Documentation
¶
Overview ¶
Package crypto encrypts content at rest with AES-256-GCM.
It protects the *content* of documents and blobs — the text of a note, the bytes of an image — never their envelope: identifiers, sources, metadata and timestamps stay clear, because stores filter and join on them. Encrypting the envelope would either break those queries or force deterministic encryption, which leaks equality.
The encryption is applicative, not engine level: sealed values travel to the database as opaque bytes, so the same key protects a SQLite file today and a PostgreSQL cluster tomorrow.
Threat model: a stolen database file, a misplaced backup, a resold disk. A compromised process holds the key and is out of scope.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Cipher ¶
type Cipher struct {
// contains filtered or unexported fields
}
Cipher seals and opens content values.
func NewCipher ¶
NewCipher derives a Cipher from key. The key must carry at least 32 bytes of material; it is stretched through HKDF-SHA256, never used raw.
Source Files