attachment

Documentation

Index

• Variables
• type EncryptedFile
  • func NewEncryptedFile() *EncryptedFile
  • func (ef *EncryptedFile) Decrypt(ciphertext []byte) ([]byte, error)
  • func (ef *EncryptedFile) DecryptInPlace(data []byte) error
  • func (ef *EncryptedFile) DecryptStream(reader io.Reader) io.ReadSeekCloser
  • func (ef *EncryptedFile) Encrypt(plaintext []byte) []byte
  • func (ef *EncryptedFile) EncryptFile(file ReadWriterAt) error
  • func (ef *EncryptedFile) EncryptInPlace(data []byte)
  • func (ef *EncryptedFile) EncryptStream(reader io.Reader) io.ReadSeekCloser
  • func (ef *EncryptedFile) PrepareForDecryption() error
• type EncryptedFileHashes
• type JSONWebKey
• type ReadWriterAt

Variables

var (
	HashMismatch         = errors.New("mismatching SHA-256 digest")
	UnsupportedVersion   = errors.New("unsupported Matrix file encryption version")
	UnsupportedAlgorithm = errors.New("unsupported JWK encryption algorithm")
	InvalidKey           = errors.New("failed to decode key")
	InvalidInitVector    = errors.New("failed to decode initialization vector")
	InvalidHash          = errors.New("failed to decode SHA-256 hash")
	ReaderClosed         = errors.New("encrypting reader was already closed")
)

Types

type EncryptedFile

type EncryptedFile struct {
	Key        JSONWebKey          `json:"key"`
	InitVector string              `json:"iv"`
	Hashes     EncryptedFileHashes `json:"hashes"`
	Version    string              `json:"v"`
	// contains filtered or unexported fields
}

func NewEncryptedFile

func NewEncryptedFile() *EncryptedFile

func (*EncryptedFile) Decrypt

func (ef *EncryptedFile) Decrypt(ciphertext []byte) ([]byte, error)

Decrypt decrypts the given data and returns the plaintext.

Deprecated: this makes a copy for the plaintext data, which means 2x memory usage. DecryptInPlace is recommended.

func (*EncryptedFile) DecryptInPlace

func (ef *EncryptedFile) DecryptInPlace(data []byte) error

DecryptInPlace decrypts the given data in-place (i.e. the provided data is overridden with the plaintext).

func (*EncryptedFile) DecryptStream

func (ef *EncryptedFile) DecryptStream(reader io.Reader) io.ReadSeekCloser

DecryptStream wraps the given io.Reader in order to decrypt the data.

The first Read call will check the algorithm and decode keys, so it might return an error before actually reading anything. If you want to validate the file before opening the stream, call PrepareForDecryption manually and check for errors.

The Close call will validate the hash and return an error if it doesn't match. In this case, the written data should be considered compromised and should not be used further.

func (*EncryptedFile) Encrypt

func (ef *EncryptedFile) Encrypt(plaintext []byte) []byte

Encrypt encrypts the given data, updates the SHA256 hash in the EncryptedFile struct and returns the ciphertext.

Deprecated: this makes a copy for the ciphertext, which means 2x memory usage. EncryptInPlace is recommended.

func (*EncryptedFile) EncryptFile

func (ef *EncryptedFile) EncryptFile(file ReadWriterAt) error

EncryptFile encrypts the given file in-place and updates the SHA256 hash in the EncryptedFile struct.

func (*EncryptedFile) EncryptInPlace

func (ef *EncryptedFile) EncryptInPlace(data []byte)

EncryptInPlace encrypts the given data in-place (i.e. the provided data is overridden with the ciphertext) and updates the SHA256 hash in the EncryptedFile struct.

func (*EncryptedFile) EncryptStream

func (ef *EncryptedFile) EncryptStream(reader io.Reader) io.ReadSeekCloser

EncryptStream wraps the given io.Reader in order to encrypt the data.

The Close() method of the returned io.ReadCloser must be called for the SHA256 hash in the EncryptedFile struct to be updated. The metadata is not valid before the hash is filled.

func (*EncryptedFile) PrepareForDecryption

func (ef *EncryptedFile) PrepareForDecryption() error

PrepareForDecryption checks that the version and algorithm are supported and decodes the base64 keys

DecryptStream will call this with the first Read() call if this hasn't been called manually.

DecryptInPlace will always call this automatically, so calling this manually is not necessary when using that function.

type EncryptedFileHashes

type EncryptedFileHashes struct {
	SHA256 string `json:"sha256"`
}

type JSONWebKey

type JSONWebKey struct {
	Key         string   `json:"k"`
	Algorithm   string   `json:"alg"`
	Extractable bool     `json:"ext"`
	KeyType     string   `json:"kty"`
	KeyOps      []string `json:"key_ops"`
}

type ReadWriterAt

type ReadWriterAt interface {
	io.WriterAt
	io.Reader
}