encryption

Documentation

Index

• type Encryptable
  • func NewClearTextEncryptor(key string) (Encryptable, error)
  • func NewDeprecatedEncryptor(keySet keyset.Handle) (Encryptable, error)
  • func NewForKeyOrURI(keyOrURI string) (Encryptable, error)
• type EncryptedPayload
• type Encryptor
  • func (e Encryptor) DecryptJSON(input json.RawMessage, output any) error
  • func (e Encryptor) EncryptJSON(input any) (json.RawMessage, error)
• type EncryptorNext
• type KMSEncryptor
  • func NewKMSEncryptorGenerateKey(uri string, v1client *awsv1kms.KMS) (*KMSEncryptor, error)
  • func NewKMSEncryptorWithKMS(uri string, v1client *awsv1kms.KMS, encryptedKeyset []byte) (*KMSEncryptor, error)
  • func (k *KMSEncryptor) Decrypt(subKey SubKey, encrypted []byte) ([]byte, error)
  • func (k *KMSEncryptor) Encrypt(subKey SubKey, cleartext []byte) ([]byte, error)
  • func (k *KMSEncryptor) GetEncryptedKeyset() []byte
• type NoOpEncryptor
  • func (n NoOpEncryptor) DecryptJSON(input json.RawMessage, output any) error
  • func (n NoOpEncryptor) EncryptJSON(input any) (json.RawMessage, error)
• type NoOpEncryptorNext
  • func (n NoOpEncryptorNext) Decrypt(_ SubKey, encrypted []byte) ([]byte, error)
  • func (n NoOpEncryptorNext) Encrypt(_ SubKey, cleartext []byte) ([]byte, error)
• type PlaintextEncryptor
  • func NewPlaintextEncryptor(key string) (*PlaintextEncryptor, error)
  • func (p PlaintextEncryptor) Decrypt(subKey SubKey, encrypted []byte) ([]byte, error)
  • func (p PlaintextEncryptor) Encrypt(subKey SubKey, cleartext []byte) ([]byte, error)
• type SubKey

Types

type Encryptable

type Encryptable interface {
	EncryptJSON(input any) (json.RawMessage, error)
	DecryptJSON(input json.RawMessage, output any) error
}

Encryptable is an interface for encrypting and decrypting JSON payloads. Deprecated: This is will be changed or removed very soon.

func NewClearTextEncryptor

func NewClearTextEncryptor(key string) (Encryptable, error)

func NewDeprecatedEncryptor

func NewDeprecatedEncryptor(keySet keyset.Handle) (Encryptable, error)

NewDeprecatedEncryptor encrypts and decrypts JSON payloads using the provided key set. The key set must contain a primary key that is a streaming AEAD primitive.

func NewForKeyOrURI

func NewForKeyOrURI(keyOrURI string) (Encryptable, error)

NewForKeyOrURI creates a new encryptor using the provided key or URI. Deprecated: This is will be changed or removed very soon.

type EncryptedPayload

type EncryptedPayload struct {
	Encrypted []byte `json:"encrypted"`
}

EncryptedPayload is a JSON payload that contains the encrypted data to put into the database. Deprecated: This is will be changed or removed very soon.

type Encryptor

type Encryptor struct {
	// contains filtered or unexported fields
}

Encryptor uses streaming with JSON payloads. Deprecated: This is will be changed or removed very soon.

func (Encryptor) DecryptJSON

func (e Encryptor) DecryptJSON(input json.RawMessage, output any) error

func (Encryptor) EncryptJSON

func (e Encryptor) EncryptJSON(input any) (json.RawMessage, error)

type EncryptorNext

type EncryptorNext interface {
	Encrypt(subKey SubKey, cleartext []byte) ([]byte, error)
	Decrypt(subKey SubKey, encrypted []byte) ([]byte, error)
}

type KMSEncryptor

type KMSEncryptor struct {
	// contains filtered or unexported fields
}

KMSEncryptor encrypts and decrypts using a KMS key via tink. TODO: maybe change to DerivableEncryptor and integrate plaintext and kms encryptor.

func NewKMSEncryptorGenerateKey

func NewKMSEncryptorGenerateKey(uri string, v1client *awsv1kms.KMS) (*KMSEncryptor, error)

func NewKMSEncryptorWithKMS

func NewKMSEncryptorWithKMS(uri string, v1client *awsv1kms.KMS, encryptedKeyset []byte) (*KMSEncryptor, error)

func (*KMSEncryptor) Decrypt

func (k *KMSEncryptor) Decrypt(subKey SubKey, encrypted []byte) ([]byte, error)

func (*KMSEncryptor) Encrypt

func (k *KMSEncryptor) Encrypt(subKey SubKey, cleartext []byte) ([]byte, error)

func (*KMSEncryptor) GetEncryptedKeyset

func (k *KMSEncryptor) GetEncryptedKeyset() []byte

type NoOpEncryptor

type NoOpEncryptor struct {
}

NoOpEncryptor does not encrypt or decrypt and just passes the input as is. Deprecated: This is will be changed or removed very soon.

func (NoOpEncryptor) DecryptJSON

func (n NoOpEncryptor) DecryptJSON(input json.RawMessage, output any) error

func (NoOpEncryptor) EncryptJSON

func (n NoOpEncryptor) EncryptJSON(input any) (json.RawMessage, error)

type NoOpEncryptorNext

type NoOpEncryptorNext struct{}

NoOpEncryptorNext does not encrypt and just passes the input as is.

func (NoOpEncryptorNext) Decrypt

func (n NoOpEncryptorNext) Decrypt(_ SubKey, encrypted []byte) ([]byte, error)

func (NoOpEncryptorNext) Encrypt

func (n NoOpEncryptorNext) Encrypt(_ SubKey, cleartext []byte) ([]byte, error)

type PlaintextEncryptor

type PlaintextEncryptor struct {
	// contains filtered or unexported fields
}

func NewPlaintextEncryptor

func NewPlaintextEncryptor(key string) (*PlaintextEncryptor, error)

func (PlaintextEncryptor) Decrypt

func (p PlaintextEncryptor) Decrypt(subKey SubKey, encrypted []byte) ([]byte, error)

func (PlaintextEncryptor) Encrypt

func (p PlaintextEncryptor) Encrypt(subKey SubKey, cleartext []byte) ([]byte, error)

type SubKey

type SubKey string

const (
	LogsSubKey  SubKey = "logs"
	AsyncSubKey SubKey = "async"
)