Documentation
¶
Overview ¶
Package secure provides passphrase-based authenticated encryption for bot backup bundles.
The container wraps an arbitrary plaintext stream (the .memoh.zip bytes) so a bundle that carries credentials can be encrypted at rest. The construction is deliberately small and dependency-light, using only the standard library and golang.org/x/crypto/argon2:
- Key derivation: Argon2id over the user passphrase + a random 16-byte salt.
- Encryption: AES-256-GCM in a chunked STREAM construction (RFC-style framed AEAD, the same shape used by age/Tink streaming): the plaintext is split into fixed-size chunks, each sealed independently with a counter-based nonce, and the final chunk is tagged via a "last" flag folded into the nonce. This authenticates chunk order and detects truncation/extension.
On-disk layout:
magic[8] | kdf[1] | argonTime[4] | argonMemoryKiB[4] | argonThreads[1] | salt[16] then a sequence of frames: ciphertextLen[uint32 BE] | ciphertext
Every encrypted stream ends with a frame produced from the final (possibly empty) chunk sealed with the last flag set, so a decrypter can always tell a complete stream from a truncated one.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrPassphraseRequired is returned when an empty passphrase is supplied. ErrPassphraseRequired = errors.New("secure: passphrase required") // ErrNotEncrypted is returned when the input is not an encrypted bundle. ErrNotEncrypted = errors.New("secure: not an encrypted bundle") // ErrAuth is returned when authentication fails: a wrong passphrase or // tampered ciphertext. ErrAuth = errors.New("secure: authentication failed (wrong passphrase or corrupted data)") // ErrTruncated is returned when the stream ends before its final frame. ErrTruncated = errors.New("secure: truncated bundle") )
Functions ¶
func Decrypt ¶
Decrypt reads an encrypted bundle from src and writes the plaintext to dst. It returns ErrNotEncrypted if src does not start with the bundle magic, ErrAuth on a wrong passphrase or tampering, and ErrTruncated on a short read.
func IsEncrypted ¶
IsEncrypted reports whether raw begins with the encrypted bundle magic.
Types ¶
This section is empty.
Source Files