Skip to Content
DocumentationFramework APIEncryption

Encryption

The encryption package provides cryptographic utilities including AES-256-GCM encryption/decryption, bcrypt password hashing, HMAC signing, and key generation helpers for securing sensitive data.

Import

import "github.com/gofastadev/gofasta/pkg/encryption"

Key Types

Encryptor

type Encryptor interface {
    Encrypt(plaintext []byte) ([]byte, error)
    Decrypt(ciphertext []byte) ([]byte, error)
    EncryptString(plaintext string) (string, error)
    DecryptString(ciphertext string) (string, error)
}

EncryptionConfig

type EncryptionConfig struct {
    Key       string `yaml:"key" env:"ENCRYPTION_KEY"`
    Algorithm string `yaml:"algorithm" env:"ENCRYPTION_ALGORITHM"`
}

Key Functions

FunctionSignatureDescription
NewEncryptorfunc NewEncryptor(cfg EncryptionConfig) (Encryptor, error)Creates an AES-256-GCM encryptor with the given key
GenerateKeyfunc GenerateKey(bits int) (string, error)Generates a random encryption key (128, 192, or 256 bits)
HashPasswordfunc HashPassword(password string) (string, error)Hashes a password with bcrypt
CheckPasswordfunc CheckPassword(hash, password string) boolCompares a bcrypt hash to a plaintext password
HMACfunc HMAC(key, data []byte) []byteComputes an HMAC-SHA256 signature
VerifyHMACfunc VerifyHMAC(key, data, signature []byte) boolVerifies an HMAC-SHA256 signature
SHA256func SHA256(data []byte) stringReturns the SHA-256 hex digest of the data
RandomBytesfunc RandomBytes(n int) ([]byte, error)Generates n cryptographically random bytes
RandomStringfunc RandomString(n int) (string, error)Generates an n-character random alphanumeric string

Usage

AES Encryption and Decryption

enc, err := encryption.NewEncryptor(encryption.EncryptionConfig{
    Key:       "a-32-byte-secret-key-for-aes256", // must be 32 bytes for AES-256
    Algorithm: "aes-256-gcm",
})
if err != nil {
    log.Fatalf("failed to create encryptor: %v", err)
}
 
// Encrypt
ciphertext, err := enc.EncryptString("sensitive data")
if err != nil {
    log.Fatalf("encryption failed: %v", err)
}
 
// Decrypt
plaintext, err := enc.DecryptString(ciphertext)
if err != nil {
    log.Fatalf("decryption failed: %v", err)
}
fmt.Println(plaintext) // "sensitive data"

Encrypting Structured Data

data, _ := json.Marshal(creditCard)
encrypted, err := enc.Encrypt(data)
if err != nil {
    return err
}
// Store encrypted bytes in the database

Password Hashing

hash, err := encryption.HashPassword("user-password-123")
if err != nil {
    return err
}
// Store hash in the database
 
// Later, verify the password
ok := encryption.CheckPassword(hash, "user-password-123")
fmt.Println(ok) // true

HMAC Signing

key := []byte("webhook-secret")
payload := []byte(`{"event":"order.created","order_id":"123"}`)
 
signature := encryption.HMAC(key, payload)
 
// Verify incoming webhook
incomingSig := r.Header.Get("X-Signature")
valid := encryption.VerifyHMAC(key, payload, []byte(incomingSig))

Key Generation

// Generate a 256-bit key for AES-256
key, err := encryption.GenerateKey(256)
if err != nil {
    log.Fatalf("key generation failed: %v", err)
}
fmt.Println(key) // base64-encoded 32-byte key

Random String Generation

// Generate a random token
token, err := encryption.RandomString(32)
if err != nil {
    return err
}
fmt.Println(token) // e.g., "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"

Configuration via config.yaml

encryption:
  key: "your-32-byte-secret-key-here!!"
  algorithm: aes-256-gcm
  • Auth — Password hashing and JWT token signing
  • Storage — Encrypt files before storage
  • Config — Encryption configuration loading
Last updated on
SessionsSeeds