func (e *Engine) BoxCredential(ctx context.Context, pt, encMec, mecNonce []byte,
	privKP *EncryptionKeyPair, pubKey []byte) ([]byte, []byte, []byte, error) {

	err := ctxutil.ErrIfDone(ctx)
	if err != nil {
		return nil, nil, nil, err
	}

	nonces := make([]byte, 48)
	_, err = rand.Read(nonces)
	if err != nil {
		return nil, nil, nil, err
	}

	cekNonce := nonces[:24]
	nonce := [24]byte{}
	copy(nonce[:], nonces[24:])

	mek, err := e.Unbox(ctx, encMec, mecNonce, privKP, pubKey)
	if err != nil {
		return nil, nil, nil, err
	}

	cek, err := deriveKey(ctx, mek, cekNonce, 32)
	if err != nil {
		return nil, nil, nil, err
	}

	cekb := [32]byte{}
	copy(cekb[:], cek)

	err = ctxutil.ErrIfDone(ctx)
	if err != nil {
		return nil, nil, nil, err
	}

	ct := secretbox.Seal([]byte{}, pt, &nonce, &cekb)
	return cekNonce, nonce[:], ct, err
}
// BoxCredential encrypts the credential value pt via symmetric secretbox
// encryption.
//
// Doing so is a multistep process.
// First we use the user's session data to unseal their private encryption key.
// With their encryption key and the public encryption key provided, we can
// decrypt the keyring master key (mek).
// Using mek and a generated nonce, we derive the credential encryption key
// (cek) via blake2b.
// Finally, we use the cek and a generated nonce to encrypt the credential.
//
// BoxCredential returns the nonce generated to derive the credential
// encryption key,  the nonce generated for encrypting the credential, and the
// encrypted credential.
BoxCredential encrypts the credential value pt via symmetric secretbox
encryption.

Doing so is a multistep process.
First we use the user's session data to unseal their private encryption key.
With their encryption key and the public encryption key provided, we can
decrypt the keyring master key (mek).
Using mek and a generated nonce, we derive the credential encryption key
(cek) via blake2b.
Finally, we use the cek and a generated nonce to encrypt the credential.

BoxCredential returns the nonce generated to derive the credential
encryption key,  the nonce generated for encrypting the credential, and the
encrypted credential.
// BoxCredential encrypts the credential value pt via symmetric secretbox // encryption . // // Doing so is a multistep process . // First we use the user ' s session data to unseal their private encryption key . // With their encryption key and the public encryption key provided we can // decrypt the keyring master key ( mek ) . // Using mek and a generated nonce we derive the credential encryption key // ( cek ) via blake2b . // Finally we use the cek and a generated nonce to encrypt the credential . // // BoxCredential returns the nonce generated to derive the credential // encryption key the nonce generated for encrypting the credential and the // encrypted credential .
func (e *Engine) BoxCredential(ctx context.Context, pt, encMec, mecNonce []byte,
	privKP *EncryptionKeyPair, pubKey []byte) ([]byte, []byte, []byte, error) {
	err := ctxutil.ErrIfDone(ctx)
	if err != nil {
		return nil, nil, nil, err
	}
	nonces := make([]byte, 48)
	_, err = rand.Read(nonces)
	if err != nil {
		return nil, nil, nil, err
	}
	cekNonce := nonces[:24]
	nonce := [24]byte{}
	copy(nonce[:], nonces[24:])
	mek, err := e.Unbox(ctx, encMec, mecNonce, privKP, pubKey)
	if err != nil {
		return nil, nil, nil, err
	}
	cek, err := deriveKey(ctx, mek, cekNonce, 32)
	if err != nil {
		return nil, nil, nil, err
	}
	cekb := [32]byte{}
	copy(cekb[:], cek)
	err = ctxutil.ErrIfDone(ctx)
	if err != nil {
		return nil, nil, nil, err
	}
	ct := secretbox.Seal([]byte{}, pt, &nonce, &cekb)
	return cekNonce, nonce[:], ct, err
}
func ( e * Engine ) BoxCredential ( ctx context . Context , pt , encMec , mecNonce [ ] byte , privKP * EncryptionKeyPair , pubKey [ ] byte ) ( [ ] byte , [ ] byte , [ ] byte , error ) { err := ctxutil . ErrIfDone ( ctx ) if err != nil { return nil , nil , nil , err } nonces := make ( [ ] byte , 48 ) _ , err = rand . Read ( nonces ) if err != nil { return nil , nil , nil , err } cekNonce := nonces [ : 24 ] nonce := [ 24 ] byte { } copy ( nonce [ : ] , nonces [ 24 : ] ) mek , err := e . Unbox ( ctx , encMec , mecNonce , privKP , pubKey ) if err != nil { return nil , nil , nil , err } cek , err := deriveKey ( ctx , mek , cekNonce , 32 ) if err != nil { return nil , nil , nil , err } cekb := [ 32 ] byte { } copy ( cekb [ : ] , cek ) err = ctxutil . ErrIfDone ( ctx ) if err != nil { return nil , nil , nil , err } ct := secretbox . Seal ( [ ] byte { } , pt , & nonce , & cekb ) return cekNonce , nonce [ : ] , ct , err }
BoxCredential encrypts the credential value pt via symmetric secretbox
encryption.
BoxCredential encrypts the credential value pt via symmetric secretbox encryption .