encrypt

Documentation

Overview

Package encrypt provides authenticated encryption for ATB bundles.

Wire format: [4 bytes magic "ATBE"][1 byte version][16 bytes salt][12 bytes nonce][16 bytes auth tag][N bytes ciphertext]

Index

• Constants
• Variables
• func Decrypt(data []byte, password string) ([]byte, error)
• func Encrypt(plaintext []byte, password string) ([]byte, error)
• func EncryptWithSaltNonce(plaintext []byte, password string, salt []byte, nonce []byte) ([]byte, error)

Constants

const (
	Magic                       = "ATBE"
	LegacyVersion          byte = 0x01
	Version                byte = 0x02
	SaltSize                    = 16
	NonceSize                   = 12
	TagSize                     = 16
	KeySize                     = 32
	LegacyPBKDF2Iterations      = 100_000
	PBKDF2Iterations            = 600_000
	HeaderSize                  = len(Magic) + 1 + SaltSize + NonceSize + TagSize
)

Variables

var (
	ErrInvalidFormat      = errors.New("encrypt: invalid format")
	ErrUnsupportedVersion = errors.New("encrypt: unsupported version")
	ErrDecryptFailed      = errors.New("encrypt: decrypt failed")
)

Functions

func Decrypt

func Decrypt(data []byte, password string) ([]byte, error)

Decrypt decrypts an encrypted ATB bundle payload.

func Encrypt

func Encrypt(plaintext []byte, password string) ([]byte, error)

Encrypt encrypts plaintext using AES-256-GCM with a random salt and nonce.

func EncryptWithSaltNonce

func EncryptWithSaltNonce(plaintext []byte, password string, salt []byte, nonce []byte) ([]byte, error)

EncryptWithSaltNonce encrypts plaintext with caller-provided salt and nonce. This is intended for deterministic test vectors and golden fixtures.