crypto

Documentation

Index

• func DecryptAESGCM(key, ciphertext, iv, tag []byte) ([]byte, error)
• func DecryptWithIdentities(data []byte, identities []age.Identity) ([]byte, error)
• func EncryptAESGCM(key, plaintext []byte) (ciphertext, iv, tag []byte, err error)
• func EncryptForRecipients(data []byte, recipients []age.Recipient) ([]byte, error)
• func GenerateAESKey() ([]byte, error)
• func GenerateAgeKeypair() (*age.X25519Identity, error)
• func IsFIDO2Recipient(pubKey string) bool
• func IsSSHKey(pubKey string) bool
• func IsYubiKeyRecipient(pubKey string) bool
• func ParseAgeIdentities(privKeys string) ([]age.Identity, error)
• func ParseAgeIdentity(privKey string) (age.Identity, error)
• func ParseAgeRecipient(pubKey string) (age.Recipient, error)
• func ParseFIDO2Recipient(pubKey string) (age.Recipient, error)
• func ParseIdentities(content string) ([]age.Identity, error)
• func ParseIdentitiesWithPassphrase(content, keyPath string, passphraseFunc PassphraseFunc) ([]age.Identity, error)
• func ParseIdentity(privKey string) (age.Identity, error)
• func ParseRecipient(pubKey string) (age.Recipient, error)
• type KeyType
  • func DetectKeyType(pubKey string) KeyType
• type PassphraseFunc

Functions

func DecryptAESGCM

func DecryptAESGCM(key, ciphertext, iv, tag []byte) ([]byte, error)

DecryptAESGCM decrypts ciphertext using AES-256-GCM

func DecryptWithIdentities

func DecryptWithIdentities(data []byte, identities []age.Identity) ([]byte, error)

DecryptWithIdentities decrypts age-encrypted data using provided identities

func EncryptAESGCM

func EncryptAESGCM(key, plaintext []byte) (ciphertext, iv, tag []byte, err error)

EncryptAESGCM encrypts plaintext using AES-256-GCM Returns ciphertext, iv, and tag separately

func EncryptForRecipients

func EncryptForRecipients(data []byte, recipients []age.Recipient) ([]byte, error)

EncryptForRecipients encrypts data for multiple age recipients

func GenerateAESKey

func GenerateAESKey() ([]byte, error)

GenerateAESKey generates a random 256-bit AES key

func GenerateAgeKeypair

func GenerateAgeKeypair() (*age.X25519Identity, error)

GenerateAgeKeypair generates a new age X25519 keypair

func IsFIDO2Recipient

func IsFIDO2Recipient(pubKey string) bool

IsFIDO2Recipient checks if a string is a FIDO2 recipient

func IsSSHKey

func IsSSHKey(pubKey string) bool

IsSSHKey returns true if the key is an SSH key

func IsYubiKeyRecipient

func IsYubiKeyRecipient(pubKey string) bool

IsYubiKeyRecipient returns true if the string is a YubiKey recipient

func ParseAgeIdentities

func ParseAgeIdentities(privKeys string) ([]age.Identity, error)

ParseAgeIdentities parses multiple age private keys (newline-separated) into Identities Deprecated: Use ParseIdentities instead which supports both age and SSH keys

func ParseAgeIdentity

func ParseAgeIdentity(privKey string) (age.Identity, error)

ParseAgeIdentity parses an age private key string into an Identity Deprecated: Use ParseIdentity instead which supports both age and SSH keys

func ParseAgeRecipient

func ParseAgeRecipient(pubKey string) (age.Recipient, error)

ParseAgeRecipient parses an age public key string into a Recipient Deprecated: Use ParseRecipient instead which supports both age and SSH keys

func ParseFIDO2Recipient

func ParseFIDO2Recipient(pubKey string) (age.Recipient, error)

ParseFIDO2Recipient parses a FIDO2 recipient string into an age.Recipient

func ParseIdentities

func ParseIdentities(content string) ([]age.Identity, error)

ParseIdentities parses private keys from file content into Identities. Supports both native age X25519 keys (newline-separated) and SSH private keys. For passphrase-protected SSH keys, use ParseIdentitiesWithPassphrase instead.

func ParseIdentitiesWithPassphrase

func ParseIdentitiesWithPassphrase(content, keyPath string, passphraseFunc PassphraseFunc) ([]age.Identity, error)

ParseIdentitiesWithPassphrase parses private keys with optional passphrase support. If the SSH key is passphrase-protected and passphraseFunc is provided, it will be called to get the passphrase. If passphraseFunc is nil, an error is returned for passphrase-protected keys.

func ParseIdentity

func ParseIdentity(privKey string) (age.Identity, error)

ParseIdentity parses a private key string into an Identity. Supports both native age X25519 keys and SSH keys (ed25519, RSA).

func ParseRecipient

func ParseRecipient(pubKey string) (age.Recipient, error)

ParseRecipient parses a public key string into a Recipient. Supports native age X25519 keys, SSH keys (ed25519, RSA), YubiKey, and FIDO2 recipients.

Types

type KeyType

type KeyType string

KeyType represents the type of a public key

const (
	KeyTypeAge        KeyType = "age"
	KeyTypeYubiKey    KeyType = "yubikey"
	KeyTypeFIDO2      KeyType = "fido2"
	KeyTypeSSHEd25519 KeyType = "ssh-ed25519"
	KeyTypeSSHRSA     KeyType = "ssh-rsa"
	KeyTypeSSHECDSA   KeyType = "ecdsa"
	KeyTypeUnknown    KeyType = "unknown"
)

func DetectKeyType

func DetectKeyType(pubKey string) KeyType

DetectKeyType detects the type of a public key string

type PassphraseFunc

type PassphraseFunc func(keyPath string) ([]byte, error)

PassphraseFunc is a callback to get a passphrase for encrypted SSH keys. The keyPath parameter indicates which key file needs the passphrase.