encryption

package

v1.0.0 Latest Latest Go to latest Published: Oct 15, 2026 License: Apache-2.0 Imports: 12 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/canonical/notary

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func SetUpEncryptionKey(database *db.DatabaseRepository, backend EncryptionService, logger *zap.Logger) error
type EncryptionBackendType
type EncryptionRepository
type EncryptionService
type NoEncryptionBackend
- func (n NoEncryptionBackend) Decrypt(ciphertext []byte) ([]byte, error)
- func (n NoEncryptionBackend) Encrypt(plaintext []byte) ([]byte, error)
type PKCS11Backend
- func NewPKCS11Backend(libPath string, pin string, keyID uint16, logger *zap.Logger) (*PKCS11Backend, error)
- func (h *PKCS11Backend) Decrypt(ciphertext []byte) ([]byte, error)
- func (h *PKCS11Backend) Encrypt(data []byte) ([]byte, error)
type PKCS11Provider
type VaultAuth
- func (a VaultAuth) AppRoleLogin(ctx context.Context, req schema.AppRoleLoginRequest, ...) (*vault.Response[map[string]interface{}], error)
type VaultAuthProvider
type VaultBackend
- func NewVaultBackendWithAppRole(endpoint, mount, keyName, roleID, roleSecretID, tlsCaCertificate string, ...) (VaultBackend, error)
- func NewVaultBackendWithToken(endpoint, mount, keyName, token, tlsCaCertificate string, tlsSkipVerify bool, ...) (VaultBackend, error)
- func (v VaultBackend) Decrypt(ciphertext []byte) ([]byte, error)
- func (v VaultBackend) Encrypt(plaintext []byte) ([]byte, error)
type VaultClient
type VaultSecrets
- func (s VaultSecrets) TransitDecrypt(ctx context.Context, name string, request schema.TransitDecryptRequest, ...) (*vault.Response[map[string]any], error)
- func (s VaultSecrets) TransitEncrypt(ctx context.Context, name string, request schema.TransitEncryptRequest, ...) (*vault.Response[map[string]any], error)
type VaultSecretsProvider

Constants ¶

View Source

const (
	EncryptionBackendTypeVault  = "vault"
	EncryptionBackendTypePKCS11 = "pkcs11"
	EncryptionBackendTypeNone   = "none"
)

Variables ¶

This section is empty.

Functions ¶

func SetUpEncryptionKey ¶

func SetUpEncryptionKey(database *db.DatabaseRepository, backend EncryptionService, logger *zap.Logger) error

Types ¶

type EncryptionBackendType ¶

type EncryptionBackendType string

type EncryptionRepository ¶

type EncryptionRepository struct {
	Service EncryptionService
	Type    EncryptionBackendType
}

type EncryptionService ¶

type EncryptionService interface {
	Decrypt(ciphertext []byte) ([]byte, error)
	Encrypt(plaintext []byte) ([]byte, error)
}

EncryptionService defines the interface for encryption operations. Implementations should handle the encryption and decryption of sensitive data.

type NoEncryptionBackend ¶

type NoEncryptionBackend struct {
}

NoEncryptionBackend is a no-op implementation of the EncryptionBackend interface. It used when encryption backend is configured to none.

func (NoEncryptionBackend) Decrypt ¶

func (n NoEncryptionBackend) Decrypt(ciphertext []byte) ([]byte, error)

Decrypt returns the ciphertext as is for NoEncryptionBackend.

func (NoEncryptionBackend) Encrypt ¶

func (n NoEncryptionBackend) Encrypt(plaintext []byte) ([]byte, error)

Encrypt returns the plaintext as is for NoEncryptionBackend.

type PKCS11Backend ¶

type PKCS11Backend struct {
	// contains filtered or unexported fields
}

PKCS11Backend implements EncryptionBackend using the PKCS11 protocol for HSMs.

func NewPKCS11Backend ¶

func NewPKCS11Backend(libPath string, pin string, keyID uint16, logger *zap.Logger) (*PKCS11Backend, error)

NewPKCS11Backend creates a new PKCS11Backend.

func (*PKCS11Backend) Decrypt ¶

func (h *PKCS11Backend) Decrypt(ciphertext []byte) ([]byte, error)

Decrypt decrypts the ciphertext using AES-CBC algorithm. The ciphertext is expected to contain the IV at the beginning.

func (*PKCS11Backend) Encrypt ¶

func (h *PKCS11Backend) Encrypt(data []byte) ([]byte, error)

Encrypt encrypts the plaintext using AES-CBC algorithm.

type PKCS11Provider ¶

type PKCS11Provider interface {
	Initialize() error
	Finalize() error
	GetSlotList(bool) ([]uint, error)
	OpenSession(uint, uint) (pkcs11.SessionHandle, error)
	CloseSession(pkcs11.SessionHandle) error
	Login(pkcs11.SessionHandle, uint, string) error
	Logout(pkcs11.SessionHandle) error
	FindObjectsInit(pkcs11.SessionHandle, []*pkcs11.Attribute) error
	FindObjects(pkcs11.SessionHandle, int) ([]pkcs11.ObjectHandle, bool, error)
	FindObjectsFinal(pkcs11.SessionHandle) error
	EncryptInit(pkcs11.SessionHandle, []*pkcs11.Mechanism, pkcs11.ObjectHandle) error
	Encrypt(pkcs11.SessionHandle, []byte) ([]byte, error)
	DecryptInit(pkcs11.SessionHandle, []*pkcs11.Mechanism, pkcs11.ObjectHandle) error
	Decrypt(pkcs11.SessionHandle, []byte) ([]byte, error)
}

PKCS11Provider defines the interface for PKCS11 operations needed by our backend

type VaultAuth ¶

type VaultAuth struct {
	Auth *vault.Auth
}

VaultAuth implements VaultAuthProvider

func (VaultAuth) AppRoleLogin ¶

func (a VaultAuth) AppRoleLogin(ctx context.Context, req schema.AppRoleLoginRequest, options ...vault.RequestOption) (*vault.Response[map[string]interface{}], error)

type VaultAuthProvider ¶

type VaultAuthProvider interface {
	AppRoleLogin(ctx context.Context, req schema.AppRoleLoginRequest, options ...vault.RequestOption) (*vault.Response[map[string]interface{}], error)
}

type VaultBackend ¶

type VaultBackend struct {
	// contains filtered or unexported fields
}

VaultBackend implements EncryptionBackend interface for Vault

func NewVaultBackendWithAppRole ¶

func NewVaultBackendWithAppRole(endpoint, mount, keyName, roleID, roleSecretID, tlsCaCertificate string, tlsSkipVerify bool, logger *zap.Logger) (VaultBackend, error)

NewVaultBackendWithAppRole creates a new VaultBackend using AppRole authentication.

func NewVaultBackendWithToken ¶

func NewVaultBackendWithToken(endpoint, mount, keyName, token, tlsCaCertificate string, tlsSkipVerify bool, logger *zap.Logger) (VaultBackend, error)

NewVaultBackendWithToken creates a new VaultBackend using token authentication.

func (VaultBackend) Decrypt ¶

func (v VaultBackend) Decrypt(ciphertext []byte) ([]byte, error)

Decrypt implements SecretBackend.

func (VaultBackend) Encrypt ¶

func (v VaultBackend) Encrypt(plaintext []byte) ([]byte, error)

Encrypt implements SecretBackend.

type VaultClient ¶

type VaultClient struct {
	Auth    VaultAuthProvider
	Secrets VaultSecretsProvider
}

type VaultSecrets ¶

type VaultSecrets struct {
	Secrets *vault.Secrets
}

VaultSecrets implements VaultSecretsProvider

func (VaultSecrets) TransitDecrypt ¶

func (s VaultSecrets) TransitDecrypt(ctx context.Context, name string, request schema.TransitDecryptRequest, options ...vault.RequestOption) (*vault.Response[map[string]any], error)

func (VaultSecrets) TransitEncrypt ¶

func (s VaultSecrets) TransitEncrypt(ctx context.Context, name string, request schema.TransitEncryptRequest, options ...vault.RequestOption) (*vault.Response[map[string]any], error)

type VaultSecretsProvider ¶

type VaultSecretsProvider interface {
	TransitEncrypt(ctx context.Context, name string, request schema.TransitEncryptRequest, options ...vault.RequestOption) (*vault.Response[map[string]any], error)
	TransitDecrypt(ctx context.Context, name string, request schema.TransitDecryptRequest, options ...vault.RequestOption) (*vault.Response[map[string]any], error)
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL