Return error from wrappers.Decrypt() if Argon2 salt is not present

go.mod

@@ -1,18 +1,17 @@
 module github.com/rwinkhart/rcw
 
-go 1.24.3
-
-require github.com/rwinkhart/peercred-mini v0.1.0
+go 1.25.6
 
 require (
 	github.com/Microsoft/go-winio v0.6.2
-	github.com/rwinkhart/go-boilerplate v0.0.0-20250509173525-20670ec7bb9c
-	golang.org/x/crypto v0.38.0
-	golang.org/x/sys v0.33.0
+	github.com/rwinkhart/go-boilerplate v0.2.2
+	github.com/rwinkhart/peercred-mini v0.1.2
+	golang.org/x/crypto v0.47.0
+	golang.org/x/sys v0.40.0
 )
 
-require golang.org/x/term v0.32.0 // indirect
+require golang.org/x/term v0.39.0 // indirect
 
-replace golang.org/x/sys => github.com/rwinkhart/sys-freebsd-13-xucred v0.33.0
+replace golang.org/x/sys => github.com/rwinkhart/sys v0.40.0
 
-replace github.com/Microsoft/go-winio => github.com/rwinkhart/go-winio-easy-pipe-handles v0.0.0-20250407031321-96994a0e8410
+replace github.com/Microsoft/go-winio => github.com/rwinkhart/go-winio v0.1.0

go.sum

@@ -1,12 +1,12 @@
-github.com/rwinkhart/go-boilerplate v0.0.0-20250509173525-20670ec7bb9c h1:RIMnYf1MwsvmAr9E0/cpn7rTh8BWdfsQ2r31ITKJp2A=
-github.com/rwinkhart/go-boilerplate v0.0.0-20250509173525-20670ec7bb9c/go.mod h1:cnzIF45I0FCOvE4YIB+26pLCUx2kWyY2llKYZruNaRY=
-github.com/rwinkhart/go-winio-easy-pipe-handles v0.0.0-20250407031321-96994a0e8410 h1:NhHwFM3Pgm6zRUfFKvi0p5ndjfFbVWsRwmmhyFlG4PE=
-github.com/rwinkhart/go-winio-easy-pipe-handles v0.0.0-20250407031321-96994a0e8410/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/rwinkhart/peercred-mini v0.1.0 h1:TiS6u8cEWzW55S9X4iVpU72Iuy/NG6rMUJMtUEVEFLw=
-github.com/rwinkhart/peercred-mini v0.1.0/go.mod h1:+x4Mxc2veE+YePSOpcUasjimh7n799c1KraLuQwHR20=
-github.com/rwinkhart/sys-freebsd-13-xucred v0.33.0 h1:W4J4cS0yLMLKuYePFFL2OR8MAYLoHkErJvq9FBBqK70=
-github.com/rwinkhart/sys-freebsd-13-xucred v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
-golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
-golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
-golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
+github.com/rwinkhart/go-boilerplate v0.2.2 h1:SVHTAQU+HWFivtUnDBcfrgClJV5ZmHyFS7/uERh7NKU=
+github.com/rwinkhart/go-boilerplate v0.2.2/go.mod h1:/NVRKGslU20E5xU5YOgXzWxA6aa94BMtv5MtHRTb5Ek=
+github.com/rwinkhart/go-winio v0.1.0 h1:b72agLW+dETGmhR3VbcbwnStfgKfc5AfgJOXBJDkaHg=
+github.com/rwinkhart/go-winio v0.1.0/go.mod h1:ZWa7ssZJT30CCDGJ7fk/2SBTq9BIQrrVjrcss0UW2s0=
+github.com/rwinkhart/peercred-mini v0.1.2 h1:4cGWDbv0whvLeVvbUdx84V/9p+2fS+DEXgrA1KxlRFo=
+github.com/rwinkhart/peercred-mini v0.1.2/go.mod h1:LLHG7YshHEpbpJJP+Il9nx2dnGj5O3VGE32rWmflj0c=
+github.com/rwinkhart/sys v0.40.0 h1:ZPBbXb+27vLL518sZhhNV89jXK1KbCnFGmYJ2juOQ/c=
+github.com/rwinkhart/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
+golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
+golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
+golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=

wrappers/highLevel.go

@@ -1,11 +1,16 @@
 package wrappers
 
+import "errors"
+
 // Decrypt decrypts the provided byte slice using the provided passphrase.
-func Decrypt(encBytes []byte, passphrase []byte) ([]byte, error) {
-	var err error = nil
+func Decrypt(encBytes, passphrase []byte) ([]byte, error) {
+	if len(encBytes) < saltSize1 {
+		return nil, errors.New("High-level decrypt: Encrypted data is too short (invalid Argon2 salt)")
+	}
 	salt1 := encBytes[:saltSize1]
 	encBytes = encBytes[saltSize1:]
 	key1 := derivePrimaryKey(passphrase, salt1)
+	var err error
 	encBytes, err = decryptCha(encBytes, key1)
 	if err != nil {
 		return nil, err
@@ -18,7 +23,7 @@ func Decrypt(encBytes []byte, passphrase []byte) ([]byte, error) {
 }
 
 // Encrypt encrypts the provided byte slice using the provided passphrase.
-func Encrypt(decBytes []byte, passphrase []byte) []byte {
+func Encrypt(decBytes, passphrase []byte) []byte {
 	salt1 := getRandomBytes(saltSize1)
 	salt2AES := getRandomBytes(saltSize2)
 	salt2Cha := getRandomBytes(saltSize2)