Documentation
¶
Overview ¶
Package crypto provides encryption utilities for TMI.
Index ¶
- Constants
- Variables
- func ContextIDOf(value string) (int, bool)
- func GenerateHMACSignature(payload []byte, secret string) string
- func IsEncrypted(value string) bool
- func VerifyHMACSignature(payload []byte, signature string, secret string) bool
- type EncryptionContext
- type SettingsEncryptor
- func NewSettingsEncryptor(ctx context.Context, provider secrets.Provider) (*SettingsEncryptor, error)
- func NewSettingsEncryptorFromKeyring(current []byte, currentID int, previous []byte, previousID int) (*SettingsEncryptor, error)
- func NewSettingsEncryptorFromKeys(currentKey, previousKey []byte, contextID int) (*SettingsEncryptor, error)
- func (e *SettingsEncryptor) CurrentPrefix() string
- func (e *SettingsEncryptor) Decrypt(value string) (string, error)
- func (e *SettingsEncryptor) Encrypt(plaintext string) (string, error)
- func (e *SettingsEncryptor) GetContext() EncryptionContext
- func (e *SettingsEncryptor) HasPreviousKey() bool
- func (e *SettingsEncryptor) IsEnabled() bool
Constants ¶
const MaxEncryptedValueLength = 4000
MaxEncryptedValueLength is the maximum length of an encrypted value string that fits in a varchar(4000) column.
Variables ¶
var ErrValueTooLong = errors.New("encrypted value exceeds maximum storage length")
ErrValueTooLong is returned when an encrypted value exceeds the database column limit.
Functions ¶
func ContextIDOf ¶
ContextIDOf parses the key id out of an ENC:v1 envelope. SEM@3b682947: parse the key id from an encrypted setting value; false for plaintext (pure)
func GenerateHMACSignature ¶
GenerateHMACSignature generates an HMAC-SHA256 signature for the payload. Returns the signature in the format "sha256=<hex-encoded-mac>". SEM@54a00be20c0e4ff2748aa85a498fbebd3f2e9e37: compute a SHA-256 HMAC signature over a payload and return it as a sha256= prefixed hex string (pure)
func IsEncrypted ¶
IsEncrypted returns true if the value has the ENC: prefix indicating encryption. SEM@b9272d08c168beb55fbc4db127cb1d4eec5f72c1: report whether a setting value carries the ENC: encryption prefix (pure)
func VerifyHMACSignature ¶
VerifyHMACSignature verifies an HMAC-SHA256 signature using constant-time comparison. SEM@54a00be20c0e4ff2748aa85a498fbebd3f2e9e37: validate an HMAC signature against a payload and secret using constant-time comparison (pure)
Types ¶
type EncryptionContext ¶
EncryptionContext tracks key version and cipher metadata. SEM@b9272d08c168beb55fbc4db127cb1d4eec5f72c1: carry key version and cipher algorithm metadata for an encrypted setting (pure)
type SettingsEncryptor ¶
type SettingsEncryptor struct {
// contains filtered or unexported fields
}
SettingsEncryptor encrypts and decrypts setting values using AES-256-GCM. SEM@3b682947: hold AES-256-GCM keys and state for encrypting and decrypting settings
func NewSettingsEncryptor ¶
func NewSettingsEncryptor(ctx context.Context, provider secrets.Provider) (*SettingsEncryptor, error)
NewSettingsEncryptor creates a new encryptor using the secrets provider. If no encryption key is found, returns a disabled encryptor that passes values through. SEM@3b682947: build a SettingsEncryptor by fetching encryption keys from a secrets provider (reads secrets)
func NewSettingsEncryptorFromKeyring ¶
func NewSettingsEncryptorFromKeyring(current []byte, currentID int, previous []byte, previousID int) (*SettingsEncryptor, error)
NewSettingsEncryptorFromKeyring builds an encryptor from raw keys with explicit ids. previousID 0 means "unknown" (selected by trial decrypt only). SEM@3b682947: build a SettingsEncryptor from a current and previous keyring with ids (pure)
func NewSettingsEncryptorFromKeys ¶
func NewSettingsEncryptorFromKeys(currentKey, previousKey []byte, contextID int) (*SettingsEncryptor, error)
NewSettingsEncryptorFromKeys creates an encryptor directly from key bytes. This is primarily for testing. contextID defaults to 1. SEM@b9272d08c168beb55fbc4db127cb1d4eec5f72c1: build a SettingsEncryptor directly from raw key bytes, for testing (pure)
func (*SettingsEncryptor) CurrentPrefix ¶
func (e *SettingsEncryptor) CurrentPrefix() string
CurrentPrefix returns the envelope prefix values written by this encryptor carry. SEM@3b682947: return the encrypted-value prefix of the current key (pure)
func (*SettingsEncryptor) Decrypt ¶
func (e *SettingsEncryptor) Decrypt(value string) (string, error)
Decrypt decrypts an encrypted value. If the value doesn't have the ENC: prefix, it is returned as-is (plaintext passthrough). Tries the current key first, then the previous key if configured and the current key fails. SEM@3b682947: decrypt an encrypted setting value using the key matching its id, falling back to the previous key
func (*SettingsEncryptor) Encrypt ¶
func (e *SettingsEncryptor) Encrypt(plaintext string) (string, error)
Encrypt encrypts a plaintext value using AES-256-GCM with the current key. Returns the original value unchanged if encryption is disabled. SEM@b9272d08c168beb55fbc4db127cb1d4eec5f72c1: encrypt a plaintext setting value with AES-256-GCM and return the encoded envelope (pure)
func (*SettingsEncryptor) GetContext ¶
func (e *SettingsEncryptor) GetContext() EncryptionContext
GetContext returns the current encryption context. SEM@b9272d08c168beb55fbc4db127cb1d4eec5f72c1: return the current encryption context containing key version and algorithm (pure)
func (*SettingsEncryptor) HasPreviousKey ¶
func (e *SettingsEncryptor) HasPreviousKey() bool
HasPreviousKey returns true if a previous key is configured for key rotation. SEM@b9272d08c168beb55fbc4db127cb1d4eec5f72c1: report whether a previous key is loaded for key rotation support (pure)
func (*SettingsEncryptor) IsEnabled ¶
func (e *SettingsEncryptor) IsEnabled() bool
IsEnabled returns true if encryption is configured and active. SEM@b9272d08c168beb55fbc4db127cb1d4eec5f72c1: report whether encryption is configured and active on the encryptor (pure)
Source Files