Security and Cryptography

Pass the key to aes.NewCipher to get a cipher.Block, wrap that block with cipher.NewGCM to get a cipher.AEAD, then call Seal(dst, nonce, plaintext, additionalData). Seal returns the ciphertext with a 16-byte authentication tag appended.

hmac.Equal(mac1, mac2 []byte) returns a bool and scans every byte, so its running time does not depend on the contents. bytes.Equal stops at the first differing byte, so its timing reveals how much of the input matched.

sha256.Sum256 hashes a byte slice you already hold and returns a [32]byte array. sha256.New returns a streaming hash.Hash you write data into and finish with Sum(nil) - use that when the input is a file or stream too large to buffer.

Call hkdf.Key once per purpose with a different info string each time, for example "cookie-encryption-v1" versus "url-signing-v1". Same secret, same salt, different info, and you get independent keys you never have to store.

math/rand/v2 is a statistical generator that makes no unpredictability promise, so its output can be reconstructed no matter how it is seeded. Use crypto/rand instead: rand.Text() for a token string, or crypto/rand.Read to fill a byte slice.

x509.CreateCertificate returns the signed certificate as raw DER bytes, not a file and not text. To get a .crt or .pem file, wrap those bytes with encoding/pem in a block whose Type is CERTIFICATE.

os.Getenv returns an empty string for both cases, so it cannot tell them apart. os.LookupEnv returns the value plus a boolean that is false only when the variable is absent, letting you fail startup instead of running with an empty credential.

Call pem.Decode on the file bytes, check the returned block is non-nil and its Type is CERTIFICATE, then pass block.Bytes, which is the DER, to x509.ParseCertificate. Both steps can fail; check both.

Hostname checking reads the Subject Alternative Name extension, which the template fills from DNSNames, IPAddresses, URIs and EmailAddresses. Go's verifier stopped matching Subject.CommonName in Go 1.15, so a certificate carrying the hostname only in CommonName is rejected.

Two goroutines touch one variable with no synchronisation: the reloader writes the pointer while handshake goroutines read it. A pointer-sized write is not automatically ordered in Go. Keep the certificate in an atomic.Pointer and Load it inside the callback.

Call ListenAndServeTLS with a certificate file and a key file. The package-level http.ListenAndServeTLS takes no tls.Config, so to set TLS options you build an http.Server, fill its TLSConfig field, and call that server's ListenAndServeTLS method.

Two fields on the server's tls.Config: ClientCAs, an x509.CertPool of the CAs you trust to issue client certificates, and ClientAuth set to tls.RequireAndVerifyClientCert. ClientCAs alone asks for nothing and verifies nothing.

It turns off both checks a Go TLS client makes on the peer's certificate: the chain is no longer verified against any trust root, and the name in the certificate is no longer matched. Any certificate from anyone is accepted.

Go 1.24 made X25519MLKEM768 the preferred TLS 1.3 key exchange whenever tls.Config.CurvePreferences is left nil. It is hybrid: classical X25519 runs alongside post-quantum ML-KEM-768, so the session key holds if either half survives.

tls.Config.MinVersion is the oldest TLS protocol version Go will negotiate; older peers are refused during the handshake. Zero means the crypto/tls package default, TLS 1.2 in current Go. Set it explicitly, because that default has been raised across releases.

go.sum only pins the bytes your machine saw first, so a poisoned first download is pinned faithfully forever. The checksum database is a global append-only log of module hashes that the go command consults before writing a new go.sum line.

Anything. Package-level variable initializers and every init function in an imported package run before main, in every binary that pulls the package in, directly or transitively. You cannot import a package and skip them, so whatever they do is imposed on your program.

Because it matches called symbols, not module versions. Go's analysis builds a static call graph and reports an advisory only when a path in your program reaches one of the vulnerable functions. A manifest scan flags every affected version you require.

go mod verify recomputes hashes of the dependencies in your local module cache and compares them with the hashes recorded at download time. It proves nobody edited the cache since; it does not re-download, contact the checksum database, or find vulnerabilities.

go mod why -m <module> prints the shortest chain of package imports leading from your main module to that module. If nothing in your build imports it, the command reports that the main module does not need it.