- Notifications
You must be signed in to change notification settings - Fork0
fossabot/aws-encryption-sdk-go
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
This project is an implementation of theAWS Encryption SDK for the Go programming language, providing a set of libraries for developers to easily add encryption and decryption functionality to their Go applications. This implementation is inspired by theaws-encryption-sdk-python and follows theAWS Encryption SDK specification closely.
The motivation behind this project was the absence of a Go implementation of the AWS Encryption SDK.This SDK aims to fill that gap, offering Go developers the tools to implement encryption according to AWS standards.
- Support for Message Format Version 2 and relatedalgorithms.
- AWS KMS Master Key Provider with a discovery filter.
- AWS KMS Multi-Region Keys usingMRK-aware provider in Discovery or Strict mode.
- Raw Master Key provider using static keys.
- Comprehensiveend-to-end tests ensuring compatibility with
aws-encryption-sdk-cli.
- Does not support the Caching Materials Manager feature yet.
- Does not support KMS aliases at this stage.
- Raw Master Key provider does not support RSA encryption.
- Only framed content type is supported.
- Go v1.20 or later.
- AWS SDK for Go v2
To install the AWS Encryption SDK for Go, use the following command:
$ go get github.com/chainifynet/aws-encryption-sdk-go@latest
This SDK provides a straightforward interface for encrypting and decrypting data.
For advanced use cases, checkexamples.
First, set up the client with the necessary configuration.
import ("github.com/chainifynet/aws-encryption-sdk-go/client""github.com/chainifynet/aws-encryption-sdk-go/clientconfig""github.com/chainifynet/aws-encryption-sdk-go/materials""github.com/chainifynet/aws-encryption-sdk-go/providers/kmsprovider""github.com/chainifynet/aws-encryption-sdk-go/providers/rawprovider""github.com/chainifynet/aws-encryption-sdk-go/suite")// setup Encryption SDK client with default configsdkClient:=client.NewClient()
You can specify the commitment policy and the limit of maximum encrypted data keys.
// setup Encryption SDK client with custom client configcfg,err:=clientconfig.NewConfigWithOpts(clientconfig.WithCommitmentPolicy(suite.CommitmentPolicyRequireEncryptRequireDecrypt),clientconfig.WithMaxEncryptedDataKeys(3),)iferr!=nil {panic(err)// handle error}// setup Encryption SDK client with a custom configsdkClient:=client.NewClientWithConfig(cfg)
rawKeyProvider,err:=rawprovider.NewWithOpts("raw",providers.WithStaticKey("static1", []byte("superSecureKeySecureKey32bytes32")),)iferr!=nil {panic("raw key provider setup failed")// handle error}
You can optionally enablediscovery or specify adiscovery filter.
// KMS key ARN to be used for encryption and decryptionkmsKeyArn:="arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"// setup KMS key providerkmsKeyProvider,err:=kmsprovider.New(kmsKeyArn)iferr!=nil {panic("kms key provider setup failed")// handle error}
You can use either the KMS Key Provider, Raw Key Provider, orboth combining them.
cmm,err:=materials.NewDefault(rawKeyProvider)iferr!=nil {panic("materials manager setup failed")// handle error}
cmm,err:=materials.NewDefault(kmsKeyProvider)iferr!=nil {panic("materials manager setup failed")// handle error}
cmm,err:=materials.NewDefault(kmsKeyProvider,rawKeyProvider)iferr!=nil {panic("materials manager setup failed")// handle error}
To encrypt data, call theEncrypt method on the client.
// define the encryption context, which is a set of key-value pairs that represent additional authenticated dataencryptionContext:=map[string]string{"purpose":"test",}// data to encryptsecretData:= []byte("secret data to encrypt")// encrypt dataciphertext,header,err:=sdkClient.Encrypt(context.TODO(),secretData,encryptionContext,cmm,)iferr!=nil {panic("encryption failed")// handle error}
To decrypt data, use theDecrypt method on the client.
// decrypt dataplaintext,header,err:=sdkClient.Decrypt(context.TODO(),ciphertext,cmm)iferr!=nil {panic("decryption failed")// handle error}
- Add support for Caching Materials Manager.
- Add support for AWS KMS Multi-Region Keys#46.
- Add support for KMS aliases.
- Cover
providerspackage with tests. - Cover
keyspackage with tests. - Cover
materialspackage with tests. - GoDoc documentation.
- Streamlined encryption and decryption.
If you encounter any issues or would like to contribute to the project, please submit an issue or pull request on GitHub.
This SDK is licensed under the Apache License 2.0. See theLICENSE file for details.
For more information on how to use this SDK, please refer to theexample directory and the detailed API reference in the documentation.
Stay tuned for further updates and features. Contributions and feedback are welcome!
About
AWS Encryption SDK for Go
Resources
License
Uh oh!
There was an error while loading.Please reload this page.
Stars
Watchers
Forks
Packages0
Languages
- Go99.5%
- Makefile0.5%