Documentation
¶
Overview ¶
Package local provides a local in-memory KMS provider for development WARNING: This should NOT be used in production as keys are stored in memory and will be lost on restart
Index ¶
- Constants
- type LocalKMSProvider
- func (p *LocalKMSProvider) Close() error
- func (p *LocalKMSProvider) GenerateDEK(ctx context.Context) (plaintext []byte, wrapped []byte, err error)
- func (p *LocalKMSProvider) GetKeyID() string
- func (p *LocalKMSProvider) RotateKey(ctx context.Context) error
- func (p *LocalKMSProvider) UnwrapDEK(ctx context.Context, wrapped []byte) ([]byte, error)
- func (p *LocalKMSProvider) WrapDEK(ctx context.Context, plaintext []byte) ([]byte, error)
Constants ¶
const ( // KeySize is the size of AES-256 keys in bytes KeySize = 32 // NonceSize is the size of GCM nonce in bytes NonceSize = 12 )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type LocalKMSProvider ¶
type LocalKMSProvider struct {
// contains filtered or unexported fields
}
LocalKMSProvider implements KMSProvider for local development Keys are stored in memory and will be lost on restart
func NewLocalKMSProvider ¶
func NewLocalKMSProvider(cfg config.LocalConfig) (*LocalKMSProvider, error)
NewLocalKMSProvider creates a new local KMS provider A new KEK is generated on each instantiation
func (*LocalKMSProvider) Close ¶
func (p *LocalKMSProvider) Close() error
Close releases any resources held by the provider
func (*LocalKMSProvider) GenerateDEK ¶
func (p *LocalKMSProvider) GenerateDEK(ctx context.Context) (plaintext []byte, wrapped []byte, err error)
GenerateDEK generates a new Data Encryption Key Returns both the plaintext DEK and the wrapped (encrypted) DEK
func (*LocalKMSProvider) GetKeyID ¶
func (p *LocalKMSProvider) GetKeyID() string
GetKeyID returns the current key identifier
func (*LocalKMSProvider) RotateKey ¶
func (p *LocalKMSProvider) RotateKey(ctx context.Context) error
RotateKey generates a new KEK version Note: This is simplified for development; real key rotation would need to handle re-encryption of existing wrapped DEKs
Source Files