Documentation
¶
Overview ¶
Package crypto implements a simple convenience wrapper around golang.org/x/crypto/nacl/box. It ultimately models a situation where you don't care about authenticating the encryptor, so the nonce and encryption public key are prepended to the encrypted message.
Shared key precomputation is used when encrypting but not when decrypting. This is not an inherent limitation, but it would complicate the implementation a little bit to do precomputation during decryption also. If performance becomes an issue (highly unlikely), it's completely feasible to add.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrDecryptionFailed = errors.New("couldn't decrypt message")
ErrDecryptionFailed means the decryption didn't work. This normally indicates that the message was corrupted or the wrong keypair was used.
Functions ¶
func IsBoxedMessage ¶
IsBoxedMessage tests whether a value is formatted using the boxedMessage format. This can be used to determine whether a string value requires encryption or is already encrypted.
Types ¶
type Decrypter ¶
type Decrypter struct {
Keypair *Keypair
}
Decrypter is generated from a keypair (a fixed keypair, generally, whose private key is stored in configuration management or otherwise), and used to decrypt messages. It should normally be obtained by calling Decrypter() on a Keypair instance.
func (*Decrypter) Decrypt ¶
Decrypt is passed an encrypted message or a particular format (the format generated by (*Encrypter)Encrypt(), which includes the nonce and public key used to create the ciphertext. It returns the decrypted string. Note that, unlike with encryption, Shared-key-precomputation is not used for decryption.
type Encrypter ¶
Encrypter is generated from a keypair (typically a newly-generated ephemeral keypair, used only for this session) with the public key of an authorized decrypter. It is then capable of encrypting messages to that decrypter's private key. An instance should normally be obtained only by calling Encrypter() on a Keypair instance.
func NewEncrypter ¶
NewEncrypter instantiates an Encrypter after pre-computing the shared key for the owned keypair and the given decrypter public key.
func (*Encrypter) Encrypt ¶
Encrypt takes a plaintext message and returns an encrypted message. Unlike raw nacl/box encryption, this message is decryptable without passing the nonce or public key out-of-band, as it includes both. This is not less secure, it just doesn't allow for authorizing the encryptor. That's fine, since authorization isn't a desired property of this particular cryptosystem.
type Keypair ¶
Keypair models a Curve25519 keypair. To generate a new Keypair, declare an empty one and call Generate() on it.
func (*Keypair) Decrypter ¶
Decrypter returns a Decrypter instance, used to decrypt properly formatted messages from arbitrary encrypters.
func (*Keypair) Encrypter ¶
Encrypter returns an Encrypter instance, given a public key, to encrypt messages to the paired, unknown, private key.
func (*Keypair) Generate ¶
Generate generates a new Curve25519 keypair into a (presumably) empty Keypair structure.
func (*Keypair) PrivateString ¶
PrivateString returns the private key in the canonical hex-encoded printable form.
func (*Keypair) PublicString ¶
PublicString returns the public key in the canonical hex-encoded printable form.
Source Files