mirror of
https://github.com/luxfi/crypto.git
synced 2026-10-30 16:59:13 +00:00
zeekay
4911095d96
- Add secret/ package: wraps runtime/secret.Do() for secure key erasure when built with GOEXPERIMENT=runtimesecret, no-op stub otherwise - Add encryption/hpke.go: HPKE encryption using Go 1.26 stdlib crypto/hpke with X25519 (classical) and ML-KEM-768+X25519 (post-quantum hybrid) - Wrap BLS key generation (both CGO and pure Go) in secret.Do() - Wrap HexToECDSA and LoadECDSA in secret.Do() for key byte cleanup - Simplify random.go: crypto/rand.Read never errors in Go 1.26 - Update CI workflows to Go 1.26.1, add GOEXPERIMENT=runtimesecret job - Update dependencies: circl 1.6.3, x/crypto 0.48.0, age 1.3.1
73 lines
1.3 KiB
Go
73 lines
1.3 KiB
Go
// Copyright (C) 2020-2026, Lux Industries Inc. All rights reserved.
|
|
// See the file LICENSE for licensing terms.
|
|
|
|
package secret
|
|
|
|
import (
|
|
"testing"
|
|
)
|
|
|
|
func TestDo(t *testing.T) {
|
|
called := false
|
|
Do(func() {
|
|
called = true
|
|
})
|
|
if !called {
|
|
t.Fatal("Do did not execute the function")
|
|
}
|
|
}
|
|
|
|
func TestDoWithKeyMaterial(t *testing.T) {
|
|
var keyBytes []byte
|
|
Do(func() {
|
|
keyBytes = make([]byte, 32)
|
|
for i := range keyBytes {
|
|
keyBytes[i] = byte(i)
|
|
}
|
|
// Simulate using the key then clearing it
|
|
clear(keyBytes)
|
|
})
|
|
// After Do, keyBytes should be zeroed
|
|
for _, b := range keyBytes {
|
|
if b != 0 {
|
|
t.Fatal("key material was not cleared inside Do")
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestEnabled(t *testing.T) {
|
|
// This test works with both build tags.
|
|
// With goexperiment.runtimesecret: Enabled() == true
|
|
// Without: Enabled() == false
|
|
// We just verify it returns a bool without panicking.
|
|
_ = Enabled()
|
|
}
|
|
|
|
func TestDoNested(t *testing.T) {
|
|
outerCalled := false
|
|
innerCalled := false
|
|
Do(func() {
|
|
outerCalled = true
|
|
Do(func() {
|
|
innerCalled = true
|
|
})
|
|
})
|
|
if !outerCalled {
|
|
t.Fatal("outer Do not called")
|
|
}
|
|
if !innerCalled {
|
|
t.Fatal("inner Do not called")
|
|
}
|
|
}
|
|
|
|
func TestDoWithPanic(t *testing.T) {
|
|
defer func() {
|
|
if r := recover(); r == nil {
|
|
t.Fatal("expected panic to propagate through Do")
|
|
}
|
|
}()
|
|
Do(func() {
|
|
panic("test panic")
|
|
})
|
|
}
|