gitee.com/liuxuezhan/go-micro-v1.18.0@v1.0.0/tunnel/crypto.go (about)

     1  package tunnel
     2  
     3  import (
     4  	"crypto/aes"
     5  	"crypto/cipher"
     6  	"crypto/rand"
     7  	"crypto/sha256"
     8  	"io"
     9  )
    10  
    11  // hash hahes the data into 32 bytes key and returns it
    12  // hash uses sha256 underneath to hash the supplied key
    13  func hash(key string) []byte {
    14  	hasher := sha256.New()
    15  	hasher.Write([]byte(key))
    16  	return hasher.Sum(nil)
    17  }
    18  
    19  // Encrypt encrypts data and returns the encrypted data
    20  func Encrypt(data []byte, key string) ([]byte, error) {
    21  	// generate a new AES cipher using our 32 byte key
    22  	c, err := aes.NewCipher(hash(key))
    23  	if err != nil {
    24  		return nil, err
    25  	}
    26  
    27  	// gcm or Galois/Counter Mode, is a mode of operation
    28  	// for symmetric key cryptographic block ciphers
    29  	// - https://en.wikipedia.org/wiki/Galois/Counter_Mode
    30  	gcm, err := cipher.NewGCM(c)
    31  	if err != nil {
    32  		return nil, err
    33  	}
    34  
    35  	// create a new byte array the size of the nonce
    36  	// NOTE: we might use smaller nonce size in the future
    37  	nonce := make([]byte, gcm.NonceSize())
    38  	if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
    39  		return nil, err
    40  	}
    41  
    42  	// NOTE: we prepend the nonce to the payload
    43  	// we need to do this as we need the same nonce
    44  	// to decrypt the payload when receiving it
    45  	return gcm.Seal(nonce, nonce, data, nil), nil
    46  }
    47  
    48  // Decrypt decrypts the payload and returns the decrypted data
    49  func Decrypt(data []byte, key string) ([]byte, error) {
    50  	// generate AES cipher for decrypting the message
    51  	c, err := aes.NewCipher(hash(key))
    52  	if err != nil {
    53  		return nil, err
    54  	}
    55  
    56  	// we use GCM to encrypt the payload
    57  	gcm, err := cipher.NewGCM(c)
    58  	if err != nil {
    59  		return nil, err
    60  	}
    61  
    62  	nonceSize := gcm.NonceSize()
    63  	// NOTE: we need to parse out nonce from the payload
    64  	// we prepend the nonce to every encrypted payload
    65  	nonce, ciphertext := data[:nonceSize], data[nonceSize:]
    66  	plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
    67  	if err != nil {
    68  		return nil, err
    69  	}
    70  
    71  	return plaintext, nil
    72  }