encryption

type Encryptor interface {
	// Encrypt appends the encrypted bytes corresponding to the given plaintext to a given slice.
	// Must not clobber the input slice and return ciphertext with additional padding and checksum.
	Encrypt(output, plainText, contentID []byte) ([]byte, error)

	// Decrypt appends the unencrypted bytes corresponding to the given ciphertext to a given slice.
	// Must not clobber the input slice. If IsAuthenticated() == true, Decrypt will perform
	// authenticity check before decrypting.
	Decrypt(output, cipherText, contentID []byte) ([]byte, error)

	// IsAuthenticated returns true if encryption is authenticated.
	// In this case Decrypt() is expected to perform authenticity check.
	IsAuthenticated() bool

	// IsDeprecated returns true if encryption is not recommended for new repositories.
	IsDeprecated() bool

	// MaxOverhead is the maximum number of bytes of overhead added by Encrypt()
	MaxOverhead() int
}

type EncryptorFactory func(p Parameters) (Encryptor, error)

type Parameters interface {
	GetEncryptionAlgorithm() string
	GetMasterKey() []byte
}