clawbot
04b5db6fbf
check / check (push) Failing after 0s
Accumulating milestone branch. One squashed commit per closed issue; `next` is kept green and mergeable to `main` at any time without notice. Landed so far: - `chore: update golangci-lint to v2.12.2 with canonical config` (#54) — canonical v2-schema `.golangci.yml`, pins bumped in `Dockerfile` and `script/bootstrap`, tree at `0 issues.`. Three behaviour deltas are recorded in that PR's body: `Cache.StoreVariant` takes a context, `MetadataStorage.Store` no longer leaks temp files on failure, and the `signing_key` too-short error text gained a `value too short:` prefix. Sequencing for the milestone is tracked in #103. Reviewed-on: #105 Co-authored-by: clawbot <clawbot@noreply.example.org>
88 lines
2.3 KiB
Go
88 lines
2.3 KiB
Go
// Package seal provides authenticated encryption utilities for pixa.
|
|
// It uses NaCl secretbox (XSalsa20-Poly1305) for sealing data
|
|
// and HKDF-SHA256 for key derivation.
|
|
package seal
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"errors"
|
|
"io"
|
|
|
|
"golang.org/x/crypto/hkdf"
|
|
"golang.org/x/crypto/nacl/secretbox"
|
|
)
|
|
|
|
// Key sizes for NaCl secretbox.
|
|
const (
|
|
KeySize = 32 // NaCl secretbox key size
|
|
NonceSize = 24 // NaCl secretbox nonce size
|
|
)
|
|
|
|
// Errors returned by crypto operations.
|
|
var (
|
|
ErrDecryptionFailed = errors.New("decryption failed: invalid ciphertext or key")
|
|
ErrInvalidPayload = errors.New("invalid encrypted payload")
|
|
ErrKeyDerivation = errors.New("key derivation failed")
|
|
)
|
|
|
|
// DeriveKey uses HKDF-SHA256 to derive a key from master key material.
|
|
// The salt parameter provides domain separation between different key usages.
|
|
func DeriveKey(masterKey []byte, salt string) ([KeySize]byte, error) {
|
|
var key [KeySize]byte
|
|
|
|
hkdfReader := hkdf.New(sha256.New, masterKey, []byte(salt), nil)
|
|
|
|
_, err := io.ReadFull(hkdfReader, key[:])
|
|
if err != nil {
|
|
return key, ErrKeyDerivation
|
|
}
|
|
|
|
return key, nil
|
|
}
|
|
|
|
// Encrypt encrypts plaintext using NaCl secretbox (XSalsa20-Poly1305).
|
|
// Returns base64url-encoded ciphertext with the nonce prepended.
|
|
func Encrypt(key [KeySize]byte, plaintext []byte) (string, error) {
|
|
// Generate random nonce
|
|
var nonce [NonceSize]byte
|
|
|
|
_, err := rand.Read(nonce[:])
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
// Encrypt: nonce + secretbox.Seal(plaintext)
|
|
encrypted := secretbox.Seal(nonce[:], plaintext, &nonce, &key)
|
|
|
|
return base64.RawURLEncoding.EncodeToString(encrypted), nil
|
|
}
|
|
|
|
// Decrypt decrypts base64url-encoded ciphertext using NaCl secretbox.
|
|
// Expects the nonce to be prepended to the ciphertext.
|
|
func Decrypt(key [KeySize]byte, ciphertext string) ([]byte, error) {
|
|
// Decode base64url
|
|
data, err := base64.RawURLEncoding.DecodeString(ciphertext)
|
|
if err != nil {
|
|
return nil, ErrInvalidPayload
|
|
}
|
|
|
|
// Check minimum length (nonce + at least some ciphertext + auth tag)
|
|
if len(data) < NonceSize+secretbox.Overhead {
|
|
return nil, ErrInvalidPayload
|
|
}
|
|
|
|
// Extract nonce
|
|
var nonce [NonceSize]byte
|
|
copy(nonce[:], data[:NonceSize])
|
|
|
|
// Decrypt
|
|
plaintext, ok := secretbox.Open(nil, data[NonceSize:], &nonce, &key)
|
|
if !ok {
|
|
return nil, ErrDecryptionFailed
|
|
}
|
|
|
|
return plaintext, nil
|
|
}
|