Documentation
¶
Index ¶
- func Decrypt(key, nonce, ciphertext []byte) ([]byte, error)
- func DeriveKey(passphrase string, salt []byte) []byte
- func Encrypt(key, plaintext []byte) (nonce, ciphertext []byte, err error)
- func GenerateDEK() ([]byte, error)
- func GenerateSalt() ([]byte, error)
- func UnlockVault(ev *EncryptedVault, passphrase string) ([]byte, error)
- type Blob
- type EncryptedVault
- type KDFParams
- type Secret
- type Set
- type SetSummary
- type Store
- func (s *Store) ChangePassphrase(oldPass, newPass string) error
- func (s *Store) CreateSet(name string) error
- func (s *Store) Delete(key string) error
- func (s *Store) DeleteSet(name string) error
- func (s *Store) Export() map[string]string
- func (s *Store) Get(key string) (string, bool)
- func (s *Store) GetSetSecrets(setName string) []Secret
- func (s *Store) Has(key string) bool
- func (s *Store) Import(secrets map[string]string) (int, error)
- func (s *Store) IsEncrypted() bool
- func (s *Store) IsLocked() bool
- func (s *Store) Keys() []string
- func (s *Store) List() []Secret
- func (s *Store) ListSets() []SetSummary
- func (s *Store) Load() error
- func (s *Store) Lock(passphrase string) error
- func (s *Store) Set(key, value string) error
- func (s *Store) SetSecretSet(key, setName string) error
- func (s *Store) SetWithSet(key, value, setName string) error
- func (s *Store) Unlock(passphrase string) error
- func (s *Store) Values() []string
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GenerateDEK ¶
GenerateDEK returns 32 random bytes for use as a data encryption key.
func GenerateSalt ¶
GenerateSalt returns 16 random bytes for use as a KDF salt.
func UnlockVault ¶
func UnlockVault(ev *EncryptedVault, passphrase string) ([]byte, error)
UnlockVault decrypts an encrypted vault, returning the plaintext secrets JSON.
Types ¶
type Blob ¶
type Blob struct {
Nonce string `json:"nonce"` // base64
Ciphertext string `json:"ciphertext"` // base64
}
Blob holds a nonce + ciphertext pair for XChaCha20-Poly1305.
type EncryptedVault ¶
type EncryptedVault struct {
Version int `json:"version"`
Encrypted bool `json:"encrypted"`
KDF KDFParams `json:"kdf"`
DEK Blob `json:"dek"`
Data Blob `json:"data"`
}
EncryptedVault is the JSON schema for secrets.enc (envelope-encrypted vault).
func ChangePassphrase ¶
func ChangePassphrase(ev *EncryptedVault, oldPass, newPass string) (*EncryptedVault, error)
ChangePassphrase re-encrypts the DEK with a new passphrase. The data ciphertext is unchanged.
type KDFParams ¶
type KDFParams struct {
Algorithm string `json:"algorithm"`
Salt string `json:"salt"` // base64
Time uint32 `json:"time"` // iterations
Memory uint32 `json:"memory"` // KiB
Threads uint8 `json:"threads"`
}
KDFParams holds the Argon2id key derivation parameters.
type Secret ¶
type Secret struct {
Key string `json:"key"`
Value string `json:"value"`
Set string `json:"set,omitempty"`
}
Secret represents a stored secret.
type SetSummary ¶
type SetSummary struct {
Name string `json:"name"`
Description string `json:"description,omitempty"`
Count int `json:"count"`
}
SetSummary is a set with its member count.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store manages secrets in a JSON file with mutex-protected access.
func (*Store) ChangePassphrase ¶
ChangePassphrase re-encrypts the DEK with a new passphrase.
func (*Store) DeleteSet ¶
DeleteSet removes a set. Secrets in the set are unassigned but not deleted.
func (*Store) GetSetSecrets ¶
GetSetSecrets returns all secrets belonging to a set, sorted by key.
func (*Store) IsEncrypted ¶
IsEncrypted returns true when the vault has an encrypted backing file.
func (*Store) ListSets ¶
func (s *Store) ListSets() []SetSummary
ListSets returns all sets with their member counts.
func (*Store) Load ¶
Load reads secrets into memory. Checks for secrets.enc first (encrypted), then falls back to secrets.json (plaintext). If the file doesn't exist, starts empty.
func (*Store) SetSecretSet ¶
SetSecretSet assigns a secret to a set (or unassigns if setName is empty).
func (*Store) SetWithSet ¶
SetWithSet adds or updates a secret and assigns it to a set.
Source Files