secrets

Documentation

Index

• type Cipher
  • func NewCipher(keyB64, fallbackPath string) (*Cipher, error)
  • func (c *Cipher) Decrypt(sealed []byte) ([]byte, error)
  • func (c *Cipher) DecryptWithAAD(sealed []byte, aad []byte) ([]byte, error)
  • func (c *Cipher) Encrypt(plain []byte) ([]byte, error)
  • func (c *Cipher) EncryptWithAAD(plain []byte, aad []byte) ([]byte, error)

Types

type Cipher

type Cipher struct {
	// contains filtered or unexported fields
}

Cipher seals and opens user-supplied secrets (cloud credentials for sandbox mounts) using AES-256-GCM. The seal format is `nonce(12) || ciphertext+tag`. The key never leaves this package; sealed bytes are what crosses other trust boundaries (DB, logs, error messages).

func NewCipher

func NewCipher(keyB64, fallbackPath string) (*Cipher, error)

NewCipher constructs a Cipher from either an explicit key (base64-encoded, must decode to 32 bytes) or a fallback file path. If the explicit key is empty and the fallback path does not exist, a fresh 32-byte key is generated and persisted at the path with mode 0600.

func (*Cipher) Decrypt

func (c *Cipher) Decrypt(sealed []byte) ([]byte, error)

Decrypt opens a sealed blob produced by Encrypt. Tampering, truncation, or using a different key all return an error.

func (*Cipher) DecryptWithAAD

func (c *Cipher) DecryptWithAAD(sealed []byte, aad []byte) ([]byte, error)

func (*Cipher) Encrypt

func (c *Cipher) Encrypt(plain []byte) ([]byte, error)

Encrypt seals plaintext. Empty input is allowed and produces a non-empty sealed blob (the nonce alone authenticates that no plaintext was sealed).

func (*Cipher) EncryptWithAAD

func (c *Cipher) EncryptWithAAD(plain []byte, aad []byte) ([]byte, error)