Function NewDKIMCipher

internal/identity/dkimcrypt.go:54–71

NewDKIMCipher derives a dedicated 32-byte KEK from the master secret via HKDF-SHA256 (mirroring oauth.deriveOAuthSigningKey: a per-purpose label so the DKIM key can rotate independently of header/OAuth/HITL signing) and returns an AES-256-GCM cipher. It fails closed when the master is shorter than 3

(master []byte)

// the config layer only enforces that in production, so a weak dev secret must
// not silently produce weak at-rest encryption.
func NewDKIMCipher(master []byte) (*DKIMCipher, error) {
	if len(master) < 32 {
		return nil, fmt.Errorf("dkim: master secret is %d bytes, need ≥32 to derive a KEK", len(master))
	}
	kek := make([]byte, 32)
	if _, err := io.ReadFull(hkdf.New(sha256.New, master, nil, []byte(dkimKEKLabel)), kek); err != nil {
		return nil, fmt.Errorf("dkim: derive KEK: %w", err)
	}
	block, err := aes.NewCipher(kek)
	if err != nil {
		return nil, fmt.Errorf("dkim: aes cipher: %w", err)
	}
	aead, err := cipher.NewGCM(block)
	if err != nil {
		return nil, fmt.Errorf("dkim: gcm: %w", err)
	}
	return &DKIMCipher{aead: aead}, nil
}

// seal encrypts a private key, binding the (normalized) domain as AAD so a
// ciphertext cannot be moved onto another domain's row and still decrypt.