crypt

Documentation

Overview

Package crypt implements the secret key-based encryption and decryption scheme used by RStudio's Connect and Package Manager products.

Index

• Constants
• Variables
• type Key
  • func NewKey() (*Key, error)
  • func NewKeyFromBytes(src []byte) (*Key, error)
  • func NewKeyFromReader(src io.Reader) (*Key, error)
  • func (k *Key) Decrypt(s string) (string, error)
  • func (k *Key) DecryptBytes(s string) ([]byte, error)
  • func (k *Key) Encrypt(s string) (string, error)
  • func (k *Key) EncryptBytes(bytes []byte) (string, error)
  • func (k *Key) EncryptBytesFIPS(bytes []byte) (string, error)
  • func (k *Key) EncryptFIPS(s string) (string, error)
  • func (k *Key) HexString() string

Constants

const FIPSMode = false

When true, this package has been built in "FIPS mode". Attempts to use encryption algorithms not permissible under FIPS-140 regulations will always fail, and encryption will use AES-256-GCM by default.

const (
	// The fixed length of a Key, in bytes.
	KeyLength = 512
)

Variables

var (
	// ErrInvalidKeyLength reports a malformed Key input.
	ErrInvalidKeyLength = errors.New("Encryption keys must be 512 bytes when decoded")
	// ErrPayLoadTooShort reports malformed cipher text.
	ErrPayLoadTooShort = errors.New("Payload is too short to be encrypted")
	// ErrFailedToDecrypt reports a failure to decrypt a given cipher text with a
	// given Key via Decrypt().
	ErrFailedToDecrypt = errors.New("Decryption failed")
	// ErrFIPS reports encryption or decryption failures caused by running
	// in FIPS mode.
	ErrFIPS = errors.New("Non-AES algorithms cannot be used when running in FIPS mode")
)

Types

type Key

type Key [KeyLength]byte

Key is a securely-generated, opaque byte array that can be used as a persistent secret when encrypting data.

func NewKey

func NewKey() (*Key, error)

NewKey returns a newly-generated key, or an error if one cannot be generated.

func NewKeyFromBytes

func NewKeyFromBytes(src []byte) (*Key, error)

NewKeyFromBytes returns the key read from the given byte slice, or an error.

func NewKeyFromReader

func NewKeyFromReader(src io.Reader) (*Key, error)

NewKeyFromReader returns the key read from an io.Reader, or an error.

func (*Key) Decrypt

func (k *Key) Decrypt(s string) (string, error)

Decrypt takes base64-encoded cipher text encrypted with the given key and returns the original clear text, or an error.

func (*Key) DecryptBytes

func (k *Key) DecryptBytes(s string) ([]byte, error)

DecryptBytes takes base64-encoded cipher text encrypted with the given key and returns the original bytes, or an error.

func (*Key) Encrypt

func (k *Key) Encrypt(s string) (string, error)

Encrypt produces base64-encoded cipher text for the given payload and key, or an error if one cannot be created.

func (*Key) EncryptBytes

func (k *Key) EncryptBytes(bytes []byte) (string, error)

EncryptBytes produces base64-encoded cipher text for the given bytes and key, or an error if one cannot be created.

func (*Key) EncryptBytesFIPS

func (k *Key) EncryptBytesFIPS(bytes []byte) (string, error)

EncryptBytesFIPS produces base64-encoded cipher text for the given bytes and key using a FIPS-compatible algorithm, or an error if one cannot be created.

func (*Key) EncryptFIPS

func (k *Key) EncryptFIPS(s string) (string, error)

EncryptFIPS produces base64-encoded cipher text for the given payload and key using a FIPS-compatible algorithm, or an error if one cannot be created.

func (*Key) HexString

func (k *Key) HexString() string

HexString produces a hex-encoded version of the key suitable for writing to disk.