Documentation
¶
Overview ¶
Package cryptoutil provides symmetric encryption for per-user secrets at rest: AES-256-GCM with a 96-bit random nonce, ciphertext and nonce returned as separate byte slices, 32-byte keys decoded from base64.
Index ¶
Constants ¶
View Source
const KeySize = 32
AES-256 key size in bytes.
View Source
const NonceSize = 12
GCM nonce size in bytes (96 bits; the standard recommendation).
Variables ¶
View Source
var ( // ErrInvalidKey is returned when the supplied key is not exactly 32 bytes. ErrInvalidKey = errors.New("cryptoutil: key must be 32 bytes (AES-256)") // ErrInvalidCiphertext is returned when the ciphertext fails authentication // or is malformed. ErrInvalidCiphertext = errors.New("cryptoutil: ciphertext could not be decrypted") )
Functions ¶
func GenerateKey ¶
GenerateKey returns a cryptographically random 32-byte key suitable for AES-256. Intended for development tooling and tests.
func GenerateKeyBase64 ¶
GenerateKeyBase64 returns GenerateKey encoded as standard base64.
Types ¶
type AEAD ¶
type AEAD struct {
// contains filtered or unexported fields
}
AEAD wraps an AES-256-GCM cipher with helper methods. Construct via New or NewFromBase64.
func NewFromBase64 ¶
NewFromBase64 decodes a standard or URL-safe base64 string and constructs an AEAD.
Source Files
Click to show internal directories.
Click to hide internal directories.