Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

encryption

package module

Go to main page

Versions in this module

v0

v0.2.1

Aug 24, 2026

v0.2.0

Aug 15, 2026

Changes in this version

+ const TagPKESK

+ const TagPublicKey

+ const TagPublicSubkey

+ const TagSignature

+ const TagUserID

+ var ErrExpired = errors.New("key has expired")

+ var ErrIncompleteCertificate = errors.New("certificate did not parse to its end")

+ var ErrNoPublicKey = errors.New("key service cannot expose the encryption key's public half")

+ var ErrNotConfigured = errors.New("key service is not configured")

+ var ErrPartialLength = fmt.Errorf("%w: partial packet lengths are not supported", ErrMalformed)

+ var ErrRevoked = errors.New("key is revoked")

+ var ErrUnverifiableRevocation = errors.New("certificate carries a revocation this cannot evaluate")

+ func CurveOID(c elliptic.Curve) ([]byte, bool)

+ func KeyServiceNames() []string

+ func RegisterKeyService(s KeyService)

+ func ResetForTesting()

+ type Deriver interface

+ CoordinateBytes func() int

+ DeriveSharedSecret func(ctx context.Context, peerPoint []byte) ([]byte, error)

+ PublicKey func() (*ecdsa.PublicKey, error)

+ type KeyRef struct

+ KeyID string

+ ServiceName string

+ func (r KeyRef) Validate() error

+ type KeyService interface

+ Deriver func(ctx context.Context, keyID string) (Deriver, error)

+ Name func() string

+ Signer func(ctx context.Context, keyID string) (crypto.Signer, error)

+ func LookupKeyService(name string) (KeyService, error)

+ func ReplaceKeyService(name string, replacement KeyService) (previous KeyService, err error)

+ type NoPublicKey struct

+ func (NoPublicKey) PublicKey() (*ecdsa.PublicKey, error)

+ type PKESK struct

+ EphemeralPoint []byte

+ KeyID [8]byte

+ Version PKESKVersion

+ WrappedKey []byte

+ func ParsePKESK(body []byte) (PKESK, error)

+ type Packet struct

+ Body []byte

+ Rest []byte

+ Tag byte

+ func ParsePacket(data []byte) (Packet, error)

v0.1.0

Aug 10, 2026

Changes in this version

+ var ErrChecksum = errors.New("session key checksum mismatch")

+ var ErrIntegrity = errors.New("key unwrap integrity check failed")

+ var ErrMalformed = errors.New("malformed input")

+ var ErrUnsupported = errors.New("unsupported algorithm")

+ func DeriveKEK(sharedSecret []byte, p KDFParams) ([]byte, error)

+ func Fingerprint(packetBody []byte) ([20]byte, error)

+ func SessionKey(m Message, p KDFParams) (byte, []byte, error)

+ type Certificate struct

+ Binding SignatureMeta

+ Certification SignatureMeta

+ Primary RSAPublicKey

+ Subkey ECDHPublicKey

+ UserID string

+ func (c Certificate) Assemble(ctx context.Context, signer Signer) ([]byte, error)

+ type ECDHPublicKey struct

+ Created time.Time

+ CurveOID []byte

+ HashID byte

+ KEKAlgID byte

+ Point []byte

+ func (k ECDHPublicKey) PacketBody() ([]byte, error)

+ type KDFParams struct

+ CoordinateBytes int

+ CurveOID []byte

+ Fingerprint []byte

+ HashID byte

+ KEKAlgID byte

+ type Message struct

+ SharedSecret []byte

+ Version PKESKVersion

+ WrappedKey []byte

+ type PKESKVersion byte

+ const PKESKVersion3

+ type RSAPublicKey struct

+ Created time.Time

+ Exponent []byte

+ Modulus []byte

+ func (k RSAPublicKey) PacketBody() ([]byte, error)

+ type SignatureMeta struct

+ Created time.Time

+ HashAlgo byte

+ KeyFlags byte

+ PubKeyAlgo byte

+ func DefaultBinding(created time.Time) SignatureMeta

+ func DefaultCertification(created time.Time) SignatureMeta

+ type Signer interface

+ PublicKey func(ctx context.Context) (crypto.PublicKey, error)

+ SignDigest func(ctx context.Context, digest []byte, hash crypto.Hash) ([]byte, error)