Documentation
¶
Overview ¶
Package encrypt implements the encryption layer of brig. The file format used looks something like this:
[HEADER][[BLOCKHEADER][PAYLOAD]...]
HEADER is 20+16 bytes big and contains the following fields:
- 8 Byte: Magic number (to identify non-brig files quickly)
- 2 Byte: Format version
- 2 Byte: Used cipher type (ChaCha20 or AES-GCM currently)
- 4 Byte: Key length in bytes.
- 4 Byte: Maximum size of each block (last may be less)
- 16 Byte: MAC protecting the header from forgery
BLOCKHEADER contains the following fields:
- 8 Byte: Nonce: Derived from the current block number. The block number is checked to be correct on decryption.
PAYLOAD contains the actual encrypted data, which includes a MAC at the end. The size of the MAC depends on the algorithm, for poly1305 it's 16 bytes.
All header metadata is encoded in little endian.
Reader/Writer are capable or reading/writing this format. Additionally, Reader supports efficient seeking into the encrypted data, provided the underlying datastream supports seeking. SEEK_END is only supported when the number of encrypted blocks is present in the header.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrBadBlockSize is returned when the data is damaged and has an invalid block size ErrBadBlockSize = errors.New("underlying reader failed to read full w.maxBlockSize") // ErrMixedMethods is returned when calling Write() with ReadFrom() together. ErrMixedMethods = errors.New("mixing Write() and ReadFrom() is not allowed") )
var KeySize = chacha.KeySize
KeySize of the used cipher's key in bytes.
var ( // MagicNumber contains the first 8 byte of every brig header. // For various reasons, it is the ascii string "moosecat". MagicNumber = []byte{ 0x6d, 0x6f, 0x6f, 0x73, 0x65, 0x63, 0x61, 0x74, } )
Functions ¶
func Decrypt ¶
Decrypt is a utility function which decrypts the data from source with key and writes the resulting encrypted data to dest.
Types ¶
type HeaderInfo ¶
type HeaderInfo struct {
// Version of the file format. Currently always 1.
Version uint16
// Cipher type used in the file.
Cipher uint16
// Keylen is the number of bytes in the encryption key.
Keylen uint32
// Blocklen is the max. number of bytes in a block.
// The last block might be smaller.
Blocklen uint32
}
HeaderInfo represents a parsed header.
func ParseHeader ¶
func ParseHeader(header, key []byte) (*HeaderInfo, error)
ParseHeader parses the header of the format file. Returns the format version, cipher type, keylength and block length. If parsing fails, an error is returned.
type Reader ¶
Reader decrypts and encrypted datastream from Reader.
func NewReader ¶
NewReader creates a new encrypted reader and validates the file header. The key is required to be KeySize bytes long.
func (*Reader) Read ¶
Read from source and decrypt.
This method always decrypts one block to optimize for continuous reads. If dest is too small to hold the block, the decrypted text is cached for the next read.
func (*Reader) Seek ¶
Seek into the encrypted stream.
Note that the seek offset is relative to the decrypted data, not to the underlying, encrypted stream.
Mixing SEEK_CUR and SEEK_SET might not a good idea, since a seek might involve reading a whole encrypted block. Therefore relative seek offset
type Writer ¶
type Writer struct {
// Internal Writer we would write to.
io.Writer
// contains filtered or unexported fields
}
Writer encrypts the data stream before writing to Writer.
func NewWriter ¶
NewWriter calls NewWriterWithTypeAndBlockSize with a sane default cipher type and a sane default max block size.
func NewWriterWithType ¶
NewWriterWithType calls NewWriterWithTypeAndBlockSize with a a sane default maxblocksize.
func NewWriterWithTypeAndBlockSize ¶
func NewWriterWithTypeAndBlockSize(w io.Writer, key []byte, cipherType uint16, maxBlockSize int64) (*Writer, error)
NewWriterWithTypeAndBlockSize returns a new Writer which encrypts data with a certain key. If `compressionFlag` is true, the compression flag in the file header will also be true. Otherwise no compression is done.
func (*Writer) Close ¶
Close the Writer and write any left-over blocks This does not close the underlying data stream.
func (*Writer) GoodDecBufferSize ¶
GoodDecBufferSize returns a buffer size that is suitable for decryption.
func (*Writer) GoodEncBufferSize ¶
GoodEncBufferSize returns a buffer size that is suitable for encryption.
Source Files