Versions in this module Expand all Collapse all v0 v0.4.0 Aug 3, 2026 v0.3.0 Jul 31, 2026 Changes in this version + func DefaultSchemes() []string type CacheEvent + Hit bool + type CloudKey struct + func (k *CloudKey) Encrypt(ctx context.Context, _ string, dek []byte) ([]byte, error) + func (k *CloudKey) ID() string + type EnvelopeEvent struct + Crypto time.Duration + CryptoAttempted bool + CryptoErr error + Err error + Namespace string + Op Operation + Total time.Duration + type Event interface type KEK + func NewCloudKey(ctx context.Context, uri string) (KEK, error) + type KeyFactory struct + func NewKeyFactory(opts ...KeyFactoryOption) *KeyFactory + func (f *KeyFactory) Create(ctx context.Context, uri string) (KEK, error) + type KeyFactoryFunc func(context.Context, string) (KEK, error) + type KeyFactoryOption interface + func WithKeyFactoryFuncForScheme(scheme string, fn KeyFactoryFunc) KeyFactoryOption type Observer + Observe func(Event) + type Operation uint8 + const OpDecrypt + const OpEncrypt + func (o Operation) String() string + type RotationEvent struct + Namespace string + Reason RotationReason + type RotationReason uint8 + const RotationInitial + const RotationOnDemand + const RotationScheduled + func (r RotationReason) String() string v0.2.0 Jul 27, 2026 Changes in this version + var ErrMalformedCipherText = errors.New("invalid ciphertext, not encrypted with a DEK") + type CacheEvent struct + Size int + type DEK struct + func NewDEK() (*DEK, error) + func (d *DEK) Decrypt(ctx context.Context, ct []byte) ([]byte, error) + func (d *DEK) Encrypt(ctx context.Context, pt []byte) ([]byte, error) + type DEKMaterial struct + EncryptedDEK string + KEKID string + Version byte + type KEK interface + Decrypt func(context.Context, []byte) ([]byte, error) + Encrypt func(context.Context, []byte) ([]byte, error) + ID func() string + type KEKRegistry struct + func NewKEKRegistry(opts ...KEKRegistryOption) (*KEKRegistry, error) + func (r *KEKRegistry) Close() error + func (r *KEKRegistry) Decrypt(ctx context.Context, m *DEKMaterial) (*DEK, error) + func (r *KEKRegistry) Encrypt(ctx context.Context, ns string, dek *DEK) (*DEKMaterial, error) + type KEKRegistryOption interface + func WithDecryptOnlyKey(k KEK) KEKRegistryOption + func WithDefaultKey(k KEK) KEKRegistryOption + func WithKeyForNamespace(ns string, k KEK) KEKRegistryOption + type KeyConfig struct + Duration time.Duration + RenewBefore time.Duration + type Message struct + Ciphertext []byte + KeyMaterial *DEKMaterial + type NamespacedVault struct + func (v *NamespacedVault) Open(ctx context.Context, msg *Message) ([]byte, error) + func (v *NamespacedVault) Seal(ctx context.Context, data []byte) (*Message, error) + type Observer interface + CacheHit func(CacheEvent) + CacheMiss func(CacheEvent) + type Vault struct + func NewVault(r *KEKRegistry, opts ...VaultOption) (*Vault, error) + func (v *Vault) ForNamespace(ns string) *NamespacedVault + func (v *Vault) Open(ctx context.Context, msg *Message) ([]byte, error) + func (v *Vault) Refresh() error + func (v *Vault) Seal(ctx context.Context, ns string, data []byte) (*Message, error) + type VaultOption func(*vaultOptions) + func WithCacheSize(n int) VaultOption + func WithDefaultKeyConfig(cfg KeyConfig) VaultOption + func WithKeyConfig(ns string, cfg KeyConfig) VaultOption + func WithNowFunc(fn func() time.Time) VaultOption + func WithObserver(o Observer) VaultOption
Go to main page