crypto

Documentation

Index

• func AADJSONFromContext(ctx context.Context) []byte
• func BytesToKeyHandle(b []byte) (*keyset.Handle, error)
• func Close() error
• func ContextWithAAD(ctx context.Context, aad AAD) context.Context
• func Initialize(ctx context.Context, kekResource, dekResource string, opts ...ManagerOption) error
• func JSONToKeyHandle(b []byte) (*keyset.Handle, error)
• func KeyHandleToBytes(kh *keyset.Handle) ([]byte, error)
• func KeyHandleToJSON(kh *keyset.Handle) ([]byte, error)
• func ParseCertsPEM(pemCerts []byte) ([]*x509.Certificate, error)
• func RandomBytes(n int) []byte
• func Unseal(ctx context.Context, sealed *Sealed) ([]byte, error)
• type AAD
  • func AADFromContext(ctx context.Context) AAD
• type KMS
  • func NewKMS(ctx context.Context, resource string) (*KMS, error)
  • func (k *KMS) Close() error
  • func (k *KMS) Decrypt(ctx context.Context, ciphertext []byte) ([]byte, error)
  • func (k *KMS) Encrypt(ctx context.Context, plain []byte) ([]byte, string, error)
• type Manager
  • func NewManager(ctx context.Context, kekResource, dekResource string, opts ...ManagerOption) (*Manager, error)
  • func (m *Manager) Close() error
  • func (m *Manager) Seal(ctx context.Context, plain []byte) (*Sealed, error)
  • func (m *Manager) Unseal(ctx context.Context, sealed *Sealed) ([]byte, error)
• type ManagerOption
  • func WithSealedTimestamp() ManagerOption
• type Sealed
  • func Seal(ctx context.Context, plain []byte) (*Sealed, error)
  • func UnmarshalSealed(b []byte) (*Sealed, error)
  • func (s *Sealed) Bytes() ([]byte, error)
• type SecretManager
  • func NewSecretManager(ctx context.Context, projectID string) (*SecretManager, error)
  • func (m *SecretManager) Close()
  • func (m *SecretManager) FetchSecret(ctx context.Context, name string) ([]byte, error)
  • func (m *SecretManager) RotateDEK(ctx context.Context, name string) (string, error)
  • func (m *SecretManager) SetSecret(ctx context.Context, name string, value []byte) (string, error)

Functions

func AADJSONFromContext

func AADJSONFromContext(ctx context.Context) []byte

func BytesToKeyHandle

func BytesToKeyHandle(b []byte) (*keyset.Handle, error)

func Close

func Close() error

func ContextWithAAD

func ContextWithAAD(ctx context.Context, aad AAD) context.Context

func Initialize

func Initialize(ctx context.Context, kekResource, dekResource string, opts ...ManagerOption) error

func JSONToKeyHandle

func JSONToKeyHandle(b []byte) (*keyset.Handle, error)

func KeyHandleToBytes

func KeyHandleToBytes(kh *keyset.Handle) ([]byte, error)

func KeyHandleToJSON

func KeyHandleToJSON(kh *keyset.Handle) ([]byte, error)

func ParseCertsPEM

func ParseCertsPEM(pemCerts []byte) ([]*x509.Certificate, error)

func RandomBytes

func RandomBytes(n int) []byte

func Unseal

func Unseal(ctx context.Context, sealed *Sealed) ([]byte, error)

Types

type AAD

type AAD struct {
	Content string `json:"content"`
}

func AADFromContext

func AADFromContext(ctx context.Context) AAD

type KMS

type KMS struct {
	// contains filtered or unexported fields
}

func NewKMS

func NewKMS(ctx context.Context, resource string) (*KMS, error)

func (*KMS) Close

func (k *KMS) Close() error

func (*KMS) Decrypt

func (k *KMS) Decrypt(ctx context.Context, ciphertext []byte) ([]byte, error)

func (*KMS) Encrypt

func (k *KMS) Encrypt(ctx context.Context, plain []byte) ([]byte, string, error)

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

func NewManager

func NewManager(ctx context.Context, kekResource, dekResource string, opts ...ManagerOption) (*Manager, error)

func (*Manager) Close

func (m *Manager) Close() error

func (*Manager) Seal

func (m *Manager) Seal(ctx context.Context, plain []byte) (*Sealed, error)

func (*Manager) Unseal

func (m *Manager) Unseal(ctx context.Context, sealed *Sealed) ([]byte, error)

type ManagerOption

type ManagerOption func(*Manager)

func WithSealedTimestamp

func WithSealedTimestamp() ManagerOption

type Sealed

type Sealed struct {
	Blob       []byte     `json:"blob"`
	DEK        []byte     `json:"dek"`
	DEKVersion string     `json:"dek_version"`
	KEKVersion string     `json:"kek_version"`
	Timestamp  *time.Time `json:"timestamp"`
}

func Seal

func Seal(ctx context.Context, plain []byte) (*Sealed, error)

func UnmarshalSealed

func UnmarshalSealed(b []byte) (*Sealed, error)

func (*Sealed) Bytes

func (s *Sealed) Bytes() ([]byte, error)

type SecretManager

type SecretManager struct {
	// contains filtered or unexported fields
}

func NewSecretManager

func NewSecretManager(ctx context.Context, projectID string) (*SecretManager, error)

func (*SecretManager) Close

func (m *SecretManager) Close()

func (*SecretManager) FetchSecret

func (m *SecretManager) FetchSecret(ctx context.Context, name string) ([]byte, error)

func (*SecretManager) RotateDEK

func (m *SecretManager) RotateDEK(ctx context.Context, name string) (string, error)

func (*SecretManager) SetSecret

func (m *SecretManager) SetSecret(ctx context.Context, name string, value []byte) (string, error)