1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
# Go Implementation of IPCrypt
This is a Go implementation of the IP address encryption and obfuscation methods specified in the IETF draft [draft-denis-ipcrypt](https://datatracker.ietf.org/doc/draft-denis-ipcrypt/).
## Overview
The implementation provides three methods for IP address encryption:
1. **ipcrypt-deterministic**: A deterministic mode where the same input always produces the same output for a given key.
2. **ipcrypt-nd**: A non-deterministic mode that uses an 8-byte tweak for enhanced privacy.
3. **ipcrypt-ndx**: An extended non-deterministic mode that uses a 32-byte key and 16-byte tweak for increased security.
## Installation
```sh
go get github.com/jedisct1/go-ipcrypt
```
## Usage
```go
package main
import (
"crypto/rand"
"fmt"
"net"
"github.com/jedisct1/go-ipcrypt/ipcrypt"
)
func main() {
// Create a 16-byte key for ipcrypt-deterministic mode
key := make([]byte, ipcrypt.KeySizeDeterministic)
rand.Read(key)
// Encrypt an IP address (ipcrypt-deterministic mode)
ip := net.ParseIP("192.168.1.1")
encrypted, err := ipcrypt.EncryptIP(key, ip)
if err != nil {
panic(err)
}
fmt.Printf("Encrypted: %s\n", encrypted)
// Decrypt the IP address
decrypted, err := ipcrypt.DecryptIP(key, encrypted)
if err != nil {
panic(err)
}
fmt.Printf("Decrypted: %s\n", decrypted)
// ipcrypt-nd mode with random tweak
ndKey := make([]byte, ipcrypt.KeySizeND)
rand.Read(ndKey)
encryptedND, err := ipcrypt.EncryptIPNonDeterministic(ip.String(), ndKey, nil)
if err != nil {
panic(err)
}
decryptedND, err := ipcrypt.DecryptIPNonDeterministic(encryptedND, ndKey)
if err != nil {
panic(err)
}
fmt.Printf("Non-deterministic decrypted: %s\n", decryptedND)
// ipcrypt-ndx mode with random tweak
xtsKey := make([]byte, ipcrypt.KeySizeNDX)
rand.Read(xtsKey)
encryptedX, err := ipcrypt.EncryptIPNonDeterministicX(ip.String(), xtsKey, nil)
if err != nil {
panic(err)
}
decryptedX, err := ipcrypt.DecryptIPNonDeterministicX(encryptedX, xtsKey)
if err != nil {
panic(err)
}
fmt.Printf("Extended non-deterministic decrypted: %s\n", decryptedX)
}
```
## Constants
- `KeySizeDeterministic`: 16 bytes (ipcrypt-deterministic)
- `KeySizeND`: 16 bytes (ipcrypt-nd)
- `KeySizeNDX`: 32 bytes (ipcrypt-ndx)
- `TweakSize`: 8 bytes (ipcrypt-nd tweak)
- `TweakSizeX`: 16 bytes (ipcrypt-ndx tweak)
|
