| 146 | } |
| 147 | |
| 148 | func NewEncryptedString(id string, data []byte, keyID string, keyBase64URL string) (*EncryptedString, error) { |
| 149 | key, err := deriveSymmetricKey(id, keyID, keyBase64URL) |
| 150 | if err != nil { |
| 151 | return nil, err |
| 152 | } |
| 153 | |
| 154 | block := must(aes.NewCipher(key)) |
| 155 | cipher := must(cipher.NewGCM(block)) |
| 156 | |
| 157 | es := EncryptedString{ |
| 158 | KeyID: keyID, |
| 159 | Algorithm: "aes-gcm-hkdf", |
| 160 | Nonce: make([]byte, 12), |
| 161 | } |
| 162 | |
| 163 | must(io.ReadFull(rand.Reader, es.Nonce)) |
| 164 | es.Data = cipher.Seal(nil, es.Nonce, data, nil) // #nosec G407 |
| 165 | |
| 166 | return &es, nil |
| 167 | } |
| 168 | |
| 169 | // SecureAlphanumeric generates a secure random alphanumeric string using standard library |
| 170 | func SecureAlphanumeric(length int) string { |