Versions in this module Expand all Collapse all v0 v0.2.0 Sep 4, 2026 v0.1.0 Aug 15, 2026 Changes in this version + const FormatVersion + const RecoveryCodeLen + var ErrAuthFailed = errors.New("tumbler: authentication failed") + var ErrBadMagic = errors.New("tumbler: bad magic") + var ErrBadVersion = errors.New("tumbler: unsupported format version") + var ErrDEKSize = errors.New("tumbler: data key size out of range") + var ErrInvalidRecoveryCode = fmt.Errorf("tumbler: invalid recovery code") + var ErrKDFParams = errors.New("tumbler: kdf parameters out of range") + var ErrMalformed = errors.New("tumbler: malformed envelope") + var ErrNoMethods = errors.New("tumbler: no methods supplied") + var ErrPolicyMismatch = errors.New("tumbler: policy mismatch") + var ErrPolicyUnsafe = errors.New("tumbler: unsafe policy") + var ErrShortData = errors.New("tumbler: short data") + var ErrSlotNotFound = errors.New("tumbler: slot not found") + var ErrUnsupportedAEAD = errors.New("tumbler: unsupported aead") + var ErrUnsupportedKDF = errors.New("tumbler: unsupported kdf") + func FormatRecoveryCode(code *securebytes.SecureBytes) (string, error) + func GenerateDEK(size int) (*securebytes.SecureBytes, error) + func GenerateRecoveryCode() (*securebytes.SecureBytes, error) + func ParseRecoveryCode(s string) (*securebytes.SecureBytes, error) + type AEADID uint8 + const AEADChaCha20Poly1305 + type Argon2idKDF struct + func NewArgon2idKDF(time, memoryKiB uint32, threads uint8) *Argon2idKDF + func (k *Argon2idKDF) Derive(password *securebytes.SecureBytes, salt []byte) (*securebytes.SecureBytes, error) + func (k *Argon2idKDF) ID() KDFID + func (k *Argon2idKDF) MarshalParams() []byte + func (k *Argon2idKDF) SaltLen() int + type Envelope struct + func NewEnvelope(ctx context.Context, dek *securebytes.SecureBytes, policy Policy, ...) (*Envelope, error) + func ParseEnvelope(b []byte) (*Envelope, error) + func (e *Envelope) AddSlot(ctx context.Context, dek *securebytes.SecureBytes, m Method) error + func (e *Envelope) EffectivePolicy() Policy + func (e *Envelope) Marshal() ([]byte, error) + func (e *Envelope) PolicyHint() Policy + func (e *Envelope) RemoveSlot(id [8]byte) error + func (e *Envelope) SlotCount() int + func (e *Envelope) SlotInfos() []SlotInfo + func (e *Envelope) Unlock(ctx context.Context, methods ...Method) (*securebytes.SecureBytes, error) + func (e *Envelope) ValidateSafety(force bool) (*SafetyReport, error) + func (e *Envelope) Version() uint8 + type KDF interface + Derive func(password *securebytes.SecureBytes, salt []byte) (*securebytes.SecureBytes, error) + ID func() KDFID + MarshalParams func() []byte + SaltLen func() int + type KDFID uint8 + const KDFArgon2id + const KDFNone + const KDFScrypt + type Method interface + Enroll func(ctx context.Context, dek *securebytes.SecureBytes) (Slot, error) + Type func() MethodType + Unlock func(ctx context.Context, slot Slot) (*securebytes.SecureBytes, error) + type MethodType uint8 + const MethodPassword + const MethodPasswordAndYubiKey + const MethodRecovery + const MethodYubiKey + func (t MethodType) String() string + type Option func(*methodOptions) + func WithLabel(label string) Option + func WithTouchAnnounce(fn func()) Option + type PasswordMethod struct + func NewPasswordMethod(kdf KDF, password *securebytes.SecureBytes, opts ...Option) *PasswordMethod + func (m *PasswordMethod) Enroll(ctx context.Context, dek *securebytes.SecureBytes) (Slot, error) + func (m *PasswordMethod) Type() MethodType + func (m *PasswordMethod) Unlock(ctx context.Context, slot Slot) (*securebytes.SecureBytes, error) + type Policy uint8 + const PolicyInvalid + const PolicyPasswordAndYubiKey + const PolicyPasswordOnly + const PolicyYubiKeyOnly + func (p Policy) String() string + type RecoveryCodeMethod struct + func NewRecoveryMethod(code *securebytes.SecureBytes, opts ...Option) *RecoveryCodeMethod + func (m *RecoveryCodeMethod) Enroll(ctx context.Context, dek *securebytes.SecureBytes) (Slot, error) + func (m *RecoveryCodeMethod) Type() MethodType + func (m *RecoveryCodeMethod) Unlock(ctx context.Context, slot Slot) (*securebytes.SecureBytes, error) + type SafetyReport struct + HasRecovery bool + UnlockSlots int + Warnings []string + type ScryptKDF struct + func NewScryptKDF(logN uint8, r, p uint32) *ScryptKDF + func (k *ScryptKDF) Derive(password *securebytes.SecureBytes, salt []byte) (*securebytes.SecureBytes, error) + func (k *ScryptKDF) ID() KDFID + func (k *ScryptKDF) MarshalParams() []byte + func (k *ScryptKDF) SaltLen() int + type Slot struct + AEADID AEADID + ChalSalt []byte + Challenge []byte + Flags uint8 + HKDFSalt [hkdfSaltLen]byte + ID [8]byte + KDFID KDFID + KDFParams []byte + KDFSalt []byte + Label []byte + Nonce [nonceLen]byte + Type MethodType + Wrapped []byte + YKSlot uint8 + type SlotInfo struct + ID [8]byte + Label string + Type MethodType + type YubiKeyConfig struct + KDF KDF + Slot uint8 + type YubiKeyMethod struct + func NewYubiKeyMethod(t transport.Transport, cfg YubiKeyConfig, password *securebytes.SecureBytes, ...) *YubiKeyMethod + func (m *YubiKeyMethod) Enroll(ctx context.Context, dek *securebytes.SecureBytes) (Slot, error) + func (m *YubiKeyMethod) Type() MethodType + func (m *YubiKeyMethod) Unlock(ctx context.Context, slot Slot) (*securebytes.SecureBytes, error)
Go to main page