Set static thread count; add sanity check before encryption on example program

example.go

@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/rwinkhart/go-boilerplate/front"
 	"github.com/rwinkhart/rcw/daemon"
 	"github.com/rwinkhart/rcw/wrappers"
-	"golang.org/x/term"
 )
 
 // This sample program serves purley as a way to interactively test the features
@@ -66,7 +66,7 @@ func main() {
 			if daemon.IsOpen() {
 				decBytes = daemon.GetDec(encBytes)
 			} else {
-				decBytes, err = wrappers.Decrypt(encBytes, inputHidden("Enter RCW passphrase:"))
+				decBytes, err = wrappers.Decrypt(encBytes, front.InputHidden("Enter RCW passphrase:"))
 				if err != nil {
 					fmt.Println(err)
 					return
@@ -104,7 +104,13 @@ func main() {
 			if daemon.IsOpen() {
 				encBytes = daemon.GetEnc(decBytes)
 			} else {
-				encBytes = wrappers.Encrypt(decBytes, inputHidden("Enter RCW passphrase:"))
+				passphrase := front.InputHidden("Enter RCW passphrase: ")
+				err := wrappers.RunSanityCheck(sanityFile, passphrase)
+				if err != nil {
+					fmt.Println(err)
+					return
+				}
+				encBytes = wrappers.Encrypt(decBytes, passphrase)
 			}
 			os.WriteFile(outputFile, encBytes, 0600)
 			return
@@ -114,11 +120,3 @@ func main() {
 		fmt.Println("Usage: rcw [init <passwd>] | [enc <text>] | dec | <passwd>")
 	}
 }
-
-// inputHidden prompts the user for input and returns the input as a byte array, hiding the input from the terminal.
-func inputHidden(prompt string) []byte {
-	fmt.Print("\n" + prompt + " ")
-	byteInput, _ := term.ReadPassword(int(os.Stdin.Fd()))
-	fmt.Println()
-	return byteInput
-}

go.mod

@@ -6,11 +6,13 @@ require github.com/rwinkhart/peercred-mini v0.1.0
 
 require (
 	github.com/Microsoft/go-winio v0.6.2
+	github.com/rwinkhart/go-boilerplate v0.0.0-20250509173525-20670ec7bb9c
 	golang.org/x/crypto v0.38.0
 	golang.org/x/sys v0.33.0
-	golang.org/x/term v0.32.0
 )
 
+require golang.org/x/term v0.32.0 // indirect
+
 replace golang.org/x/sys => github.com/rwinkhart/sys-freebsd-13-xucred v0.33.0
 
 replace github.com/Microsoft/go-winio => github.com/rwinkhart/go-winio-easy-pipe-handles v0.0.0-20250407031321-96994a0e8410

go.sum

@@ -1,3 +1,5 @@
+github.com/rwinkhart/go-boilerplate v0.0.0-20250509173525-20670ec7bb9c h1:RIMnYf1MwsvmAr9E0/cpn7rTh8BWdfsQ2r31ITKJp2A=
+github.com/rwinkhart/go-boilerplate v0.0.0-20250509173525-20670ec7bb9c/go.mod h1:cnzIF45I0FCOvE4YIB+26pLCUx2kWyY2llKYZruNaRY=
 github.com/rwinkhart/go-winio-easy-pipe-handles v0.0.0-20250407031321-96994a0e8410 h1:NhHwFM3Pgm6zRUfFKvi0p5ndjfFbVWsRwmmhyFlG4PE=
 github.com/rwinkhart/go-winio-easy-pipe-handles v0.0.0-20250407031321-96994a0e8410/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/rwinkhart/peercred-mini v0.1.0 h1:TiS6u8cEWzW55S9X4iVpU72Iuy/NG6rMUJMtUEVEFLw=

wrappers/keyDeriv.go

@@ -1,24 +1,21 @@
 package wrappers
 
 import (
-	"runtime"
-
 	"golang.org/x/crypto/argon2"
 )
 
 const (
 	// parameters for Argon2
-	argonTime   = 8          // set to pass 1-second test in dev environment
+	argonTime    = 8          // set to pass 1-second test in dev environment
-	argonMemory = 384 * 1024 // 384 MB (target running comfortably on a Pi Zero/512 MB RAM)
+	argonMemory  = 384 * 1024 // 384 MB (target running comfortably on a Pi Zero/512 MB RAM)
+	argonThreads = 32         // must use a static thread count for support across multiple devices
 
 	// general constants
 	keyLen   = 32 // 256 bits, key length for both algorithms
 	saltSize = 16 // 128 bits, recommended salt size for both algorithms
 )
 
-var argonThreads = uint8(runtime.NumCPU())
+// deriveKey derives an encryption key from a passphrase using Argon2.
-
-// DeriveKey derives an encryption key from a passphrase using Argon2.
 func deriveKey(passphrase []byte, salt []byte) []byte {
 	return argon2.IDKey(passphrase, salt, argonTime, argonMemory, argonThreads, keyLen)
 }