The highest tagged major version is
Documentation
¶
Overview ¶
Package aes contains the interfaces and implementations for encrypting and decrypting data.
Index ¶
Constants ¶
const KeyLength = 32
KeyLength is the key size this package accepts, in bytes. AES-256 is the only size offered: a configurable one invites a 16-byte key chosen by accident, and nothing here is short of entropy.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Cipher ¶
type Cipher struct {
// contains filtered or unexported fields
}
Cipher is the AES-256-GCM encryption.Cipher implementation. It is exported, and returned by NewCipher, so a caller who has chosen AES-256-GCM can depend on that choice rather than on the interface every cipher shares.
func NewCipher ¶
NewCipher builds an AES-256-GCM Cipher over key.
The AEAD is constructed once here rather than per operation. Key schedule setup is not free, and doing it on every Encrypt was a per-row cost paid for nothing.
func (*Cipher) Open ¶
Open reverses Seal.
Every way of failing to authenticate collapses to encryption.ErrAuthenticationFailed: a tampered ciphertext, the wrong key, and associated data that does not match all produce the same GCM failure, and reporting which one it was would answer a question only an attacker is asking.
func (*Cipher) Seal ¶
Seal encrypts plaintext, authenticating associatedData alongside it.
The output is nonce || ciphertext || tag, unencoded. The previous surface base64'd its result because it returned a string; a []byte surface has nothing to escape, and a caller that needs text can encode once at the boundary that needs it rather than paying a third in size at rest.
type Option ¶
type Option func(*options)
Option configures the encryptor this package constructs. The zero configuration works: an absent logger logs nowhere and an absent tracer provider traces nowhere.
func WithTracerProvider ¶
WithTracerProvider attaches a tracer provider, enabling spans on every operation.
Source Files