Documentation
¶
Overview ¶
Package agecrypt is lore's encryption boundary for portable artifacts: it wraps a whole serialized artifact byte stream in an age envelope (and reverses it), so the exported file is encrypted at rest and in transit. It deliberately does nothing clever — age (filippo.io/age) owns the header, nonce, KDF, and AEAD framing, and the artifacts it writes are ordinary age files decryptable by the standalone `age` tool. The whole stream is encrypted, vectors included (vectors are invertible to approximate plaintext, so encrypting text but not vectors would leak the corpus).
Index ¶
- Variables
- func DecryptIdentities(ciphertext, identityFile []byte) ([]byte, error)
- func DecryptPassphrase(ciphertext []byte, passphrase string) ([]byte, error)
- func EncryptPassphrase(plaintext []byte, passphrase string) ([]byte, error)
- func EncryptRecipients(plaintext []byte, recipients []string) ([]byte, error)
- func IsEncrypted(data []byte) bool
Constants ¶
This section is empty.
Variables ¶
var ErrDecrypt = errors.New("could not decrypt")
ErrDecrypt means the artifact could not be decrypted: a wrong passphrase, an identity matching no recipient, or a tampered/corrupt ciphertext. age's AEAD makes these indistinguishable by design — all mean "you do not have the key, or the bytes changed" — so they share one sentinel the CLI maps to exit 1.
Functions ¶
func DecryptIdentities ¶
DecryptIdentities decrypts using the identities parsed from an age identity file's contents; a non-matching identity or tampered ciphertext is ErrDecrypt.
func DecryptPassphrase ¶
DecryptPassphrase decrypts an age passphrase stream; a wrong passphrase or tampered ciphertext is ErrDecrypt.
func EncryptPassphrase ¶
EncryptPassphrase wraps plaintext in an age passphrase (scrypt) stream.
func EncryptRecipients ¶
EncryptRecipients wraps plaintext encrypted to the given age recipients (age1... X25519 public keys); any can later decrypt with their identity.
func IsEncrypted ¶
IsEncrypted reports whether data looks like an age stream (binary or armored), so import detects encryption from the artifact itself.
Types ¶
This section is empty.
Source Files