rypt

The Go client for rypt, encryption as a service in front of Google Cloud KMS. It covers the whole API: direct encryption, envelope encryption, the key lifecycle, usage, the audit log, and the console's API tokens, containers, firewalls and billing. It has no dependencies outside the standard library.

go get github.com/x6c-co/rypt

Example

Envelope encryption: rypt generates a data key and wraps it under your rypt key; you encrypt locally with the data key and store the wrapped form beside the data.

client, err := rypt.NewClient(os.Getenv("RYPT_TOKEN"))
if err != nil {
	log.Fatal(err)
}

dk, err := client.GenerateDataKey(ctx, keyID, nil)
if err != nil {
	log.Fatal(err)
}
// Encrypt with dk.Plaintext, for example with AES-256-GCM, store
// dk.Wrapped with the ciphertext, and clear(dk.Plaintext).

dek, err := client.Unwrap(ctx, keyID, dk.Wrapped, nil)
// Decrypt with dek, then clear(dek).

Small values can be encrypted by the service directly:

ciphertext, err := client.Encrypt(ctx, keyID, []byte("078-05-1120"), aad)
plaintext, err := client.Decrypt(ctx, keyID, ciphertext, aad)

Errors from the API carry its error code and request id:

if rypt.IsCode(err, rypt.CodeKeyPendingDeletion) {
	// restore the key with client.RestoreKey
}

Documentation

• Package documentation: every method, which credential it needs, and whether it is retried.
• examples/: runnable programs for envelope encryption, direct encryption and a usage report.
• rypt.dev/docs: the service, its tiers and its API.

Versioning

The module follows semantic versioning. Until v1.0.0, a minor version may change the API; see CHANGELOG.md. It supports the Go version in go.mod and later.

Contributing

See CONTRIBUTING.md for the branch workflow, the tests and how releases are made.

License

MIT. See LICENSE.