GitHubMirror/rcw
1
0
Fork 0
mirror of https://github.com/rwinkhart/rcw.git synced 2026-09-05 08:37:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

Significant hardening (always work on bytes; zeroize everything); address JetBrains warnings

Browse Source
This commit is contained in:
RandyTheSilly
2026-02-10 00:33:56 -05:00
parent 4fd72b0042
commit c5e259a446
9 changed files with 75 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wrappers/highLevel.go
+21 -6
View File
@@ -1,15 +1,21 @@
package wrappers
import "errors"
import (
"errors"
// Decrypt decrypts the provided byte slice using the provided passphrase.
func Decrypt(encBytes, passphrase []byte) ([]byte, error) {
"github.com/rwinkhart/go-boilerplate/security"
)
// DecryptAndZeroizePassphrase decrypts the provided byte slice using the provided passphrase.
func DecryptAndZeroizePassphrase(encBytes, passphrase []byte) ([]byte, error) {
if len(encBytes) < saltSize1 {
return nil, errors.New("High-level decrypt: Encrypted data is too short (invalid Argon2 salt)")
return nil, errors.New("high-level decrypt: encrypted data is too short (invalid Argon2 salt)")
}
salt1 := encBytes[:saltSize1]
encBytes = encBytes[saltSize1:]
key1 := derivePrimaryKey(passphrase, salt1)
security.ZeroizeBytes(passphrase)
security.ZeroizeBytes(salt1)
var err error
encBytes, err = decryptCha(encBytes, key1)
if err != nil {
@@ -19,19 +25,28 @@ func Decrypt(encBytes, passphrase []byte) ([]byte, error) {
if err != nil {
return nil, err
}
security.ZeroizeBytes(key1)
return encBytes, err
}
// Encrypt encrypts the provided byte slice using the provided passphrase.
func Encrypt(decBytes, passphrase []byte) []byte {
// EncryptAndZeroizeDecBytesAndPassphrase encrypts the provided byte slice using the provided passphrase.
func EncryptAndZeroizeDecBytesAndPassphrase(decBytes, passphrase []byte) []byte {
defer security.ZeroizeBytes(decBytes)
salt1 := getRandomBytes(saltSize1)
defer security.ZeroizeBytes(salt1)
salt2AES := getRandomBytes(saltSize2)
salt2Cha := getRandomBytes(saltSize2)
key1 := derivePrimaryKey(passphrase, salt1)
security.ZeroizeBytes(passphrase)
key2AES := deriveSecondaryKey(key1, salt2AES, []byte(hkdfInfoAES))
key2Cha := deriveSecondaryKey(key1, salt2Cha, []byte(hkdfInfoCha))
security.ZeroizeBytes(key1)
decBytes = encryptAES(decBytes, key2AES, salt2AES)
security.ZeroizeBytes(key2AES)
security.ZeroizeBytes(salt2AES)
decBytes = encryptCha(decBytes, key2Cha, salt2Cha)
security.ZeroizeBytes(key2Cha)
security.ZeroizeBytes(salt2Cha)
// format: salt1 + decBytes per algorithm (salt2* + nonce + ciphertext)
return append(append(make([]byte, 0, saltSize1+len(decBytes)), salt1...), decBytes...)
}