cryptfs

README

moov-io/cryptfs

Moov's mission is to give developers an easy way to create and integrate bank processing into their own software products. Our open source projects are each focused on solving a single responsibility in financial services and designed around performance, scalability, and ease of use.

cryptfs implements Go's io/fs.FS interface for interacting with the local filesystem to transparently encrypt/decrypt files. This is useful as a library because it offers applications a well tested routine for keeping data protected.

Project Status

cryptfs is included in multiple open-source projects Moov offers and is used in production environments. Please star the project if you are interested in its progress. If you find any bugs or desire additional encryption/encoding algorithms we would appreciate an issue or pull request. Thanks!

Usage

Cryptfs supports AES and GPG for encryption and Base64 (Standard Raw) encoding. Currently cryptfs is usable as a Go library in your applications. This needs to be initialized prior to reading or writing any files.

AES Cryptor

key := []byte("1234567812345678")) // insecure key

fsys, err := cryptfs.FromCryptor(cryptfs.NewAESCryptor(key))
if err != nil {
    // do something
}

fsys.SetCoder(cryptfs.Base64()) // optional, default is the raw bytes

GPG Cryptor

fsys, err := cryptfs.FromCryptor(cryptfs.NewGPGCryptorFile(publicKeyPath, privateKeyPath, password))
if err != nil {
    // do something
}

fsys.SetCoder(cryptfs.Base64()) // optional, default is the raw bytes

Once initialized you can perform open/read and write operations.

Open

file, err := fsys.Open(path)
if err != nil {
    // do something
}

ReadFile

plaintext, err := fsys.ReadFile(path)
if err != nil {
    // do something
}

WriteFile

err := fsys.WriteFile(path, data, 0600)
if err != nil {
    // do something
}

Command Line

Moov offers a command line tool for using this library as well. It's handy for operational debugging and testing.

Getting help

channel	info
Twitter @moov	You can follow Moov.io's Twitter feed to get updates on our project(s). You can also tweet us questions or just share blogs or stories.
GitHub Issue	If you are able to reproduce a problem please open a GitHub Issue under the specific project that caused the error.
moov-io slack	Join our slack channel to have an interactive discussion about the development of the project.

Supported and tested platforms

• 64-bit Linux (Ubuntu, Debian), macOS, and Windows

Contributing

Yes please! Please review our Contributing guide and Code of Conduct to get started! Checkout our issues for first time contributors for something to help out with.

This project uses Go Modules and Go v1.18 or newer. See Golang's install instructions for help setting up Go. You can download the source code and we offer tagged and released versions as well. We highly recommend you use a tagged release for production.

License

Apache License 2.0 - See LICENSE for details.

Documentation

Index

• type AESCryptor
  • func NewAESCryptor(key []byte) (*AESCryptor, error)
• type Coder
  • func Base64() Coder
  • func NoEncoding() Coder
• type Compressor
  • func Gzip() Compressor
  • func GzipLevel(level int) Compressor
  • func GzipRequired(level int) Compressor
  • func NoCompression() Compressor
• type Cryptor
  • func NewGPGCryptor(publicKey, privateKey io.Reader, password []byte) (Cryptor, error)
  • func NewGPGCryptorFile(publicKeyPath, privateKeyPath string, password []byte) (Cryptor, error)
  • func NewGPGDecryptor(data io.Reader, password []byte) (Cryptor, error)
  • func NewGPGDecryptorFile(path string, password []byte) (Cryptor, error)
  • func NewGPGEncryptor(data io.Reader) (Cryptor, error)
  • func NewGPGEncryptorFile(path string) (Cryptor, error)
• type FS
  • func FromCryptor(cryptor Cryptor, err error) (*FS, error)
  • func New(cryptor Cryptor) (*FS, error)
  • func (fsys *FS) Disfigure(plaintext []byte) ([]byte, error)
  • func (fsys *FS) Open(name string) (fs.File, error)
  • func (fsys *FS) ReadFile(name string) ([]byte, error)
  • func (fsys *FS) Reveal(encodedBytes []byte) ([]byte, error)
  • func (fsys *FS) SetCoder(coder Coder)
  • func (fsys *FS) SetCompression(compressor Compressor)
  • func (fsys *FS) WriteFile(filepath string, plaintext []byte, perm fs.FileMode) error
• type GPGCryptor

Types

type AESCryptor

type AESCryptor struct {
	// contains filtered or unexported fields
}

func NewAESCryptor

func NewAESCryptor(key []byte) (*AESCryptor, error)

NewAESCryptor returns an Cryptor which performs AES encryption/decryption.

The key must be 16, 24, or 32 bytes to select AES-128, AES-192, or AES-256.

type Coder

type Coder interface {
	// contains filtered or unexported methods
}

Coder is an interface describing two operations which transform data into another format. This can be done to compress or disfigure bytes.

func Base64

func Base64() Coder

Base64 is a Coder which transforms data following RFC 4648 section 3.2. There are no padding characters added or accepted by this Coder.

func NoEncoding

func NoEncoding() Coder

NoEncoding is a Coder which does not transform data.

type Compressor

type Compressor interface {
	// contains filtered or unexported methods
}

func Gzip

func Gzip() Compressor

func GzipLevel

func GzipLevel(level int) Compressor

GzipLevel allows callers to specify the compression level. Refer to compress/gzip.DefaultCompression and other values for more details.

func GzipRequired

func GzipRequired(level int) Compressor

GzipRequired forces the Compressor to only allow gzipped data to be decompressed.

Refer to compress/gzip.DefaultCompression and other values for more details on levels.

func NoCompression

func NoCompression() Compressor

type Cryptor

type Cryptor interface {
	// contains filtered or unexported methods
}

func NewGPGCryptor

func NewGPGCryptor(publicKey, privateKey io.Reader, password []byte) (Cryptor, error)

func NewGPGCryptorFile

func NewGPGCryptorFile(publicKeyPath, privateKeyPath string, password []byte) (Cryptor, error)

func NewGPGDecryptor

func NewGPGDecryptor(data io.Reader, password []byte) (Cryptor, error)

func NewGPGDecryptorFile

func NewGPGDecryptorFile(path string, password []byte) (Cryptor, error)

func NewGPGEncryptor

func NewGPGEncryptor(data io.Reader) (Cryptor, error)

func NewGPGEncryptorFile

func NewGPGEncryptorFile(path string) (Cryptor, error)

type FS

type FS struct {
	// contains filtered or unexported fields
}

func FromCryptor

func FromCryptor(cryptor Cryptor, err error) (*FS, error)

FromCryptor returns an FS instance and allows passing the results of creating a Cryptor directly as the arguments.

func New

func New(cryptor Cryptor) (*FS, error)

New returns a FS instance with the specified Cryptor used for all operations.

func (*FS) Disfigure

func (fsys *FS) Disfigure(plaintext []byte) ([]byte, error)

Disfigure will encrypt and encode the plaintext

func (*FS) Open

func (fsys *FS) Open(name string) (fs.File, error)

Open will open a file at the given name

func (*FS) ReadFile

func (fsys *FS) ReadFile(name string) ([]byte, error)

ReadFile will attempt to open, decode, and decrypt a file.

func (*FS) Reveal

func (fsys *FS) Reveal(encodedBytes []byte) ([]byte, error)

Reveal will decode and then decrypt the bytes its given

func (*FS) SetCoder

func (fsys *FS) SetCoder(coder Coder)

func (*FS) SetCompression

func (fsys *FS) SetCompression(compressor Compressor)

func (*FS) WriteFile

func (fsys *FS) WriteFile(filepath string, plaintext []byte, perm fs.FileMode) error

WriteFile will attempt to encrypt, encode, and create a file under the given filepath.

type GPGCryptor

type GPGCryptor struct {
	// contains filtered or unexported fields
}