data

Documentation

Index

• type EncryptedData
  • func NewEncryptedData(kekName string, wdekName string, wdek string, data []byte) EncryptedData
• type EncryptionEngine
  • func NewEncryptionEngine(kekName string, wDekPathName string, gcpClient registry.KMSClient, ...) *EncryptionEngine
  • func (ee *EncryptionEngine) Load(data EncryptedData)
  • func (ee *EncryptionEngine) Obfuscate(dataPlain []byte) []byte
  • func (ee *EncryptionEngine) Package(data []byte) EncryptedData
  • func (ee *EncryptionEngine) ReadWdek()
  • func (ee *EncryptionEngine) Reveal(cipherData []byte) []byte
  • func (ee *EncryptionEngine) WriteWdek()
• type Encryptor

Types

type EncryptedData

type EncryptedData struct {
	KekName       string `json:"kek"`
	WdekName      string `json:"wdekName"`
	Wdek          string `json:"wdek"`
	EncryptedData string `json:"data"`
}

EncryptedData is the object stored in the bucket.

EncryptedData is base64 encoded for transfer.
Wdek from Tink is json and encrypted.
WdekName is the primaryKeyID for the dek
KekName is the key stored in GCP KMS

func NewEncryptedData

func NewEncryptedData(kekName string, wdekName string, wdek string, data []byte) EncryptedData

NewEncryptedData constructs an object to send to GCS

type EncryptionEngine

type EncryptionEngine struct {
	// contains filtered or unexported fields
}

EncryptionEngine specifies necessary details to use Tink.

func NewEncryptionEngine

func NewEncryptionEngine(kekName string, wDekPathName string, gcpClient registry.KMSClient, logger *logrus.Logger) *EncryptionEngine

NewEncryptionEngine creates engines with required parameters

func (*EncryptionEngine) Load

func (ee *EncryptionEngine) Load(data EncryptedData)

Load grabs the wDek and reads it in.

func (*EncryptionEngine) Obfuscate

func (ee *EncryptionEngine) Obfuscate(dataPlain []byte) []byte

Obfuscate encrypts data using the underlying encryption engine

func (*EncryptionEngine) Package

func (ee *EncryptionEngine) Package(data []byte) EncryptedData

Package marshalls the encrypted data with key hierarchy information to be stored as a blob of structured data

func (*EncryptionEngine) ReadWdek

func (ee *EncryptionEngine) ReadWdek()

ReadWdek loads the wdek using KMS

func (*EncryptionEngine) Reveal

func (ee *EncryptionEngine) Reveal(cipherData []byte) []byte

Reveal decrypts data using the underlying encryption engine

func (*EncryptionEngine) WriteWdek

func (ee *EncryptionEngine) WriteWdek()

WriteWdek outputs JSON file with wDEK (encrypted)

type Encryptor

type Encryptor interface {
	Obfuscate(data io.Reader)
	Reveal() io.Writer

	ReadWdek()
	WriteWdek()

	Package(data []byte) EncryptedData
	Load(data EncryptedData)
}

Encryptor defines methods to support data encryption