From 57eefdf8b415cd6a202a7d831ef3f2505d9f16e3 Mon Sep 17 00:00:00 2001 From: Randall Winkhart Date: Sun, 25 Jan 2026 15:57:26 -0500 Subject: [PATCH] Return error from wrappers.Decrypt() if Argon2 salt is not present --- go.mod | 12 ++++++------ go.sum | 16 ++++++++-------- wrappers/highLevel.go | 11 ++++++++--- 3 files changed, 22 insertions(+), 17 deletions(-) diff --git a/go.mod b/go.mod index 46e3bc2..51e2456 100644 --- a/go.mod +++ b/go.mod @@ -1,17 +1,17 @@ module github.com/rwinkhart/rcw -go 1.25.4 +go 1.25.6 require ( github.com/Microsoft/go-winio v0.6.2 - github.com/rwinkhart/go-boilerplate v0.1.0 + github.com/rwinkhart/go-boilerplate v0.2.2 github.com/rwinkhart/peercred-mini v0.1.2 - golang.org/x/crypto v0.45.0 - golang.org/x/sys v0.38.0 + golang.org/x/crypto v0.47.0 + golang.org/x/sys v0.40.0 ) -require golang.org/x/term v0.37.0 // indirect +require golang.org/x/term v0.39.0 // indirect -replace golang.org/x/sys => github.com/rwinkhart/sys v0.38.0 +replace golang.org/x/sys => github.com/rwinkhart/sys v0.40.0 replace github.com/Microsoft/go-winio => github.com/rwinkhart/go-winio v0.1.0 diff --git a/go.sum b/go.sum index 1a60093..9d01c23 100644 --- a/go.sum +++ b/go.sum @@ -1,12 +1,12 @@ -github.com/rwinkhart/go-boilerplate v0.1.0 h1:EzlVj6R7Bxtl79Nl7R5zRcg6s+Cf2FAqGIzR4giWTQg= -github.com/rwinkhart/go-boilerplate v0.1.0/go.mod h1:cnzIF45I0FCOvE4YIB+26pLCUx2kWyY2llKYZruNaRY= +github.com/rwinkhart/go-boilerplate v0.2.2 h1:SVHTAQU+HWFivtUnDBcfrgClJV5ZmHyFS7/uERh7NKU= +github.com/rwinkhart/go-boilerplate v0.2.2/go.mod h1:/NVRKGslU20E5xU5YOgXzWxA6aa94BMtv5MtHRTb5Ek= github.com/rwinkhart/go-winio v0.1.0 h1:b72agLW+dETGmhR3VbcbwnStfgKfc5AfgJOXBJDkaHg= github.com/rwinkhart/go-winio v0.1.0/go.mod h1:ZWa7ssZJT30CCDGJ7fk/2SBTq9BIQrrVjrcss0UW2s0= github.com/rwinkhart/peercred-mini v0.1.2 h1:4cGWDbv0whvLeVvbUdx84V/9p+2fS+DEXgrA1KxlRFo= github.com/rwinkhart/peercred-mini v0.1.2/go.mod h1:LLHG7YshHEpbpJJP+Il9nx2dnGj5O3VGE32rWmflj0c= -github.com/rwinkhart/sys v0.38.0 h1:V1PGKcUutWtD3+VdHvyvfGtPy7PDXzKHNM1IzVq1ysY= -github.com/rwinkhart/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= -golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= -golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU= -golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254= +github.com/rwinkhart/sys v0.40.0 h1:ZPBbXb+27vLL518sZhhNV89jXK1KbCnFGmYJ2juOQ/c= +github.com/rwinkhart/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8= +golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A= +golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY= +golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww= diff --git a/wrappers/highLevel.go b/wrappers/highLevel.go index 5e247b3..d6e2e32 100644 --- a/wrappers/highLevel.go +++ b/wrappers/highLevel.go @@ -1,11 +1,16 @@ package wrappers +import "errors" + // Decrypt decrypts the provided byte slice using the provided passphrase. -func Decrypt(encBytes []byte, passphrase []byte) ([]byte, error) { - var err error = nil +func Decrypt(encBytes, passphrase []byte) ([]byte, error) { + if len(encBytes) < saltSize1 { + return nil, errors.New("High-level decrypt: Encrypted data is too short (invalid Argon2 salt)") + } salt1 := encBytes[:saltSize1] encBytes = encBytes[saltSize1:] key1 := derivePrimaryKey(passphrase, salt1) + var err error encBytes, err = decryptCha(encBytes, key1) if err != nil { return nil, err @@ -18,7 +23,7 @@ func Decrypt(encBytes []byte, passphrase []byte) ([]byte, error) { } // Encrypt encrypts the provided byte slice using the provided passphrase. -func Encrypt(decBytes []byte, passphrase []byte) []byte { +func Encrypt(decBytes, passphrase []byte) []byte { salt1 := getRandomBytes(saltSize1) salt2AES := getRandomBytes(saltSize2) salt2Cha := getRandomBytes(saltSize2)