crypto

Documentation

Overview

Package crypto provides encryption and key management operations using the age library.

This package handles:

• X25519 key generation (public/private key pairs)
• Secret encryption/decryption for secure API key storage
• Key rotation for periodic security best practices
• Atomic key replacement to prevent partial state

Thread Safety:

• Key file operations are not thread-safe (file I/O)
• Functions should not be called concurrently on same key files

Security:

• All key files use 0600 permissions (owner only)
• Temporary files are created with secure defaults
• Key rotation uses atomic operations to prevent data loss
• Private key material is never logged or printed

Performance:

• Key generation uses X25519 (fast, secure curve)
• Encryption uses age's efficient streaming API
• Temporary key files are cleaned up on failure

Index

• func DecryptSecrets(secretsPath, keyPath string) (string, error)
• func EncryptSecrets(secretsPath, keyPath, secrets string) error
• func EnsureKeyExists(configDir string) error
• func GenerateKey(keyPath string) error
• func RotateKey(configDir string) error

Functions

func DecryptSecrets

func DecryptSecrets(secretsPath, keyPath string) (string, error)

DecryptSecrets decrypts the secrets file and returns the plaintext content.

func EncryptSecrets

func EncryptSecrets(secretsPath, keyPath, secrets string) error

EncryptSecrets encrypts the given secrets string using age encryption and saves to the specified path.

func EnsureKeyExists

func EnsureKeyExists(configDir string) error

EnsureKeyExists generates a new encryption key if one doesn't exist at the specified directory.

func GenerateKey

func GenerateKey(keyPath string) error

GenerateKey generates a new X25519 encryption key and saves it to the specified path.

func RotateKey

func RotateKey(configDir string) error

RotateKey generates a new encryption key and re-encrypts all secrets with it. The old key is replaced with the new key. This should be done periodically as a security best practice.