README
¶
encryption
AES-256-GCM and ChaCha20-Poly1305 encryption for sensitive data.
Install
go get github.com/kbukum/gokit
Quick Start
package main
import (
"fmt"
"github.com/kbukum/gokit/encryption"
)
func main() {
svc, err := encryption.NewService("my-secret-key")
if err != nil {
panic(err)
}
ciphertext, err := svc.Encrypt("sensitive data")
if err != nil {
panic(err)
}
fmt.Println(ciphertext)
plaintext, err := svc.Decrypt(ciphertext)
if err != nil {
panic(err)
}
fmt.Println(plaintext)
}
Key Types & Functions
| Name | Description |
|---|---|
Service |
AES-256-GCM encryption/decryption service |
ChaCha20Service |
ChaCha20-Poly1305 encryption/decryption service |
NewService(key string) |
Create AES-GCM service using PBKDF2-SHA256 with a random salt per encryption |
NewChaCha20(key string) |
Create ChaCha20-Poly1305 service using PBKDF2-SHA256 with a random salt per encryption |
Encrypt(plaintext string) |
Encrypt to a versioned envelope `base64(version |
Decrypt(ciphertext string) |
Decrypt from base64-encoded ciphertext |
Documentation
¶
Overview ¶
Package encryption provides authenticated encryption utilities for sensitive data in gokit applications.
It supports AES-256-GCM and ChaCha20-Poly1305 with PBKDF2-SHA256 key derivation, producing ciphertexts encoded as base64(version || algorithm || salt || nonce || ciphertext).
Usage ¶
enc, err := encryption.New("my-secret-passphrase")
ciphertext, err := enc.Encrypt(plaintext)
plaintext, err := enc.Decrypt(ciphertext)
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ChaCha20Service ¶
type ChaCha20Service struct {
// contains filtered or unexported fields
}
ChaCha20Service handles encryption/decryption using ChaCha20-Poly1305. This is a modern AEAD cipher that performs well on CPUs without AES hardware acceleration (e.g., ARM devices, older processors).
func NewChaCha20 ¶
func NewChaCha20(key string) (*ChaCha20Service, error)
NewChaCha20 creates a new ChaCha20-Poly1305 encryption service. The passphrase is stretched with PBKDF2-SHA256 using a random 16-byte salt per encryption.
type Encryptor ¶
type Encryptor interface {
Encrypt(plaintext string) (string, error)
Decrypt(ciphertext string) (string, error)
}
Encryptor defines the interface for symmetric encryption and decryption. Projects choose which implementation to use based on their requirements.
func New ¶
New creates an Encryptor with the given key and options. Default algorithm is AES-256-GCM. Use WithAlgorithm to select ChaCha20-Poly1305.
The passphrase is stretched with PBKDF2-SHA256 and each ciphertext is a base64-encoded versioned envelope: version || algorithm || salt || nonce || ciphertext, with the header authenticated as AEAD associated data (wire-compatible with rskit).
type Option ¶
type Option func(*options)
Option configures the encryption service.
func WithAlgorithm ¶
WithAlgorithm selects the encryption algorithm (default: AES-256-GCM).
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service handles encryption/decryption of sensitive data using AES-256-GCM.
func NewService ¶
NewService creates a new encryption service with the given key. The passphrase is stretched with PBKDF2-SHA256 using a random 16-byte salt per encryption.
Source Files