Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

security

package

Go to main page

Versions in this module

v3

v3.0.2

Aug 7, 2026

v3.0.1

Jul 26, 2026

v3.0.0

Jul 16, 2026

Changes in this version

+ const CipherAlg

+ const EnvelopeAlg

+ func B64(bytes []byte) string

+ func BuildSecret(input BuildSecretInput) (domain.SecretBody, error)

+ func CanonicalJSON(value interface{}) (string, error)

+ func DecryptEnvelope(identity domain.LocalIdentityRecord, envelope domain.EnvelopeJSON) ([]byte, error)

+ func DecryptSecret(secret domain.SecretBody, envKey []byte) (string, error)

+ func DecryptXChaCha(key []byte, payload domain.EncryptedPayload, aad []byte) ([]byte, error)

+ func DeriveValueKeys(master []byte, scope string) ([]byte, []byte, error)

+ func DeviceIDForSigningPublicKey(publicKey []byte) string

+ func EncryptForDevice(identity domain.LocalIdentityRecord, recipientPublicKeyB64 string, ...) (domain.EnvelopeJSON, error)

+ func EncryptXChaCha(key []byte, plaintext []byte, aad []byte) (domain.EncryptedPayload, error)

+ func Fingerprint(bytes []byte) string

+ func NewAccessGrant(projectID string, envName string, identity domain.LocalIdentityRecord, ...) (domain.AccessGrantRecord, error)

+ func NewDeviceIdentity(projectID string, name string, platform string) (domain.LocalIdentityRecord, domain.DeviceRecord, error)

+ func NewEnvironmentKey(projectID string, envName string, identity domain.LocalIdentityRecord, ...) (domain.EnvironmentKeyRecord, domain.AccessGrantRecord, []byte, error)

+ func Now() string

+ func PublicDeviceRecord(identity domain.LocalIdentityRecord) domain.DeviceRecord

+ func RandomBytes(size int) ([]byte, error)

+ func RotateEnvironmentKey(projectID string, envName string, identity domain.LocalIdentityRecord, ...) (domain.EnvironmentKeyRecord, []byte, []byte, error)

+ func SignCanonical(value interface{}, identity domain.LocalIdentityRecord) (string, error)

+ func SignDeviceRecord(record *domain.DeviceRecord, identity domain.LocalIdentityRecord) error

+ func SignEnvelope(envelope domain.EnvelopeJSON, identity domain.LocalIdentityRecord) (string, error)

+ func SignSecretBody(secret *domain.SecretBody, identity domain.LocalIdentityRecord) error

+ func UB64(value string) ([]byte, error)

+ func UUID() (string, error)

+ func VerifyCanonical(value interface{}, publicKeyB64 string, signatureB64 string) bool

+ func VerifyDeviceRecord(record domain.DeviceRecord) error

+ func VerifyEnvelope(envelope domain.EnvelopeJSON, senderPublicKeyB64 string) bool

+ func VerifySecretBody(secret domain.SecretBody, publicKeyB64 string, signatureB64 string) bool

+ type BuildSecretInput struct

+ ChangeReason string

+ Environment string

+ EnvironmentKey []byte

+ EnvironmentKeyRecord domain.EnvironmentKeyRecord

+ Identity domain.LocalIdentityRecord

+ Key string

+ Plaintext string

+ PreviousVersion int

+ ProjectID string

+ type IdentityRegistryEntry struct

+ DeviceID string

+ Identity string

+ ProjectID string

+ ProjectName string

+ Root string

+ UpdatedAt string

+ type IdentityStore struct

+ func NewIdentityStore() (IdentityStore, error)

+ func (s IdentityStore) Delete(projectID string) error

+ func (s IdentityStore) ListProjectIdentities() ([]IdentityRegistryEntry, error)

+ func (s IdentityStore) Load(projectID string) (domain.LocalIdentityRecord, error)

+ func (s IdentityStore) Path(projectID string) string

+ func (s IdentityStore) ProjectIdentity(projectID string) (IdentityRegistryEntry, bool, error)

+ func (s IdentityStore) RegisterProjectIdentity(identity domain.LocalIdentityRecord, projectName string, root string) error

+ func (s IdentityStore) RegistryPath() (string, error)

+ func (s IdentityStore) Save(identity domain.LocalIdentityRecord) error

+ func (s IdentityStore) UnregisterProjectIdentity(projectID string) error

v3.0.0-rc.2

Jul 16, 2026

v3.0.0-rc.1

Jul 15, 2026