Documentation
¶
Overview ¶
Package crypto holds envelope encryption for mailbox credentials and password hashing.
Index ¶
- Constants
- Variables
- func GenerateMasterKey(dataDir string) ([]byte, error)
- func HashPassword(password string) (string, error)
- func LoadMasterKey(value, keyFile, dataDir string) ([]byte, error)
- func MasterKeyFile(dataDir string) string
- func MasterKeySource(value, keyFile, dataDir string) string
- func Open(master []byte, rowID int64, secretEnc, dekEnc []byte) ([]byte, error)
- func Seal(master []byte, rowID int64, plaintext []byte) (secretEnc, dekEnc []byte, err error)
- func VerifyPassword(encoded, password string) bool
Constants ¶
const MinPasswordLen = 12
MinPasswordLen is the shortest admin password, for first-run setup, a change in the browser and the reset command.
Variables ¶
var ErrDecrypt = errors.New("decrypt failed")
ErrDecrypt means a ciphertext was tampered with, moved between rows, or sealed under another key.
var ErrNoMasterKey = errors.New("no master key")
ErrNoMasterKey means no key was given, in the environment or a named file, and the data directory has no master.key yet. LoadMasterKey never makes one: whether a new key is safe depends on what the database holds, so the caller decides and calls GenerateMasterKey.
Functions ¶
func GenerateMasterKey ¶ added in v0.1.2
GenerateMasterKey makes a new random key and stores it, readable only by the user, as <dataDir>/master.key. It never replaces a file that is already there.
func HashPassword ¶
HashPassword returns an argon2id hash in the standard encoded form.
func LoadMasterKey ¶
LoadMasterKey returns the key-encryption key: from the base64 value, else from keyFile, else from <dataDir>/master.key. It returns ErrNoMasterKey when that file does not exist.
func MasterKeyFile ¶ added in v0.1.2
MasterKeyFile is where the key lives when neither the environment nor a named file gives it.
func MasterKeySource ¶ added in v0.1.2
MasterKeySource names where LoadMasterKey reads the key from, for a message to a person.
func Seal ¶
Seal encrypts plaintext under a fresh data key and wraps that key with the master key. rowID is bound into both ciphertexts, so they cannot be swapped between rows.
func VerifyPassword ¶
VerifyPassword reports whether password matches an encoded hash, in constant time.
Types ¶
This section is empty.
Source Files