vault

Documentation

Index

• func Decrypt(v Vault, id string, down provider.Downloader) (provider.Downloader, error)
• func Encrypt(v Vault, id, alg string, up provider.Uploader) (provider.Uploader, error)
• type Cipher
  • func (c Cipher) Decrypt(rd io.Reader) (io.Reader, error)
  • func (c Cipher) Encrypt(wr io.Writer) (io.WriteCloser, error)
• type DecryptedDownloader
  • func (d DecryptedDownloader) Close() error
  • func (d DecryptedDownloader) Read(b []byte) (int, error)
  • func (d DecryptedDownloader) ReadCompressed() int64
  • func (d DecryptedDownloader) ReadUncompressed() int64
• type EncryptedUploader
  • func (e EncryptedUploader) Cancel() error
  • func (e EncryptedUploader) Close() error
  • func (e EncryptedUploader) Path() string
  • func (e EncryptedUploader) Write(b []byte) (int, error)
  • func (e EncryptedUploader) WroteCompressed() int64
  • func (e EncryptedUploader) WroteUncompressed() int64
• type FixedKeyResolver
• type FixedKeySource
  • func (fks FixedKeySource) Derive(alg string, resolve func(string) ([]byte, error)) (Cipher, error)
• type NilVault
  • func (NilVault) Delete(_ string) error
  • func (NilVault) FixedKeyResolver() FixedKeyResolver
  • func (NilVault) GetCipher(_ string) (Cipher, error)
  • func (NilVault) SetCipher(_ string, _ Cipher) error
• type Vault
  • func (v Vault) Cipher(alg string) (Cipher, error)
• type VaultProvider

Functions

func Decrypt

func Decrypt(v Vault, id string, down provider.Downloader) (provider.Downloader, error)

func Encrypt

func Encrypt(v Vault, id, alg string, up provider.Uploader) (provider.Uploader, error)

Types

type Cipher

type Cipher struct {
	Algorithm string
	Key       []byte
	IV        []byte
}

func (Cipher) Decrypt

func (c Cipher) Decrypt(rd io.Reader) (io.Reader, error)

func (Cipher) Encrypt

func (c Cipher) Encrypt(wr io.Writer) (io.WriteCloser, error)

type DecryptedDownloader

type DecryptedDownloader struct {
	// contains filtered or unexported fields
}

func (DecryptedDownloader) Close

func (d DecryptedDownloader) Close() error

func (DecryptedDownloader) Read

func (d DecryptedDownloader) Read(b []byte) (int, error)

func (DecryptedDownloader) ReadCompressed

func (d DecryptedDownloader) ReadCompressed() int64

func (DecryptedDownloader) ReadUncompressed

func (d DecryptedDownloader) ReadUncompressed() int64

type EncryptedUploader

type EncryptedUploader struct {
	// contains filtered or unexported fields
}

func (EncryptedUploader) Cancel

func (e EncryptedUploader) Cancel() error

func (EncryptedUploader) Close

func (e EncryptedUploader) Close() error

func (EncryptedUploader) Path

func (e EncryptedUploader) Path() string

func (EncryptedUploader) Write

func (e EncryptedUploader) Write(b []byte) (int, error)

func (EncryptedUploader) WroteCompressed

func (e EncryptedUploader) WroteCompressed() int64

func (EncryptedUploader) WroteUncompressed

func (e EncryptedUploader) WroteUncompressed() int64

type FixedKeyResolver

type FixedKeyResolver func(in string) ([]byte, error)

var PassThroughResolver FixedKeyResolver = func(in string) ([]byte, error) {
	return []byte(in), nil
}

type FixedKeySource

type FixedKeySource struct {
	// Enabled turns on fixed key derivation.
	//
	Enabled bool

	// PBKDF2 is the id of a secret, stored in the provider
	// backend vault, from which we will derive encrpytion
	// parameters.
	//
	PBKDF2 string

	// Literal provides paths to algorithm-specific key and
	// initialization vector values stored in the vault.
	//
	Literal struct {
		AES128 struct {
			Key string
			IV  string
		}
		AES192 struct {
			Key string
			IV  string
		}
		AES256 struct {
			Key string
			IV  string
		}
	}
}

FixedKeySource represents operator configuration for the source and derivation of a single fixed cipher's static key and initialization vector.

We currently support the following methods:

PBKDF2   Password-Based Key Derivation; the operator
         points us at a secret *in* the vault, and
         we use that as an input to a deterministic
         function for deriving key + iv.

Literal  The key and the iv, encoded as fixed-length
         hexadecimal values, are to be found in the
         vault at fixed locations.  Different paths
         (ids) in the vault are used for different
         algorithms.

func (FixedKeySource) Derive

func (fks FixedKeySource) Derive(alg string, resolve func(string) ([]byte, error)) (Cipher, error)

type NilVault

type NilVault struct{}

func (NilVault) Delete

func (NilVault) Delete(_ string) error

func (NilVault) FixedKeyResolver

func (NilVault) FixedKeyResolver() FixedKeyResolver

func (NilVault) GetCipher

func (NilVault) GetCipher(_ string) (Cipher, error)

func (NilVault) SetCipher

func (NilVault) SetCipher(_ string, _ Cipher) error

type Vault

type Vault struct {
	FixedKey FixedKeySource
	Provider VaultProvider
}

var Nil Vault

func (Vault) Cipher

func (v Vault) Cipher(alg string) (Cipher, error)

type VaultProvider

type VaultProvider interface {
	FixedKeyResolver() FixedKeyResolver
	SetCipher(string, Cipher) error
	GetCipher(string) (Cipher, error)
	Delete(string) error
}