mirror of
https://github.com/luxfi/crypto.git
synced 2026-07-27 01:54:50 +00:00
Hanzo Dev
b01d9e9e7b
- Add secret/ package: wraps runtime/secret.Do() for secure key erasure when built with GOEXPERIMENT=runtimesecret, no-op stub otherwise - Add encryption/hpke.go: HPKE encryption using Go 1.26 stdlib crypto/hpke with X25519 (classical) and ML-KEM-768+X25519 (post-quantum hybrid) - Wrap BLS key generation (both CGO and pure Go) in secret.Do() - Wrap HexToECDSA and LoadECDSA in secret.Do() for key byte cleanup - Simplify random.go: crypto/rand.Read never errors in Go 1.26 - Update CI workflows to Go 1.26.1, add GOEXPERIMENT=runtimesecret job - Update dependencies: circl 1.6.3, x/crypto 0.48.0, age 1.3.1
39 lines
1.1 KiB
Go
39 lines
1.1 KiB
Go
// Copyright (C) 2020-2026, Lux Industries Inc. All rights reserved.
|
|
// See the file LICENSE for licensing terms.
|
|
|
|
//go:build goexperiment.runtimesecret
|
|
|
|
// Package secret provides helpers for secure handling of cryptographic key material.
|
|
//
|
|
// When built with GOEXPERIMENT=runtimesecret, secret key bytes are processed
|
|
// inside runtime/secret.Do(), which ensures the memory holding the key material
|
|
// is zeroed by the runtime after use and is not visible to core dumps or
|
|
// debuggers.
|
|
//
|
|
// Without the experiment flag, the package provides identical API with no-op
|
|
// wrappers so callers do not need build tags.
|
|
package secret
|
|
|
|
import (
|
|
"runtime/secret"
|
|
)
|
|
|
|
// Do executes f inside a runtime/secret context, ensuring any stack-allocated
|
|
// secret material in f is securely erased after f returns.
|
|
//
|
|
// Use this to wrap operations that handle raw private key bytes:
|
|
//
|
|
// secret.Do(func() {
|
|
// key := generateKeyBytes()
|
|
// defer clear(key)
|
|
// useKey(key)
|
|
// })
|
|
func Do(f func()) {
|
|
secret.Do(f)
|
|
}
|
|
|
|
// Enabled reports whether the runtime secret erasure support is active.
|
|
func Enabled() bool {
|
|
return secret.Enabled()
|
|
}
|