Documentation
¶
Overview ¶
Package vault provides a HashiCorp Vault Transit encryption provider for field-level encryption. It uses the Vault Transit engine for key management while generating DEKs locally for envelope encryption.
Index ¶
- type Option
- type Provider
- func (p *Provider) Close() error
- func (p *Provider) Decrypt(ctx context.Context, keyID string, ciphertext []byte) ([]byte, error)
- func (p *Provider) DecryptDataKey(ctx context.Context, keyID string, encryptedKey []byte) ([]byte, error)
- func (p *Provider) Encrypt(ctx context.Context, keyID string, plaintext []byte) ([]byte, error)
- func (p *Provider) GenerateDataKey(ctx context.Context, keyID string) (*encryption.DataKey, error)
- func (p *Provider) IsRevoked(keyID string) (bool, error)
- func (p *Provider) RevokeKey(keyID string) error
- type VaultClient
- type VaultRevocationClient
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Option ¶
type Option func(*Provider)
Option configures a Vault Provider.
func WithVaultClient ¶
func WithVaultClient(client VaultClient) Option
WithVaultClient sets the Vault Transit client.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements encryption.Provider using HashiCorp Vault Transit.
func (*Provider) DecryptDataKey ¶
func (p *Provider) DecryptDataKey(ctx context.Context, keyID string, encryptedKey []byte) ([]byte, error)
DecryptDataKey decrypts a previously encrypted DEK using Vault Transit.
func (*Provider) GenerateDataKey ¶
GenerateDataKey creates a new random 32-byte DEK and encrypts it via Vault Transit. Unlike KMS, Vault Transit doesn't have a native GenerateDataKey API, so we generate the DEK locally and encrypt it with Vault.
func (*Provider) IsRevoked ¶ added in v1.1.3
IsRevoked reports whether keyID's Transit key has been deleted. It implements encryption.Revocable.
func (*Provider) RevokeKey ¶ added in v1.1.3
RevokeKey crypto-shreds keyID by deleting its Vault Transit key. It implements encryption.Revocable. It requires the injected client to implement VaultRevocationClient, otherwise it returns ErrRevocationUnsupported. It is idempotent: a key that no longer exists returns nil.
type VaultClient ¶
type VaultClient interface {
// Encrypt encrypts plaintext using the named Transit key.
Encrypt(ctx context.Context, keyName string, plaintext []byte) (ciphertext []byte, err error)
// Decrypt decrypts ciphertext using the named Transit key.
Decrypt(ctx context.Context, keyName string, ciphertext []byte) (plaintext []byte, err error)
}
VaultClient defines the minimal interface for Vault Transit operations. Users inject their own implementation (e.g., wrapping the official Vault SDK).
type VaultRevocationClient ¶ added in v1.1.3
type VaultRevocationClient interface {
// DeleteKey deletes the named Transit key (the key must allow deletion).
DeleteKey(ctx context.Context, keyName string) error
// KeyExists reports whether the named Transit key still exists.
KeyExists(ctx context.Context, keyName string) (bool, error)
}
VaultRevocationClient is an OPTIONAL extension of VaultClient. When the injected client also implements it, the provider implements encryption.Revocable and supports crypto-shredding (GDPR erasure) by deleting the named Transit key so its ciphertext can never be decrypted again.
Source Files