Documentation
¶
Index ¶
- func AES256Decrypt(key []byte, cipherPayload []byte) ([]byte, error)
- func AES256Encrypt(key []byte, plainPayload []byte) ([]byte, error)
- func LoadRsaPrivateKey(path string) (*rsa.PrivateKey, error)
- func LoadRsaPublicKey(path string) (*rsa.PublicKey, error)
- func RandomByteArray(length int) ([]byte, error)
- func SplitByteSliceIntoSize(data []byte, size int) [][]byte
- func X509AES256Decrypt(privateKey *rsa.PrivateKey, cipherPayload []byte) ([]byte, error)
- func X509AES256Encrypt(publicKey *rsa.PublicKey, plainPayload []byte) ([]byte, error)
- func X509ChunkDecrypt(privateKey *rsa.PrivateKey, cipherPayload []byte) ([]byte, error)
- func X509ChunkEncrypt(publicKey *rsa.PublicKey, plainPayload []byte) ([]byte, error)
- func X509PrivateKeyMaxEncryptPayloadLength(privateKey *rsa.PrivateKey) int
- func X509PubicKeyMaxEncryptPayloadLength(pubicKey *rsa.PublicKey) int
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AES256Decrypt ¶
AES256Decrypt takes a key and cipher text and returns the decrypted plain text.
The cipher text is expected to contain a 16 byte salt, followed by the AES-256 encrypted plain text, followed by the 256 bit HMAC of the plain text.
The key is expected to be a 256 bit key, it is used to derive a 256 bit key using the salt and the PBKDF2 key derivation function with a cost of 4096.
The HMAC is verified before the plain text is decrypted, if the HMAC is invalid an error is returned.
The cipher text is decrypted using the derived key and the AES-256 cipher in Cipher Feedback (CFB) mode.
The decrypted plain text is returned as a byte slice, or an error is returned if any of the above steps fail.
func AES256Encrypt ¶
AES256Encrypt encrypts the given plainPayload with the given key. It returns the encrypted text or an error. The encrypted text is a concatenation of the random salt used in the derivation of the encryption key, the encrypted payload, and the MAC (Message Authentication Code) of the encrypted payload. The salt is a random byte slice of length 16, the encrypted payload is a byte slice of length BlockSize + len(plainPayload) where BlockSize is the block size of the AES cipher, and the MAC is a byte slice of length sha256.Size (32 bytes).
func LoadRsaPrivateKey ¶
func LoadRsaPrivateKey(path string) (*rsa.PrivateKey, error)
func RandomByteArray ¶
RandomByteArray returns a byte slice of length `length` that is randomly generated.
func SplitByteSliceIntoSize ¶
func X509AES256Decrypt ¶
func X509AES256Decrypt(privateKey *rsa.PrivateKey, cipherPayload []byte) ([]byte, error)
Requires a rsa private key and a cipher payload (created by X509AES256Encrypt) as parameters. First splits the cipher payload into the X509 encrypted random byte array and the aes encrypted cipher payload. Then uses the X509 private key to decrypt the X509 encrypted random byte array. Then uses the decrypted random byte array to aes decrypt the rest of the cipher payload.
func X509AES256Encrypt ¶
Requires a rsa public key and a payload (that should be encrypted) as parameters. Generates a random byte array with the maximum encryption length technically permitted by the public key. Then uses this random byte array to encrypt the payload via aes encryption and returns the encrypted playload (cipher payload) as well as the X509 encrypted random byte array. The cipher payload is a concatenation of a X509 encrypted random byte array and the aes encrypted payload.
Even if a symmetric aes encryption is used internally, the actual procedure must be regarded as asymmetric because only the private key can decrypt the random byte array, which is the only one that can decrypt the playload via aes.
func X509ChunkDecrypt ¶
func X509ChunkDecrypt(privateKey *rsa.PrivateKey, cipherPayload []byte) ([]byte, error)
X509ChunkDecrypt decrypts a ciphertext using a private key. The ciphertext is expected to have been encrypted using the corresponding public key.
X509ChunkEncrypt and X509ChunkDecrypt are called "chunk" encrypt / decrypt because they have a maximum payload length depending on the public key size.
The function will return an error if the private key is nil, the cipher payload is nil or empty, or if an error occurs during the decryption process.
func X509ChunkEncrypt ¶
X509ChunkEncrypt encrypts a plain text using a public key. The plain text is expected to be not longer than the maximum payload length depending on the public key size.
X509ChunkEncrypt and X509ChunkDecrypt are called "chunk" encrypt / decrypt because they have a maximum payload length depending on the public key size.
The function will return an error if the public key is nil, the plain payload is nil or empty, or if an error occurs during the encryption process.
func X509PrivateKeyMaxEncryptPayloadLength ¶
func X509PrivateKeyMaxEncryptPayloadLength(privateKey *rsa.PrivateKey) int
Types ¶
This section is empty.
Source Files