crypto

package

v0.0.5 Latest Latest Go to latest Published: Apr 14, 2026 License: MIT Imports: 7 Imported by: 0

Details

Package crypto provides X25519 key exchange and AES-256-GCM encryption for end-to-end encrypted communication between SDK clients and guest agents.

The daemon never sees plaintext payloads — it forwards opaque encrypted blobs while still being able to read JSON-RPC method names for routing.

This section is empty.

This section is empty.

func DeriveSharedSecret(priv *ecdh.PrivateKey, peerPub *ecdh.PublicKey) ([]byte, error)

DeriveSharedSecret performs X25519 ECDH and returns the 32-byte shared secret.

func PublicKeyFromBytes(b []byte) (*ecdh.PublicKey, error)

PublicKeyFromBytes parses a raw 32-byte X25519 public key.

type KeyPair struct {
	Private *ecdh.PrivateKey
	Public  *ecdh.PublicKey
}

KeyPair holds an X25519 private/public key pair.

func GenerateKeyPair() (*KeyPair, error)

GenerateKeyPair generates a new X25519 key pair.

type Session struct {
	// contains filtered or unexported fields
}

Session holds a negotiated encryption session with AES-256-GCM.

func NewSession(sharedSecret []byte) (*Session, error)

NewSession creates an encryption session from a 32-byte shared secret.

func (s *Session) Open(ciphertext []byte) ([]byte, error)

Open decrypts nonce+ciphertext produced by Seal.

func (s *Session) OpenBase64(encoded string) ([]byte, error)

OpenBase64 decrypts a base64-encoded ciphertext.

func (s *Session) Seal(plaintext []byte) ([]byte, error)

Seal encrypts plaintext with AES-256-GCM and returns nonce+ciphertext.

func (s *Session) SealBase64(plaintext []byte) (string, error)

SealBase64 encrypts plaintext and returns it as a base64 string suitable for embedding in JSON-RPC params/results.