Documentation
¶
Index ¶
- Variables
- func CheckHMACKey(key []byte) error
- func GenerateJWTKeysetsFromCloudKMS(keyUri string, credentialsJSON []byte) (privateEc256 []byte, publicEc256 []byte, publicHandle []byte, err error)
- func GenerateLocalKeys() (masterKey []byte, privateEc256 []byte, publicEc256 []byte, ...)
- func InsecureHandleFromBytes(keysetBytes []byte) (*keyset.Handle, error)
- func NewCloudKMSEncryption(keyUri string, credentialsJSON, privateEc256, publicEc256 []byte) (*cloudkmsEncryptionService, error)
- func NewHMAC(h func() hash.Hash, key []byte) (hash.Hash, error)
- func NewInsecureJWTEncryption(privateEc256, publicEc256 []byte) (*insecureJWTEncryptionService, error)
- func NewLocalEncryption(masterKey []byte, privateEc256 []byte, publicEc256 []byte) (*localEncryptionService, error)
- func RequireFIPSBuild() error
- type EncryptionService
Constants ¶
This section is empty.
Variables ¶
var ErrHMACKeyTooShort = errors.New("HMAC keys shorter than 112 bits are not permitted in FIPS mode")
ErrHMACKeyTooShort is returned in FIPS mode for HMAC keys under 112 bits.
Functions ¶
func CheckHMACKey ¶ added in v0.111.0
CheckHMACKey reports whether key may be used with HMAC under the current FIPS mode.
func GenerateLocalKeys ¶
func InsecureHandleFromBytes ¶ added in v0.83.15
InsecureHandleFromBytes reconstructs a keyset.Handle from a base64 raw-encoded JSON keyset without using a master key. It should only be used with public or cleartext keysets in trusted environments, as the key material is not encrypted at rest.
func NewCloudKMSEncryption ¶
func NewCloudKMSEncryption(keyUri string, credentialsJSON, privateEc256, publicEc256 []byte) (*cloudkmsEncryptionService, error)
NewCloudKMSEncryption creates a GCP CloudKMS-backed encryption service.
func NewHMAC ¶ added in v0.111.0
NewHMAC is hmac.New with the FIPS key-length check applied first, so a short key is an error instead of a panic.
func NewInsecureJWTEncryption ¶ added in v0.94.0
func NewInsecureJWTEncryption(privateEc256, publicEc256 []byte) (*insecureJWTEncryptionService, error)
NewInsecureJWTEncryption builds an EncryptionService from cleartext JWT keysets; only the JWT handles are usable, Encrypt/Decrypt return errors.
func NewLocalEncryption ¶
func NewLocalEncryption(masterKey []byte, privateEc256 []byte, publicEc256 []byte) (*localEncryptionService, error)
NewLocalEncryption creates a new local encryption service. keysetBytes is the raw keyset in base64-encoded JSON format. This can be generated by calling hatchet-admin keyset create-local.
func RequireFIPSBuild ¶ added in v0.111.0
func RequireFIPSBuild() error
RequireFIPSBuild fails when a binary built with GOFIPS140 is running with FIPS mode disabled, which only happens if GODEBUG=fips140=off overrides the build default at runtime.
Types ¶
type EncryptionService ¶
type EncryptionService interface {
// Encrypt encrypts the given plaintext with the given data id. The data id is used to
// associate the ciphertext with the data in the database.
// For more information, see: https://developers.google.com/tink/client-side-encryption#kms_envelope_aead
Encrypt(plaintext []byte, dataId string) ([]byte, error)
// Decrypt decrypts the given ciphertext with the given data id. The data id is used to
// associate the ciphertext with the data in the database.
// For more information, see: https://developers.google.com/tink/client-side-encryption#kms_envelope_aead
Decrypt(ciphertext []byte, dataId string) ([]byte, error)
// EncryptString encrypts a string using base64 internally
EncryptString(plaintext string, dataId string) (string, error)
// DecryptString decrypts a string using base64 internally
DecryptString(ciphertext string, dataId string) (string, error)
// GetPrivateJWTHandle returns a private JWT handle. This is used to sign JWTs.
GetPrivateJWTHandle() *keyset.Handle
// GetPublicJWTHandle returns a public JWT handle. This is used to verify JWTs.
GetPublicJWTHandle() *keyset.Handle
}
Source Files