加密与安全工具实战教程

// pkg/crypto/aes.go
package crypto

import (
    "crypto/aes"
    "crypto/cipher"
    "crypto/rand"
    "errors"
    "io"
)

type AESGCM struct {
    key []byte
}

func NewAESGCM(key string) (*AESGCM, error) {
    if len(key) != 32 {
        return nil, errors.New("密钥必须是 32 字节")
    }
    return &AESGCM{key: []byte(key)}, nil
}

// Encrypt 加密
func (a *AESGCM) Encrypt(plaintext []byte) ([]byte, error) {
    block, err := aes.NewCipher(a.key)
    if err != nil {
        return nil, err
    }

    gcm, err := cipher.NewGCM(block)
    if err != nil {
        return nil, err
    }

    nonce := make([]byte, gcm.NonceSize())
    if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
        return nil, err
    }

    return gcm.Seal(nonce, nonce, plaintext, nil), nil
}

// Decrypt 解密
func (a *AESGCM) Decrypt(ciphertext []byte) ([]byte, error) {
    block, err := aes.NewCipher(a.key)
    if err != nil {
        return nil, err
    }

    gcm, err := cipher.NewGCM(block)
    if err != nil {
        return nil, err
    }

    nonceSize := gcm.NonceSize()
    if len(ciphertext) < nonceSize {
        return nil, errors.New("密文太短")
    }

    nonce, ciphertext := ciphertext[:nonceSize], ciphertext[nonceSize:]
    return gcm.Open(nil, nonce, ciphertext, nil)
}

// 加密敏感配置
func EncryptConfig(rawConfig string, encryptionKey string) (string, error) {
    aes, err := crypto.NewAESGCM(encryptionKey)
    if err != nil {
        return "", err
    }
    encrypted, err := aes.Encrypt([]byte(rawConfig))
    if err != nil {
        return "", err
    }
    return base64.StdEncoding.EncodeToString(encrypted), nil
}

// 使用示例：加密第三方 API Key
apiKey := "sk-xxxxxxxxxxxxxxxxxxxx"
encrypted, _ := EncryptConfig(apiKey, config.EncryptionKey)
// 将 encrypted 存入数据库

// 使用时解密
decrypted, _ := aes.Decrypt(base64Decode(encrypted))
// decrypted = "sk-xxxxxxxxxxxxxxxxxxxx"

// 用户密码哈希
func HashPassword(password string) (string, error) {
    bytes, err := bcrypt.GenerateFromPassword([]byte(password), 12)
    return string(bytes), err
}

func VerifyPassword(password, hash string) bool {
    err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
    return err == nil
}

// 为第三方系统生成 API Key
func GenerateAPIKey() (string, string) {
    // 生成随机 key
    apiKey := make([]byte, 32)
    rand.Read(apiKey)
    key := hex.EncodeToString(apiKey)

    // 生成 secret
    apiSecret := make([]byte, 64)
    rand.Read(apiSecret)
    secret := hex.EncodeToString(apiSecret)

    return key, secret
}

// Webhook 请求签名
func SignRequest(secret string, payload []byte) string {
    h := hmac.New(sha256.New, []byte(secret))
    h.Write(payload)
    return hex.EncodeToString(h.Sum(nil))
}

// 验证签名
func VerifySignature(secret string, payload []byte, signature string) bool {
    expected := SignRequest(secret, payload)
    return hmac.Equal([]byte(expected), []byte(signature))
}