Rename all occurrences of "passphrase" to "password"

wrappers/highLevel.go

@@ -6,15 +6,15 @@ import (
 	"github.com/rwinkhart/go-boilerplate/security"
 )
 
-// DecryptAndZeroizePassphrase decrypts the provided byte slice using the provided passphrase.
-func DecryptAndZeroizePassphrase(encBytes, passphrase []byte) ([]byte, error) {
+// DecryptAndZeroizePassword decrypts the provided byte slice using the provided password.
+func DecryptAndZeroizePassword(encBytes, password []byte) ([]byte, error) {
 	if len(encBytes) < saltSize1 {
 		return nil, errors.New("high-level decrypt: encrypted data is too short (invalid Argon2 salt)")
 	}
 	salt1 := encBytes[:saltSize1]
 	encBytes = encBytes[saltSize1:]
-	key1 := derivePrimaryKey(passphrase, salt1)
-	security.ZeroizeBytes(passphrase)
+	key1 := derivePrimaryKey(password, salt1)
+	security.ZeroizeBytes(password)
 	security.ZeroizeBytes(salt1)
 	var err error
 	encBytes, err = decryptCha(encBytes, key1)
@@ -29,15 +29,15 @@ func DecryptAndZeroizePassphrase(encBytes, passphrase []byte) ([]byte, error) {
 	return encBytes, err
 }
 
-// EncryptAndZeroizeDecBytesAndPassphrase encrypts the provided byte slice using the provided passphrase.
-func EncryptAndZeroizeDecBytesAndPassphrase(decBytes, passphrase []byte) []byte {
+// EncryptAndZeroizeDecBytesAndPassword encrypts the provided byte slice using the provided password.
+func EncryptAndZeroizeDecBytesAndPassword(decBytes, password []byte) []byte {
 	defer security.ZeroizeBytes(decBytes)
 	salt1 := getRandomBytes(saltSize1)
 	defer security.ZeroizeBytes(salt1)
 	salt2AES := getRandomBytes(saltSize2)
 	salt2Cha := getRandomBytes(saltSize2)
-	key1 := derivePrimaryKey(passphrase, salt1)
-	security.ZeroizeBytes(passphrase)
+	key1 := derivePrimaryKey(password, salt1)
+	security.ZeroizeBytes(password)
 	key2AES := deriveSecondaryKey(key1, salt2AES, []byte(hkdfInfoAES))
 	key2Cha := deriveSecondaryKey(key1, salt2Cha, []byte(hkdfInfoCha))
 	security.ZeroizeBytes(key1)

wrappers/keyDeriv.go

@@ -21,14 +21,14 @@ const (
 	saltSize2 = 32 // 256 bits, recommended salt size for HKDF
 )
 
-// derivePrimaryKey derives an encryption key from a passphrase using Argon2.
+// derivePrimaryKey derives an encryption key from a password using Argon2.
 // The resulting key is not meant to be used directly for encryption, but rather as a key to derive other keys.
-func derivePrimaryKey(passphrase, salt []byte) []byte {
-	return argon2.IDKey(passphrase, salt, argonTime, argonMemory, argonThreads, keyLen)
+func derivePrimaryKey(password, salt []byte) []byte {
+	return argon2.IDKey(password, salt, argonTime, argonMemory, argonThreads, keyLen)
 }
 
 // deriveSecondaryKey derives a secondary key from the primary key using HKDF.
-// It is meant to be an efficient way to derive multiple keys from a single passphrase.
+// It is meant to be an efficient way to derive multiple keys from a single password.
 func deriveSecondaryKey(primaryKey, salt, info []byte) []byte {
 	h := hkdf.New(sha256.New, primaryKey, salt, info)
 	derivedKey := make([]byte, keyLen)

wrappers/sanityCheck.go

@@ -8,28 +8,28 @@ import (
 	"github.com/rwinkhart/go-boilerplate/security"
 )
 
-// GenSanityCheckAndZeroizePassphrase creates an encrypted file containing known plaintext
+// GenSanityCheckAndZeroizePassword creates an encrypted file containing known plaintext
 // to later be used for ensuring the user does not encrypt data with
-// an incorrect passphrase.
-func GenSanityCheckAndZeroizePassphrase(path string, passphrase []byte) error {
-	err := os.WriteFile(path, EncryptAndZeroizeDecBytesAndPassphrase([]byte("thx4usin'rcw"), passphrase), 0600)
-	security.ZeroizeBytes(passphrase)
+// an incorrect password.
+func GenSanityCheckAndZeroizePassword(path string, password []byte) error {
+	err := os.WriteFile(path, EncryptAndZeroizeDecBytesAndPassword([]byte("thx4usin'rcw"), password), 0600)
+	security.ZeroizeBytes(password)
 	return err
 }
 
 // RunSanityCheck should be run before any encryption operation
-// to ensure the user does not encrypt data with an incorrect passphrase.
+// to ensure the user does not encrypt data with an incorrect password.
 // Failure to perform this check could result in data loss.
-func RunSanityCheck(path string, passphrase []byte) error {
+func RunSanityCheck(path string, password []byte) error {
 	encBytes, err := os.ReadFile(path)
 	if err != nil {
 		return errors.New("Failed to read sanity check file (" + path + ")")
 	}
-	decBytes, err := DecryptAndZeroizePassphrase(encBytes, passphrase)
+	decBytes, err := DecryptAndZeroizePassword(encBytes, password)
 	if err == nil {
 		if bytes.Equal(decBytes, []byte("thx4usin'rcw")) {
 			return nil
 		}
 	}
-	return errors.New("sanity check failed (likely due to inconsistent passphrase)")
+	return errors.New("sanity check failed (likely due to inconsistent password)")
 }