Documentation
¶
Index ¶
- Variables
- func Decrypt(encryptd []byte, decrypter Decrypter) ([]byte, error)
- func Defaults(key []byte, fips bool) (Encrypter, Decrypter)
- func Encrypt(plaintext []byte, encrypter Encrypter) ([]byte, error)
- func GenerateSecretKey() []byte
- func HumanReadableKey(key []byte) string
- func ParseHumanReadableKey(key string) ([]byte, error)
- type Decrypter
- type Encrypter
- type ErrCannotDecrypt
- type Fernet
- type MultiDecrypter
- type NACLSecretbox
Constants ¶
This section is empty.
Variables ¶
var NoopCrypter = noopCrypter{}
NoopCrypter is just a pass-through crypter - it does not actually encrypt or decrypt any data
Functions ¶
func Decrypt ¶
Decrypt turns a slice of bytes serialized as an MaybeEncryptedRecord into a slice of plaintext bytes
func Defaults ¶
Defaults returns a default encrypter and decrypter. If the FIPS parameter is set to true, the only algorithm supported on both the encrypter and decrypter will be fernet.
func GenerateSecretKey ¶
func GenerateSecretKey() []byte
GenerateSecretKey generates a secret key that can be used for encrypting data using this package
func HumanReadableKey ¶
HumanReadableKey displays a secret key in a human readable way
func ParseHumanReadableKey ¶
ParseHumanReadableKey returns a key as bytes from recognized serializations of said keys
Types ¶
type Decrypter ¶
type Decrypter interface {
Decrypt(api.MaybeEncryptedRecord) ([]byte, error)
}
A Decrypter can decrypt an encrypted record
type Encrypter ¶
type Encrypter interface {
Encrypt(data []byte) (*api.MaybeEncryptedRecord, error)
}
A Encrypter can encrypt some bytes into an encrypted record
type ErrCannotDecrypt ¶
type ErrCannotDecrypt struct {
// contains filtered or unexported fields
}
ErrCannotDecrypt is the type of error returned when some data cannot be decryptd as plaintext
func (ErrCannotDecrypt) Error ¶
func (e ErrCannotDecrypt) Error() string
type Fernet ¶
type Fernet struct {
// contains filtered or unexported fields
}
Fernet wraps the `fernet` library as an implementation of encrypter/decrypter.
func (Fernet) Algorithm ¶
func (f Fernet) Algorithm() api.MaybeEncryptedRecord_Algorithm
Algorithm returns the type of algorithm this is (Fernet, which uses AES128-CBC)
type MultiDecrypter ¶
type MultiDecrypter struct {
// contains filtered or unexported fields
}
MultiDecrypter is a decrypter that will attempt to decrypt with multiple decrypters. It references them by algorithm, so that only the relevant decrypters are checked instead of every single one. The reason for multiple decrypters per algorithm is to support hitless encryption key rotation.
For raft encryption for instance, during an encryption key rotation, it's possible to have some raft logs encrypted with the old key and some encrypted with the new key, so we need a decrypter that can decrypt both.
func NewMultiDecrypter ¶
func NewMultiDecrypter(decrypters ...Decrypter) MultiDecrypter
NewMultiDecrypter returns a new MultiDecrypter given multiple Decrypters. If any of the Decrypters are also MultiDecrypters, they are flattened into a single map, but it does not deduplicate any decrypters. Note that if something is neither a MultiDecrypter nor a specificDecrypter, it is ignored.
func (MultiDecrypter) Decrypt ¶
func (m MultiDecrypter) Decrypt(r api.MaybeEncryptedRecord) ([]byte, error)
Decrypt tries to decrypt using any decrypters that match the given algorithm.
type NACLSecretbox ¶
type NACLSecretbox struct {
// contains filtered or unexported fields
}
NACLSecretbox is an implementation of an encrypter/decrypter. Encrypting generates random Nonces.
func NewNACLSecretbox ¶
func NewNACLSecretbox(key []byte) NACLSecretbox
NewNACLSecretbox returns a new NACL secretbox encrypter/decrypter with the given key
func (NACLSecretbox) Algorithm ¶
func (n NACLSecretbox) Algorithm() api.MaybeEncryptedRecord_Algorithm
Algorithm returns the type of algorithm this is (NACL Secretbox using XSalsa20 and Poly1305)
func (NACLSecretbox) Decrypt ¶
func (n NACLSecretbox) Decrypt(record api.MaybeEncryptedRecord) ([]byte, error)
Decrypt decrypts a MaybeEncryptedRecord and returns some bytes
func (NACLSecretbox) Encrypt ¶
func (n NACLSecretbox) Encrypt(data []byte) (*api.MaybeEncryptedRecord, error)
Encrypt encrypts some bytes and returns an encrypted record
Source Files