Documentation
¶
Index ¶
- Variables
- func CheckHMACKey(key []byte) error
- func GenerateJWTKeysetsFromCloudKMS(keyUri string, credentialsJSON []byte) (privateEc256 []byte, publicEc256 []byte, publicHandle []byte, err error)
- func GenerateLocalKeys() (masterKey []byte, privateEc256 []byte, publicEc256 []byte, ...)
- func InsecureHandleFromBytes(keysetBytes []byte) (*keyset.Handle, error)
- func NewCloudKMSEncryption(keyUri string, credentialsJSON, privateEc256, publicEc256 []byte) (*cloudkmsEncryptionService, error)
- func NewHMAC(h func() hash.Hash, key []byte) (hash.Hash, error)
- func NewInsecureJWTEncryption(privateEc256, publicEc256 []byte) (*insecureJWTEncryptionService, error)
- func NewLocalEncryption(masterKey []byte, privateEc256 []byte, publicEc256 []byte) (*localEncryptionService, error)
- func RequireFIPSBuild() error
- func SHA1Allowed() (allowed bool)
- type EncryptionService
Constants ¶
This section is empty.
Variables ¶
var ErrHMACKeyTooShort = errors.New("HMAC keys shorter than 112 bits are not permitted in FIPS mode")
ErrHMACKeyTooShort is returned in FIPS mode for HMAC keys under 112 bits.
Functions ¶
func CheckHMACKey ¶ added in v0.111.0
CheckHMACKey reports whether key may be used with HMAC under the current FIPS mode.
func GenerateLocalKeys ¶
func InsecureHandleFromBytes ¶ added in v0.83.15
InsecureHandleFromBytes reconstructs a keyset.Handle from a base64 raw-encoded JSON keyset without using a master key. It should only be used with public or cleartext keysets in trusted environments, as the key material is not encrypted at rest.
func NewCloudKMSEncryption ¶
func NewCloudKMSEncryption(keyUri string, credentialsJSON, privateEc256, publicEc256 []byte) (*cloudkmsEncryptionService, error)
NewCloudKMSEncryption creates a GCP CloudKMS-backed encryption service.
func NewHMAC ¶ added in v0.111.0
NewHMAC is hmac.New with the FIPS key-length check applied first, so a short key is an error instead of a panic.
func NewInsecureJWTEncryption ¶ added in v0.94.0
func NewInsecureJWTEncryption(privateEc256, publicEc256 []byte) (*insecureJWTEncryptionService, error)
NewInsecureJWTEncryption builds an EncryptionService from cleartext JWT keysets; only the JWT handles are usable, Encrypt/Decrypt return errors.
func NewLocalEncryption ¶
func NewLocalEncryption(masterKey []byte, privateEc256 []byte, publicEc256 []byte) (*localEncryptionService, error)
NewLocalEncryption creates a new local encryption service. keysetBytes is the raw keyset in base64-encoded JSON format. This can be generated by calling hatchet-admin keyset create-local.
func RequireFIPSBuild ¶ added in v0.111.0
func RequireFIPSBuild() error
RequireFIPSBuild fails when a binary built with GOFIPS140 is running with FIPS mode disabled, which only happens if GODEBUG=fips140=off overrides the build default at runtime.
func SHA1Allowed ¶ added in v0.113.0
func SHA1Allowed() (allowed bool)
SHA1Allowed reports whether this process may compute SHA-1 digests. GODEBUG=fips140=only makes crypto/sha1 panic, which rules out protocols whose handshake is specified over SHA-1, such as the RFC 6455 websocket upgrade.
Types ¶
type EncryptionService ¶
type EncryptionService interface {
// Encrypt encrypts the given plaintext with the given data id. The data id is used to
// associate the ciphertext with the data in the database.
// For more information, see: https://developers.google.com/tink/client-side-encryption#kms_envelope_aead
Encrypt(plaintext []byte, dataId string) ([]byte, error)
// Decrypt decrypts the given ciphertext with the given data id. The data id is used to
// associate the ciphertext with the data in the database.
// For more information, see: https://developers.google.com/tink/client-side-encryption#kms_envelope_aead
Decrypt(ciphertext []byte, dataId string) ([]byte, error)
// EncryptString encrypts a string using base64 internally
EncryptString(plaintext string, dataId string) (string, error)
// DecryptString decrypts a string using base64 internally
DecryptString(ciphertext string, dataId string) (string, error)
// GetPrivateJWTHandle returns a private JWT handle. This is used to sign JWTs.
GetPrivateJWTHandle() *keyset.Handle
// GetPublicJWTHandle returns a public JWT handle. This is used to verify JWTs.
GetPublicJWTHandle() *keyset.Handle
}
func NewCloudKMSDataEncryption ¶ added in v0.113.0
func NewCloudKMSDataEncryption(keyUri string, credentialsJSON []byte) (EncryptionService, error)
NewCloudKMSDataEncryption creates a GCP CloudKMS-backed encryption service for data encryption only, the CloudKMS counterpart of NewLocalDataEncryption. GetPrivateJWTHandle and GetPublicJWTHandle return nil.
func NewLocalDataEncryption ¶ added in v0.113.0
func NewLocalDataEncryption(masterKey []byte) (EncryptionService, error)
NewLocalDataEncryption creates a local encryption service for data encryption only, from the master keyset alone. It shares the envelope construction with NewLocalEncryption, so ciphertext written by either is readable by the other. Processes that never issue or verify JWTs (the out-of-process serverless operator) use this so they need not be given the JWT keysets; GetPrivateJWTHandle and GetPublicJWTHandle return nil.
Source Files