GoMFT/internal/encryption

Encryption Module

This module provides secure encryption and decryption functionality for sensitive credential fields in GoMFT using AES-256 encryption.

Key Management

The key management module handles secure retrieval, validation, and management of encryption keys from environment variables or secure storage.

Setup

1. Set the environment variable GOMFT_ENCRYPTION_KEY with a securely generated key:

   # Generate a secure random key and set it as an environment variable
   GOMFT_ENCRYPTION_KEY=$(go run -e 'import "encoding/base64"; import "crypto/rand"; key := make([]byte, 32); rand.Read(key); fmt.Println(base64.StdEncoding.EncodeToString(key))')
   

2. Include this key in your .env file (for development only):

   GOMFT_ENCRYPTION_KEY=your-base64-encoded-key
   

Usage

To initialize the key manager:

import "github.com/starfleetcptn/gomft/internal/encryption"

func init() {
    // Initialize with default environment variable (GOMFT_ENCRYPTION_KEY)
    err := encryption.InitializeKeyManager("")
    if err != nil {
        panic("Failed to initialize encryption key: " + err.Error())
    }
}

To get the key manager instance:

keyManager := encryption.GetKeyManager()

To generate a new random encryption key:

key, err := encryption.GenerateKey(encryption.AES256KeySize)
if err != nil {
    // handle error
}

Security Considerations

• Never store encryption keys in the database or expose them in logs
• The key should be at least 32 bytes (256 bits) for AES-256 encryption
• In production, use secure key management solutions (e.g., HashiCorp Vault, AWS KMS) instead of environment variables
• Rotate keys periodically for enhanced security
• Monitor for any unusual encryption/decryption activity

Testing

The module includes comprehensive unit tests. Run them with:

go test -v ./internal/encryption/...