Documentation
¶
Overview ¶
Package credential encrypts provider credential values at rest.
An encrypted value is self-describing:
enc:v1:<keyID>:<base64url(nonce || AES-256-GCM ciphertext)>
so protection is a property of each stored value, never of the config. Anything without the prefix is plaintext. The additional authenticated data is the provider ID and the credential's key joined by a zero byte, so a ciphertext copied into another provider, or under another key name, fails to decrypt instead of quietly becoming someone else's secret.
Index ¶
Constants ¶
const ( ProtectionAESGCM = "aes-256-gcm" ProtectionPlaintext = "plaintext" )
Protection values reported per credential value.
const KeySize = 32
KeySize is the only key length accepted: AES-256.
Variables ¶
var ( // configured, or no key is configured at all. ErrKeyUnavailable = errors.New("credential key is not configured") // ErrMalformed means a value has the encrypted prefix but can't be read. ErrMalformed = errors.New("credential value is malformed") )
Functions ¶
func Describe ¶
Describe reports how one stored value is protected, and under which key. An absent marker means plaintext, never "unknown".
func IsEncrypted ¶
IsEncrypted reports whether a stored value carries the encrypted prefix.
Types ¶
type Cipher ¶
type Cipher struct {
// contains filtered or unexported fields
}
Cipher encrypts with its primary key and decrypts with any configured key. A nil *Cipher is valid: it passes plaintext through and refuses ciphertext.
func NewCipher ¶
NewCipher builds a Cipher that encrypts with primary and can also decrypt values written under any of previous.
func (*Cipher) Decrypt ¶
Decrypt opens a stored value. Plaintext passes through unchanged, so callers can decrypt a map without checking each value first.
Source Files