| 71 | } |
| 72 | |
| 73 | func (es *EncryptedString) Decrypt(id string, decryptionKeys map[string]string) ([]byte, error) { |
| 74 | decryptionKey := decryptionKeys[es.KeyID] |
| 75 | |
| 76 | if decryptionKey == "" { |
| 77 | return nil, fmt.Errorf("crypto: decryption key with name %q does not exist", es.KeyID) |
| 78 | } |
| 79 | |
| 80 | key, err := deriveSymmetricKey(id, es.KeyID, decryptionKey) |
| 81 | if err != nil { |
| 82 | return nil, err |
| 83 | } |
| 84 | |
| 85 | block := must(aes.NewCipher(key)) |
| 86 | cipher := must(cipher.NewGCM(block)) |
| 87 | |
| 88 | decrypted, err := cipher.Open(nil, es.Nonce, es.Data, nil) // #nosec G407 |
| 89 | if err != nil { |
| 90 | return nil, err |
| 91 | } |
| 92 | |
| 93 | return decrypted, nil |
| 94 | } |
| 95 | |
| 96 | func ParseEncryptedString(str string) *EncryptedString { |
| 97 | if !strings.HasPrefix(str, "{") { |