security

package

v1.1.0 Latest Latest Go to latest Published: Nov 6, 2026 License: MIT Imports: 8 Imported by: 0

Details

Package security provides scoped standard cryptographic utilities.

This section is empty.

This section is empty.

func CheckPassword(hash, password []byte) error

CheckPassword verifies a bcrypt password hash.

func Equal(a, b []byte) bool

Equal compares byte strings using constant-time comparison.

func HashPassword(password []byte, cost int) ([]byte, error)

HashPassword hashes a password with an explicit validated bcrypt cost.

func RandomBytes(n int) ([]byte, error)

RandomBytes returns cryptographically secure random bytes of a bounded positive length.

func Redact(v any) any

Redact returns a recursively redacted copy of JSON-like data. Free text must not contain secrets.

func SHA256(b []byte) [32]byte

SHA256 returns the SHA-256 digest; do not use this as a password hash.

func Sensitive(key string) bool

Sensitive identifies structured fields that must never be logged.

func Sign(key, data []byte) ([]byte, error)

Sign computes an HMAC-SHA256 tag with a key of at least 32 bytes.

func Token(n int) (string, error)

Token returns a base64url token backed by cryptographic randomness.

func Verify(key, data, tag []byte) bool

Verify checks an HMAC-SHA256 authentication tag.

func Zero(b []byte)

Zero clears the supplied byte slice; copies are outside its control.

This section is empty.