Documentation
¶
Overview ¶
Package local is the on-disk PEM private key backend for the encryption key service. Blank-import to activate; init registers it as "local".
import _ "gitlab.com/phpboyscout/go/encryption/local"
It pairs with go/signing's local backend, which is the same idea for the signing half and which this deliberately mirrors — a tool that offers `--backend local` for signing and not for decryption is an inconsistency its users will trip over.
What it is for ¶
The key identifier is a path to an unencrypted PEM file, and the private half is read into this process. That is the exact opposite of what the aws-kms backend provides and of what this module exists to make possible, so the distinction matters:
- aws-kms is the production path. The private half never leaves the key service, which is the whole premise of the exchange.
- local is for a developer without cloud credentials, for the tutorial path, and for tests that need the real key-service interface rather than a hand-rolled double.
Why it exists at all, beyond convenience ¶
A key service call is billed and rate-limited, and that cost is why the decrypt path bounds how many candidate session-key packets it will try. The bound and the requirement never to lose a genuine report pull against each other, and three separate defects came from testing them together.
With this backend an attempt is free, so the two can be tested apart: that no candidate is ever excluded, and separately that cost is bounded. go-crypto needs no such bound precisely because its attempts are local, which is the same observation from the other end.
Supported PEM contents ¶
- An EC private key on P-256, P-384 or P-521, in SEC 1 ("EC PRIVATE KEY") or PKCS#8 ("PRIVATE KEY") form, for [KeyService.Deriver].
- An RSA private key, in PKCS#1 or PKCS#8 form, for [KeyService.Signer] — the certification half, which must be RSA because that is the signature form OpenPGP specifies and a key service produces.
Encrypted PEMs are refused: the standard library does not decrypt PKCS#8, and pretending otherwise would be worse than saying so. Encrypt the file at the filesystem layer, or use a key service.
X25519 is deliberately absent. This module implements the RFC 6637 ECDH construction over NIST curves; the X25519 construction derives its key differently and applying this KDF to it fails in ways that read as curve errors.
Source Files