Make input zeroization optional

wrappers/aes.go

@@ -24,7 +24,6 @@ func encryptAES(decBytes, key2, salt2 []byte) []byte {
 
 	// generate a random nonce
 	nonce := getRandomBytes(nonceSizeAES)
-	defer security.ZeroizeBytes(nonce)
 
 	// encrypt the data
 	ciphertext := aesGCM.Seal(nil, nonce, decBytes, nil)

wrappers/chacha.go

@@ -18,7 +18,6 @@ func encryptCha(decBytes, key2, salt2 []byte) []byte {
 
 	// generate a random nonce
 	nonce := getRandomBytes(nonceSizeCha)
-	defer security.ZeroizeBytes(nonce)
 
 	// encrypt the data
 	ciphertext := stream.Seal(nil, nonce, decBytes, nil)

wrappers/highLevel.go

@@ -6,16 +6,18 @@ import (
 	"github.com/rwinkhart/go-boilerplate/security"
 )
 
-// DecryptAndZeroizePassword decrypts the provided byte slice using the provided password.
-func DecryptAndZeroizePassword(encBytes, password []byte) ([]byte, error) {
+// Decrypt decrypts the provided byte slice using the provided password.
+func Decrypt(encBytes, password []byte, zeroizePassword bool) ([]byte, error) {
 	if len(encBytes) < saltSize1 {
 		return nil, errors.New("high-level decrypt: encrypted data is too short (invalid Argon2 salt)")
 	}
 	salt1 := encBytes[:saltSize1]
 	encBytes = encBytes[saltSize1:]
 	key1 := derivePrimaryKey(password, salt1)
-	security.ZeroizeBytes(password)
-	security.ZeroizeBytes(salt1)
+	defer security.ZeroizeBytes(key1)
+	if zeroizePassword {
+		security.ZeroizeBytes(password)
+	}
 	var err error
 	encBytes, err = decryptCha(encBytes, key1)
 	if err != nil {
@@ -25,19 +27,22 @@ func DecryptAndZeroizePassword(encBytes, password []byte) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	security.ZeroizeBytes(key1)
 	return encBytes, err
 }
 
-// EncryptAndZeroizeDecBytesAndPassword encrypts the provided byte slice using the provided password.
-func EncryptAndZeroizeDecBytesAndPassword(decBytes, password []byte) []byte {
-	defer security.ZeroizeBytes(decBytes)
+// Encrypt encrypts the provided byte slice using the provided password.
+func Encrypt(decBytes, password []byte, zeroizeDecBytes, zeroizePassword bool) []byte {
+	if zeroizeDecBytes {
+		defer security.ZeroizeBytes(decBytes)
+	}
 	salt1 := getRandomBytes(saltSize1)
 	defer security.ZeroizeBytes(salt1)
 	salt2AES := getRandomBytes(saltSize2)
 	salt2Cha := getRandomBytes(saltSize2)
 	key1 := derivePrimaryKey(password, salt1)
-	security.ZeroizeBytes(password)
+	if zeroizePassword {
+		security.ZeroizeBytes(password)
+	}
 	key2AES := deriveSecondaryKey(key1, salt2AES, []byte(hkdfInfoAES))
 	key2Cha := deriveSecondaryKey(key1, salt2Cha, []byte(hkdfInfoCha))
 	security.ZeroizeBytes(key1)

wrappers/sanityCheck.go

@@ -4,16 +4,13 @@ import (
 	"bytes"
 	"errors"
 	"os"
-
-	"github.com/rwinkhart/go-boilerplate/security"
 )
 
-// GenSanityCheckAndZeroizePassword creates an encrypted file containing known plaintext
+// GenSanityCheck creates an encrypted file containing known plaintext
 // to later be used for ensuring the user does not encrypt data with
 // an incorrect password.
-func GenSanityCheckAndZeroizePassword(path string, password []byte) error {
-	err := os.WriteFile(path, EncryptAndZeroizeDecBytesAndPassword([]byte("thx4usin'rcw"), password), 0600)
-	security.ZeroizeBytes(password)
+func GenSanityCheck(path string, password []byte, zeroizePassword bool) error {
+	err := os.WriteFile(path, Encrypt([]byte("thx4usin'rcw"), password, false, zeroizePassword), 0600)
 	return err
 }
 
@@ -25,9 +22,7 @@ func RunSanityCheck(path string, password []byte) error {
 	if err != nil {
 		return errors.New("Failed to read sanity check file (" + path + ")")
 	}
-
-	// avoid zeroizing password, as this function expects the user to use the password after running it
-	decBytes, err := DecryptAndZeroizePassword(encBytes, append([]byte{}, password...))
+	decBytes, err := Decrypt(encBytes, password, false)
 	if err == nil {
 		if bytes.Equal(decBytes, []byte("thx4usin'rcw")) {
 			return nil