Versions in this module Expand all Collapse all v0 v0.1.0 Oct 12, 2026 Changes in this version + const DefaultCacheSize + const DefaultCacheTTL + const DefaultEncryptionCap + const DefaultMaxAge + const DefaultReserveBlock + const MaxEncryptionCap + const MaxSubjectLen + var ErrDEKNotFound = errors.New("keyforge: data key not found") + var ErrInvalidEnvelope = errors.New("keyforge: envelope inconsistent with its key") + var ErrInvalidSubject = errors.New("keyforge: invalid subject") + var ErrKEKNotFound = errors.New("keyforge: key-encryption key not found") + var ErrKeyUnavailable = errors.New("keyforge: key unavailable") + var ErrKeyUnusable = errors.New("keyforge: key unusable") + var ErrNoActiveKEK = errors.New("keyforge: no active key-encryption key") + var ErrPurposeMismatch = errors.New("keyforge: envelope purpose does not match") + var ErrSubjectNotAllowed = errors.New("keyforge: this purpose is not per-subject") + var ErrSubjectRequired = errors.New("keyforge: this purpose is per-subject and needs a subject") + var ErrSubjectShredded = errors.New("keyforge: the subject has been shredded") + var ErrUnknownPurpose = errors.New("keyforge: unknown purpose") + func DEKWrapAAD(purpose Purpose, subject string, dekID, kekID envelope.ID) []byte + func InlineWrapAAD(purpose Purpose, kekID envelope.ID) []byte + func ValidateSubject(subject string) error + type Client struct + func New(opts Options) (*Client, error) + func (c *Client) AdvanceEpoch(ctx context.Context, purpose Purpose, subject string) (DEKRecord, error) + func (c *Client) Decrypt(ctx context.Context, purpose Purpose, e *Envelope, bound []byte) (pt []byte, info Info, err error) + func (c *Client) Encrypt(ctx context.Context, purpose Purpose, plaintext, context []byte) (e *Envelope, err error) + func (c *Client) EncryptFor(ctx context.Context, purpose Purpose, subject string, ...) (e *Envelope, err error) + func (c *Client) EncryptInline(ctx context.Context, purpose Purpose, plaintext, bound []byte) (e *Envelope, err error) + func (c *Client) Purge() + func (c *Client) Reencrypt(ctx context.Context, purpose Purpose, e *Envelope, bound []byte) (_ *Envelope, err error) + func (c *Client) Verify(ctx context.Context, purposes ...Purpose) []VerifyResult + type Clock interface + Now func() time.Time + type DEKRecord struct + Algorithm algorithm.ID + CreatedAt time.Time + Epoch uint32 + ID envelope.ID + KEKID envelope.ID + KEKVersion uint32 + Purpose Purpose + Reserved uint64 + State DEKState + Subject string + Wrapped []byte + WrappedUnder []KEKVersionRef + type DEKState uint8 + const DEKActive + const DEKCompromised + const DEKDecryptOnly + const DEKDestroyed + func (s DEKState) String() string + type Envelope = envelope.Envelope + type Info struct + Epoch uint32 + KEKVersion uint32 + Mode envelope.Mode + Stale bool + Subject string + type KEKVersion struct + Ref provider.KeyRef + Version uint32 + type KEKVersionRef struct + KEKID envelope.ID + Version uint32 + type KeyRef = provider.KeyRef + type KeySpec = provider.KeySpec + type Options struct + CacheSize int + CacheTTL time.Duration + Clock Clock + EncryptionCap uint64 + Entropy io.Reader + MaxAge time.Duration + Metrics metrics.Metrics + Providers []provider.Provider + Purposes map[Purpose]PurposeConfig + ReserveBlock uint64 + Selector *algorithm.Selector + Store Store + type Purpose string + func (p Purpose) Validate() error + type PurposeConfig struct + Algorithms algorithm.Selection + EncryptionCap uint64 + MaxAge time.Duration + PerSubject bool + type Store interface + ActiveKEK func(ctx context.Context, purpose Purpose) (KEKVersion, error) + AdvanceDEK func(ctx context.Context, purpose Purpose, subject string, from uint32, ...) (DEKRecord, error) + CurrentDEK func(ctx context.Context, purpose Purpose, subject string) (DEKRecord, error) + GetDEK func(ctx context.Context, id envelope.ID) (DEKRecord, error) + KEK func(ctx context.Context, id envelope.ID) (provider.KeyRef, error) + KEKVersionUsable func(ctx context.Context, id envelope.ID, version uint32) (bool, error) + ReserveEncryptions func(ctx context.Context, id envelope.ID, n, limit uint64) (granted uint64, err error) + type VerifyCheck struct + Mode string + Outcome string + type VerifyResult struct + Checks []VerifyCheck + OK bool + Purpose Purpose
Go to main page