Documentation
¶
Overview ¶
Package crypto provides AES-256-GCM encryption for Vault secrets.
Index ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var ErrInvalidKeySize = errors.New("crypto: key must be exactly 32 bytes for AES-256")
ErrInvalidKeySize is returned when the key is not exactly 32 bytes.
Functions ¶
This section is empty.
Types ¶
type EncryptionKeyProvider ¶
type EncryptionKeyProvider interface {
// GetKey returns the current encryption key.
GetKey(ctx context.Context) ([]byte, error)
// RotateKey generates and stores a new key, returning it.
RotateKey(ctx context.Context) ([]byte, error)
}
EncryptionKeyProvider retrieves and rotates encryption keys.
type Encryptor ¶
type Encryptor struct {
// contains filtered or unexported fields
}
Encryptor provides AES-256-GCM encryption and decryption.
func NewEncryptor ¶
NewEncryptor creates an Encryptor from a 32-byte AES-256 key.
type EnvKeyProvider ¶
type EnvKeyProvider struct {
// contains filtered or unexported fields
}
EnvKeyProvider reads the encryption key from an environment variable. The key can be hex-encoded or base64-encoded (auto-detected).
func NewEnvKeyProvider ¶
func NewEnvKeyProvider(envVar string) *EnvKeyProvider
NewEnvKeyProvider creates a provider that reads the key from the given env var.
type KeyStore ¶
type KeyStore interface {
// GetOrCreate retrieves the key for the given ID, creating one if it doesn't exist.
GetOrCreate(ctx context.Context, id string) ([]byte, error)
// Get retrieves the key for the given ID.
Get(ctx context.Context, id string) ([]byte, error)
// Delete removes the key for the given ID (crypto-shredding).
Delete(ctx context.Context, id string) error
}
KeyStore manages per-entity encryption keys (for GDPR-style per-tenant key isolation).
Source Files
Click to show internal directories.
Click to hide internal directories.