Make daemon return decrypted data, not passphrase

example.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/rwinkhart/rcw/daemon"
 	"github.com/rwinkhart/rcw/wrappers"
+	"golang.org/x/term"
 )
 
 // This sample program serves purley as a way to interactively test the features
@@ -13,10 +14,9 @@ import (
 //
 // Usage:
 // rcw init <passwd> : Generates the required sanity check file
-// rcw <text> : Runs the rcw daemon to serve the provided text for three minutes
-// rcw : Requests the data served by the RCW daemon and outputs it to stdout
+// rcw <passphrase> : Runs the rcw daemon to decrypt data for three minutes
 // rcw enc <text> <passwd> : Encrypts the provided text and outputs the ciphertext to encrypted-example.txt
-// rcw dec <passwd> : Decrypts encrypted-example.txt and outputs the plaintext to stdout
+// rcw dec : Decrypts ex-cipher.rcw and outputs the plaintext to stdout (attempts to use daemon, falls back to user input for passphrase)
 
 // TODO Tests:
 // Salt (aes+chacha)
@@ -26,9 +26,6 @@ import (
 // RPC password sharing
 
 // TODO Enhancements:
-// Security:
-// 	   Handle decryption in the daemon and return decrypted data, rather than returning the passphrase
-// 	   Play with nonce sizes and KDF parameters to find the best speed-security balance
 // Standalone cmd:
 //     Usable as symmetric-only GPG replacement
 
@@ -40,28 +37,42 @@ const (
 func main() {
 	switch len(os.Args) {
 	case 2:
-		// serve data
-		daemon.Start(os.Args[1])
+		if os.Args[1] == "dec" {
+			// decrypt file (using daemon if available)
+			// rcw dec
+			encBytes, err := os.ReadFile(outputFile)
+			if err != nil {
+				fmt.Println(err)
+				return
+			}
+			decBytes := daemon.CallDaemonIfOpen(encBytes)
+			if decBytes == nil {
+				fmt.Println("No RCW daemon available")
+				passphrase := inputHidden("Enter RCW passphrase:")
+				decBytes, err = wrappers.Decrypt(encBytes, passphrase)
+				if err != nil {
+					fmt.Println(err)
+					return
+				}
+			}
+			fmt.Println(string(decBytes))
+			return
+		}
+		// run decrypter daemon
+		// rcw <passwd>
+		daemon.Start([]byte(os.Args[1]))
 	case 3:
 		if os.Args[1] == "init" {
 			// create sanity check file
+			// rcw init <passwd>
 			err := wrappers.GenSanityCheck(sanityFile, []byte(os.Args[2]))
 			if err != nil {
 				fmt.Println(err)
 			}
-			return
 		}
-
-		// decrypt file
-		encBytes, _ := os.ReadFile(outputFile)
-		decBytes, err := wrappers.Decrypt(encBytes, []byte(os.Args[2]))
-		if err != nil {
-			fmt.Println(err)
-			return
-		}
-		fmt.Println(string(decBytes))
 	case 4:
 		// encrypt data (from cli args)
+		// rcw enc <text> <passwd>
 		err := wrappers.RunSanityCheck(sanityFile, []byte(os.Args[3]))
 		if err != nil {
 			fmt.Println(err)
@@ -70,11 +81,14 @@ func main() {
 		encBytes := wrappers.Encrypt([]byte(os.Args[2]), []byte(os.Args[3]))
 		os.WriteFile(outputFile, encBytes, 0600)
 	default:
-		// request served data
-		if servedData := daemon.CallDaemonIfOpen(); servedData != nil {
-			fmt.Println(string(servedData))
-		} else {
-			fmt.Println("No RCW daemon available")
-		}
+		fmt.Println("Usage: rcw [init <passwd>] | [enc <text> <passwd>] | [dec] | [<passwd>]")
 	}
 }
+
+// inputHidden prompts the user for input and returns the input as a byte array, hiding the input from the terminal.
+func inputHidden(prompt string) []byte {
+	fmt.Print("\n" + prompt + " ")
+	byteInput, _ := term.ReadPassword(int(os.Stdin.Fd()))
+	fmt.Println()
+	return byteInput
+}