credentialhash

package

v0.16.0 Latest Latest Go to latest Published: Sep 4, 2026 License: MIT Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/forgekeep/nebula-mesh

Links

Open Source Insights

Documentation ¶

Overview ¶

Package credentialhash creates keyed, domain-separated credential digests.

Index ¶

type Hasher
- func New(master []byte) (*Hasher, error)
- func (h *Hasher) Destroy()
- func (h *Hasher) Digest(purpose Purpose, raw []byte) (string, error)
type Purpose

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Hasher ¶

type Hasher struct {
	// contains filtered or unexported fields
}

Hasher holds the derived root key used to produce credential digests.

func New ¶

func New(master []byte) (*Hasher, error)

New derives a credential-digest root key from master.

func (*Hasher) Destroy ¶

func (h *Hasher) Destroy()

Destroy zeroizes the derived root key and disables future digests.

func (*Hasher) Digest ¶

func (h *Hasher) Digest(purpose Purpose, raw []byte) (string, error)

Digest returns a versioned HMAC-SHA256 digest for raw in the given domain.

type Purpose ¶

type Purpose string

Purpose identifies the credential type to hash.

const (
	PurposeOperatorAPIKey   Purpose = "operator-api-key"
	PurposeOperatorSession  Purpose = "operator-session"
	PurposeEnrollmentToken  Purpose = "enrollment-token"
	PurposeMeshImportToken  Purpose = "mesh-import-token" // #nosec G101 -- public domain label, not credential material
	PurposeTOTPRecoveryCode Purpose = "totp-recovery-code"
)

Source Files ¶

View all Source files

hasher.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL