Documentation
¶
Overview ¶
Package dataprotection provides authenticated encryption of small payloads behind the Provider interface, plus helpers to protect and unprotect JSON objects as base64url strings. NewSymmetric derives an AES-256-GCM key from a caller supplied high-entropy secret with HKDF-SHA256; the protected blob is nonce || ciphertext || tag with no key identifier, so key rotation must be handled by the caller.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ProtectObject ¶ added in v0.9.0
ProtectObject returns encrypted object value in base64url encoded format
Types ¶
type Provider ¶
type Provider interface {
// Protect returns protected blob
Protect(ctx context.Context, data []byte) ([]byte, error)
// Unprotect returns unprotected data
Unprotect(ctx context.Context, protected []byte) ([]byte, error)
// IsReady returns true when provider has encryption keys
IsReady() bool
// PublicKey is returned for asymmetric signer
PublicKey() crypto.PublicKey
}
Provider interface for data protection
func NewSymmetric ¶
NewSymmetric returns `Provider` based on AES256-GCM encryption
Source Files
Click to show internal directories.
Click to hide internal directories.