-
Notifications
You must be signed in to change notification settings - Fork 3
/
doc.go
67 lines (49 loc) · 2.51 KB
/
doc.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
/*
See LICENSE file for license details
Copyright (c) 2015 XOR Data Exchange, Inc.
Superdog - the Crypto library for Vault from Hashicorp
Superdog is a library for managing strong cryptography in both development and test environments. Superdog provides an elegant wrapper to the Vault(https://www.vaultproject.io) API that allows you to manage your cryptographic keys in Vault using any code that implements the `KeyProvider` interface. An implemention of the `KeyProvider` interface is provided for Vault, but others could be supported.
Features
- Versioned Keys - Key version is stored as the first few bytes of the encrypted text
- Key Rotation - Rotate your keys safely, knowing that you'll always be able to decrypt older versionss
- Development implementation for tests and local development
- Versioned and Rotated IV/Salt - `SaltProvider` interface works the same as `KeyProvider` to allow development and testing access to the crypto libraries without requiring a live Key (Vault) server
- `Reencrypt` function to simplify key rotation, decrypts with given key, reencrypts with latest key
Cypher Suites
`superdog` supports AES encryption with CFB/CTR/GCM/OFB modes.
Production Usage
By default, `superdog` uses the `DevKeyProvider` which is a static key with static IV. This is extremely insecure, and SHOULD NOT ever be used in production.
We reccommend using Go's [build tags](https://golang.org/pkg/go/build/) to enable strong cryptography in production usage.
Create a file with your connection routines in the init() function. Add the build tag `// +build production` to the top of that file. Incomplete example:
// +build production
package main
import (
"github.com/xordataexchange/superdog"
"github.com/xordataexxchange/superdog/vault/hashi"
"github.com/hashicorp/vault/api"
)
// Assign each application a unique UUID
// and use Vault's AppID authentication mechanism
const (
appid = "SOME RANDOM UUID"
)
func init() {
user := os.Getenv("VAULT_USER")
vaultaddr := os.Getenv("VAULT_ADDRESS")
// TEST these for empty strings & handle appropriately in your code
cfg:= api.DefaultConfig()
cfg.Address = vaultaddr
vault, err := hashi.NewVault(cfg)
if err != nil {
// handle appropriately
}
err = vault.AuthAppID(appid, user)
if err != nil {
// handle appropriately
}
crypto.DefaultKeyProvider = vault
crypto.DefaultSaltProvider = vault
}
Now compile your program with `go build -tags production` to include this code. The `KeyProvider` will be set to use Vault.
*/
package superdog