cryptocore

Documentation

Overview

Package cryptocore wraps OpenSSL and Go GCM crypto and provides a nonce generator.

Index

• func RandBytes(n int) []byte
• func RandUint64() uint64
• type AEADTypeEnum
• type CryptoCore
  • func New(key []byte, aeadType AEADTypeEnum, IVBitLen int, useHKDF bool, ...) *CryptoCore

Functions

func RandBytes

func RandBytes(n int) []byte

RandBytes gets "n" random bytes from /dev/urandom or panics

func RandUint64

func RandUint64() uint64

RandUint64 returns a secure random uint64

Types

type AEADTypeEnum

type AEADTypeEnum int

AEADTypeEnum indicates the type of AEAD backend in use.

const (
	// KeyLen is the cipher key length in bytes.  32 for AES-256.
	KeyLen = 32
	// AuthTagLen is the length of a GCM auth tag in bytes.
	AuthTagLen = 16

	// BackendOpenSSL specifies the OpenSSL backend.
	BackendOpenSSL AEADTypeEnum = iota
	// BackendGoGCM specifies the Go based GCM backend.
	BackendGoGCM AEADTypeEnum = iota
	// BackendAESSIV specifies an AESSIV backend.
	BackendAESSIV AEADTypeEnum = iota
)

type CryptoCore

type CryptoCore struct {
	// EME is used for filename encryption.
	EMECipher *eme.EMECipher
	// GCM or AES-SIV. This is used for content encryption.
	AEADCipher cipher.AEAD
	// Which backend is behind AEADCipher?
	AEADBackend AEADTypeEnum
	// GCM needs unique IVs (nonces)
	IVGenerator *nonceGenerator
	IVLen       int
}

CryptoCore is the low level crypto implementation.

func New

func New(key []byte, aeadType AEADTypeEnum, IVBitLen int, useHKDF bool, forceDecode bool) *CryptoCore

New returns a new CryptoCore object or panics.

Even though the "GCMIV128" feature flag is now mandatory, we must still support 96-bit IVs here because they were used for encrypting the master key in gocryptfs.conf up to gocryptfs v1.2. v1.3 switched to 128 bits.