Documentation
¶
Overview ¶
Package crypto provides authenticated symmetric encryption for data at rest — e.g. connector credentials sealed before they are written to Postgres. The core interfaces.Encryptor contract is backed here by AES-256-GCM with a fresh random nonce per message; the key is injected from configuration, never hardcoded.
Index ¶
Constants ¶
const KeySize = 32
KeySize is the required key length in bytes for AES-256.
Variables ¶
This section is empty.
Functions ¶
func New ¶
func New(key []byte) (interfaces.Encryptor, error)
New builds an AES-256-GCM interfaces.Encryptor over a 32-byte key. It fails loudly on a key of the wrong length rather than silently truncating or padding it.
func NewFromConfig ¶
func NewFromConfig(cfg Config) (interfaces.Encryptor, error)
NewFromConfig builds an interfaces.Encryptor from cfg: it base64-decodes the key and fails loudly on a missing key, invalid base64, or a decoded length other than 32 bytes (New enforces the length), so bad key material is rejected at startup, not first use.
Source Files