Documentation
¶
Index ¶
- func GenerateJWTKeysetsFromCloudKMS(keyUri string, credentialsJSON []byte) (privateEc256 []byte, publicEc256 []byte, publicHandle []byte, err error)
- func GenerateLocalKeys() (masterKey []byte, privateEc256 []byte, publicEc256 []byte, ...)
- func InsecureHandleFromBytes(keysetBytes []byte) (*keyset.Handle, error)
- func NewCloudKMSEncryption(keyUri string, credentialsJSON, privateEc256, publicEc256 []byte) (*cloudkmsEncryptionService, error)
- func NewInsecureJWTEncryption(privateEc256, publicEc256 []byte) (*insecureJWTEncryptionService, error)
- func NewLocalEncryption(masterKey []byte, privateEc256 []byte, publicEc256 []byte) (*localEncryptionService, error)
- type EncryptionService
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GenerateLocalKeys ¶
func InsecureHandleFromBytes ¶ added in v0.83.15
InsecureHandleFromBytes reconstructs a keyset.Handle from a base64 raw-encoded JSON keyset without using a master key. It should only be used with public or cleartext keysets in trusted environments, as the key material is not encrypted at rest.
func NewCloudKMSEncryption ¶
func NewCloudKMSEncryption(keyUri string, credentialsJSON, privateEc256, publicEc256 []byte) (*cloudkmsEncryptionService, error)
NewCloudKMSEncryption creates a GCP CloudKMS-backed encryption service.
func NewInsecureJWTEncryption ¶ added in v0.94.0
func NewInsecureJWTEncryption(privateEc256, publicEc256 []byte) (*insecureJWTEncryptionService, error)
NewInsecureJWTEncryption builds an EncryptionService from cleartext JWT keysets; only the JWT handles are usable, Encrypt/Decrypt return errors.
func NewLocalEncryption ¶
func NewLocalEncryption(masterKey []byte, privateEc256 []byte, publicEc256 []byte) (*localEncryptionService, error)
NewLocalEncryption creates a new local encryption service. keysetBytes is the raw keyset in base64-encoded JSON format. This can be generated by calling hatchet-admin keyset create-local.
Types ¶
type EncryptionService ¶
type EncryptionService interface {
// Encrypt encrypts the given plaintext with the given data id. The data id is used to
// associate the ciphertext with the data in the database.
// For more information, see: https://developers.google.com/tink/client-side-encryption#kms_envelope_aead
Encrypt(plaintext []byte, dataId string) ([]byte, error)
// Decrypt decrypts the given ciphertext with the given data id. The data id is used to
// associate the ciphertext with the data in the database.
// For more information, see: https://developers.google.com/tink/client-side-encryption#kms_envelope_aead
Decrypt(ciphertext []byte, dataId string) ([]byte, error)
// EncryptString encrypts a string using base64 internally
EncryptString(plaintext string, dataId string) (string, error)
// DecryptString decrypts a string using base64 internally
DecryptString(ciphertext string, dataId string) (string, error)
// GetPrivateJWTHandle returns a private JWT handle. This is used to sign JWTs.
GetPrivateJWTHandle() *keyset.Handle
// GetPublicJWTHandle returns a public JWT handle. This is used to verify JWTs.
GetPublicJWTHandle() *keyset.Handle
}
func NewCloudKMSDataEncryption ¶
func NewCloudKMSDataEncryption(keyUri string, credentialsJSON []byte) (EncryptionService, error)
NewCloudKMSDataEncryption creates a GCP CloudKMS-backed encryption service for data encryption only, the CloudKMS counterpart of NewLocalDataEncryption. GetPrivateJWTHandle and GetPublicJWTHandle return nil.
func NewLocalDataEncryption ¶
func NewLocalDataEncryption(masterKey []byte) (EncryptionService, error)
NewLocalDataEncryption creates a local encryption service for data encryption only, from the master keyset alone. It shares the envelope construction with NewLocalEncryption, so ciphertext written by either is readable by the other. Processes that never issue or verify JWTs (the out-of-process serverless operator) use this so they need not be given the JWT keysets; GetPrivateJWTHandle and GetPublicJWTHandle return nil.
Source Files