Documentation
¶
Overview ¶
Package local provides an in-memory AES-256-GCM encryption provider for testing. It stores master keys in memory and supports key revocation for crypto-shredding simulation.
This provider should NOT be used in production. Use the kms or vault providers instead.
Index ¶
- type Option
- type Provider
- func (p *Provider) AddKey(keyID string, key []byte) error
- func (p *Provider) Close() error
- func (p *Provider) Decrypt(_ context.Context, keyID string, ciphertext []byte) ([]byte, error)
- func (p *Provider) DecryptDataKey(_ context.Context, keyID string, encryptedKey []byte) ([]byte, error)
- func (p *Provider) Encrypt(_ context.Context, keyID string, plaintext []byte) ([]byte, error)
- func (p *Provider) GenerateDataKey(_ context.Context, keyID string) (*encryption.DataKey, error)
- func (p *Provider) IsRevoked(keyID string) (bool, error)
- func (p *Provider) RevocationState(keyID string) (encryption.RevocationState, error)
- func (p *Provider) RevokeKey(keyID string) error
- func (p *Provider) SoftRevokeKey(keyID string, graceWindow time.Duration) error
- func (p *Provider) UnrevokeKey(keyID string) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Option ¶
Option configures a local Provider.
func WithKey ¶
WithKey pre-loads a master key into the provider. The key must be exactly 32 bytes (AES-256).
WithKey is normally applied at construction time via New, but it mirrors the guards of AddKey so it remains safe if applied to an already-constructed or closed provider: it takes the write lock, rejects use after Close, and initializes the key map if it has not been allocated yet.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider is an in-memory AES-256-GCM encryption provider for testing. Keys are stored in memory and never persisted.
func (*Provider) AddKey ¶
AddKey adds a master key to the provider. The key must be exactly 32 bytes (AES-256).
func (*Provider) Decrypt ¶
Decrypt decrypts ciphertext using AES-256-GCM with the specified master key.
func (*Provider) DecryptDataKey ¶
func (p *Provider) DecryptDataKey(_ context.Context, keyID string, encryptedKey []byte) ([]byte, error)
DecryptDataKey decrypts a previously encrypted DEK using the master key.
func (*Provider) Encrypt ¶
Encrypt encrypts plaintext using AES-256-GCM with the specified master key.
func (*Provider) GenerateDataKey ¶
GenerateDataKey creates a new random 32-byte DEK and encrypts it with the master key.
func (*Provider) IsRevoked ¶ added in v1.1.3
IsRevoked reports whether keyID has been revoked — soft or hard. It implements encryption.Revocable. Callers that need to distinguish a still-recoverable soft-revocation from a permanent shred use RevocationState.
func (*Provider) RevocationState ¶ added in v1.1.3
func (p *Provider) RevocationState(keyID string) (encryption.RevocationState, error)
RevocationState reports keyID's fine-grained revocation state, first promoting an elapsed soft-revocation to a permanent shred. Implements encryption.StatefulRevocable.
func (*Provider) RevokeKey ¶
RevokeKey marks a key as revoked and removes the key material. This simulates crypto-shredding: once revoked, data encrypted with this key can never be decrypted. It implements encryption.Revocable and is idempotent — revoking an already-revoked key is a no-op success.
func (*Provider) SoftRevokeKey ¶ added in v1.1.3
SoftRevokeKey blocks decryption under keyID but allows UnrevokeKey to restore it until graceWindow elapses, after which it is permanent. Implements encryption.RecoverableRevocable.
func (*Provider) UnrevokeKey ¶ added in v1.1.3
UnrevokeKey restores a soft-revoked key if still within its grace window. Implements encryption.RecoverableRevocable.
Source Files