Documentation
¶
Overview ¶
Package crypto provides AES-256-GCM encryption for cloud profile credentials.
Index ¶
- Constants
- func DecryptWithKey(encrypted, key []byte) ([]byte, error)
- func DeriveProfileKey(masterKey []byte, provider, name string) []byte
- func EncryptWithKey(data, key []byte) ([]byte, error)
- func GenerateKey() ([]byte, error)
- func GetMachineID() (string, error)
- func GetOrCreateMasterKey(baseDir string) ([]byte, error)
- func LoadMasterKey(baseDir string) ([]byte, error)
- type MasterKeyData
Constants ¶
const ( // KeySize is the AES-256 key size in bytes. KeySize = 32 // NonceSize is the GCM nonce size in bytes. NonceSize = 12 // TagSize is the GCM authentication tag size in bytes. TagSize = 16 // MinEncryptedSize is the minimum size of encrypted data (nonce + tag). MinEncryptedSize = NonceSize + TagSize // PrefixEncrypted indicates encrypted data. PrefixEncrypted = "ENC:" // PrefixOpen indicates unencrypted data (fallback mode). PrefixOpen = "OPEN:" )
Variables ¶
This section is empty.
Functions ¶
func DecryptWithKey ¶
DecryptWithKey decrypts data using AES-256-GCM with the provided key. Expects input format: [12-byte nonce][ciphertext][16-byte GCM tag]
func DeriveProfileKey ¶
DeriveProfileKey derives a profile-specific encryption key from the master key. Uses SHA256(masterKey || provider:name) to create isolated keys per profile.
func EncryptWithKey ¶
EncryptWithKey encrypts data using AES-256-GCM with the provided key. Returns: [12-byte nonce][ciphertext][16-byte GCM tag]
func GenerateKey ¶
GenerateKey generates a random 32-byte encryption key.
func GetMachineID ¶
GetMachineID returns a unique identifier for the current machine. This is used to derive encryption keys that are tied to the machine. The implementation is platform-specific.
func GetOrCreateMasterKey ¶
GetOrCreateMasterKey retrieves or creates the master encryption key. The master key is encrypted using a key derived from the machine ID.
func LoadMasterKey ¶
LoadMasterKey loads and decrypts the master key from disk.
Types ¶
type MasterKeyData ¶
MasterKeyData holds the encrypted master key and its salt.
Source Files