Documentation
¶
Index ¶
- Constants
- func CRC32Base62(data string, width int) string
- func CompareBcryptHash(hash, password string) (bool, error)
- func DecodeHexKey256(hexKey string) ([]byte, error)
- func DecryptAESGCM(encoded string, key, aad []byte) ([]byte, error)
- func EncryptAESGCM(plaintext, key, aad []byte, keyID string) (string, error)
- func HMACSHA256(key, data []byte) []byte
- func HashBcrypt(password string) (string, error)
- func RandAlphanumericBytes(n int) ([]byte, error)
- func RandAlphanumericString(n int) (string, error)
- func RandHexString(n int) (string, error)
- func VerifyHMACSHA256(key, data, expected []byte) bool
- type AESGCMEnvelope
Constants ¶
const ( // AESGCMEncodedVersion is the current envelope version. // // Format: // enc_v1_k<keyID>_<b64url(nonce || ciphertext || tag)> AESGCMEncodedVersion = "enc_v1" // AESGCMKeyBytes is the required key length for AES-256-GCM. AESGCMKeyBytes = 32 )
Variables ¶
This section is empty.
Functions ¶
func CRC32Base62 ¶
CRC32Base62 computes a CRC32-C (Castagnoli) checksum of data and returns it as a base-62 [a-zA-Z0-9] string left-padded to the given width.
func CompareBcryptHash ¶
CompareBcryptHash compares a plaintext password against a bcrypt hash. Returns (false, nil) when the password does not match, and (false, error) for unexpected errors (e.g. malformed hash).
func DecodeHexKey256 ¶
DecodeHexKey256 decodes a hex-encoded AES-256 key.
The hex string must decode to exactly 32 bytes (64 hex characters).
func DecryptAESGCM ¶
DecryptAESGCM decrypts a previously generated envelope string.
Params:
- encoded: string returned by EncryptAESGCM.
- key: the AES-256 key corresponding to envelope.KeyID.
- aad: must match the aad used at encryption time.
Returns:
- plaintext on success.
- error if parsing fails, key is wrong, aad mismatches, or ciphertext is invalid.
func EncryptAESGCM ¶
EncryptAESGCM encrypts plaintext using AES-256-GCM and returns a fully encoded envelope string suitable for storage in a database.
Params:
- plaintext: data to encrypt
- key: 32-byte AES-256 key
- aad: associated data (optional); must be present to decrypt if provided
- keyID: identifier for key rotation; included in the envelope
func HMACSHA256 ¶
HMACSHA256 computes the HMAC-SHA256 of data using the provided key. Returns a 32-byte MAC.
func HashBcrypt ¶
HashBcrypt hashes a plaintext password using bcrypt with the default cost factor.
func RandAlphanumericBytes ¶
RandAlphanumericBytes returns an output of length n, where each byte is an ASCII character chosen uniformly from [a-zA-Z0-9]. The output length n is both the number of characters and the number of bytes in the returned slice.
func RandAlphanumericString ¶
RandAlphanumericString returns a random alphanumeric string of length n, implemented on top of RandAlphanumericBytes.
func RandHexString ¶
RandHexString returns a hex-encoded string of n random bytes (2*n hex characters). Useful for random tokens or passwords.
func VerifyHMACSHA256 ¶
VerifyHMACSHA256 computes the HMAC-SHA256 of data using the provided key and compares it against expected using a constant-time comparison.
Types ¶
type AESGCMEnvelope ¶
type AESGCMEnvelope struct {
// Envelope version string (e.g. "enc_v1")
Version string
// Identifier used to select the correct encryption key for decryption
KeyID string
// Base64 URL-safe (no padding) encoding of (nonce || ciphertext || tag)
Payload string
}
AESGCMEnvelope represents a parsed AES-GCM envelope.
func ParseAESGCMEnvelope ¶
func ParseAESGCMEnvelope(encoded string) (AESGCMEnvelope, error)
ParseAESGCMEnvelope parses an encoded AES-GCM envelope string into a struct.
Expected format:
enc_v1_k<keyID>_<payload>
Returns:
- AESGCMEnvelope struct containing Version, KeyID, and Payload.
- error if the format or version is invalid.
Callers typically:
- Parse envelope
- Use KeyID to select key
- Call DecryptAESGCM with that key
Source Files