Documentation
¶
Overview ¶
Package crypto provides AES-256-GCM encryption for credential storage.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func VaultExists ¶
VaultExists reports whether a vault key is already configured (env var set or key file exists on disk). It performs a read-only passive check and does NOT create files or initialize the vault.
Types ¶
type Vault ¶
type Vault struct {
// contains filtered or unexported fields
}
Vault provides AES-256-GCM encryption using a single master key.
func NewVault ¶
NewVault creates a Vault by loading or generating the encryption key. Key loading priority: 1. cfg.EncryptionKey (hex-decoded from ENGRAM_ENCRYPTION_KEY env var) 2. cfg.EncryptionKeyFile (read file from ENGRAM_ENCRYPTION_KEY_FILE env var) 3. Auto-generate: save to DataDir()/vault.key, log warning
func (*Vault) Decrypt ¶
Decrypt decrypts ciphertext produced by Encrypt. Expected format: nonce (12B) || ciphertext || GCM tag (16B).
func (*Vault) Encrypt ¶
Encrypt encrypts plaintext using AES-256-GCM. Returns nonce (12B) || ciphertext || GCM tag as a single byte slice.
func (*Vault) Fingerprint ¶
Fingerprint returns the first 16 hex chars of SHA-256(key).
func (*Vault) KeySource ¶
KeySource returns how the encryption key was loaded: "env", "file", or "auto_generated".
func (*Vault) MatchesFingerprint ¶
MatchesFingerprint reports whether fp matches this vault's key fingerprint. Uses constant-time comparison to avoid timing side-channels on key-derived material.
Source Files