Encryption and Security Toolkit Tutorial

// pkg/crypto/aes.go
package crypto

import (
    "crypto/aes"
    "crypto/cipher"
    "crypto/rand"
    "errors"
    "io"
)

type AESGCM struct {
    key []byte
}

func NewAESGCM(key string) (*AESGCM, error) {
    if len(key) != 32 {
        return nil, errors.New("key must be 32 bytes")
    }
    return &AESGCM{key: []byte(key)}, nil
}

// Encrypt encrypts
func (a *AESGCM) Encrypt(plaintext []byte) ([]byte, error) {
    block, err := aes.NewCipher(a.key)
    if err != nil {
        return nil, err
    }

    gcm, err := cipher.NewGCM(block)
    if err != nil {
        return nil, err
    }

    nonce := make([]byte, gcm.NonceSize())
    if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
        return nil, err
    }

    return gcm.Seal(nonce, nonce, plaintext, nil), nil
}

// Decrypt decrypts
func (a *AESGCM) Decrypt(ciphertext []byte) ([]byte, error) {
    block, err := aes.NewCipher(a.key)
    if err != nil {
        return nil, err
    }

    gcm, err := cipher.NewGCM(block)
    if err != nil {
        return nil, err
    }

    nonceSize := gcm.NonceSize()
    if len(ciphertext) < nonceSize {
        return nil, errors.New("ciphertext too short")
    }

    nonce, ciphertext := ciphertext[:nonceSize], ciphertext[nonceSize:]
    return gcm.Open(nil, nonce, ciphertext, nil)
}

// Encrypt sensitive configuration
func EncryptConfig(rawConfig string, encryptionKey string) (string, error) {
    aes, err := crypto.NewAESGCM(encryptionKey)
    if err != nil {
        return "", err
    }
    encrypted, err := aes.Encrypt([]byte(rawConfig))
    if err != nil {
        return "", err
    }
    return base64.StdEncoding.EncodeToString(encrypted), nil
}

// Example: encrypt a third-party API key
apiKey := "sk-xxxxxxxxxxxxxxxxxxxx"
encrypted, _ := EncryptConfig(apiKey, config.EncryptionKey)
// Store encrypted in the database

// Decrypt when using it
decrypted, _ := aes.Decrypt(base64Decode(encrypted))
// decrypted = "sk-xxxxxxxxxxxxxxxxxxxx"

// Hash a user password
func HashPassword(password string) (string, error) {
    bytes, err := bcrypt.GenerateFromPassword([]byte(password), 12)
    return string(bytes), err
}

func VerifyPassword(password, hash string) bool {
    err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
    return err == nil
}

// Generate an API key for a third-party system
func GenerateAPIKey() (string, string) {
    // Generate a random key
    apiKey := make([]byte, 32)
    rand.Read(apiKey)
    key := hex.EncodeToString(apiKey)

    // Generate a secret
    apiSecret := make([]byte, 64)
    rand.Read(apiSecret)
    secret := hex.EncodeToString(apiSecret)

    return key, secret
}

// Sign a webhook request
func SignRequest(secret string, payload []byte) string {
    h := hmac.New(sha256.New, []byte(secret))
    h.Write(payload)
    return hex.EncodeToString(h.Sum(nil))
}

// Verify a signature
func VerifySignature(secret string, payload []byte, signature string) bool {
    expected := SignRequest(secret, payload)
    return hmac.Equal([]byte(expected), []byte(signature))
}