secretbox

Documentation

Overview

Package secretbox provides authenticated symmetric encryption (AES-256-GCM) for secrets stored at rest (e.g. per-shop Telegram bot tokens).

Index

• Constants
• Variables
• type Box
  • func New(key []byte) (*Box, error)
  • func (b *Box) HMAC(s string) string
  • func (b *Box) Open(encoded string) (string, error)
  • func (b *Box) Seal(plaintext string) (string, error)

Constants

const KeySize = 32

KeySize is the required AES-256 key length in bytes.

Variables

var ErrInvalidKey = errors.New("secretbox: key must be 32 bytes")

ErrInvalidKey is returned when the key is not KeySize bytes.

Types

type Box

type Box struct {
	// contains filtered or unexported fields
}

Box seals and opens secrets with AES-256-GCM, and derives deterministic HMAC tags (for equality/uniqueness checks over encrypted-at-rest values).

func New

func New(key []byte) (*Box, error)

New returns a Box for the given 32-byte key.

func (*Box) HMAC

func (b *Box) HMAC(s string) string

HMAC returns a deterministic hex HMAC-SHA256 tag of s. Unlike Seal (random nonce → different ciphertext each call), HMAC yields the same tag for the same input, so it can back a UNIQUE index for detecting duplicate secrets without storing plaintext.

func (*Box) Open

func (b *Box) Open(encoded string) (string, error)

Open decrypts a value produced by Seal.

func (*Box) Seal

func (b *Box) Seal(plaintext string) (string, error)

Seal encrypts plaintext and returns base64(nonce ‖ ciphertext).