crypto

README

tinywasm/crypto

A lightweight Go library for cryptographic operations, designed for WebAssembly and small devices using TinyGo.

Features

• Simple API: Easy-to-use API for symmetric and asymmetric encryption, digital signatures, and HMAC.
• TinyGo Optimized: Designed to produce small binaries when compiled with TinyGo.
• WebAssembly Ready: Can be used in browser environments.
• Zero Dependencies on Go Standard Library: Uses github.com/tinywasm/fmt for string, number, and error handling to minimize binary size.

Basic Usage

To use the library, import the package and call its functions directly:

package main

import (
	"github.com/tinywasm/fmt"
	"github.com/tinywasm/crypto"
)

func main() {
	// Symmetric encryption
	key := make([]byte, 32) // AES-256 key
	plaintext := []byte("hello world")
	ciphertext, err := crypto.Encrypt(plaintext, key)
	if err != nil {
		panic(err)
	}
	decrypted, err := crypto.Decrypt(ciphertext, key)
	if err != nil {
		panic(err)
	}
	fmt.Println("Symmetric decrypted:", string(decrypted))

	// Asymmetric signatures
	pub, priv, err := crypto.GenerateKeyPair()
	if err != nil {
		panic(err)
	}
	message := []byte("this is a test message")
	signature, err := crypto.Sign(message, priv)
	if err != nil {
		panic(err)
	}
	ok, err := crypto.Verify(message, signature, pub)
	if err != nil {
		panic(err)
	}
	fmt.Println("Signature verified:", ok)
}

Documentation

The detailed API documentation is organized into the following sections:

• Symmetric Encryption
• Asymmetric Encryption
• Digital Signatures
• Hashing and MACs
• Architecture Details
• Implementation Guide
• TinyGo Compatibility

Documentation

Index

• func Decrypt(ciphertext, key []byte) (plaintext []byte, err error)
• func DecryptAsymmetric(ciphertext, privateKey []byte) (plaintext []byte, err error)
• func Encrypt(plaintext, key []byte) (ciphertext []byte, err error)
• func EncryptAsymmetric(plaintext, publicKey []byte) (ciphertext []byte, err error)
• func GenerateKeyPair() (publicKey []byte, privateKey []byte, err error)
• func HMACEqual(mac1, mac2 []byte) bool
• func HMACSHA256(key, message []byte) []byte
• func Sign(message, privateKey []byte) (signature []byte, err error)
• func Verify(message, signature, publicKey []byte) (ok bool, err error)

Functions

func Decrypt

func Decrypt(ciphertext, key []byte) (plaintext []byte, err error)

Decrypt performs symmetric decryption of ciphertext using AES-GCM with a 32-byte key.

func DecryptAsymmetric

func DecryptAsymmetric(ciphertext, privateKey []byte) (plaintext []byte, err error)

DecryptAsymmetric decrypts ciphertext with a private key.

func Encrypt

func Encrypt(plaintext, key []byte) (ciphertext []byte, err error)

Encrypt performs symmetric encryption of plaintext using AES-GCM with a 32-byte key. It returns the ciphertext, which includes the nonce and the encrypted data.

func EncryptAsymmetric

func EncryptAsymmetric(plaintext, publicKey []byte) (ciphertext []byte, err error)

EncryptAsymmetric encrypts plaintext for a given public key using ECIES (ECDH + AES-GCM). The returned ciphertext includes the ephemeral public key needed for decryption.

func GenerateKeyPair

func GenerateKeyPair() (publicKey []byte, privateKey []byte, err error)

GenerateKeyPair generates a new ECDSA key pair for asymmetric cryptography using the P-256 curve.

func HMACEqual

func HMACEqual(mac1, mac2 []byte) bool

HMACEqual reports whether two MACs are equal, in constant time. A non-constant-time comparison of a MAC is a timing oracle: never compare signatures with == or a byte loop that returns early.

func HMACSHA256

func HMACSHA256(key, message []byte) []byte

HMACSHA256 returns the HMAC-SHA256 of message under key. Used by tinywasm/user to sign JWT session tokens.

func Sign

func Sign(message, privateKey []byte) (signature []byte, err error)

Sign creates a digital signature for a message using a private key (ECDSA with P-256 and SHA-256).

func Verify

func Verify(message, signature, publicKey []byte) (ok bool, err error)

Verify checks a digital signature of a message using a public key.