encryptor-go

A Go package for ECDH P-256 key exchange, SHA-256 shared-secret derivation, and AES-256-CBC encryption/decryption. Interoperable with the TypeScript and Swift implementations — both sides can derive the same shared secret and exchange encrypted payloads directly.

---

Installation

go get github.com/CypriotUnknown/encryptor-go

---

Features

• Generate ECDH key pairs (P-256 curve)
• Import/export keys for both app (SPKI/PKCS8, Base64) and browser (JWK) platforms
• Compute shared secrets via ECDH + SHA-256
• AES-256-CBC symmetric encryption and decryption
• Random digit generation (e.g. OTP codes)
• No third-party dependencies — uses the Go standard library only

---

Usage

import "github.com/CypriotUnknown/encryptor-go/security"

enc := security.GetInstance()

1. Generate keys

keys := enc.GenerateKeys(security.PlatformApp)

fmt.Println(keys.PublicKeyString)  // Base64 SPKI — share with the other party
fmt.Println(keys.PrivateKeyString) // Base64 PKCS8 — keep this private
// keys.PrivateKey is the raw *ecdh.PrivateKey, ready to use directly

Use security.PlatformBrowser when the counterpart is a web client exchanging JWK-formatted keys.

2. Import a key from a string

// Re-import a stored private key
output := enc.GenerateCryptoKeyFromBase64(&security.GenerateCryptoKeyFromBase64Dto{
    Platform:        security.PlatformApp,
    Base64KeyString: storedPrivateKeyString,
    ReturnKey:       security.Private,
})
privateKey := output.PrivateKey

// Import a peer's public key
output = enc.GenerateCryptoKeyFromBase64(&security.GenerateCryptoKeyFromBase64Dto{
    Platform:        security.PlatformApp,
    Base64KeyString: peerPublicKeyString,
    ReturnKey:       security.Public,
})
publicKey := output.PublicKey

3. Compute a shared secret

secret := enc.ComputeSecret(&security.ComputeSecretDTO{
    Platform:              security.PlatformApp,
    ClientPublicKeyBase64: serverPublicKeyString,
    PrivateKey:            keys.PrivateKey,
})
// secret is a Base64-encoded SHA-256 digest of the raw ECDH shared secret

4. Generate random digits (OTP)

otp := enc.GenerateRandomDigits(6)
fmt.Println(otp) // e.g. "482031"

5. Encrypt and decrypt

body, _ := json.Marshal(map[string]string{"hello": "world"})

encrypted, err := enc.EncryptContent(&security.EncryptContentDto{
    Content:  string(body),
    Secret:   secret,
    Platform: security.PlatformApp,
})
// encrypted.IV   — Base64 initialization vector
// encrypted.Hash — Base64 ciphertext (hex for PlatformBrowser)

decrypted, err := enc.DecryptContent(&security.DecryptContentDto{
    Content:  encrypted,
    Secret:   secret,
    Platform: security.PlatformApp,
})
fmt.Println(string(decrypted)) // {"hello":"world"}

---

Supported Platforms

Platform	Key Format	Cipher Output	Typical Use Case
PlatformApp	SPKI / PKCS8 (Base64)	Base64	Mobile/desktop apps, Go/Node.js/Bun backends
PlatformBrowser	JWK (JSON string)	Hex	Web clients using the Web Crypto API

---

Full Example

package main

import (
    "encoding/json"
    "fmt"
    "github.com/CypriotUnknown/encryptor-go/security"
)

func main() {
    enc := security.GetInstance()

    // Both parties generate their own key pairs
    clientKeys := enc.GenerateKeys(security.PlatformApp)
    serverKeys := enc.GenerateKeys(security.PlatformApp)

    // Each party computes the same shared secret from the other's public key
    secret := enc.ComputeSecret(&security.ComputeSecretDTO{
        Platform:              security.PlatformApp,
        ClientPublicKeyBase64: clientKeys.PublicKeyString,
        PrivateKey:            serverKeys.PrivateKey,
    })

    body, _ := json.Marshal(map[string]string{"hello": "world"})

    encrypted, err := enc.EncryptContent(&security.EncryptContentDto{
        Content:  string(body),
        Secret:   secret,
        Platform: security.PlatformApp,
    })
    if err != nil {
        panic(err)
    }
    fmt.Printf("%+v\n", encrypted)
    // &{IV:... Hash:...}

    decrypted, err := enc.DecryptContent(&security.DecryptContentDto{
        Content:  encrypted,
        Secret:   secret,
        Platform: security.PlatformApp,
    })
    if err != nil {
        panic(err)
    }
    fmt.Println(string(decrypted)) // {"hello":"world"}
}

---

Related Packages

Language	Package
TypeScript	@cypriot/encryptor — JSR (Deno / Bun / Node.js) · @cypriotunknown/encryptor — npm
Swift	SwiftEncryptor — iOS 15+ / macOS 12+ / tvOS 15+ / watchOS 8+

All three implementations share the same P-256 curve, SHA-256 secret digest, AES-256-CBC cipher, and "app"/"browser" platform conventions, so any pair can interoperate directly.

---

License

MIT