dataencryption

package

v0.1.0 Latest Latest Go to latest Published: Jul 18, 2026 License: Apache-2.0 Imports: 10 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/chirino/memory-service

Links

Open Source Insights

Documentation ¶

Overview ¶

Package dataencryption provides the MSEH envelope format and DataEncryptionService.

Wire format (Java-compatible):

[4 bytes: 0x4D 0x53 0x45 0x48]  "MSEH" magic
[varint32: proto byte length]
[EncryptionHeader proto bytes]   see dataencryption/v1/encryption_header.proto
[ciphertext bytes]

Index ¶

Constants
func EncodeHeader(h Header) ([]byte, error)
func FieldAAD(headerPrefix []byte, domain, identity string) []byte
func HasMagic(b []byte) bool
func WithContext(ctx context.Context, svc *Service) context.Context
func WriteHeader(w io.Writer, h Header) error
type Header
- func ReadHeader(r io.Reader) (*Header, bool, error)
type Service
- func FromContext(ctx context.Context) *Service
- func New(ctx context.Context, cfg *config.Config) (*Service, error)

Constants ¶

View Source

const (
	// VersionAttachmentStreamAESGCM is the authenticated record stream format used for attachments.
	VersionAttachmentStreamAESGCM uint32 = 3
	// VersionFieldAESGCM is the authenticated field format using domain/identity AAD.
	VersionFieldAESGCM uint32 = 4
)

Variables ¶

This section is empty.

Functions ¶

func EncodeHeader ¶ added in v0.0.4

func EncodeHeader(h Header) ([]byte, error)

EncodeHeader encodes h as an MSEH envelope prefix.

func FieldAAD ¶ added in v0.0.4

func FieldAAD(headerPrefix []byte, domain, identity string) []byte

FieldAAD returns the canonical associated data for an MSEH v4 persisted field.

func HasMagic ¶

func HasMagic(b []byte) bool

HasMagic reports whether b starts with the MSEH magic bytes.

func WithContext ¶

func WithContext(ctx context.Context, svc *Service) context.Context

WithContext returns a new context carrying the given Service.

func WriteHeader ¶

func WriteHeader(w io.Writer, h Header) error

WriteHeader encodes h as an MSEH envelope prefix and writes it to w.

Types ¶

type Header ¶

type Header struct {
	Version    uint32
	ProviderID string
	Nonce      []byte
}

Header is the decoded MSEH envelope header.

func ReadHeader ¶

func ReadHeader(r io.Reader) (*Header, bool, error)

ReadHeader reads the MSEH magic + varint + proto fields from r. Returns (header, true, nil) on success, (nil, false, nil) if magic is absent, or (nil, true, err) on a read error after the magic has been confirmed present.

type Service ¶

type Service struct {
	// contains filtered or unexported fields
}

Service orchestrates encryption providers. The primary provider is used for new encryptions; all registered providers are available for decryption routing via the MSEH ProviderID field.

func FromContext ¶

func FromContext(ctx context.Context) *Service

FromContext retrieves the Service from the context. Returns nil if none was set.

func New ¶

func New(ctx context.Context, cfg *config.Config) (*Service, error)

New constructs a Service from cfg.EncryptionProviders (comma-separated list). The first named provider becomes the primary (used for encryption).

func (*Service) AttachmentSigningKeys ¶

func (s *Service) AttachmentSigningKeys(ctx context.Context) ([][]byte, error)

AttachmentSigningKeys returns signing keys from the primary provider for attachment download URL HMAC signing. Returns nil when the primary provider does not support signed URLs (e.g. "plain" with no key configured).

func (*Service) DecryptField ¶ added in v0.0.4

func (s *Service) DecryptField(ciphertext []byte, domain, identity string) ([]byte, error)

DecryptField decrypts a persisted field. Encrypted values must use MSEH v4 and are authenticated with the supplied domain and identity. Headerless values are accepted only when plain is the primary provider.

func (*Service) DecryptStream ¶

func (s *Service) DecryptStream(src io.Reader) (io.Reader, error)

DecryptStream routes current MSEH v3 streams by provider. Headerless streams are accepted only when plain is the primary provider.

func (*Service) EncryptField ¶ added in v0.0.4

func (s *Service) EncryptField(plaintext []byte, domain, identity string) ([]byte, error)

EncryptField encrypts a persisted field with MSEH v4 domain/identity AAD binding.

func (*Service) EncryptStream ¶

func (s *Service) EncryptStream(dst io.Writer) (io.WriteCloser, error)

EncryptStream delegates to the primary provider.

func (*Service) IsPrimaryReal ¶

func (s *Service) IsPrimaryReal() bool

IsPrimaryReal returns true when the primary provider performs actual encryption (i.e. is not the "plain" no-op provider).

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL