crypto

package

v0.0.12 Latest Latest Go to latest Published: Sep 20, 2026 License: Apache-2.0, MIT Imports: 14 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/riipandi/tango

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func SignHMAC(payload, key []byte) []byte
type Algorithm
type Cipher
- func NewCipher(key []byte) (*Cipher, error)
- func (c *Cipher) Decrypt(encoded string) (string, error)
- func (c *Cipher) Encrypt(plaintext string) (string, error)
type PasswordHasher
- func NewPasswordHasher() *PasswordHasher

Constants ¶

View Source

const EncPrefix = "enc:"

EncPrefix marks a recoverable value sealed by this package; every stored ciphertext must carry it exactly once, case-sensitively, at the beginning of the string, with no surrounding whitespace. It is metadata, not part of the plaintext or ciphertext. Values without it are invalid — there is no unprefixed legacy format, and the prefix is not a password-hash marker.

Variables ¶

View Source

var (
	ErrUnknownAlgorithm = errors.New("crypto: unknown algorithm")
	ErrInvalidHash      = errors.New("crypto: invalid hash encoding")
)

Errors returned while decoding password hashes.

View Source

var ErrCiphertextTooShort = errors.New("crypto: ciphertext is too short")

ErrCiphertextTooShort reports a value shorter than the nonce prefix.

View Source

var ErrInvalidKeySize = errors.New("crypto: AES-256 requires a 32-byte key")

ErrInvalidKeySize reports a key that is not 32 bytes.

View Source

var ErrMissingPrefix = errors.New("crypto: value is missing the enc: prefix")

ErrMissingPrefix reports a recoverable value stored without the enc: marker.

Functions ¶

func SignHMAC ¶

func SignHMAC(payload, key []byte) []byte

SignHMAC returns the HMAC-SHA256 signature of payload under key.

Types ¶

type Algorithm ¶

type Algorithm string

Algorithm selects the password hashing scheme.

const (
	// AlgorithmScrypt is the default password hashing algorithm.
	AlgorithmScrypt Algorithm = "scrypt"

	// AlgorithmArgon2id selects Argon2id.
	AlgorithmArgon2id Algorithm = "argon2id"
)

type Cipher ¶

type Cipher struct {
	// contains filtered or unexported fields
}

Cipher encrypts and decrypts values with AES-256-GCM.

func NewCipher ¶

func NewCipher(key []byte) (*Cipher, error)

NewCipher builds a Cipher from a 32-byte key.

func (*Cipher) Decrypt ¶

func (c *Cipher) Decrypt(encoded string) (string, error)

Decrypt opens a value produced by Encrypt. The prefix must appear exactly once at the beginning, case-sensitively; values without it are rejected, and plaintext is never treated as encrypted data.

func (*Cipher) Encrypt ¶

func (c *Cipher) Encrypt(plaintext string) (string, error)

Encrypt seals plaintext with a fresh random nonce and returns the canonical "enc:<ciphertext>" form.

type PasswordHasher ¶

type PasswordHasher struct {
	// contains filtered or unexported fields
}

PasswordHasher hashes and verifies passwords with scrypt or Argon2id.

func NewPasswordHasher ¶

func NewPasswordHasher() *PasswordHasher

NewPasswordHasher returns a hasher with scrypt defaults.

func (*PasswordHasher) Hash ¶

func (h *PasswordHasher) Hash(password string) (string, error)

Hash derives a PHC-formatted password hash with a fresh random salt.

func (*PasswordHasher) Verify ¶

func (h *PasswordHasher) Verify(password, encoded string) (bool, error)

Verify reports whether password matches the encoded hash.

func (*PasswordHasher) WithAlgorithm ¶

func (h *PasswordHasher) WithAlgorithm(algorithm Algorithm) *PasswordHasher

WithAlgorithm selects the hashing scheme.

func (*PasswordHasher) WithArgon2Cost ¶

func (h *PasswordHasher) WithArgon2Cost(memoryKiB, iterations uint32, threads uint8) *PasswordHasher

WithArgon2Cost sets the Argon2id memory, iteration, and lane counts.

func (*PasswordHasher) WithKeyLength ¶

func (h *PasswordHasher) WithKeyLength(n uint32) *PasswordHasher

WithKeyLength sets the derived key length in bytes.

func (*PasswordHasher) WithSaltLength ¶

func (h *PasswordHasher) WithSaltLength(n uint32) *PasswordHasher

WithSaltLength sets the per-hash random salt length in bytes.

func (*PasswordHasher) WithScryptCost ¶

func (h *PasswordHasher) WithScryptCost(n, r uint32, p uint8) *PasswordHasher

WithScryptCost sets the scrypt cost parameters.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL