GitHubMirror/rcw
1
0
Fork 0
mirror of https://github.com/rwinkhart/rcw.git synced 2026-09-06 00:57:18 -04:00
Code Issues Packages Projects Releases Wiki Activity

Make input zeroization optional

Browse Source
This commit is contained in:
RandyTheSilly
2026-02-10 23:34:30 -05:00
parent ddd7f893e9
commit e8ef243e87
11 changed files with 50 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wrappers/highLevel.go
+14 -9
View File
@@ -6,16 +6,18 @@ import (
"github.com/rwinkhart/go-boilerplate/security"
)
// DecryptAndZeroizePassword decrypts the provided byte slice using the provided password.
func DecryptAndZeroizePassword(encBytes, password []byte) ([]byte, error) {
// Decrypt decrypts the provided byte slice using the provided password.
func Decrypt(encBytes, password []byte, zeroizePassword bool) ([]byte, error) {
if len(encBytes) < saltSize1 {
return nil, errors.New("high-level decrypt: encrypted data is too short (invalid Argon2 salt)")
}
salt1 := encBytes[:saltSize1]
encBytes = encBytes[saltSize1:]
key1 := derivePrimaryKey(password, salt1)
security.ZeroizeBytes(password)
security.ZeroizeBytes(salt1)
defer security.ZeroizeBytes(key1)
if zeroizePassword {
security.ZeroizeBytes(password)
}
var err error
encBytes, err = decryptCha(encBytes, key1)
if err != nil {
@@ -25,19 +27,22 @@ func DecryptAndZeroizePassword(encBytes, password []byte) ([]byte, error) {
if err != nil {
return nil, err
}
security.ZeroizeBytes(key1)
return encBytes, err
}
// EncryptAndZeroizeDecBytesAndPassword encrypts the provided byte slice using the provided password.
func EncryptAndZeroizeDecBytesAndPassword(decBytes, password []byte) []byte {
defer security.ZeroizeBytes(decBytes)
// Encrypt encrypts the provided byte slice using the provided password.
func Encrypt(decBytes, password []byte, zeroizeDecBytes, zeroizePassword bool) []byte {
if zeroizeDecBytes {
defer security.ZeroizeBytes(decBytes)
}
salt1 := getRandomBytes(saltSize1)
defer security.ZeroizeBytes(salt1)
salt2AES := getRandomBytes(saltSize2)
salt2Cha := getRandomBytes(saltSize2)
key1 := derivePrimaryKey(password, salt1)
security.ZeroizeBytes(password)
if zeroizePassword {
security.ZeroizeBytes(password)
}
key2AES := deriveSecondaryKey(key1, salt2AES, []byte(hkdfInfoAES))
key2Cha := deriveSecondaryKey(key1, salt2Cha, []byte(hkdfInfoCha))
security.ZeroizeBytes(key1)