, rowID int64, plaintext []byte) (secretEnc, dekEnc []byte, err error)
- func VerifyPassword(encoded, password string) bool
Constants ¶
This section is empty.
Variables ¶
View Source
var ErrDecrypt = errors.New("decrypt failed")
ErrDecrypt means a ciphertext was tampered with, moved between rows, or sealed under another key.
Functions ¶
func HashPassword ¶
HashPassword returns an argon2id hash in the standard encoded form.
func LoadMasterKey ¶
LoadMasterKey returns the key-encryption key: from the base64 value, else from keyFile, else from <dataDir>/master.key, which is generated (mode 0600) on first run.
func Seal ¶
Seal encrypts plaintext under a fresh data key and wraps that key with the master key. rowID is bound into both ciphertexts, so they cannot be swapped between rows.
func VerifyPassword ¶
VerifyPassword reports whether password matches an encoded hash, in constant time.
Types ¶
This section is empty.
Source Files
Click to show internal directories.
Click to hide internal directories.