Encryption #

// AES-256-GCM encryption and decryption
import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/base64"
	"errors"
)

func encryptData(plaintext []byte, key []byte) (map[string]string, error) {
	if len(key) != 32 {
		return nil, errors.New("key must be 256 bits (32 bytes)")
	}

	// Generate a new nonce for every encryption
	// CRITICAL: never reuse a nonce with the same key!
	nonce := make([]byte, 12) // 96-bit nonce — the GCM standard
	if _, err := rand.Read(nonce); err != nil {
		return nil, err
	}

	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}
	aesgcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, err
	}

	// Encrypt + authenticate
	// GCM produces ciphertext + an authentication tag (16 bytes)
	ciphertext := aesgcm.Seal(nil, nonce, plaintext, nil)

	return map[string]string{
		"nonce":      base64.StdEncoding.EncodeToString(nonce),
		"ciphertext": base64.StdEncoding.EncodeToString(ciphertext),
		"algorithm":  "AES-256-GCM",
	}, nil
}

func decryptData(encrypted map[string]string, key []byte) ([]byte, error) {
	nonce, err := base64.StdEncoding.DecodeString(encrypted["nonce"])
	if err != nil {
		return nil, err
	}
	ciphertext, err := base64.StdEncoding.DecodeString(encrypted["ciphertext"])
	if err != nil {
		return nil, err
	}

	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}
	aesgcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, err
	}

	// GCM automatically verifies the authentication tag
	// If data was modified, an error is returned
	plaintext, err := aesgcm.Open(nil, nonce, ciphertext, nil)
	if err != nil {
		return nil, errors.New("decryption failed: data may have been modified")
	}
	return plaintext, nil
}

// Usage:
// key := make([]byte, 32) // 256-bit key — store it securely!
// plaintext := []byte("Sensitive data that needs encryption")
// encrypted, _ := encryptData(plaintext, key)
// decrypted, _ := decryptData(encrypted, key)

// Envelope encryption pattern:
// KEK (Key Encryption Key) → encrypts the DEK
// DEK (Data Encryption Key) → encrypts data
//
// The KEK is stored in a secure location (HSM, KMS)
// The DEK is stored with the encrypted data (in encrypted form)
import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/base64"
	"errors"
)

type EnvelopeEncryption struct {
	kekCipher cipher.AEAD
}

// NewEnvelopeEncryption takes a 256-bit Key Encryption Key from a KMS or HSM.
func NewEnvelopeEncryption(kek []byte) (*EnvelopeEncryption, error) {
	if len(kek) != 32 {
		return nil, errors.New("KEK must be 256-bit")
	}
	block, err := aes.NewCipher(kek)
	if err != nil {
		return nil, err
	}
	aead, err := cipher.NewGCM(block)
	if err != nil {
		return nil, err
	}
	return &EnvelopeEncryption{kekCipher: aead}, nil
}

// Encrypt data using envelope encryption.
// Every call generates a new DEK.
func (e *EnvelopeEncryption) Encrypt(plaintext []byte) (map[string]string, error) {
	// 1. Generate a new Data Encryption Key (DEK)
	dek := make([]byte, 32) // 256-bit DEK
	if _, err := rand.Read(dek); err != nil {
		return nil, err
	}

	// 2. Encrypt the data with the DEK
	dataNonce := make([]byte, 12)
	if _, err := rand.Read(dataNonce); err != nil {
		return nil, err
	}
	dataBlock, _ := aes.NewCipher(dek)
	dataCipher, _ := cipher.NewGCM(dataBlock)
	encryptedData := dataCipher.Seal(nil, dataNonce, plaintext, nil)

	// 3. Encrypt the DEK with the KEK (wrapping)
	keyNonce := make([]byte, 12)
	if _, err := rand.Read(keyNonce); err != nil {
		return nil, err
	}
	encryptedDek := e.kekCipher.Seal(nil, keyNonce, dek, nil)

	return map[string]string{
		"encrypted_dek":  base64.StdEncoding.EncodeToString(encryptedDek),
		"key_nonce":      base64.StdEncoding.EncodeToString(keyNonce),
		"encrypted_data": base64.StdEncoding.EncodeToString(encryptedData),
		"data_nonce":     base64.StdEncoding.EncodeToString(dataNonce),
	}, nil
}

// Decrypt data from an envelope.
func (e *EnvelopeEncryption) Decrypt(envelope map[string]string) ([]byte, error) {
	// 1. Unwrap the DEK using the KEK
	encryptedDek, _ := base64.StdEncoding.DecodeString(envelope["encrypted_dek"])
	keyNonce, _ := base64.StdEncoding.DecodeString(envelope["key_nonce"])
	dek, err := e.kekCipher.Open(nil, keyNonce, encryptedDek, nil)
	if err != nil {
		return nil, err
	}

	// 2. Decrypt the data using the DEK
	encryptedData, _ := base64.StdEncoding.DecodeString(envelope["encrypted_data"])
	dataNonce, _ := base64.StdEncoding.DecodeString(envelope["data_nonce"])
	dataBlock, _ := aes.NewCipher(dek)
	dataCipher, _ := cipher.NewGCM(dataBlock)
	return dataCipher.Open(nil, dataNonce, encryptedData, nil)
}

// Rotate the KEK: decrypt with the old KEK, re-encrypt the DEK with the new KEK.
// Data doesn't need to be decrypted and re-encrypted!
func (e *EnvelopeEncryption) RotateKek(newKek []byte, envelope map[string]string) (map[string]string, error) {
	oldEncryptedDek, _ := base64.StdEncoding.DecodeString(envelope["encrypted_dek"])
	oldKeyNonce, _ := base64.StdEncoding.DecodeString(envelope["key_nonce"])
	dek, err := e.kekCipher.Open(nil, oldKeyNonce, oldEncryptedDek, nil)
	if err != nil {
		return nil, err
	}

	// Re-encrypt the DEK with the new KEK
	newKekBlock, _ := aes.NewCipher(newKek)
	newKekCipher, _ := cipher.NewGCM(newKekBlock)
	newKeyNonce := make([]byte, 12)
	if _, err := rand.Read(newKeyNonce); err != nil {
		return nil, err
	}
	newEncryptedDek := newKekCipher.Seal(nil, newKeyNonce, dek, nil)

	// encrypted_data and data_nonce stay unchanged
	envelope["encrypted_dek"] = base64.StdEncoding.EncodeToString(newEncryptedDek)
	envelope["key_nonce"] = base64.StdEncoding.EncodeToString(newKeyNonce)
	return envelope, nil
}

// Transparently encrypted database fields
// Go equivalent of SQLAlchemy's TypeDecorator: a type implementing
// database/sql's Scanner and Valuer interfaces
import (
	"crypto/sha256"
	"database/sql"
	"database/sql/driver"
	"encoding/hex"
	"encoding/json"
	"os"
)

type EncryptedString struct {
	Value string
	key   []byte
}

// Encrypt before storing in the database.
func (e EncryptedString) Value() (driver.Value, error) {
	if e.Value == "" {
		return nil, nil
	}
	encrypted, err := encryptData([]byte(e.Value), e.key)
	if err != nil {
		return nil, err
	}
	return json.Marshal(encrypted)
}

// Decrypt when reading from the database.
func (e *EncryptedString) Scan(value interface{}) error {
	if value == nil {
		e.Value = ""
		return nil
	}
	var encrypted map[string]string
	if err := json.Unmarshal(value.([]byte), &encrypted); err != nil {
		return err
	}
	plaintext, err := decryptData(encrypted, e.key)
	if err != nil {
		return err
	}
	e.Value = string(plaintext)
	return nil
}

// Configuration
var fieldEncryptionKey = []byte(os.Getenv("FIELD_ENCRYPTION_KEY"))

type User struct {
	ID          int64
	Email       string
	PhoneNumber EncryptedString // Sensitive fields that get encrypted
	TaxID       EncryptedString
	DateOfBirth EncryptedString

	// NOT encrypted — needed for search/filter
	// For fields needing search, store a separate hash
	PhoneHash string
}

type UserRepository struct{ db *sql.DB }

func (r UserRepository) CreateUser(email string, phone, taxID, dob *string) error {
	user := User{Email: email}
	if phone != nil {
		// automatically encrypted by EncryptedString
		user.PhoneNumber = EncryptedString{Value: *phone, key: fieldEncryptionKey}
		// Store a hash for search purposes
		sum := sha256.Sum256([]byte(*phone))
		user.PhoneHash = hex.EncodeToString(sum[:])
	}
	// ... insert the user; encrypted fields are serialized by Value()
	return nil
}

// Find a user by phone number.
func (r UserRepository) FindByPhone(phone string) (*User, error) {
	sum := sha256.Sum256([]byte(phone))
	hash := hex.EncodeToString(sum[:])
	// ... SELECT * FROM users WHERE phone_hash = ? AND scan with EncryptedString
	return nil, nil
}

// Password hashing — NOT encryption
// Uses golang.org/x/crypto/argon2 (a battle-tested password KDF)
import (
	"crypto/rand"
	"encoding/base64"
	"fmt"

	"golang.org/x/crypto/argon2"
)

// Hash a password — can't be reversed to the original.
func storePassword(password string) string {
	salt := make([]byte, 16)
	if _, err := rand.Read(salt); err != nil {
		panic(err)
	}
	// Argon2id with the same parameters as the Python example
	hash := argon2.IDKey([]byte(password), salt, 3, 64*1024, 2, 32)
	return fmt.Sprintf("$argon2id$v=19$m=65536,t=3,p=2$%s$%s",
		base64.RawStdEncoding.EncodeToString(salt),
		base64.RawStdEncoding.EncodeToString(hash))
}

// Verify a stored password hash.
func verifyPassword(storedHash string, password string) bool {
	// ... parse the hash, recompute argon2.IDKey with the stored salt,
	// and compare in constant time (e.g. subtle.ConstantTimeCompare)
	return false
}

// Sensitive data encryption — NOT hashing
// Encrypt — decryptable for processing payments.
func storeCreditCard(cardNumber string, key []byte) (map[string]string, error) {
	return encryptData([]byte(cardNumber), key)
}

// ANTI-PATTERN: hardcoding keys in source code
// const secretKey = "mysecretkey123" // DON'T — source code can leak in git

// ANTI-PATTERN: keys too short or weak
// key := []byte("password") // 64-bit — easily brute-forced

// ANTI-PATTERN: the same key for every purpose
// masterKey := make([]byte, 32) // one key for everything → one leak, everything leaks

// CORRECT: keys from environment variables or secret managers
import (
	"encoding/hex"
	"fmt"
	"os"
)

// Get the key from the environment or a secret manager.
func getEncryptionKey() ([]byte, error) {
	keyHex := os.Getenv("ENCRYPTION_KEY")
	if keyHex == "" {
		return nil, fmt.Errorf("ENCRYPTION_KEY not configured")
	}

	key, err := hex.DecodeString(keyHex)
	if err != nil {
		return nil, err
	}
	if len(key) != 32 {
		return nil, fmt.Errorf("ENCRYPTION_KEY must be 256-bit (64 hex chars)")
	}
	return key, nil
}

// Different keys for different purposes
func setupKeys() map[string][]byte {
	return map[string][]byte{
		"user_pii_key": []byte(os.Getenv("USER_PII_ENCRYPTION_KEY")),
		"payment_key":  []byte(os.Getenv("PAYMENT_ENCRYPTION_KEY")),
		"session_key":  []byte(os.Getenv("SESSION_ENCRYPTION_KEY")),
	}
}

// Digital signatures with Ed25519 (proving authenticity, not confidentiality)
import (
	"crypto/ed25519"
	"crypto/rand"
)

// Generate an Ed25519 keypair for digital signatures.
func generateSigningKeypair() (ed25519.PrivateKey, ed25519.PublicKey) {
	publicKey, privateKey, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		panic(err)
	}
	return privateKey, publicKey
}

// Sign a payload to prove authenticity.
func signPayload(payload []byte, privateKey ed25519.PrivateKey) []byte {
	return ed25519.Sign(privateKey, payload)
}

// Verify a signature.
func verifySignature(payload []byte, signature []byte, publicKey ed25519.PublicKey) bool {
	return ed25519.Verify(publicKey, payload, signature)
}

// ✗ Anti-pattern 1: encrypting passwords
// encryptedPassword := encrypt(password, key)
// If the key leaks, all passwords are decrypted
// ✓ Solution: hash with Argon2id, bcrypt, or scrypt

// ✗ Anti-pattern 2: reusing nonces/IVs
// nonce := make([]byte, 12) // static nonce — FATAL for GCM!
// Reusing a nonce with the same key destroys GCM security
// ✓ Solution: crypto/rand for every encryption

// ✗ Anti-pattern 3: keys derived from weak passwords without KDFs
// key := []byte(password)[:32] // not a good key
// Short passwords → weak keys
// ✓ Solution: use PBKDF2/Argon2 to derive keys from passwords

// ✗ Anti-pattern 4: storing keys in databases
// Keys and encrypted data in the same place
// If the database leaks, both leak
// ✓ Solution: keys in secret managers or environment variables

// ✗ Anti-pattern 5: CBC mode without authentication
// AES-CBC without HMAC is vulnerable to padding oracle attacks
// block, _ := aes.NewCipher(key)
// ciphertext := cipher.NewCBCEncrypter(block, iv).CryptBlocks(...)
// ✓ Solution: use AES-GCM which provides authenticated encryption

// ✗ Anti-pattern 6: implementing your own cryptographic algorithms
func myEncrypt(data, key []byte) []byte {
	// Custom XOR or similar implementations
	out := make([]byte, len(data))
	for i := range data {
		out[i] = data[i] ^ key[i%len(key)]
	}
	return out
}
// Highly insecure — use battle-tested libraries
// ✓ Solution: crypto/aes (Go), BouncyCastle (Java), WebCrypto API (JS)