Documentation
¶
Overview ¶
Package crypto provides encryption utilities for TMI.
Index ¶
- Constants
- Variables
- func ContextIDOf(value string) (int, bool)
- func GenerateHMACSignature(payload []byte, secret string) string
- func IsEncrypted(value string) bool
- func VerifyHMACSignature(payload []byte, signature string, secret string) bool
- type EncryptionContext
- type SettingsEncryptor
- func NewSettingsEncryptor(ctx context.Context, provider secrets.Provider) (*SettingsEncryptor, error)
- func NewSettingsEncryptorFromKeyring(current []byte, currentID int, previous []byte, previousID int) (*SettingsEncryptor, error)
- func NewSettingsEncryptorFromKeys(currentKey, previousKey []byte, contextID int) (*SettingsEncryptor, error)
- func (e *SettingsEncryptor) CurrentPrefix() string
- func (e *SettingsEncryptor) Decrypt(value string) (string, error)
- func (e *SettingsEncryptor) Encrypt(plaintext string) (string, error)
- func (e *SettingsEncryptor) GetContext() EncryptionContext
- func (e *SettingsEncryptor) HasPreviousKey() bool
- func (e *SettingsEncryptor) IsEnabled() bool
Constants ¶
const MaxEncryptedValueLength = 4000
MaxEncryptedValueLength is the maximum length of an encrypted value string that fits in a varchar(4000) column.
Variables ¶
var ErrValueTooLong = errors.New("encrypted value exceeds maximum storage length")
ErrValueTooLong is returned when an encrypted value exceeds the database column limit.
Functions ¶
func ContextIDOf ¶
ContextIDOf parses the key id out of an ENC:v1 envelope.
func GenerateHMACSignature ¶
GenerateHMACSignature generates an HMAC-SHA256 signature for the payload. Returns the signature in the format "sha256=<hex-encoded-mac>".
func IsEncrypted ¶
IsEncrypted returns true if the value has the ENC: prefix indicating encryption.
Types ¶
type EncryptionContext ¶
EncryptionContext tracks key version and cipher metadata.
type SettingsEncryptor ¶
type SettingsEncryptor struct {
// contains filtered or unexported fields
}
SettingsEncryptor encrypts and decrypts setting values using AES-256-GCM.
func NewSettingsEncryptor ¶
func NewSettingsEncryptor(ctx context.Context, provider secrets.Provider) (*SettingsEncryptor, error)
NewSettingsEncryptor creates a new encryptor using the secrets provider. If no encryption key is found, returns a disabled encryptor that passes values through.
func NewSettingsEncryptorFromKeyring ¶
func NewSettingsEncryptorFromKeyring(current []byte, currentID int, previous []byte, previousID int) (*SettingsEncryptor, error)
NewSettingsEncryptorFromKeyring builds an encryptor from raw keys with explicit ids. previousID 0 means "unknown" (selected by trial decrypt only).
func NewSettingsEncryptorFromKeys ¶
func NewSettingsEncryptorFromKeys(currentKey, previousKey []byte, contextID int) (*SettingsEncryptor, error)
NewSettingsEncryptorFromKeys creates an encryptor directly from key bytes. This is primarily for testing. contextID defaults to 1.
func (*SettingsEncryptor) CurrentPrefix ¶
func (e *SettingsEncryptor) CurrentPrefix() string
CurrentPrefix returns the envelope prefix values written by this encryptor carry.
func (*SettingsEncryptor) Decrypt ¶
func (e *SettingsEncryptor) Decrypt(value string) (string, error)
Decrypt decrypts an encrypted value. If the value doesn't have the ENC: prefix, it is returned as-is (plaintext passthrough). Tries the current key first, then the previous key if configured and the current key fails.
func (*SettingsEncryptor) Encrypt ¶
func (e *SettingsEncryptor) Encrypt(plaintext string) (string, error)
Encrypt encrypts a plaintext value using AES-256-GCM with the current key. Returns the original value unchanged if encryption is disabled.
func (*SettingsEncryptor) GetContext ¶
func (e *SettingsEncryptor) GetContext() EncryptionContext
GetContext returns the current encryption context.
func (*SettingsEncryptor) HasPreviousKey ¶
func (e *SettingsEncryptor) HasPreviousKey() bool
HasPreviousKey returns true if a previous key is configured for key rotation.
func (*SettingsEncryptor) IsEnabled ¶
func (e *SettingsEncryptor) IsEnabled() bool
IsEnabled returns true if encryption is configured and active.
Source Files