crypto

Documentation

Overview

Package crypto provides AES-256-GCM encryption for the scratchpad.

The key is a 256-bit random value stored as a raw file. The nonce is 12 bytes of random data prepended to the ciphertext. Each write re-encrypts the entire file.

Index

• Constants
• func Decrypt(key, ciphertext []byte) ([]byte, error)
• func Encrypt(key, plaintext []byte) ([]byte, error)
• func GenerateKey() ([]byte, error)
• func LoadKey(path string) ([]byte, error)
• func SaveKey(path string, key []byte) error

Constants

const KeySize = 32

KeySize is the required key length in bytes (256 bits).

const NonceSize = 12

NonceSize is the GCM nonce length in bytes.

Functions

func Decrypt

func Decrypt(key, ciphertext []byte) ([]byte, error)

Decrypt decrypts AES-256-GCM ciphertext produced by Encrypt.

Parameters:

• key: 32-byte AES-256 key (must match the key used for encryption)
• ciphertext: Nonce-prefixed ciphertext as produced by Encrypt

Returns:

• []byte: Decrypted plaintext
• error: Non-nil if key is wrong, ciphertext is too short, or authentication fails

func Encrypt

func Encrypt(key, plaintext []byte) ([]byte, error)

Encrypt encrypts plaintext with AES-256-GCM.

The returned ciphertext is formatted as:

[12-byte nonce][ciphertext + 16-byte GCM tag]

Parameters:

• key: 32-byte AES-256 key
• plaintext: Data to encrypt

Returns:

• []byte: Nonce-prefixed ciphertext
• error: Non-nil if key is wrong size or encryption fails

func GenerateKey

func GenerateKey() ([]byte, error)

GenerateKey returns a new 256-bit random key.

Returns:

• []byte: A 32-byte random key
• error: Non-nil if the system random source fails

func LoadKey

func LoadKey(path string) ([]byte, error)

LoadKey reads a 32-byte key from a file.

Parameters:

• path: Path to the key file

Returns:

• []byte: The 32-byte key
• error: Non-nil if the file cannot be read or is not exactly 32 bytes

func SaveKey

func SaveKey(path string, key []byte) error

SaveKey writes a key to a file with mode 0600.

Parameters:

• path: Destination file path
• key: Key bytes to write

Returns:

• error: Non-nil if the file cannot be written