snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

oryx/aead/aead_oss.go

@@ -0,0 +1,23 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build !commercial
+
+// Package aead provides the authenticated cipher (AEAD) that Ory uses to
+// seal opaque payloads such as pagination tokens.
+package aead
+
+import (
+	"crypto/cipher"
+
+	"github.com/pkg/errors"
+	"golang.org/x/crypto/chacha20poly1305"
+)
+
+// New returns the XChaCha20-Poly1305 AEAD that seals opaque payloads under
+// the given key. Its 192-bit random nonce imposes no practical limit on the
+// number of payloads sealed per key.
+func New(key [32]byte) (cipher.AEAD, error) {
+	a, err := chacha20poly1305.NewX(key[:])
+	return a, errors.Wrap(err, "cannot create XChaCha20-Poly1305 AEAD")
+}

oryx/aead/legacy_secretbox.go

@@ -0,0 +1,19 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package aead
+
+import "golang.org/x/crypto/nacl/secretbox"
+
+// OpenLegacySecretbox opens a payload sealed by the NaCl secretbox scheme
+// that was used before this package existed: a 24-byte nonce prefixed to the
+// ciphertext, without additional data. Remove it once all such payloads have
+// expired.
+func OpenLegacySecretbox(key [32]byte, raw []byte) ([]byte, bool) {
+	if len(raw) < 24 {
+		return nil, false
+	}
+	var nonce [24]byte
+	copy(nonce[:], raw[:24])
+	return secretbox.Open(nil, raw[24:], &nonce, &key)
+}