From 111d70596a47939729a26bbd97c3bd50f0713e26 Mon Sep 17 00:00:00 2001
From: Randall Winkhart <idgr@tutanota.com>
Date: Sat, 3 May 2025 18:42:55 -0400
Subject: [PATCH] Give error handling control to importing applications

---
 example.go         | 16 ++++++++++++++--
 wrappers/aes.go    | 16 +++++++---------
 wrappers/chacha.go | 16 +++++++---------
 3 files changed, 28 insertions(+), 20 deletions(-)

diff --git a/example.go b/example.go
index 6d0c12b..3f6fffe 100644
--- a/example.go
+++ b/example.go
@@ -28,6 +28,10 @@ import (
 //     Store:
 //         Hash of passphrase (prevent user from losing data by accidentally providing incorrect passphrase during encryption)
 // 		   Order of algorithms (determined randomly at keyfile generation)
+// Security:
+// 	   Play with nonce sizes and Argon2 parameters to find the best speed-security balance
+// Standalone cmd:
+//     Usable as symmetric-only GPG replacement
 
 func main() {
 	switch len(os.Args) {
@@ -37,8 +41,16 @@ func main() {
 	case 3:
 		// decrypt file
 		encBytes, _ := os.ReadFile("encrypted-example.txt")
-		decBytes := wrappers.DecryptCha(encBytes, []byte(os.Args[2]))
-		decBytes = wrappers.DecryptAES(decBytes, []byte(os.Args[2]))
+		decBytes, err := wrappers.DecryptCha(encBytes, []byte(os.Args[2]))
+		if err != nil {
+			fmt.Println(err)
+			return
+		}
+		decBytes, err = wrappers.DecryptAES(decBytes, []byte(os.Args[2]))
+		if err != nil {
+			fmt.Println(err)
+			return
+		}
 		fmt.Println(string(decBytes))
 	case 4:
 		// encrypt data (from cli args)
diff --git a/wrappers/aes.go b/wrappers/aes.go
index aa4bafa..c91d6d4 100644
--- a/wrappers/aes.go
+++ b/wrappers/aes.go
@@ -4,7 +4,7 @@ import (
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/rand"
-	"fmt"
+	"errors"
 	"io"
 )
 
@@ -12,7 +12,7 @@ const (
 	nonceSizeAES = 12 // GCM standard nonce size is 12 bytes
 )
 
-// EncryptAES encrypts data using AES-256-GCM
+// EncryptAES encrypts data using AES-256-GCM.
 func EncryptAES(data []byte, passphrase []byte) []byte {
 	// generate a random salt
 	salt := make([]byte, saltSize)
@@ -43,11 +43,10 @@ func EncryptAES(data []byte, passphrase []byte) []byte {
 	return result
 }
 
-// DecryptAES decrypts data using AES-256-GCM
-func DecryptAES(encryptedData []byte, passphrase []byte) []byte {
+// DecryptAES decrypts data using AES256-GCM.
+func DecryptAES(encryptedData []byte, passphrase []byte) ([]byte, error) {
 	if len(encryptedData) < saltSize+nonceSizeAES {
-		fmt.Println("Encrypted data is too short")
-		return nil
+		return nil, errors.New("AES256-GCM: Encrypted data is too short")
 	}
 
 	// extract salt, nonce, and ciphertext
@@ -67,9 +66,8 @@ func DecryptAES(encryptedData []byte, passphrase []byte) []byte {
 	// decrypt the data
 	plaintext, err := aesGCM.Open(nil, nonce, ciphertext, nil)
 	if err != nil {
-		fmt.Printf("Decryption failed (possibly wrong passphrase): %s", err.Error())
-		return nil
+		return nil, err
 	}
 
-	return plaintext
+	return plaintext, nil
 }
diff --git a/wrappers/chacha.go b/wrappers/chacha.go
index bdb4012..d6cd4ad 100644
--- a/wrappers/chacha.go
+++ b/wrappers/chacha.go
@@ -2,7 +2,7 @@ package wrappers
 
 import (
 	"crypto/rand"
-	"fmt"
+	"errors"
 	"io"
 
 	"golang.org/x/crypto/chacha20poly1305"
@@ -12,7 +12,7 @@ const (
 	nonceSizeCha = chacha20poly1305.NonceSizeX
 )
 
-// EncryptCha encrypts data using ChaCha20-Poly1305
+// EncryptCha encrypts data using ChaCha20-Poly1305.
 func EncryptCha(data []byte, passphrase []byte) []byte {
 	// generate a random salt
 	salt := make([]byte, saltSize)
@@ -41,11 +41,10 @@ func EncryptCha(data []byte, passphrase []byte) []byte {
 	return result
 }
 
-// DecryptCha decrypts data using ChaCha20-Poly1305
-func DecryptCha(encryptedData []byte, passphrase []byte) []byte {
+// DecryptCha decrypts data using ChaCha20-Poly1305.
+func DecryptCha(encryptedData []byte, passphrase []byte) ([]byte, error) {
 	if len(encryptedData) < saltSize+nonceSizeCha {
-		fmt.Println("Encrypted data is too short")
-		return nil
+		return nil, errors.New("ChaCha20-Poly1305: Encrypted data is too short")
 	}
 
 	// extract salt, nonce, and ciphertext
@@ -62,9 +61,8 @@ func DecryptCha(encryptedData []byte, passphrase []byte) []byte {
 	// decrypt the data
 	plaintext, err := stream.Open(nil, nonce, ciphertext, nil)
 	if err != nil {
-		fmt.Printf("Decryption failed (possibly wrong passphrase): %s", err.Error())
-		return nil
+		return nil, err
 	}
 
-	return plaintext
+	return plaintext, nil
 }