Documentation
¶
Overview ¶
Package secrets is the end-to-end encryption of a workspace's secrets (ADR-0009, docs/architecture/security.md): age with X25519 keys.
- The workspace has a key pair. Its public half (the recipient) is on the workspace server: anyone allowed to set a secret encrypts to it.
- Every device has a key pair of its own. The workspace's private key reaches a device wrapped — encrypted — to the device's public key, by a device that holds it already (an admin's or a teamlead's agent), or from the recovery key.
- The server keeps public keys, wrapped keys and ciphertexts: it reads no value.
Index ¶
- func NewKey() (*age.X25519Identity, error)
- func Open(sealed []byte, key *age.X25519Identity) ([]byte, error)
- func ParseKey(s string) (*age.X25519Identity, error)
- func Seal(value []byte, publicKey string) ([]byte, error)
- func Unwrap(wrapped []byte, device *age.X25519Identity) (*age.X25519Identity, error)
- func Wrap(workspaceKey *age.X25519Identity, devicePublic string) ([]byte, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewKey ¶
func NewKey() (*age.X25519Identity, error)
NewKey makes a key pair: a workspace's or a device's.
func Open ¶
func Open(sealed []byte, key *age.X25519Identity) ([]byte, error)
Open decrypts what Seal made for key.
func ParseKey ¶
func ParseKey(s string) (*age.X25519Identity, error)
ParseKey reads a private key: AGE-SECRET-KEY-1…, the form of the recovery key too.
func Unwrap ¶
func Unwrap(wrapped []byte, device *age.X25519Identity) (*age.X25519Identity, error)
Unwrap opens a workspace key wrapped for this device.
Types ¶
This section is empty.
Source Files
Click to show internal directories.
Click to hide internal directories.