From 2f94fedd3c1e81532dfaf5ae3f62f4401a3ea0e0 Mon Sep 17 00:00:00 2001
From: thaidn <thaidn@google.com>
Date: Thu, 21 Feb 2019 13:07:50 -0800
Subject: [PATCH] Golang refactoring: move internal, registry, format,
 primitiveset to core.

Also rename format to cryptofmt.

PiperOrigin-RevId: 235053667
GitOrigin-RevId: 220074d95b7e2baa628251b1be6945339b2911f4
---
 go/aead/BUILD.bazel                           | 12 +++++-----
 go/aead/aead.go                               |  2 +-
 go/aead/aead_factory.go                       |  8 +++----
 go/aead/aead_factory_test.go                  | 10 ++++-----
 go/aead/aead_key_templates_test.go            |  2 +-
 go/aead/aead_test.go                          |  2 +-
 go/aead/aes_ctr_hmac_aead_key_manager.go      |  2 +-
 go/aead/aes_ctr_hmac_aead_key_manager_test.go |  2 +-
 go/aead/aes_gcm_key_manager.go                |  2 +-
 go/aead/aes_gcm_key_manager_test.go           |  2 +-
 go/aead/chacha20poly1305_key_manager.go       |  2 +-
 go/aead/chacha20poly1305_key_manager_test.go  |  2 +-
 go/aead/kms_envelope_aead.go                  |  2 +-
 go/aead/kms_envelope_aead_key_manager.go      |  2 +-
 go/aead/xchacha20poly1305_key_manager.go      |  2 +-
 go/aead/xchacha20poly1305_key_manager_test.go |  2 +-
 go/{format => core/cryptofmt}/BUILD.bazel     |  6 ++---
 .../format.go => core/cryptofmt/cryptofmt.go} |  4 ++--
 .../cryptofmt/cryptofmt_test.go}              | 22 +++++++++----------
 go/{ => core}/internal/BUILD.bazel            |  2 +-
 go/{ => core}/internal/internal.go            |  0
 go/{ => core}/primitiveset/BUILD.bazel        |  6 ++---
 go/{ => core}/primitiveset/primitiveset.go    |  8 +++----
 .../primitiveset/primitiveset_test.go         | 10 ++++-----
 go/{ => core}/registry/BUILD.bazel            |  4 ++--
 go/{ => core}/registry/key_manager.go         |  0
 go/{ => core}/registry/kms_client.go          |  0
 go/{ => core}/registry/private_key_manager.go |  0
 go/{ => core}/registry/registry.go            |  2 +-
 go/{ => core}/registry/registry_test.go       |  2 +-
 go/daead/BUILD.bazel                          | 11 +++++-----
 go/daead/aes_siv_key_manager.go               |  2 +-
 go/daead/aes_siv_key_manager_test.go          |  2 +-
 go/daead/daead.go                             |  2 +-
 go/daead/daead_factory.go                     |  8 +++----
 go/daead/daead_factory_test.go                | 10 ++++-----
 go/daead/daead_test.go                        |  2 +-
 go/insecurecleartextkeyset/BUILD.bazel        |  4 ++--
 .../insecurecleartextkeyset.go                |  2 +-
 go/integration/gcpkms/BUILD.bazel             | 16 ++++++--------
 go/integration/gcpkms/gcp_kms_aead_test.go    |  2 +-
 go/integration/gcpkms/gcp_kms_client.go       |  2 +-
 go/keyset/BUILD.bazel                         |  7 +++---
 go/keyset/handle.go                           |  4 ++--
 go/keyset/keyset.go                           |  2 +-
 go/keyset/manager.go                          |  2 +-
 go/mac/BUILD.bazel                            | 10 ++++-----
 go/mac/hmac_key_manager.go                    |  2 +-
 go/mac/hmac_key_manager_test.go               |  2 +-
 go/mac/mac.go                                 |  2 +-
 go/mac/mac_factory.go                         |  8 +++----
 go/mac/mac_factory_test.go                    | 12 +++++-----
 go/mac/mac_test.go                            |  2 +-
 go/signature/BUILD.bazel                      | 10 ++++-----
 go/signature/ecdsa_signer_key_manager.go      |  2 +-
 go/signature/ecdsa_signer_key_manager_test.go |  2 +-
 go/signature/ecdsa_verifier_key_manager.go    |  2 +-
 .../ecdsa_verifier_key_manager_test.go        |  2 +-
 go/signature/ed25519_signer_key_manager.go    |  2 +-
 .../ed25519_signer_key_manager_test.go        |  2 +-
 go/signature/ed25519_verifier_key_manager.go  |  2 +-
 .../ed25519_verifier_key_manager_test.go      |  2 +-
 go/signature/signature.go                     |  2 +-
 go/signature/signature_test.go                |  2 +-
 go/signature/signer_factory.go                |  8 +++----
 go/signature/verifier_factory.go              | 10 ++++-----
 go/testkeyset/BUILD.bazel                     |  2 +-
 go/testkeyset/testkeyset.go                   |  2 +-
 go/testutil/BUILD.bazel                       |  2 +-
 go/testutil/testutil.go                       |  2 +-
 70 files changed, 145 insertions(+), 149 deletions(-)
 rename go/{format => core/cryptofmt}/BUILD.bazel (78%)
 rename go/{format/format.go => core/cryptofmt/cryptofmt.go} (94%)
 rename go/{format/format_test.go => core/cryptofmt/cryptofmt_test.go} (76%)
 rename go/{ => core}/internal/BUILD.bazel (86%)
 rename go/{ => core}/internal/internal.go (100%)
 rename go/{ => core}/primitiveset/BUILD.bazel (77%)
 rename go/{ => core}/primitiveset/primitiveset.go (92%)
 rename go/{ => core}/primitiveset/primitiveset_test.go (96%)
 rename go/{ => core}/registry/BUILD.bazel (90%)
 rename go/{ => core}/registry/key_manager.go (100%)
 rename go/{ => core}/registry/kms_client.go (100%)
 rename go/{ => core}/registry/private_key_manager.go (100%)
 rename go/{ => core}/registry/registry.go (97%)
 rename go/{ => core}/registry/registry_test.go (99%)

diff --git a/go/aead/BUILD.bazel b/go/aead/BUILD.bazel
index e480dc8e6..f08d9b47a 100644
--- a/go/aead/BUILD.bazel
+++ b/go/aead/BUILD.bazel
@@ -20,10 +20,10 @@ go_library(
     importpath = "github.com/google/tink/go/aead",
     visibility = ["//visibility:public"],
     deps = [
-        "//go/format:go_default_library",
+        "//go/core/cryptofmt:go_default_library",
+        "//go/core/primitiveset:go_default_library",
+        "//go/core/registry:go_default_library",
         "//go/keyset:go_default_library",
-        "//go/primitiveset:go_default_library",
-        "//go/registry:go_default_library",
         "//go/subtle/aead:go_default_library",
         "//go/subtle/mac:go_default_library",
         "//go/subtle/random:go_default_library",
@@ -45,9 +45,9 @@ go_library(
 go_test(
     name = "go_default_test",
     srcs = [
-        "aead_test.go",
         "aead_factory_test.go",
         "aead_key_templates_test.go",
+        "aead_test.go",
         "aes_ctr_hmac_aead_key_manager_test.go",
         "aes_gcm_key_manager_test.go",
         "chacha20poly1305_key_manager_test.go",
@@ -55,9 +55,9 @@ go_test(
     ],
     embed = [":go_default_library"],
     deps = [
-        "//go/format:go_default_library",
+        "//go/core/cryptofmt:go_default_library",
+        "//go/core/registry:go_default_library",
         "//go/keyset:go_default_library",
-        "//go/registry:go_default_library",
         "//go/subtle/aead:go_default_library",
         "//go/subtle/random:go_default_library",
         "//go/testkeyset:go_default_library",
diff --git a/go/aead/aead.go b/go/aead/aead.go
index bec30468f..262f7000a 100644
--- a/go/aead/aead.go
+++ b/go/aead/aead.go
@@ -18,7 +18,7 @@ package aead
 import (
 	"fmt"
 
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 )
 
 func init() {
diff --git a/go/aead/aead_factory.go b/go/aead/aead_factory.go
index 160d127e9..7bf30e96c 100644
--- a/go/aead/aead_factory.go
+++ b/go/aead/aead_factory.go
@@ -17,10 +17,10 @@ package aead
 import (
 	"fmt"
 
-	"github.com/google/tink/go/format"
+	"github.com/google/tink/go/core/cryptofmt"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/primitiveset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/primitiveset"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/tink"
 )
 
@@ -73,7 +73,7 @@ func (a *primitiveSet) Encrypt(pt, ad []byte) ([]byte, error) {
 // ciphertext is authenticated.
 func (a *primitiveSet) Decrypt(ct, ad []byte) ([]byte, error) {
 	// try non-raw keys
-	prefixSize := format.NonRawPrefixSize
+	prefixSize := cryptofmt.NonRawPrefixSize
 	if len(ct) > prefixSize {
 		prefix := ct[:prefixSize]
 		ctNoPrefix := ct[prefixSize:]
diff --git a/go/aead/aead_factory_test.go b/go/aead/aead_factory_test.go
index 818156ca1..5eeab4118 100644
--- a/go/aead/aead_factory_test.go
+++ b/go/aead/aead_factory_test.go
@@ -21,7 +21,7 @@ import (
 	"testing"
 
 	"github.com/google/tink/go/aead"
-	"github.com/google/tink/go/format"
+	"github.com/google/tink/go/core/cryptofmt"
 	"github.com/google/tink/go/subtle/random"
 	"github.com/google/tink/go/testkeyset"
 	"github.com/google/tink/go/testutil"
@@ -43,7 +43,7 @@ func TestFactoryMultipleKeys(t *testing.T) {
 	if err != nil {
 		t.Errorf("aead.New failed: %s", err)
 	}
-	expectedPrefix, _ := format.OutputPrefix(primaryKey)
+	expectedPrefix, _ := cryptofmt.OutputPrefix(primaryKey)
 	if err := validateAEADFactoryCipher(a, a, expectedPrefix); err != nil {
 		t.Errorf("invalid cipher: %s", err)
 	}
@@ -59,14 +59,14 @@ func TestFactoryMultipleKeys(t *testing.T) {
 	if err != nil {
 		t.Errorf("aead.New failed: %s", err)
 	}
-	if err := validateAEADFactoryCipher(a2, a, format.RawPrefix); err != nil {
+	if err := validateAEADFactoryCipher(a2, a, cryptofmt.RawPrefix); err != nil {
 		t.Errorf("invalid cipher: %s", err)
 	}
 
 	// encrypt with a random key not in the keyset, decrypt with the keyset should fail
 	keyset2 = testutil.NewTestAESGCMKeyset(tinkpb.OutputPrefixType_TINK)
 	primaryKey = keyset2.Key[0]
-	expectedPrefix, _ = format.OutputPrefix(primaryKey)
+	expectedPrefix, _ = cryptofmt.OutputPrefix(primaryKey)
 	keysetHandle2, _ = testkeyset.NewHandle(keyset2)
 	a2, err = aead.New(keysetHandle2)
 	if err != nil {
@@ -89,7 +89,7 @@ func TestFactoryRawKeyAsPrimary(t *testing.T) {
 	if err != nil {
 		t.Errorf("cannot get primitive from keyset handle: %s", err)
 	}
-	if err := validateAEADFactoryCipher(a, a, format.RawPrefix); err != nil {
+	if err := validateAEADFactoryCipher(a, a, cryptofmt.RawPrefix); err != nil {
 		t.Errorf("invalid cipher: %s", err)
 	}
 }
diff --git a/go/aead/aead_key_templates_test.go b/go/aead/aead_key_templates_test.go
index 22dcfbb0a..024b3acd8 100644
--- a/go/aead/aead_key_templates_test.go
+++ b/go/aead/aead_key_templates_test.go
@@ -22,7 +22,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"github.com/google/tink/go/aead"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/testutil"
 	"github.com/google/tink/go/tink"
 	ctrhmacpb "github.com/google/tink/proto/aes_ctr_hmac_aead_go_proto"
diff --git a/go/aead/aead_test.go b/go/aead/aead_test.go
index 366162a8b..f9ca3ae0e 100644
--- a/go/aead/aead_test.go
+++ b/go/aead/aead_test.go
@@ -17,7 +17,7 @@ package aead_test
 import (
 	"testing"
 
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/testutil"
 )
 
diff --git a/go/aead/aes_ctr_hmac_aead_key_manager.go b/go/aead/aes_ctr_hmac_aead_key_manager.go
index db47891a7..15c8068da 100644
--- a/go/aead/aes_ctr_hmac_aead_key_manager.go
+++ b/go/aead/aes_ctr_hmac_aead_key_manager.go
@@ -20,7 +20,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/aead"
 	"github.com/google/tink/go/subtle/mac"
 	"github.com/google/tink/go/subtle/random"
diff --git a/go/aead/aes_ctr_hmac_aead_key_manager_test.go b/go/aead/aes_ctr_hmac_aead_key_manager_test.go
index 12c19b684..89e6a8518 100644
--- a/go/aead/aes_ctr_hmac_aead_key_manager_test.go
+++ b/go/aead/aes_ctr_hmac_aead_key_manager_test.go
@@ -19,7 +19,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"github.com/google/tink/go/aead"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/testutil"
 	ctrhmacpb "github.com/google/tink/proto/aes_ctr_hmac_aead_go_proto"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
diff --git a/go/aead/aes_gcm_key_manager.go b/go/aead/aes_gcm_key_manager.go
index f53377daf..64ea4ce56 100644
--- a/go/aead/aes_gcm_key_manager.go
+++ b/go/aead/aes_gcm_key_manager.go
@@ -19,7 +19,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/aead"
 	"github.com/google/tink/go/subtle/random"
 	gcmpb "github.com/google/tink/proto/aes_gcm_go_proto"
diff --git a/go/aead/aes_gcm_key_manager_test.go b/go/aead/aes_gcm_key_manager_test.go
index 1b50a7dd7..c6fb92e28 100644
--- a/go/aead/aes_gcm_key_manager_test.go
+++ b/go/aead/aes_gcm_key_manager_test.go
@@ -20,7 +20,7 @@ import (
 	"testing"
 
 	"github.com/golang/protobuf/proto"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	subteAEAD "github.com/google/tink/go/subtle/aead"
 	"github.com/google/tink/go/subtle/random"
 	"github.com/google/tink/go/testutil"
diff --git a/go/aead/chacha20poly1305_key_manager.go b/go/aead/chacha20poly1305_key_manager.go
index 61478ddc2..3d4ba7250 100644
--- a/go/aead/chacha20poly1305_key_manager.go
+++ b/go/aead/chacha20poly1305_key_manager.go
@@ -20,7 +20,7 @@ import (
 	"github.com/golang/protobuf/proto"
 	"golang.org/x/crypto/chacha20poly1305"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/aead"
 	"github.com/google/tink/go/subtle/random"
 
diff --git a/go/aead/chacha20poly1305_key_manager_test.go b/go/aead/chacha20poly1305_key_manager_test.go
index 33b39b633..dd69e8ab4 100644
--- a/go/aead/chacha20poly1305_key_manager_test.go
+++ b/go/aead/chacha20poly1305_key_manager_test.go
@@ -21,7 +21,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"golang.org/x/crypto/chacha20poly1305"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/random"
 	"github.com/google/tink/go/testutil"
 
diff --git a/go/aead/kms_envelope_aead.go b/go/aead/kms_envelope_aead.go
index fba0a3f7b..17caf3b6f 100644
--- a/go/aead/kms_envelope_aead.go
+++ b/go/aead/kms_envelope_aead.go
@@ -20,7 +20,7 @@ import (
 	"errors"
 
 	"github.com/golang/protobuf/proto"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/tink"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
 )
diff --git a/go/aead/kms_envelope_aead_key_manager.go b/go/aead/kms_envelope_aead_key_manager.go
index da75bdeac..096c57f44 100644
--- a/go/aead/kms_envelope_aead_key_manager.go
+++ b/go/aead/kms_envelope_aead_key_manager.go
@@ -20,7 +20,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	kmsepb "github.com/google/tink/proto/kms_envelope_go_proto"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
 )
diff --git a/go/aead/xchacha20poly1305_key_manager.go b/go/aead/xchacha20poly1305_key_manager.go
index 0f2713584..9691b14cb 100644
--- a/go/aead/xchacha20poly1305_key_manager.go
+++ b/go/aead/xchacha20poly1305_key_manager.go
@@ -20,7 +20,7 @@ import (
 	"github.com/golang/protobuf/proto"
 	"golang.org/x/crypto/chacha20poly1305"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/aead"
 	"github.com/google/tink/go/subtle/random"
 
diff --git a/go/aead/xchacha20poly1305_key_manager_test.go b/go/aead/xchacha20poly1305_key_manager_test.go
index 30b97e286..810c90312 100644
--- a/go/aead/xchacha20poly1305_key_manager_test.go
+++ b/go/aead/xchacha20poly1305_key_manager_test.go
@@ -21,7 +21,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"golang.org/x/crypto/chacha20poly1305"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/random"
 	"github.com/google/tink/go/testutil"
 
diff --git a/go/format/BUILD.bazel b/go/core/cryptofmt/BUILD.bazel
similarity index 78%
rename from go/format/BUILD.bazel
rename to go/core/cryptofmt/BUILD.bazel
index 7d9827921..78a55455f 100644
--- a/go/format/BUILD.bazel
+++ b/go/core/cryptofmt/BUILD.bazel
@@ -6,8 +6,8 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
     name = "go_default_library",
-    srcs = ["format.go"],
-    importpath = "github.com/google/tink/go/format",
+    srcs = ["cryptofmt.go"],
+    importpath = "github.com/google/tink/go/core/cryptofmt",
     visibility = ["//visibility:public"],
     deps = [
         "//proto:tink_go_proto",
@@ -16,7 +16,7 @@ go_library(
 
 go_test(
     name = "go_default_test",
-    srcs = ["format_test.go"],
+    srcs = ["cryptofmt_test.go"],
     embed = [":go_default_library"],
     deps = [
         "//proto:tink_go_proto",
diff --git a/go/format/format.go b/go/core/cryptofmt/cryptofmt.go
similarity index 94%
rename from go/format/format.go
rename to go/core/cryptofmt/cryptofmt.go
index aab77f391..09f3c3845 100644
--- a/go/format/format.go
+++ b/go/core/cryptofmt/cryptofmt.go
@@ -12,8 +12,8 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-// Package format contains constants and convenience methods that deal with ciphertext and signature format.
-package format
+// Package cryptofmt provides constants and convenience methods that define the format of ciphertexts and signatures.
+package cryptofmt
 
 import (
 	"encoding/binary"
diff --git a/go/format/format_test.go b/go/core/cryptofmt/cryptofmt_test.go
similarity index 76%
rename from go/format/format_test.go
rename to go/core/cryptofmt/cryptofmt_test.go
index 995f6ca8a..b6fa6a5bb 100644
--- a/go/format/format_test.go
+++ b/go/core/cryptofmt/cryptofmt_test.go
@@ -12,12 +12,12 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-package format_test
+package cryptofmt_test
 
 import (
 	"testing"
 
-	"github.com/google/tink/go/format"
+	"github.com/google/tink/go/core/cryptofmt"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
 )
 
@@ -45,32 +45,32 @@ func TestOutputPrefix(t *testing.T) {
 		key.KeyId = test.keyID
 		// legacy type
 		key.OutputPrefixType = tinkpb.OutputPrefixType_LEGACY
-		prefix, err := format.OutputPrefix(key)
-		if err != nil || !validatePrefix(prefix, format.LegacyStartByte, test.result) {
+		prefix, err := cryptofmt.OutputPrefix(key)
+		if err != nil || !validatePrefix(prefix, cryptofmt.LegacyStartByte, test.result) {
 			t.Errorf("incorrect legacy prefix in test %d", i)
 		}
 		// crunchy type
 		key.OutputPrefixType = tinkpb.OutputPrefixType_CRUNCHY
-		prefix, err = format.OutputPrefix(key)
-		if err != nil || !validatePrefix(prefix, format.LegacyStartByte, test.result) {
+		prefix, err = cryptofmt.OutputPrefix(key)
+		if err != nil || !validatePrefix(prefix, cryptofmt.LegacyStartByte, test.result) {
 			t.Errorf("incorrect legacy prefix in test %d", i)
 		}
 		// tink type
 		key.OutputPrefixType = tinkpb.OutputPrefixType_TINK
-		prefix, err = format.OutputPrefix(key)
-		if err != nil || !validatePrefix(prefix, format.TinkStartByte, test.result) {
+		prefix, err = cryptofmt.OutputPrefix(key)
+		if err != nil || !validatePrefix(prefix, cryptofmt.TinkStartByte, test.result) {
 			t.Errorf("incorrect tink prefix in test %d", i)
 		}
 		// raw type
 		key.OutputPrefixType = tinkpb.OutputPrefixType_RAW
-		prefix, err = format.OutputPrefix(key)
-		if err != nil || prefix != format.RawPrefix {
+		prefix, err = cryptofmt.OutputPrefix(key)
+		if err != nil || prefix != cryptofmt.RawPrefix {
 			t.Errorf("incorrect raw prefix in test %d", i)
 		}
 	}
 	// unknown prefix type
 	key.OutputPrefixType = tinkpb.OutputPrefixType_UNKNOWN_PREFIX
-	if _, err := format.OutputPrefix(key); err == nil {
+	if _, err := cryptofmt.OutputPrefix(key); err == nil {
 		t.Errorf("expect an error when prefix type is unknown")
 	}
 }
diff --git a/go/internal/BUILD.bazel b/go/core/internal/BUILD.bazel
similarity index 86%
rename from go/internal/BUILD.bazel
rename to go/core/internal/BUILD.bazel
index b8f931d21..5caea708c 100644
--- a/go/internal/BUILD.bazel
+++ b/go/core/internal/BUILD.bazel
@@ -7,7 +7,7 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library")
 go_library(
     name = "go_default_library",
     srcs = ["internal.go"],
-    importpath = "github.com/google/tink/go/internal",
+    importpath = "github.com/google/tink/go/core/internal",
     visibility = [
         "//go/insecurecleartextkeyset:__pkg__",
         "//go/keyset:__pkg__",
diff --git a/go/internal/internal.go b/go/core/internal/internal.go
similarity index 100%
rename from go/internal/internal.go
rename to go/core/internal/internal.go
diff --git a/go/primitiveset/BUILD.bazel b/go/core/primitiveset/BUILD.bazel
similarity index 77%
rename from go/primitiveset/BUILD.bazel
rename to go/core/primitiveset/BUILD.bazel
index e20df65f1..904fe53d3 100644
--- a/go/primitiveset/BUILD.bazel
+++ b/go/core/primitiveset/BUILD.bazel
@@ -7,10 +7,10 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 go_library(
     name = "go_default_library",
     srcs = ["primitiveset.go"],
-    importpath = "github.com/google/tink/go/primitiveset",
+    importpath = "github.com/google/tink/go/core/primitiveset",
     visibility = ["//visibility:public"],
     deps = [
-        "//go/format:go_default_library",
+        "//go/core/cryptofmt:go_default_library",
         "//proto:tink_go_proto",
     ],
 )
@@ -20,7 +20,7 @@ go_test(
     srcs = ["primitiveset_test.go"],
     embed = [":go_default_library"],
     deps = [
-        "//go/format:go_default_library",
+        "//go/core/cryptofmt:go_default_library",
         "//go/testutil:go_default_library",
         "//proto:tink_go_proto",
     ],
diff --git a/go/primitiveset/primitiveset.go b/go/core/primitiveset/primitiveset.go
similarity index 92%
rename from go/primitiveset/primitiveset.go
rename to go/core/primitiveset/primitiveset.go
index 2c78d17f8..805c49f08 100644
--- a/go/primitiveset/primitiveset.go
+++ b/go/core/primitiveset/primitiveset.go
@@ -12,7 +12,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-// Package primitiveset is a container for a set of primitives (i.e., implementations of cryptographic primitives offered by Tink).
+// Package primitiveset provides a container for a set of cryptographic primitives.
 //
 // It provides also additional properties for the primitives it holds. In particular, one of the primitives in the set can be distinguished as "the primary" one.
 package primitiveset
@@ -20,7 +20,7 @@ package primitiveset
 import (
 	"fmt"
 
-	"github.com/google/tink/go/format"
+	"github.com/google/tink/go/core/cryptofmt"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
 )
 
@@ -69,7 +69,7 @@ func New() *PrimitiveSet {
 
 // RawEntries returns all primitives in the set that have RAW prefix.
 func (ps *PrimitiveSet) RawEntries() ([]*Entry, error) {
-	return ps.EntriesForPrefix(format.RawPrefix)
+	return ps.EntriesForPrefix(cryptofmt.RawPrefix)
 }
 
 // EntriesForPrefix returns all primitives in the set that have the given prefix.
@@ -86,7 +86,7 @@ func (ps *PrimitiveSet) Add(p interface{}, key *tinkpb.Keyset_Key) (*Entry, erro
 	if key == nil || p == nil {
 		return nil, fmt.Errorf("primitive_set: key and primitive must not be nil")
 	}
-	prefix, err := format.OutputPrefix(key)
+	prefix, err := cryptofmt.OutputPrefix(key)
 	if err != nil {
 		return nil, fmt.Errorf("primitive_set: %s", err)
 	}
diff --git a/go/primitiveset/primitiveset_test.go b/go/core/primitiveset/primitiveset_test.go
similarity index 96%
rename from go/primitiveset/primitiveset_test.go
rename to go/core/primitiveset/primitiveset_test.go
index ed0448fe4..bf6c30d8e 100644
--- a/go/primitiveset/primitiveset_test.go
+++ b/go/core/primitiveset/primitiveset_test.go
@@ -19,8 +19,8 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/google/tink/go/format"
-	"github.com/google/tink/go/primitiveset"
+	"github.com/google/tink/go/core/cryptofmt"
+	"github.com/google/tink/go/core/primitiveset"
 	"github.com/google/tink/go/testutil"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
 )
@@ -79,7 +79,7 @@ func TestPrimitiveSetBasic(t *testing.T) {
 	tinkMacs := []testutil.DummyMAC{macs[0], macs[5]}
 	tinkStatuses := []tinkpb.KeyStatusType{keys[0].Status, keys[5].Status}
 	tinkPrefixTypes := []tinkpb.OutputPrefixType{keys[0].OutputPrefixType, keys[5].OutputPrefixType}
-	prefix, _ := format.OutputPrefix(keys[0])
+	prefix, _ := cryptofmt.OutputPrefix(keys[0])
 	tinkEntries, err := ps.EntriesForPrefix(prefix)
 	if err != nil {
 		t.Errorf("unexpected error when getting primitives: %s", err)
@@ -91,7 +91,7 @@ func TestPrimitiveSetBasic(t *testing.T) {
 	tinkMacs = []testutil.DummyMAC{macs[2]}
 	tinkStatuses = []tinkpb.KeyStatusType{keys[2].Status}
 	tinkPrefixTypes = []tinkpb.OutputPrefixType{keys[2].OutputPrefixType}
-	prefix, _ = format.OutputPrefix(keys[2])
+	prefix, _ = cryptofmt.OutputPrefix(keys[2])
 	tinkEntries, err = ps.EntriesForPrefix(prefix)
 	if err != nil {
 		t.Errorf("unexpected error when getting tink primitives: %s", err)
@@ -103,7 +103,7 @@ func TestPrimitiveSetBasic(t *testing.T) {
 	legacyMacs := []testutil.DummyMAC{macs[1]}
 	legacyStatuses := []tinkpb.KeyStatusType{keys[1].Status}
 	legacyPrefixTypes := []tinkpb.OutputPrefixType{keys[1].OutputPrefixType}
-	legacyPrefix, _ := format.OutputPrefix(keys[1])
+	legacyPrefix, _ := cryptofmt.OutputPrefix(keys[1])
 	legacyEntries, err := ps.EntriesForPrefix(legacyPrefix)
 	if err != nil {
 		t.Errorf("unexpected error when getting legacy primitives: %s", err)
diff --git a/go/registry/BUILD.bazel b/go/core/registry/BUILD.bazel
similarity index 90%
rename from go/registry/BUILD.bazel
rename to go/core/registry/BUILD.bazel
index 8241efcaa..63e4d6c72 100644
--- a/go/registry/BUILD.bazel
+++ b/go/core/registry/BUILD.bazel
@@ -12,7 +12,7 @@ go_library(
         "private_key_manager.go",
         "registry.go",
     ],
-    importpath = "github.com/google/tink/go/registry",
+    importpath = "github.com/google/tink/go/core/registry",
     deps = [
         "//go/tink:go_default_library",
         "//proto:tink_go_proto",
@@ -26,8 +26,8 @@ go_test(
     srcs = ["registry_test.go"],
     deps = [
         "//go/aead:go_default_library",
+        "//go/core/registry:go_default_library",
         "//go/mac:go_default_library",
-        "//go/registry:go_default_library",
         "//go/subtle/mac:go_default_library",
         "//go/testutil:go_default_library",
         "//proto:aes_gcm_go_proto",
diff --git a/go/registry/key_manager.go b/go/core/registry/key_manager.go
similarity index 100%
rename from go/registry/key_manager.go
rename to go/core/registry/key_manager.go
diff --git a/go/registry/kms_client.go b/go/core/registry/kms_client.go
similarity index 100%
rename from go/registry/kms_client.go
rename to go/core/registry/kms_client.go
diff --git a/go/registry/private_key_manager.go b/go/core/registry/private_key_manager.go
similarity index 100%
rename from go/registry/private_key_manager.go
rename to go/core/registry/private_key_manager.go
diff --git a/go/registry/registry.go b/go/core/registry/registry.go
similarity index 97%
rename from go/registry/registry.go
rename to go/core/registry/registry.go
index f5f730638..e6a1ecd05 100644
--- a/go/registry/registry.go
+++ b/go/core/registry/registry.go
@@ -12,7 +12,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-// Package registry is a container that for each supported key type holds a corresponding KeyManager
+// Package registry provides a container that for each supported key type holds a corresponding KeyManager
 // object, which can generate new keys or instantiate the primitive corresponding to given key.
 //
 // Registry is initialized at startup, and is later used to instantiate primitives for given keys
diff --git a/go/registry/registry_test.go b/go/core/registry/registry_test.go
similarity index 99%
rename from go/registry/registry_test.go
rename to go/core/registry/registry_test.go
index 88e835e93..0fa6812c3 100644
--- a/go/registry/registry_test.go
+++ b/go/core/registry/registry_test.go
@@ -20,7 +20,7 @@ import (
 	"github.com/golang/protobuf/proto"
 	"github.com/google/tink/go/aead"
 	"github.com/google/tink/go/mac"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	subtleMac "github.com/google/tink/go/subtle/mac"
 	"github.com/google/tink/go/testutil"
 	gcmpb "github.com/google/tink/proto/aes_gcm_go_proto"
diff --git a/go/daead/BUILD.bazel b/go/daead/BUILD.bazel
index bc93b6b08..2bd822c91 100644
--- a/go/daead/BUILD.bazel
+++ b/go/daead/BUILD.bazel
@@ -14,10 +14,10 @@ go_library(
     importpath = "github.com/google/tink/go/daead",
     visibility = ["//visibility:public"],
     deps = [
-        "//go/format:go_default_library",
+        "//go/core/cryptofmt:go_default_library",
+        "//go/core/primitiveset:go_default_library",
+        "//go/core/registry:go_default_library",
         "//go/keyset:go_default_library",
-        "//go/registry:go_default_library",
-        "//go/primitiveset:go_default_library",
         "//go/subtle/daead:go_default_library",
         "//go/subtle/random:go_default_library",
         "//go/tink:go_default_library",
@@ -36,9 +36,9 @@ go_test(
     ],
     embed = [":go_default_library"],
     deps = [
-        "//go/format:go_default_library",
+        "//go/core/cryptofmt:go_default_library",
+        "//go/core/registry:go_default_library",
         "//go/keyset:go_default_library",
-        "//go/registry:go_default_library",
         "//go/subtle/daead:go_default_library",
         "//go/subtle/random:go_default_library",
         "//go/testkeyset:go_default_library",
@@ -49,4 +49,3 @@ go_test(
         "@com_github_golang_protobuf//proto:go_default_library",
     ],
 )
-
diff --git a/go/daead/aes_siv_key_manager.go b/go/daead/aes_siv_key_manager.go
index c7c4de900..ece752440 100644
--- a/go/daead/aes_siv_key_manager.go
+++ b/go/daead/aes_siv_key_manager.go
@@ -19,7 +19,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/daead"
 	"github.com/google/tink/go/subtle/random"
 
diff --git a/go/daead/aes_siv_key_manager_test.go b/go/daead/aes_siv_key_manager_test.go
index f07ec8f60..c1bcc742d 100644
--- a/go/daead/aes_siv_key_manager_test.go
+++ b/go/daead/aes_siv_key_manager_test.go
@@ -20,7 +20,7 @@ import (
 	"testing"
 
 	"github.com/golang/protobuf/proto"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/random"
 	"github.com/google/tink/go/testutil"
 
diff --git a/go/daead/daead.go b/go/daead/daead.go
index 4516ae2fe..2bc193a73 100644
--- a/go/daead/daead.go
+++ b/go/daead/daead.go
@@ -18,7 +18,7 @@ package daead
 import (
 	"fmt"
 
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 )
 
 func init() {
diff --git a/go/daead/daead_factory.go b/go/daead/daead_factory.go
index d0a306883..9fefd7a6f 100644
--- a/go/daead/daead_factory.go
+++ b/go/daead/daead_factory.go
@@ -17,10 +17,10 @@ package daead
 import (
 	"fmt"
 
-	"github.com/google/tink/go/format"
+	"github.com/google/tink/go/core/cryptofmt"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/primitiveset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/primitiveset"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/tink"
 )
 
@@ -70,7 +70,7 @@ func (d *primitiveSet) EncryptDeterministically(pt, aad []byte) ([]byte, error)
 // ciphertext is authenticated.
 func (d *primitiveSet) DecryptDeterministically(ct, aad []byte) ([]byte, error) {
 	// try non-raw keys
-	prefixSize := format.NonRawPrefixSize
+	prefixSize := cryptofmt.NonRawPrefixSize
 	if len(ct) > prefixSize {
 		prefix := ct[:prefixSize]
 		ctNoPrefix := ct[prefixSize:]
diff --git a/go/daead/daead_factory_test.go b/go/daead/daead_factory_test.go
index 2f2d4d7c3..8964dbf38 100644
--- a/go/daead/daead_factory_test.go
+++ b/go/daead/daead_factory_test.go
@@ -21,7 +21,7 @@ import (
 	"testing"
 
 	"github.com/google/tink/go/daead"
-	"github.com/google/tink/go/format"
+	"github.com/google/tink/go/core/cryptofmt"
 	"github.com/google/tink/go/subtle/random"
 	"github.com/google/tink/go/testkeyset"
 	"github.com/google/tink/go/testutil"
@@ -42,7 +42,7 @@ func TestFactoryMultipleKeys(t *testing.T) {
 	if err != nil {
 		t.Errorf("daead.New failed: %s", err)
 	}
-	expectedPrefix, _ := format.OutputPrefix(primaryKey)
+	expectedPrefix, _ := cryptofmt.OutputPrefix(primaryKey)
 	if err := validateDAEADFactoryCipher(d, d, expectedPrefix); err != nil {
 		t.Errorf("invalid cipher: %s", err)
 	}
@@ -59,7 +59,7 @@ func TestFactoryMultipleKeys(t *testing.T) {
 		if err != nil {
 			t.Errorf("daead.New failed: %s", err)
 		}
-		if err := validateDAEADFactoryCipher(d2, d, format.RawPrefix); err != nil {
+		if err := validateDAEADFactoryCipher(d2, d, cryptofmt.RawPrefix); err != nil {
 			t.Errorf("invalid cipher: %s", err)
 		}
 	}
@@ -76,7 +76,7 @@ func TestFactoryMultipleKeys(t *testing.T) {
 		if err != nil {
 			t.Errorf("daead.New failed: %s", err)
 		}
-		expectedPrefix, _ = format.OutputPrefix(newPK)
+		expectedPrefix, _ = cryptofmt.OutputPrefix(newPK)
 		err = validateDAEADFactoryCipher(d2, d, expectedPrefix)
 		if err == nil || !strings.Contains(err.Error(), "decryption failed") {
 			t.Errorf("expect decryption to fail with random key: %s", err)
@@ -95,7 +95,7 @@ func TestFactoryRawKeyAsPrimary(t *testing.T) {
 	if err != nil {
 		t.Errorf("cannot get primitive from keyset handle: %s", err)
 	}
-	if err := validateDAEADFactoryCipher(d, d, format.RawPrefix); err != nil {
+	if err := validateDAEADFactoryCipher(d, d, cryptofmt.RawPrefix); err != nil {
 		t.Errorf("invalid cipher: %s", err)
 	}
 }
diff --git a/go/daead/daead_test.go b/go/daead/daead_test.go
index db4279e52..4c6b852e7 100644
--- a/go/daead/daead_test.go
+++ b/go/daead/daead_test.go
@@ -17,7 +17,7 @@ package daead_test
 import (
 	"testing"
 
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/testutil"
 )
 
diff --git a/go/insecurecleartextkeyset/BUILD.bazel b/go/insecurecleartextkeyset/BUILD.bazel
index 2edcfcb55..a93c1da39 100644
--- a/go/insecurecleartextkeyset/BUILD.bazel
+++ b/go/insecurecleartextkeyset/BUILD.bazel
@@ -9,7 +9,7 @@ go_library(
     srcs = ["insecurecleartextkeyset.go"],
     importpath = "github.com/google/tink/go/insecurecleartextkeyset",
     deps = [
-        "//go/internal:go_default_library",
+        "//go/core/internal:go_default_library",
         "//go/keyset:go_default_library",
         "//proto:tink_go_proto",
     ],
@@ -20,9 +20,9 @@ go_test(
     srcs = ["insecurecleartextkeyset_test.go"],
     embed = [":go_default_library"],
     deps = [
+        "//go/keyset:go_default_library",
         "//go/mac:go_default_library",
         "//go/testutil:go_default_library",
-        "//go/keyset:go_default_library",
         "//proto:tink_go_proto",
         "@com_github_golang_protobuf//proto:go_default_library",
     ],
diff --git a/go/insecurecleartextkeyset/insecurecleartextkeyset.go b/go/insecurecleartextkeyset/insecurecleartextkeyset.go
index 52197bb8c..d73348614 100644
--- a/go/insecurecleartextkeyset/insecurecleartextkeyset.go
+++ b/go/insecurecleartextkeyset/insecurecleartextkeyset.go
@@ -21,7 +21,7 @@ package insecurecleartextkeyset
 import (
 	"errors"
 
-	"github.com/google/tink/go/internal"
+	"github.com/google/tink/go/core/internal"
 	"github.com/google/tink/go/keyset"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
 )
diff --git a/go/integration/gcpkms/BUILD.bazel b/go/integration/gcpkms/BUILD.bazel
index f043ecad2..1a16a2797 100644
--- a/go/integration/gcpkms/BUILD.bazel
+++ b/go/integration/gcpkms/BUILD.bazel
@@ -2,10 +2,8 @@ package(default_visibility = ["//tools/build_defs:internal_pkg"])
 
 licenses(["notice"])  # Apache 2.0 # keep
 
-
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
-
 go_library(
     name = "go_default_library",
     srcs = [
@@ -15,11 +13,11 @@ go_library(
     importpath = "github.com/google/tink/go/integration/gcpkms",
     visibility = ["//visibility:public"],
     deps = [
+        "//go/core/registry:go_default_library",
+        "//go/tink:go_default_library",
         "@org_golang_google_api//cloudkms/v1:go_default_library",
         "@org_golang_x_oauth2//:go_default_library",
         "@org_golang_x_oauth2//google:go_default_library",
-        "//go/tink:go_default_library",
-        "//go/registry:go_default_library",
     ],
 )
 
@@ -27,17 +25,17 @@ go_test(
     name = "go_default_test",
     srcs = ["gcp_kms_aead_test.go"],
     data = [
-        "@google_root_pem//file", #keep
         "//testdata:credentials",
         "//testdata:ecies_keysets",
-        "@wycheproof//testvectors:all", #keep
+        "@google_root_pem//file",  #keep
+        "@wycheproof//testvectors:all",  #keep
     ],
-    embed = [":go_default_library",],
+    embed = [":go_default_library"],
     deps = [
         "//go/aead:go_default_library",
+        "//go/core/registry:go_default_library",
+        "//go/keyset:go_default_library",
         "//go/subtle/random:go_default_library",
         "//go/tink:go_default_library",
-        "//go/keyset:go_default_library",
-        "//go/registry:go_default_library",
     ],
 )
diff --git a/go/integration/gcpkms/gcp_kms_aead_test.go b/go/integration/gcpkms/gcp_kms_aead_test.go
index 0e98c6815..e527be9a6 100644
--- a/go/integration/gcpkms/gcp_kms_aead_test.go
+++ b/go/integration/gcpkms/gcp_kms_aead_test.go
@@ -25,7 +25,7 @@ import (
 	// TEST_SRCDIR to read the roots.pem
 	"github.com/google/tink/go/aead"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/random"
 	"github.com/google/tink/go/tink"
 )
diff --git a/go/integration/gcpkms/gcp_kms_client.go b/go/integration/gcpkms/gcp_kms_client.go
index 8866b0603..560f39abb 100644
--- a/go/integration/gcpkms/gcp_kms_client.go
+++ b/go/integration/gcpkms/gcp_kms_client.go
@@ -26,7 +26,7 @@ import (
 	"google.golang.org/api/cloudkms/v1"
 	"golang.org/x/oauth2/google"
 	"golang.org/x/oauth2"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/tink"
 )
 
diff --git a/go/keyset/BUILD.bazel b/go/keyset/BUILD.bazel
index 0c76b99b6..ac603db75 100644
--- a/go/keyset/BUILD.bazel
+++ b/go/keyset/BUILD.bazel
@@ -18,9 +18,9 @@ go_library(
     ],
     importpath = "github.com/google/tink/go/keyset",
     deps = [
-        "//go/internal:go_default_library",
-        "//go/primitiveset:go_default_library",
-        "//go/registry:go_default_library",
+        "//go/core/internal:go_default_library",
+        "//go/core/primitiveset:go_default_library",
+        "//go/core/registry:go_default_library",
         "//go/subtle/random:go_default_library",
         "//go/tink:go_default_library",
         "//proto:tink_go_proto",
@@ -46,4 +46,3 @@ go_test(
         "@com_github_golang_protobuf//proto:go_default_library",
     ],
 )
-
diff --git a/go/keyset/handle.go b/go/keyset/handle.go
index 125d8851b..64d68a91b 100644
--- a/go/keyset/handle.go
+++ b/go/keyset/handle.go
@@ -20,8 +20,8 @@ import (
 
 	"github.com/golang/protobuf/proto"
 
-	"github.com/google/tink/go/primitiveset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/primitiveset"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/tink"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
 )
diff --git a/go/keyset/keyset.go b/go/keyset/keyset.go
index a77cea857..c99094861 100644
--- a/go/keyset/keyset.go
+++ b/go/keyset/keyset.go
@@ -16,7 +16,7 @@
 package keyset
 
 import (
-	"github.com/google/tink/go/internal"
+	"github.com/google/tink/go/core/internal"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
 )
 
diff --git a/go/keyset/manager.go b/go/keyset/manager.go
index bca390252..bbe222aff 100644
--- a/go/keyset/manager.go
+++ b/go/keyset/manager.go
@@ -17,7 +17,7 @@ package keyset
 import (
 	"fmt"
 
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/random"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
 )
diff --git a/go/mac/BUILD.bazel b/go/mac/BUILD.bazel
index 9edc52c9c..a0030a2a0 100644
--- a/go/mac/BUILD.bazel
+++ b/go/mac/BUILD.bazel
@@ -15,10 +15,10 @@ go_library(
     importpath = "github.com/google/tink/go/mac",
     visibility = ["//visibility:public"],
     deps = [
-        "//go/format:go_default_library",
+        "//go/core/cryptofmt:go_default_library",
+        "//go/core/primitiveset:go_default_library",
+        "//go/core/registry:go_default_library",
         "//go/keyset:go_default_library",
-        "//go/primitiveset:go_default_library",
-        "//go/registry:go_default_library",
         "//go/subtle/mac:go_default_library",
         "//go/subtle/random:go_default_library",
         "//go/tink:go_default_library",
@@ -39,8 +39,8 @@ go_test(
     ],
     embed = [":go_default_library"],
     deps = [
-        "//go/format:go_default_library",
-        "//go/registry:go_default_library",
+        "//go/core/cryptofmt:go_default_library",
+        "//go/core/registry:go_default_library",
         "//go/subtle:go_default_library",
         "//go/subtle/mac:go_default_library",
         "//go/subtle/random:go_default_library",
diff --git a/go/mac/hmac_key_manager.go b/go/mac/hmac_key_manager.go
index aff45a126..b3318453f 100644
--- a/go/mac/hmac_key_manager.go
+++ b/go/mac/hmac_key_manager.go
@@ -20,7 +20,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/mac"
 	"github.com/google/tink/go/subtle/random"
 	commonpb "github.com/google/tink/proto/common_go_proto"
diff --git a/go/mac/hmac_key_manager_test.go b/go/mac/hmac_key_manager_test.go
index e2609d0b7..7bb713397 100644
--- a/go/mac/hmac_key_manager_test.go
+++ b/go/mac/hmac_key_manager_test.go
@@ -21,7 +21,7 @@ import (
 	"testing"
 
 	"github.com/golang/protobuf/proto"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	subtleMac "github.com/google/tink/go/subtle/mac"
 	"github.com/google/tink/go/subtle/random"
 	"github.com/google/tink/go/subtle"
diff --git a/go/mac/mac.go b/go/mac/mac.go
index d6a548739..afc4cb6df 100644
--- a/go/mac/mac.go
+++ b/go/mac/mac.go
@@ -18,7 +18,7 @@ package mac
 import (
 	"fmt"
 
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 )
 
 func init() {
diff --git a/go/mac/mac_factory.go b/go/mac/mac_factory.go
index f8b337761..5285b0405 100644
--- a/go/mac/mac_factory.go
+++ b/go/mac/mac_factory.go
@@ -17,10 +17,10 @@ package mac
 import (
 	"fmt"
 
-	"github.com/google/tink/go/format"
+	"github.com/google/tink/go/core/cryptofmt"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/primitiveset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/primitiveset"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/tink"
 )
 
@@ -75,7 +75,7 @@ var errInvalidMAC = fmt.Errorf("mac_factory: invalid mac")
 func (m *primitiveSet) VerifyMAC(mac, data []byte) error {
 	// This also rejects raw MAC with size of 4 bytes or fewer. Those MACs are
 	// clearly insecure, thus should be discouraged.
-	prefixSize := format.NonRawPrefixSize
+	prefixSize := cryptofmt.NonRawPrefixSize
 	if len(mac) <= prefixSize {
 		return errInvalidMAC
 	}
diff --git a/go/mac/mac_factory_test.go b/go/mac/mac_factory_test.go
index 243dc9771..d56a92dbc 100644
--- a/go/mac/mac_factory_test.go
+++ b/go/mac/mac_factory_test.go
@@ -19,7 +19,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/tink/go/format"
+	"github.com/google/tink/go/core/cryptofmt"
 	"github.com/google/tink/go/mac"
 	"github.com/google/tink/go/testkeyset"
 	"github.com/google/tink/go/testutil"
@@ -44,9 +44,9 @@ func TestFactoryMultipleKeys(t *testing.T) {
 	if err != nil {
 		t.Errorf("mac.New failed: %s", err)
 	}
-	expectedPrefix, err := format.OutputPrefix(primaryKey)
+	expectedPrefix, err := cryptofmt.OutputPrefix(primaryKey)
 	if err != nil {
-		t.Errorf("format.OutputPrefix failed: %s", err)
+		t.Errorf("cryptofmt.OutputPrefix failed: %s", err)
 	}
 
 	if err := verifyMacPrimitive(p, p, expectedPrefix, tagSize); err != nil {
@@ -68,14 +68,14 @@ func TestFactoryMultipleKeys(t *testing.T) {
 	if err != nil {
 		t.Errorf("mac.New failed: %s", err)
 	}
-	if err := verifyMacPrimitive(p2, p, format.RawPrefix, tagSize); err != nil {
+	if err := verifyMacPrimitive(p2, p, cryptofmt.RawPrefix, tagSize); err != nil {
 		t.Errorf("invalid primitive: %s", err)
 	}
 
 	// mac with a random key not in the keyset, verify with the keyset should fail
 	keyset2 = testutil.NewTestHMACKeyset(tagSize, tinkpb.OutputPrefixType_TINK)
 	primaryKey = keyset2.Key[0]
-	expectedPrefix, _ = format.OutputPrefix(primaryKey)
+	expectedPrefix, _ = cryptofmt.OutputPrefix(primaryKey)
 	keysetHandle2, err = testkeyset.NewHandle(keyset2)
 	if err != nil {
 		t.Errorf("testkeyset.NewHandle failed: %s", err)
@@ -106,7 +106,7 @@ func TestFactoryRawKey(t *testing.T) {
 	if err != nil {
 		t.Errorf("mac.New failed: %s", err)
 	}
-	if err := verifyMacPrimitive(p, p, format.RawPrefix, tagSize); err != nil {
+	if err := verifyMacPrimitive(p, p, cryptofmt.RawPrefix, tagSize); err != nil {
 		t.Errorf("invalid primitive: %s", err)
 	}
 }
diff --git a/go/mac/mac_test.go b/go/mac/mac_test.go
index 816e6cef0..9b9d5814b 100644
--- a/go/mac/mac_test.go
+++ b/go/mac/mac_test.go
@@ -17,7 +17,7 @@ package mac_test
 import (
 	"testing"
 
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/testutil"
 )
 
diff --git a/go/signature/BUILD.bazel b/go/signature/BUILD.bazel
index a26c81f4b..b6c7d77b1 100644
--- a/go/signature/BUILD.bazel
+++ b/go/signature/BUILD.bazel
@@ -20,10 +20,10 @@ go_library(
     importpath = "github.com/google/tink/go/signature",
     visibility = ["//visibility:public"],
     deps = [
-        "//go/format:go_default_library",
+        "//go/core/cryptofmt:go_default_library",
+        "//go/core/primitiveset:go_default_library",
+        "//go/core/registry:go_default_library",
         "//go/keyset:go_default_library",
-        "//go/primitiveset:go_default_library",
-        "//go/registry:go_default_library",
         "//go/subtle:go_default_library",
         "//go/subtle/signature:go_default_library",
         "//go/tink:go_default_library",
@@ -49,8 +49,8 @@ go_test(
     ],
     embed = [":go_default_library"],
     deps = [
-        "//go/format:go_default_library",
-        "//go/registry:go_default_library",
+        "//go/core/cryptofmt:go_default_library",
+        "//go/core/registry:go_default_library",
         "//go/subtle/random:go_default_library",
         "//go/subtle/signature:go_default_library",
         "//go/testkeyset:go_default_library",
diff --git a/go/signature/ecdsa_signer_key_manager.go b/go/signature/ecdsa_signer_key_manager.go
index 5d351fea5..aae2f4c3a 100644
--- a/go/signature/ecdsa_signer_key_manager.go
+++ b/go/signature/ecdsa_signer_key_manager.go
@@ -22,7 +22,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	subtleSignature "github.com/google/tink/go/subtle/signature"
 	"github.com/google/tink/go/subtle"
 	commonpb "github.com/google/tink/proto/common_go_proto"
diff --git a/go/signature/ecdsa_signer_key_manager_test.go b/go/signature/ecdsa_signer_key_manager_test.go
index d8bcbbce5..1ccbb6033 100644
--- a/go/signature/ecdsa_signer_key_manager_test.go
+++ b/go/signature/ecdsa_signer_key_manager_test.go
@@ -20,7 +20,7 @@ import (
 	"testing"
 
 	"github.com/golang/protobuf/proto"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/random"
 	"github.com/google/tink/go/subtle/signature"
 	"github.com/google/tink/go/testutil"
diff --git a/go/signature/ecdsa_verifier_key_manager.go b/go/signature/ecdsa_verifier_key_manager.go
index 6e3c50606..ce6323299 100644
--- a/go/signature/ecdsa_verifier_key_manager.go
+++ b/go/signature/ecdsa_verifier_key_manager.go
@@ -19,7 +19,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	subtleSignature "github.com/google/tink/go/subtle/signature"
 	ecdsapb "github.com/google/tink/proto/ecdsa_go_proto"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
diff --git a/go/signature/ecdsa_verifier_key_manager_test.go b/go/signature/ecdsa_verifier_key_manager_test.go
index a9fe73eee..fb7cd0826 100644
--- a/go/signature/ecdsa_verifier_key_manager_test.go
+++ b/go/signature/ecdsa_verifier_key_manager_test.go
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	"github.com/golang/protobuf/proto"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/signature"
 	"github.com/google/tink/go/testutil"
 	commonpb "github.com/google/tink/proto/common_go_proto"
diff --git a/go/signature/ed25519_signer_key_manager.go b/go/signature/ed25519_signer_key_manager.go
index 5c4a9a2b3..bd4cc0319 100644
--- a/go/signature/ed25519_signer_key_manager.go
+++ b/go/signature/ed25519_signer_key_manager.go
@@ -23,7 +23,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	subtleSignature "github.com/google/tink/go/subtle/signature"
 	ed25519pb "github.com/google/tink/proto/ed25519_go_proto"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
diff --git a/go/signature/ed25519_signer_key_manager_test.go b/go/signature/ed25519_signer_key_manager_test.go
index 3b96dfb81..89fff3e1a 100644
--- a/go/signature/ed25519_signer_key_manager_test.go
+++ b/go/signature/ed25519_signer_key_manager_test.go
@@ -19,7 +19,7 @@ import (
 	"testing"
 
 	"github.com/golang/protobuf/proto"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/random"
 	"github.com/google/tink/go/subtle/signature"
 	"github.com/google/tink/go/testutil"
diff --git a/go/signature/ed25519_verifier_key_manager.go b/go/signature/ed25519_verifier_key_manager.go
index 3a324ef3a..363820b0c 100644
--- a/go/signature/ed25519_verifier_key_manager.go
+++ b/go/signature/ed25519_verifier_key_manager.go
@@ -20,7 +20,7 @@ import (
 	"github.com/golang/protobuf/proto"
 	"golang.org/x/crypto/ed25519"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	subtleSignature "github.com/google/tink/go/subtle/signature"
 	ed25519pb "github.com/google/tink/proto/ed25519_go_proto"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
diff --git a/go/signature/ed25519_verifier_key_manager_test.go b/go/signature/ed25519_verifier_key_manager_test.go
index d2620c193..4bfff9d5a 100644
--- a/go/signature/ed25519_verifier_key_manager_test.go
+++ b/go/signature/ed25519_verifier_key_manager_test.go
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	"github.com/golang/protobuf/proto"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/signature"
 	"github.com/google/tink/go/testutil"
 )
diff --git a/go/signature/signature.go b/go/signature/signature.go
index 47059ac34..3cd905eb0 100644
--- a/go/signature/signature.go
+++ b/go/signature/signature.go
@@ -18,7 +18,7 @@ package signature
 import (
 	"fmt"
 
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 )
 
 func init() {
diff --git a/go/signature/signature_test.go b/go/signature/signature_test.go
index ddf1d60fa..cc8cdbc46 100644
--- a/go/signature/signature_test.go
+++ b/go/signature/signature_test.go
@@ -17,7 +17,7 @@ package signature_test
 import (
 	"testing"
 
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/testutil"
 )
 
diff --git a/go/signature/signer_factory.go b/go/signature/signer_factory.go
index 5d4cb5337..04a4de106 100644
--- a/go/signature/signer_factory.go
+++ b/go/signature/signer_factory.go
@@ -17,10 +17,10 @@ package signature
 import (
 	"fmt"
 
-	"github.com/google/tink/go/format"
+	"github.com/google/tink/go/core/cryptofmt"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/primitiveset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/primitiveset"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/tink"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
 )
@@ -61,7 +61,7 @@ func (s *signerSet) Sign(data []byte) ([]byte, error) {
 	var signedData []byte
 	if primary.PrefixType == tinkpb.OutputPrefixType_LEGACY {
 		signedData = append(signedData, data...)
-		signedData = append(signedData, format.LegacyStartByte)
+		signedData = append(signedData, cryptofmt.LegacyStartByte)
 	} else {
 		signedData = data
 	}
diff --git a/go/signature/verifier_factory.go b/go/signature/verifier_factory.go
index 837547996..27c849867 100644
--- a/go/signature/verifier_factory.go
+++ b/go/signature/verifier_factory.go
@@ -18,10 +18,10 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/google/tink/go/format"
+	"github.com/google/tink/go/core/cryptofmt"
 	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/primitiveset"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/primitiveset"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/tink"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
 )
@@ -60,7 +60,7 @@ var errInvalidSignature = errors.New("verifier_factory: invalid signature")
 
 // Verify checks whether the given signature is a valid signature of the given data.
 func (v *verifierSet) Verify(signature, data []byte) error {
-	prefixSize := format.NonRawPrefixSize
+	prefixSize := cryptofmt.NonRawPrefixSize
 	if len(signature) < prefixSize {
 		return errInvalidSignature
 	}
@@ -73,7 +73,7 @@ func (v *verifierSet) Verify(signature, data []byte) error {
 			var signedData []byte
 			if entries[i].PrefixType == tinkpb.OutputPrefixType_LEGACY {
 				signedData = append(signedData, data...)
-				signedData = append(signedData, format.LegacyStartByte)
+				signedData = append(signedData, cryptofmt.LegacyStartByte)
 			} else {
 				signedData = data
 			}
diff --git a/go/testkeyset/BUILD.bazel b/go/testkeyset/BUILD.bazel
index b11683aea..1d100b9a0 100644
--- a/go/testkeyset/BUILD.bazel
+++ b/go/testkeyset/BUILD.bazel
@@ -10,7 +10,7 @@ go_library(
     srcs = ["testkeyset.go"],
     importpath = "github.com/google/tink/go/testkeyset",
     deps = [
-        "//go/internal:go_default_library",
+        "//go/core/internal:go_default_library",
         "//go/keyset:go_default_library",
         "//proto:tink_go_proto",
         "@com_github_golang_protobuf//proto:go_default_library",
diff --git a/go/testkeyset/testkeyset.go b/go/testkeyset/testkeyset.go
index 6d8fdcf41..cbae28bce 100644
--- a/go/testkeyset/testkeyset.go
+++ b/go/testkeyset/testkeyset.go
@@ -18,7 +18,7 @@ package testkeyset
 import (
 	"errors"
 
-	"github.com/google/tink/go/internal"
+	"github.com/google/tink/go/core/internal"
 	"github.com/google/tink/go/keyset"
 	tinkpb "github.com/google/tink/proto/tink_go_proto"
 )
diff --git a/go/testutil/BUILD.bazel b/go/testutil/BUILD.bazel
index e8872d0fe..69bb580e3 100644
--- a/go/testutil/BUILD.bazel
+++ b/go/testutil/BUILD.bazel
@@ -10,10 +10,10 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//go/aead:go_default_library",
+        "//go/core/registry:go_default_library",
         "//go/daead:go_default_library",
         "//go/keyset:go_default_library",
         "//go/mac:go_default_library",
-        "//go/registry:go_default_library",
         "//go/signature:go_default_library",
         "//go/subtle:go_default_library",
         "//go/subtle/daead:go_default_library",
diff --git a/go/testutil/testutil.go b/go/testutil/testutil.go
index 9a9832447..11961c3ae 100644
--- a/go/testutil/testutil.go
+++ b/go/testutil/testutil.go
@@ -24,7 +24,7 @@ import (
 	"golang.org/x/crypto/ed25519"
 	"github.com/google/tink/go/keyset"
 	"github.com/google/tink/go/mac"
-	"github.com/google/tink/go/registry"
+	"github.com/google/tink/go/core/registry"
 	"github.com/google/tink/go/subtle/random"
 	"github.com/google/tink/go/subtle"
 	"github.com/google/tink/go/tink"
-- 
GitLab