pqcrypt

Documentation

Index

• Constants
• Variables
• func CreateKey(ctx context.Context, kid string, opts ...KeyOptions) error
• func CreateKeyWithUUID(ctx context.Context, kid uuid.UUID, opts ...KeyOptions) error
• func Decrypt(ctx context.Context, raw *EncryptedRaw, dest interface{}) error
• func Use()
• type Algorithm
  • func (a *Algorithm) UnmarshalText(text []byte) error
• type DataEncryptionProperties
  • func BindDataEncryptionProperties(ctx *bootstrap.ApplicationContext) DataEncryptionProperties
  • func NewDataEncryptionProperties() *DataEncryptionProperties
• type EncryptedMap
  • func NewEncryptedMap(kid uuid.UUID, v map[string]interface{}) *EncryptedMap
  • func (d *EncryptedMap) Scan(src interface{}) error
  • func (d *EncryptedMap) Value() (driver.Value, error)
• type EncryptedRaw
  • func Encrypt(ctx context.Context, kid string, v interface{}) (*EncryptedRaw, error)
  • func ParseEncryptedRaw(text string) (ret *EncryptedRaw, err error)
  • func (EncryptedRaw) GormDataType() string
  • func (d *EncryptedRaw) Scan(src interface{}) error
  • func (d *EncryptedRaw) UnmarshalTextV1(text []byte) error
  • func (d *EncryptedRaw) Value() (driver.Value, error)
• type Encryptor
• type KeyOperations
• type KeyOptions
• type KeyProperties
• type KeyType
  • func (t *KeyType) UnmarshalText(text []byte) error
• type Version
  • func (v *Version) UnmarshalJSON(data []byte) (err error)
  • func (v *Version) UnmarshalText(text []byte) error

Constants

const (
	KeyTypeAES128   = "aes128-gcm96"
	KeyTypeAES256   = "aes256-gcm96"
	KeyTypeChaCha20 = "chacha20-poly1305"
	KeyTypeED25519  = "ed25519"
	KeyTypeECDSA256 = "ecdsa-p256"
	KeyTypeECDSA384 = "ecdsa-p384"
	KeyTypeECDSA521 = "ecdsa-p521"
	KeyTypeRSA2048  = "rsa-2048"
	KeyTypeRSA3072  = "rsa-3072"
	KeyTypeRSA4096  = "rsa-4096"
)

https://www.vaultproject.io/api/secret/transit#create-key

const (
	PropertiesPrefix = "data.encryption"
)

Variables

var (
	ErrUnsupportedVersion   = data.NewDataError(data.ErrorCodeOrmMapping, "unsupported version of encrypted data format")
	ErrUnsupportedAlgorithm = data.NewDataError(data.ErrorCodeOrmMapping, "unsupported encryption algorithm of data")
	ErrInvalidFormat        = data.NewDataError(data.ErrorCodeOrmMapping, "invalid encrypted data")
	ErrInvalidV1Format      = data.NewDataError(data.ErrorCodeOrmMapping, "invalid V1 data payload format")
)

var Module = &bootstrap.Module{
	Name:       "data-encryption",
	Precedence: bootstrap.DatabasePrecedence,
	Options: []fx.Option{
		appconfig.FxEmbeddedDefaults(defaultConfigFS),
		fx.Provide(BindDataEncryptionProperties, provideEncryptor),
		fx.Invoke(initialize),
	},
}

Functions

func CreateKey

func CreateKey(ctx context.Context, kid string, opts ...KeyOptions) error

CreateKey create keys with given key ID. Note: KeyOptions is for future support, it's currently ignored

func CreateKeyWithUUID

func CreateKeyWithUUID(ctx context.Context, kid uuid.UUID, opts ...KeyOptions) error

CreateKeyWithUUID create keys with given key ID. Note: KeyOptions is for future support, it's currently ignored

func Decrypt

func Decrypt(ctx context.Context, raw *EncryptedRaw, dest interface{}) error

Decrypt is a package level API that wraps shared Encryptor.Decrypt

func Use

func Use()

Types

type Algorithm

type Algorithm string

const (
	AlgPlain Algorithm = "p"
	AlgVault Algorithm = "e" // this value is compatible with Java counterpart

)

func (*Algorithm) UnmarshalText

func (a *Algorithm) UnmarshalText(text []byte) error

UnmarshalText implements encoding.TextUnmarshaler

type DataEncryptionProperties

type DataEncryptionProperties struct {
	Enabled bool          `json:"enabled"`
	Key     KeyProperties `json:"key"`
}

func BindDataEncryptionProperties

func BindDataEncryptionProperties(ctx *bootstrap.ApplicationContext) DataEncryptionProperties

BindDataEncryptionProperties create and bind SessionProperties, with a optional prefix

func NewDataEncryptionProperties

func NewDataEncryptionProperties() *DataEncryptionProperties

NewDataEncryptionProperties create a CockroachProperties with default values

type EncryptedMap

type EncryptedMap struct {
	EncryptedRaw
	Data map[string]interface{} `json:"-"`
}

func NewEncryptedMap

func NewEncryptedMap(kid uuid.UUID, v map[string]interface{}) *EncryptedMap

func (*EncryptedMap) Scan

func (d *EncryptedMap) Scan(src interface{}) error

Scan implements sql.Scanner

func (*EncryptedMap) Value

func (d *EncryptedMap) Value() (driver.Value, error)

Value implements driver.Valuer

type EncryptedRaw

type EncryptedRaw struct {
	Ver   Version         `json:"v"`
	KeyID string          `json:"kid,omitempty"`
	Alg   Algorithm       `json:"alg,omitempty"`
	Raw   json.RawMessage `json:"d,omitempty"`
}

EncryptedRaw is the carrier of encrypted data this data type implements gorm.Valuer, schema.GormDataTypeInterface

func Encrypt

func Encrypt(ctx context.Context, kid string, v interface{}) (*EncryptedRaw, error)

Encrypt is a package level API that wraps shared Encryptor.Encrypt

func ParseEncryptedRaw

func ParseEncryptedRaw(text string) (ret *EncryptedRaw, err error)

func (EncryptedRaw) GormDataType

func (EncryptedRaw) GormDataType() string

GormDataType implements schema.GormDataTypeInterface

func (*EncryptedRaw) Scan

func (d *EncryptedRaw) Scan(src interface{}) error

Scan implements sql.Scanner

func (*EncryptedRaw) UnmarshalTextV1

func (d *EncryptedRaw) UnmarshalTextV1(text []byte) error

UnmarshalTextV1 deserialize V1 format of text

func (*EncryptedRaw) Value

func (d *EncryptedRaw) Value() (driver.Value, error)

Value implements driver.Valuer

type Encryptor

type Encryptor interface {
	// Encrypt encrypt given "v" and populate EncryptedRaw.Raw
	// The process may read EncryptedRaw.Alg and EncryptedRaw.KeyID and update EncryptedRaw.Ver
	Encrypt(ctx context.Context, kid string, v interface{}) (*EncryptedRaw, error)

	// Decrypt reads EncryptedRaw and populate the decrypted data into given "v"
	// if v is not pointer type, this method may return error
	Decrypt(ctx context.Context, raw *EncryptedRaw, dest interface{}) error

	// KeyOperations returns an object that operates on keys.
	// depending on configurations, this method may returns no-op impl, but never nil
	KeyOperations() KeyOperations
}

type KeyOperations

type KeyOperations interface {
	// Create create keys with given key ID.
	// Note: KeyOptions is for future support, it's currently ignored
	Create(ctx context.Context, kid string, opts ...KeyOptions) error
}

type KeyOptions

type KeyOptions func(opt *keyOption)

type KeyProperties

type KeyProperties struct {
	Type                 string `json:"type"`
	Exportable           bool   `json:"exportable"`
	AllowPlaintextBackup bool   `json:"allow-plaintext-backup"`
}

type KeyType

type KeyType string

func (*KeyType) UnmarshalText

func (t *KeyType) UnmarshalText(text []byte) error

UnmarshalText implements encoding.TextUnmarshaler

type Version

type Version int

const (
	// V1 is Java compatible data structure
	V1 Version = 1
	// V2 is Generic JSON version, default format of go-lanai
	V2 Version = 2
)

func (*Version) UnmarshalJSON

func (v *Version) UnmarshalJSON(data []byte) (err error)

UnmarshalJSON implements json.Unmarshaler with V1 support

func (*Version) UnmarshalText

func (v *Version) UnmarshalText(text []byte) error

UnmarshalText implements encoding.TextUnmarshaler