feat: 增加商户消息加密密钥管理

server/utility/encrypt/aes_gcm_test.go

@@ -0,0 +1,34 @@
+package encrypt
+
+import (
+	"bytes"
+	"testing"
+)
+
+func TestAESGCMRoundTripAndRandomNonce(t *testing.T) {
+	key := bytes.Repeat([]byte{7}, AESGCMKeySize)
+	plain := []byte("message encryption key")
+	aad := []byte("tenant:1:version:1")
+	first, firstNonce, err := AESGCMEncrypt(plain, key, aad)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, secondNonce, err := AESGCMEncrypt(plain, key, aad)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Equal(firstNonce, secondNonce) || bytes.Equal(first, second) {
+		t.Fatal("repeated encryption must use a different nonce and ciphertext")
+	}
+	decoded, err := AESGCMDecrypt(first, firstNonce, key, aad)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(decoded, plain) {
+		t.Fatalf("unexpected plaintext: %q", decoded)
+	}
+	first[0] ^= 1
+	if _, err = AESGCMDecrypt(first, firstNonce, key, aad); err == nil {
+		t.Fatal("tampered ciphertext must fail authentication")
+	}
+}