Bump Go to v1.24.6; bump dependencies

daemon/2server.go

@@ -8,6 +8,8 @@ import (
 	"github.com/rwinkhart/rcw/wrappers"
 )
 
+var Timeout = 300 // seconds for RPC server timeout; configurable
+
 var daemonHash []byte
 var globalPassphrase []byte
 

daemon/2serverUNIXGeneric.go

@@ -47,14 +47,14 @@ func Start(passphrase []byte) {
 		os.Exit(0)
 	}()
 
-	// accept connections (timeout after 3 minutes of inactivity)
+	// accept connections until Timeout takes effect
 	for {
-		listener.(*net.UnixListener).SetDeadline(time.Now().Add(3 * time.Minute))
+		listener.(*net.UnixListener).SetDeadline(time.Now().Add(time.Duration(Timeout) * time.Second))
 
 		conn, err := listener.Accept()
 		if err != nil {
 			if err.(net.Error).Timeout() {
-				log.Println("Three minutes have passed without any connections. Exiting...")
+				log.Println(strconv.Itoa(Timeout) + " seconds have passed without any connections. Exiting...")
 				listener.Close()
 				os.Exit(0)
 			}

daemon/2serverWindows.go

@@ -9,6 +9,7 @@ import (
 	"net/rpc"
 	"os"
 	"os/signal"
+	"strconv"
 	"syscall"
 	"time"
 
@@ -54,13 +55,13 @@ func Start(passphrase []byte) {
 	// capture sigterms to ensure listener is closed
 	sigChan := make(chan os.Signal, 1)
 	signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)
-	// create 3-minute inactivity timer
+	// create inactivity timer
-	timer := time.NewTimer(3 * time.Minute)
+	timer := time.NewTimer(time.Duration(Timeout) * time.Second)
 	killTimer := make(chan struct{})
 	go func() {
 		select {
 		case <-timer.C:
-			log.Println("Three minutes have passed without any connections. Exiting...")
+			log.Println(strconv.Itoa(Timeout) + " seconds have passed without any connections. Exiting...")
 			listener.Close()
 			os.Exit(0)
 		case <-killTimer:

go.mod

@@ -1,18 +1,17 @@
 module github.com/rwinkhart/rcw
 
-go 1.24.3
+go 1.24.6
-
-require github.com/rwinkhart/peercred-mini v0.1.0
 
 require (
 	github.com/Microsoft/go-winio v0.6.2
-	github.com/rwinkhart/go-boilerplate v0.0.0-20250509173525-20670ec7bb9c
+	github.com/rwinkhart/go-boilerplate v0.1.0
-	golang.org/x/crypto v0.38.0
+	github.com/rwinkhart/peercred-mini v0.1.1
-	golang.org/x/sys v0.33.0
+	golang.org/x/crypto v0.41.0
+	golang.org/x/sys v0.35.0
 )
 
-require golang.org/x/term v0.32.0 // indirect
+require golang.org/x/term v0.34.0 // indirect
 
-replace golang.org/x/sys => github.com/rwinkhart/sys-freebsd-13-xucred v0.33.0
+replace golang.org/x/sys => github.com/rwinkhart/sys v0.35.0
 
 replace github.com/Microsoft/go-winio => github.com/rwinkhart/go-winio-easy-pipe-handles v0.0.0-20250407031321-96994a0e8410

go.sum

@@ -1,12 +1,12 @@
-github.com/rwinkhart/go-boilerplate v0.0.0-20250509173525-20670ec7bb9c h1:RIMnYf1MwsvmAr9E0/cpn7rTh8BWdfsQ2r31ITKJp2A=
+github.com/rwinkhart/go-boilerplate v0.1.0 h1:EzlVj6R7Bxtl79Nl7R5zRcg6s+Cf2FAqGIzR4giWTQg=
-github.com/rwinkhart/go-boilerplate v0.0.0-20250509173525-20670ec7bb9c/go.mod h1:cnzIF45I0FCOvE4YIB+26pLCUx2kWyY2llKYZruNaRY=
+github.com/rwinkhart/go-boilerplate v0.1.0/go.mod h1:cnzIF45I0FCOvE4YIB+26pLCUx2kWyY2llKYZruNaRY=
 github.com/rwinkhart/go-winio-easy-pipe-handles v0.0.0-20250407031321-96994a0e8410 h1:NhHwFM3Pgm6zRUfFKvi0p5ndjfFbVWsRwmmhyFlG4PE=
 github.com/rwinkhart/go-winio-easy-pipe-handles v0.0.0-20250407031321-96994a0e8410/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/rwinkhart/peercred-mini v0.1.0 h1:TiS6u8cEWzW55S9X4iVpU72Iuy/NG6rMUJMtUEVEFLw=
+github.com/rwinkhart/peercred-mini v0.1.1 h1:hDoqSEwynJN4w8OWlZNSQAjAum/ocP3AYF7DjtPV5qU=
-github.com/rwinkhart/peercred-mini v0.1.0/go.mod h1:+x4Mxc2veE+YePSOpcUasjimh7n799c1KraLuQwHR20=
+github.com/rwinkhart/peercred-mini v0.1.1/go.mod h1:dstv+IydIklCnffwAZgD2AWqkGe0mETn3lLtqJjYAeI=
-github.com/rwinkhart/sys-freebsd-13-xucred v0.33.0 h1:W4J4cS0yLMLKuYePFFL2OR8MAYLoHkErJvq9FBBqK70=
+github.com/rwinkhart/sys v0.35.0 h1:6ZikETjyuv9ndnSEnXQmp/M3lxyCHWoHAm3lGzy0pnE=
-github.com/rwinkhart/sys-freebsd-13-xucred v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+github.com/rwinkhart/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
-golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
-golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
-golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=

wrappers/aes.go

@@ -3,62 +3,49 @@ package wrappers
 import (
 	"crypto/aes"
 	"crypto/cipher"
-	"crypto/rand"
 	"errors"
-	"io"
 )
 
 const (
 	nonceSizeAES = 12 // GCM standard nonce size is 12 bytes
+	hkdfInfoAES  = "AES256-GCM"
+	hkdfInfoCha  = "ChaCha20-Poly1305"
 )
 
 // EncryptAES encrypts data using AES-256-GCM.
-func encryptAES(decBytes []byte, passphrase []byte) []byte {
+func encryptAES(decBytes, key2, salt2 []byte) []byte {
-	// generate a random salt
-	salt := make([]byte, saltSize)
-	io.ReadFull(rand.Reader, salt)
-
-	// derive key from passphrase using the salt
-	key := deriveKey(passphrase, salt)
-
 	// create AES-256 cipher
-	block, _ := aes.NewCipher(key)
+	block, _ := aes.NewCipher(key2)
 
 	// create GCM mode
 	aesGCM, _ := cipher.NewGCM(block)
 
 	// generate a random nonce
-	nonce := make([]byte, nonceSizeAES)
+	nonce := getRandomBytes(nonceSizeAES)
-	io.ReadFull(rand.Reader, nonce)
 
 	// encrypt the data
 	ciphertext := aesGCM.Seal(nil, nonce, decBytes, nil)
 
-	// format: salt + nonce + ciphertext
+	// format: salt2 + nonce + ciphertext
-	result := make([]byte, 0, saltSize+nonceSizeAES+len(ciphertext))
+	return append(append(append(make([]byte, 0, saltSize2+nonceSizeAES+len(ciphertext)), salt2...), nonce...), ciphertext...)
-	result = append(result, salt...)
-	result = append(result, nonce...)
-	result = append(result, ciphertext...)
-
-	return result
 }
 
 // DecryptAES decrypts data using AES256-GCM.
-func decryptAES(encBytes []byte, passphrase []byte) ([]byte, error) {
+func decryptAES(encBytes, key1 []byte) ([]byte, error) {
-	if len(encBytes) < saltSize+nonceSizeAES {
+	if len(encBytes) < saltSize2+nonceSizeAES {
 		return nil, errors.New("AES256-GCM: Encrypted data is too short")
 	}
 
 	// extract salt, nonce, and ciphertext
-	salt := encBytes[:saltSize]
+	salt2 := encBytes[:saltSize2]
-	nonce := encBytes[saltSize : saltSize+nonceSizeAES]
+	nonce := encBytes[saltSize2 : saltSize2+nonceSizeAES]
-	ciphertext := encBytes[saltSize+nonceSizeAES:]
+	ciphertext := encBytes[saltSize2+nonceSizeAES:]
 
-	// derive key from passphrase using the salt
+	// derive secondary key from primary key using the salt
-	key := deriveKey(passphrase, salt)
+	key2 := deriveSecondaryKey(key1, salt2, []byte(hkdfInfoAES))
 
 	// create AES-256 cipher
-	block, _ := aes.NewCipher(key)
+	block, _ := aes.NewCipher(key2)
 
 	// create GCM mode
 	aesGCM, _ := cipher.NewGCM(block)

wrappers/chacha.go

@@ -1,9 +1,7 @@
 package wrappers
 
 import (
-	"crypto/rand"
 	"errors"
-	"io"
 
 	"golang.org/x/crypto/chacha20poly1305"
 )
@@ -13,49 +11,36 @@ const (
 )
 
 // EncryptCha encrypts data using ChaCha20-Poly1305.
-func encryptCha(data []byte, passphrase []byte) []byte {
+func encryptCha(decBytes, key2, salt2 []byte) []byte {
-	// generate a random salt
-	salt := make([]byte, saltSize)
-	io.ReadFull(rand.Reader, salt)
-
-	// derive key from passphrase using the salt
-	key := deriveKey(passphrase, salt)
-
 	// create ChaCha20-Poly1305 cipher
-	stream, _ := chacha20poly1305.NewX(key)
+	stream, _ := chacha20poly1305.NewX(key2)
 
 	// generate a random nonce
-	nonce := make([]byte, nonceSizeCha)
+	nonce := getRandomBytes(nonceSizeCha)
-	io.ReadFull(rand.Reader, nonce)
 
 	// encrypt the data
-	ciphertext := stream.Seal(nil, nonce, data, nil)
+	ciphertext := stream.Seal(nil, nonce, decBytes, nil)
 
-	// format: salt + nonce + ciphertext
+	// format: salt2 + nonce + ciphertext
-	result := make([]byte, 0, saltSize+nonceSizeCha+len(ciphertext))
+	return append(append(append(make([]byte, 0, saltSize2+nonceSizeCha+len(ciphertext)), salt2...), nonce...), ciphertext...)
-	result = append(result, salt...)
-	result = append(result, nonce...)
-	result = append(result, ciphertext...)
-
-	return result
 }
 
 // DecryptCha decrypts data using ChaCha20-Poly1305.
-func decryptCha(encryptedData []byte, passphrase []byte) ([]byte, error) {
+func decryptCha(encBytes, key1 []byte) ([]byte, error) {
-	if len(encryptedData) < saltSize+nonceSizeCha {
+	if len(encBytes) < saltSize2+nonceSizeCha {
 		return nil, errors.New("ChaCha20-Poly1305: Encrypted data is too short")
 	}
 
 	// extract salt, nonce, and ciphertext
-	salt := encryptedData[:saltSize]
+	salt2 := encBytes[:saltSize2]
-	nonce := encryptedData[saltSize : saltSize+nonceSizeCha]
+	nonce := encBytes[saltSize2 : saltSize2+nonceSizeCha]
-	ciphertext := encryptedData[saltSize+nonceSizeCha:]
+	ciphertext := encBytes[saltSize2+nonceSizeCha:]
 
-	// derive key from passphrase using the salt
+	// derive secondary key from primary key using the salt
-	key := deriveKey(passphrase, salt)
+	key2 := deriveSecondaryKey(key1, salt2, []byte(hkdfInfoCha))
 
 	// create ChaCha20-Poly1305 cipher
-	stream, _ := chacha20poly1305.NewX(key)
+	stream, _ := chacha20poly1305.NewX(key2)
 
 	// decrypt the data
 	plaintext, err := stream.Open(nil, nonce, ciphertext, nil)

wrappers/highLevel.go

@@ -3,11 +3,14 @@ package wrappers
 // Decrypt decrypts the provided byte slice using the provided passphrase.
 func Decrypt(encBytes []byte, passphrase []byte) ([]byte, error) {
 	var err error = nil
-	encBytes, err = decryptCha(encBytes, passphrase)
+	salt1 := encBytes[:saltSize1]
+	encBytes = encBytes[saltSize1:]
+	key1 := derivePrimaryKey(passphrase, salt1)
+	encBytes, err = decryptCha(encBytes, key1)
 	if err != nil {
 		return nil, err
 	}
-	encBytes, err = decryptAES(encBytes, passphrase)
+	encBytes, err = decryptAES(encBytes, key1)
 	if err != nil {
 		return nil, err
 	}
@@ -16,7 +19,14 @@ func Decrypt(encBytes []byte, passphrase []byte) ([]byte, error) {
 
 // Encrypt encrypts the provided byte slice using the provided passphrase.
 func Encrypt(decBytes []byte, passphrase []byte) []byte {
-	decBytes = encryptAES(decBytes, passphrase)
+	salt1 := getRandomBytes(saltSize1)
-	decBytes = encryptCha(decBytes, passphrase)
+	salt2AES := getRandomBytes(saltSize2)
-	return decBytes
+	salt2Cha := getRandomBytes(saltSize2)
+	key1 := derivePrimaryKey(passphrase, salt1)
+	key2AES := deriveSecondaryKey(key1, salt2AES, []byte(hkdfInfoAES))
+	key2Cha := deriveSecondaryKey(key1, salt2Cha, []byte(hkdfInfoCha))
+	decBytes = encryptAES(decBytes, key2AES, salt2AES)
+	decBytes = encryptCha(decBytes, key2Cha, salt2Cha)
+	// format: salt1 + decBytes per algorithm (salt2* + nonce + ciphertext)
+	return append(append(make([]byte, 0, saltSize1+len(decBytes)), salt1...), decBytes...)
 }

wrappers/keyDeriv.go

@@ -1,21 +1,44 @@
 package wrappers
 
 import (
+	"crypto/rand"
+	"crypto/sha256"
+	"io"
+
 	"golang.org/x/crypto/argon2"
+	"golang.org/x/crypto/hkdf"
 )
 
 const (
 	// parameters for Argon2
-	argonTime    = 8          // set to pass 1-second test in dev environment
+	argonTime    = 5           // pass 1-second test on dev environment
-	argonMemory  = 384 * 1024 // 384 MB (target running comfortably on a Pi Zero/512 MB RAM)
+	argonMemory  = 1024 * 1024 // 1 GB
-	argonThreads = 32         // must use a static thread count for support across multiple devices
+	argonThreads = 32          // 32 threads offers the best balance between utilization on high-end devices and performance on low-end devices
 
 	// general constants
-	keyLen   = 32 // 256 bits, key length for both algorithms
+	keyLen    = 32 // 256 bits, key length for both algorithms
-	saltSize = 16 // 128 bits, recommended salt size for both algorithms
+	saltSize1 = 16 // 128 bits, recommended salt size for AES256/ChaCha20/Argon2
+	saltSize2 = 32 // 256 bits, recommended salt size for HKDF
 )
 
-// deriveKey derives an encryption key from a passphrase using Argon2.
+// derivePrimaryKey derives an encryption key from a passphrase using Argon2.
-func deriveKey(passphrase []byte, salt []byte) []byte {
+// The resulting key is not meant to be used directly for encryption, but rather as a key to derive other keys.
+func derivePrimaryKey(passphrase, salt []byte) []byte {
 	return argon2.IDKey(passphrase, salt, argonTime, argonMemory, argonThreads, keyLen)
 }
+
+// deriveSecondaryKey derives a secondary key from the primary key using HKDF.
+// It is meant to be an efficient way to derive multiple keys from a single passphrase.
+func deriveSecondaryKey(primaryKey, salt, info []byte) []byte {
+	h := hkdf.New(sha256.New, primaryKey, salt, info)
+	derivedKey := make([]byte, keyLen)
+	io.ReadFull(h, derivedKey)
+	return derivedKey
+}
+
+// getRandomBytes returns a random salt/nonce of the specified size.
+func getRandomBytes(size uint8) []byte {
+	salt := make([]byte, size)
+	io.ReadFull(rand.Reader, salt)
+	return salt
+}