Function DecryptAES

internal/crypto/aes.go:59–92

DecryptAES decrypts a base64 RawURL-encoded AES-256-GCM ciphertext produced by EncryptAES. Returns an error if authentication fails or input is malformed.

(key, encryptedText string)

// DecryptAES decrypts a base64 RawURL-encoded AES-256-GCM ciphertext produced
// by EncryptAES. Returns an error if authentication fails or input is malformed.
func DecryptAES(key, encryptedText string) (string, error) {
	keyBytes, err := deriveAESKey(key)
	if err != nil {
		return "", err
	}

	data, err := base64.RawURLEncoding.DecodeString(encryptedText)
	if err != nil {
		return "", err
	}

	block, err := aes.NewCipher(keyBytes)
	if err != nil {
		return "", err
	}

	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return "", err
	}

	nonceSize := gcm.NonceSize()
	if len(data) < nonceSize {
		return "", errors.New("ciphertext too short")
	}

	nonce, ciphertext := data[:nonceSize], data[nonceSize:]
	plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
	if err != nil {
		return "", err
	}

	return string(plaintext), nil
}