Documentation
¶
Overview ¶
Package crypto provides age-based encryption functionality for OpenPass. It supports encryption with X25519 recipients, passphrase-based encryption, and multi-recipient encryption for sharing vault entries.
Index ¶
- Constants
- Variables
- func Decrypt(ciphertext []byte, identity *age.X25519Identity) ([]byte, error)
- func DecryptWithPassphrase(ciphertext []byte, passphrase string) ([]byte, error)
- func Encrypt(plaintext []byte, recipient *age.X25519Recipient) ([]byte, error)
- func EncryptWithPassphrase(plaintext []byte, passphrase string) ([]byte, error)
- func EncryptWithRecipients(plaintext []byte, recipients ...*age.X25519Recipient) ([]byte, error)
- func GenerateIdentity() (*age.X25519Identity, error)
- func GenerateIdentityString() (string, error)
- func GeneratePassword(length int, useSymbols bool) (string, error)
- func GetRecipientFromIdentity(identity *age.X25519Identity) (*age.X25519Recipient, error)
- func IdentityExists(path string) bool
- func IsValidIdentity(identityStr string) bool
- func IsValidRecipient(recipientStr string) bool
- func LoadIdentity(path string, passphrase string) (*age.X25519Identity, error)
- func ParseRecipients(recipientStrs []string) ([]*age.X25519Recipient, error)
- func RecipientsToStrings(recipients []*age.X25519Recipient) []string
- func SaveIdentity(id *age.X25519Identity, path string, passphrase string) error
- func SetScryptWorkFactorForTests(workFactor int) func()
- func ValidateIdentity(identityStr string) (*age.X25519Identity, error)
- func ValidateRecipient(recipientStr string) (*age.X25519Recipient, error)
- func ValidateTOTPParams(algorithm string, digits, period int) error
- func ValidateTOTPSecret(secret string) error
- type TOTPCode
Constants ¶
const MaxPasswordLength = 1024
MaxPasswordLength is the upper bound for generated password length.
Variables ¶
var ( ErrNilRecipient = errors.New("recipient is nil") ErrNilIdentity = errors.New("identity is nil") ErrNoRecipients = errors.New("no recipients provided") ErrInvalidKeyFormat = errors.New("invalid key format") ErrDecryptionFailed = errors.New("decryption failed") ErrEmptyPlaintext = errors.New("plaintext is empty") ErrEmptyCiphertext = errors.New("ciphertext is empty") )
Common errors for crypto operations
Functions ¶
func Decrypt ¶
func Decrypt(ciphertext []byte, identity *age.X25519Identity) ([]byte, error)
Decrypt decrypts ciphertext using the provided identity. Returns the decrypted plaintext or an error if decryption fails.
func DecryptWithPassphrase ¶
DecryptWithPassphrase decrypts ciphertext using a passphrase. The passphrase must match the one used during encryption.
func Encrypt ¶
func Encrypt(plaintext []byte, recipient *age.X25519Recipient) ([]byte, error)
Encrypt encrypts plaintext for a single recipient. Returns the encrypted ciphertext or an error if encryption fails.
func EncryptWithPassphrase ¶
EncryptWithPassphrase encrypts plaintext using a passphrase. The passphrase is used to derive a scrypt-based recipient. This is useful for encrypting data that should be decryptable with a password.
func EncryptWithRecipients ¶
func EncryptWithRecipients(plaintext []byte, recipients ...*age.X25519Recipient) ([]byte, error)
EncryptWithRecipients encrypts plaintext for multiple recipients. All provided recipients will be able to decrypt the resulting ciphertext. Returns an error if no recipients are provided or if any recipient is nil.
func GenerateIdentity ¶
func GenerateIdentity() (*age.X25519Identity, error)
GenerateIdentity generates a new age X25519 identity. Returns the generated identity or an error if generation fails.
func GenerateIdentityString ¶
GenerateIdentityString generates a new age identity and returns it as a string.
func GetRecipientFromIdentity ¶
func GetRecipientFromIdentity(identity *age.X25519Identity) (*age.X25519Recipient, error)
GetRecipientFromIdentity extracts the public recipient from an identity.
func IdentityExists ¶
IdentityExists checks if an identity file exists at the given path.
func IsValidIdentity ¶
IsValidIdentity checks if the given string is a valid age identity without returning the parsed identity.
func IsValidRecipient ¶
IsValidRecipient checks if the given string is a valid age recipient without returning the parsed recipient.
func LoadIdentity ¶
func LoadIdentity(path string, passphrase string) (*age.X25519Identity, error)
LoadIdentity loads and decrypts an identity from a file using a passphrase. Returns the decrypted identity or an error if loading/decryption fails.
func ParseRecipients ¶
func ParseRecipients(recipientStrs []string) ([]*age.X25519Recipient, error)
ParseRecipients parses a slice of recipient strings into X25519Recipient objects. Returns an error if any recipient string is invalid.
func RecipientsToStrings ¶
func RecipientsToStrings(recipients []*age.X25519Recipient) []string
RecipientsToStrings converts a slice of X25519Recipient to their string representations.
func SaveIdentity ¶
func SaveIdentity(id *age.X25519Identity, path string, passphrase string) error
SaveIdentity encrypts and saves an identity to a file using a passphrase. The identity is encrypted with scrypt before being written to disk. The file permissions are set to 0o600 (readable/writable by owner only).
func SetScryptWorkFactorForTests ¶
func SetScryptWorkFactorForTests(workFactor int) func()
SetScryptWorkFactorForTests overrides the scrypt work factor for identities created in tests and returns a restore function.
func ValidateIdentity ¶
func ValidateIdentity(identityStr string) (*age.X25519Identity, error)
ValidateIdentity validates that the given string is a valid age identity. A valid identity starts with "AGE-SECRET-KEY-1" and contains valid bech32 encoding.
func ValidateRecipient ¶
func ValidateRecipient(recipientStr string) (*age.X25519Recipient, error)
ValidateRecipient validates that the given string is a valid age recipient. A valid recipient starts with "age1" and contains valid bech32 encoding.
func ValidateTOTPParams ¶ added in v1.1.0
ValidateTOTPParams enforces RFC 6238 bounds on TOTP parameters. Empty algorithm and zero digits/period are accepted (used to detect if values need to be set). This prevents DoS/overflow from malformed entries.
Source Files