package main
import (
"bytes"
"fmt"
"github.com/scaleway/tink-go-scwkms/integration/scwkms"
"github.com/tink-crypto/tink-go/v2/keyset"
"github.com/tink-crypto/tink-go/v2/streamingaead"
"io"
"log"
"os"
"path/filepath"
)
func main() {
const keyURIPrefix = "scw-kms://regions/<region>/keys/"
keyURI := keyURIPrefix + os.Getenv("SCW_KMS_KEY_ID")
client, err := scwkms.NewClient(keyURIPrefix)
if err != nil {
log.Fatal(err)
}
kekAEAD, err := client.GetAEAD(keyURI)
if err != nil {
log.Fatal(err)
}
handle, err := keyset.NewHandle(streamingaead.AES256GCMHKDF1MBKeyTemplate())
if err != nil {
log.Fatal(err)
}
// Encrypt the keyset and store it in memory (using a bytes buffer)
buf := new(bytes.Buffer)
writer := keyset.NewBinaryWriter(buf)
err = handle.Write(writer, kekAEAD)
if err != nil {
log.Fatalf("Error writing encrypted keyset: %v", err)
}
// Decrypt the keyset from the buffer
reader := keyset.NewBinaryReader(buf)
decryptedHandle, err := keyset.Read(reader, kekAEAD)
if err != nil {
log.Fatalf("Error reading encrypted keyset: %v", err)
}
// Create the Streaming AEAD primitive from the decrypted keyset
primitive, err := streamingaead.New(decryptedHandle)
if err != nil {
log.Fatalf("Error creating streaming AEAD primitive: %v", err)
}
// Create a file with the plaintext.
dir, err := os.MkdirTemp("", "streamingaead")
if err != nil {
log.Fatal(err)
}
defer os.RemoveAll(dir)
plaintextPath := filepath.Join(dir, "plaintext")
if err := os.WriteFile(plaintextPath, []byte("this data needs to be encrypted"), 0666); err != nil {
log.Fatal(err)
}
plaintextFile, err := os.Open(plaintextPath)
if err != nil {
log.Fatal(err)
}
// AssociatedData defines the context of the encryption. (It is optional)
// Here, we include the path of the plaintext file.
associatedData := []byte("associatedData for " + plaintextPath)
// Encrypt the plaintext file and write the output to the ciphertext file.
ciphertextPath := filepath.Join(dir, "ciphertext")
ciphertextFile, err := os.Create(ciphertextPath)
if err != nil {
log.Fatal(err)
}
w, err := primitive.NewEncryptingWriter(ciphertextFile, associatedData)
if err != nil {
log.Fatal(err)
}
if _, err := io.Copy(w, plaintextFile); err != nil {
log.Fatal(err)
}
if err := w.Close(); err != nil {
log.Fatal(err)
}
if err := ciphertextFile.Close(); err != nil {
log.Fatal(err)
}
if err := plaintextFile.Close(); err != nil {
log.Fatal(err)
}
// Print the content of the encrypted file.
c, err := os.ReadFile(ciphertextPath)
if err != nil {
log.Fatal(err)
}
fmt.Println(string(c))
// Decrypt the ciphertext file and write the output in the decrypted file.
ciphertextFile, err = os.Open(ciphertextPath)
if err != nil {
log.Fatal(err)
}
decryptedPath := filepath.Join(dir, "decrypted")
decryptedFile, err := os.Create(decryptedPath)
if err != nil {
log.Fatal(err)
}
r, err := primitive.NewDecryptingReader(ciphertextFile, associatedData)
if err != nil {
log.Fatal(err)
}
if _, err := io.Copy(decryptedFile, r); err != nil {
log.Fatal(err)
}
if err := decryptedFile.Close(); err != nil {
log.Fatal(err)
}
if err := ciphertextFile.Close(); err != nil {
log.Fatal(err)
}
// Print the content of the decrypted file.
b, err := os.ReadFile(decryptedPath)
if err != nil {
log.Fatal(err)
}
fmt.Println(string(b))
}