Cryptography in Go: Encryption and Hashing

Cryptography in Go (Golang): A Complete Guide to Encryption and Hashing

Go (Golang) provides a powerful standard library crypto, which includes all the necessary tools for implementing cryptographic data protection. In this article, we will detail the main capabilities of working with encryption and hashing in Go, including symmetric (AES), asymmetric (RSA) encryption, hash functions (SHA-256), and password protection using bcrypt.

1. Hashing Data in Go

Hashing is a one-way transformation of data into a fixed length. In Go, the crypto/sha256 package (and other SHA families) is used for this.

Example: SHA-256 hash of a string

package main

import (    "crypto/sha256"    "fmt")

func main() {    data := "PythonLib.ru — educational website"    hash := sha256.Sum256([]byte(data))    fmt.Printf("SHA-256: %x", hash)}

Output: SHA-256: 3c4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4

For streaming hashing (large files), use the hash.Hash interface:

package main

import (    "crypto/sha256"    "fmt"    "io"    "strings")

func main() {    h := sha256.New()    reader := strings.NewReader("Stream of data for hashing")    io.Copy(h, reader)    fmt.Printf("Streaming SHA-256: %x", h.Sum(nil))}

2. Password Protection with bcrypt

For storing passwords, never use regular hashes (SHA-256). Use bcrypt — an algorithm with salt and adaptive cost. In Go, this is implemented by the golang.org/x/crypto/bcrypt package.

Installation:

go get golang.org/x/crypto/bcrypt

Example of hashing and verifying a password:

package main

import (    "fmt"    "golang.org/x/crypto/bcrypt")

func main() {    password := "MySecurePass123!"

    // Hashing (default cost = 10)    hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)    if err != nil {        panic(err)    }    fmt.Printf("bcrypt hash: %s", hash)

    // Password verification    err = bcrypt.CompareHashAndPassword(hash, []byte(password))    if err != nil {        fmt.Println("Invalid password")    } else {        fmt.Println("Password is correct!")    }}

3. Symmetric Encryption AES-GCM

AES (Advanced Encryption Standard) is a symmetric algorithm. The recommended mode is GCM (Galois/Counter Mode), which provides authentication (AEAD). Use the crypto/aes and crypto/cipher packages.

Example of AES-256-GCM encryption and decryption:

package main

import (    "crypto/aes"    "crypto/cipher"    "crypto/rand"    "encoding/hex"    "fmt"    "io")

func main() {    key := []byte("32-byte key for AES-256!!!") // 32 bytes    plaintext := []byte("Secret message for PythonLib")

    // Encryption    ciphertext, nonce := encryptAESGCM(key, plaintext)    fmt.Printf("Encrypted: %s", hex.EncodeToString(ciphertext))

    // Decryption    decrypted, err := decryptAESGCM(key, ciphertext, nonce)    if err != nil {        panic(err)    }    fmt.Printf("Decrypted: %s", decrypted)}

func encryptAESGCM(key, plaintext []byte) (ciphertext, nonce []byte) {    block, _ := aes.NewCipher(key)    gcm, _ := cipher.NewGCM(block)    nonce = make([]byte, gcm.NonceSize())    io.ReadFull(rand.Reader, nonce)    return gcm.Seal(nil, nonce, plaintext, nil), nonce}

func decryptAESGCM(key, ciphertext, nonce []byte) ([]byte, error) {    block, _ := aes.NewCipher(key)    gcm, _ := cipher.NewGCM(block)    return gcm.Open(nil, nonce, ciphertext, nil)}