Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type AppKeyset ¶
type AppKeyset struct {
// contains filtered or unexported fields
}
func MustAppKeyset ¶
func MustAppKeyset(cfg AppKeysetConfig) *AppKeyset
Panics if anything is misconfigured. If desired, you can defer the panic to the first use (rather than at instantiation) by passing in a true boolean as the second argument.
type AppKeysetConfig ¶
type AppKeysetConfig struct {
// Provide a latest-first slice of environment variable names pointing
// to base64-encoded 32-byte root secrets.
// Example: []string{"CURRENT_SECRET", "PREVIOUS_SECRET"}
LatestFirstEnvVarNames []string
// Passed into the salt parameter of downstream HKDF functions.
// Once set, do not change this unless you want and entirely new keyset.
ApplicationName string
// When instantiated via MustAppKeyset, if this is true, panics
// due to misconfiguration are deferred to the first use of the
// keyset rather than at instantiation time.
DeferPanic bool
}
type Keyset ¶
type Keyset struct {
// contains filtered or unexported fields
}
func FromUnwrapped ¶
func FromUnwrapped(uks UnwrappedKeyset) (*Keyset, error)
func LoadRootKeyset ¶
Pass in a latest-first slice of environment variable names pointing to base64-encoded 32-byte root secrets. Example: LoadRootKeyset("CURRENT_SECRET", "PREVIOUS_SECRET")
func RootSecretsToRootKeyset ¶
func RootSecretsToRootKeyset(rootSecrets RootSecrets) (*Keyset, error)
RootSecretsToRootKeyset converts a slice of base64-encoded root secrets into a Keyset.
func (*Keyset) First ¶
func (wk *Keyset) First() (cryptoutil.Key32, error)
First returns the first key in the keyset and returns an error if the keyset is nil or empty or if the first key is nil.
func (*Keyset) HKDF ¶
Keyset.HKDF applies HKDF to each key in the base Keyset using the provided salt and info string, returning a new Keyset consisting of the derived keys.
func (*Keyset) Unwrap ¶
func (wk *Keyset) Unwrap() UnwrappedKeyset
Unwrap returns the underlying UnwrappedKeyset, which is a latest-first slice of size 32 byte array pointers.
type RootSecret ¶
type RootSecret = string
Base64-encoded 32-byte root secret. To generate new root secrets, run `openssl rand -base64 32`.
type RootSecrets ¶
type RootSecrets []RootSecret
Latest-first slice of base64-encoded 32-byte root secrets. To generate new root secrets, run `openssl rand -base64 32`.
func LoadRootSecrets ¶
func LoadRootSecrets(latestFirstEnvVarNames ...string) (RootSecrets, error)
Pass in a latest-first slice of environment variable names pointing to base64-encoded 32-byte root secrets. Example: LoadRootSecrets("CURRENT_SECRET", "PREVIOUS_SECRET")
type UnwrappedKeyset ¶
type UnwrappedKeyset []cryptoutil.Key32
Latest-first slice of size 32 byte array pointers
Source Files