hsm

Documentation

Overview

Package hsm provides HSMProvider implementations for use with keeper. SoftHSM is an in-process provider backed by memguard, intended for testing and CI environments. It must not be used in production.

Index

• type SoftHSM
  • func NewSoftHSM() (*SoftHSM, error)
  • func (h *SoftHSM) Ping(_ context.Context) error
  • func (h *SoftHSM) UnwrapDEK(wrapped []byte) ([]byte, error)
  • func (h *SoftHSM) WrapDEK(dek []byte) ([]byte, error)

Types

type SoftHSM

type SoftHSM struct {
	// contains filtered or unexported fields
}

SoftHSM is a purely in-process HSMProvider backed by a random wrapping key held in a memguard Enclave. It satisfies the keeper.HSMProvider interface and is safe for concurrent use, but provides no hardware-level protection.

func NewSoftHSM

func NewSoftHSM() (*SoftHSM, error)

NewSoftHSM generates a random 32-byte wrapping key and seals it into a memguard Enclave. The returned SoftHSM is ready to use immediately.

func (*SoftHSM) Ping

func (h *SoftHSM) Ping(_ context.Context) error

Ping always returns nil for an in-process provider. It satisfies the keeper.HSMProvider interface for health monitoring.

func (*SoftHSM) UnwrapDEK

func (h *SoftHSM) UnwrapDEK(wrapped []byte) ([]byte, error)

UnwrapDEK decrypts a wrapped DEK produced by WrapDEK. Returns an error if authentication fails or the data is malformed.

func (*SoftHSM) WrapDEK

func (h *SoftHSM) WrapDEK(dek []byte) ([]byte, error)

WrapDEK encrypts dek with the internal wrapping key using XChaCha20-Poly1305. The returned bytes are [24-byte nonce || ciphertext || 16-byte tag].