encryption

Documentation

Index

• Variables
• func DecryptAESGCM(packedData []byte, key []byte) ([]byte, error)
• func DecryptX25519(packedBlob []byte, privateKeyBytes []byte) ([]byte, error)
• func SignEd25519(message []byte, privateKeyHex string) ([]byte, error)
• type S3BackupConfig
• type Service
  • func NewService(t transport.Transport, encryptionKeyHex string) (*Service, error)
  • func (s *Service) Decrypt(ctx context.Context, fig *model.Fig, namespace string) ([]byte, error)

Variables

var (
	ErrInvalidKey = errors.New("invalid key")
	ErrUnwrap     = errors.New("unwrap failed")
)

Functions

func DecryptAESGCM

func DecryptAESGCM(packedData []byte, key []byte) ([]byte, error)

DecryptAESGCM decrypts data using AES-GCM. Format: IV (12 bytes) || Ciphertext

func DecryptX25519

func DecryptX25519(packedBlob []byte, privateKeyBytes []byte) ([]byte, error)

DecryptX25519 implements ECIES decryption consistent with the web client. Format: EphemeralPubKey (32 bytes) || IV (12 bytes) || Ciphertext

func SignEd25519

func SignEd25519(message []byte, privateKeyHex string) ([]byte, error)

SignEd25519 signs a message using an Ed25519 private key. The private key must be 64 bytes (seed + public).

Types

type S3BackupConfig

type S3BackupConfig struct {
	Bucket    string
	Prefix    string
	Region    string
	Endpoint  string
	PathStyle bool
}

type Service

type Service struct {
	S3BackupEnabled bool
	S3BackupConfig  S3BackupConfig
	ClientID        string
	// contains filtered or unexported fields
}

func NewService

func NewService(t transport.Transport, encryptionKeyHex string) (*Service, error)

NewService creates a new encryption service with the given Hex-encoded X25519 private key.

func (*Service) Decrypt

func (s *Service) Decrypt(ctx context.Context, fig *model.Fig, namespace string) ([]byte, error)