|
1 |
| -use argon2::{Config, Variant, Version}; |
2 |
| -use chacha20poly1305::aead::Aead; |
3 |
| -use chacha20poly1305::{Key, KeyInit, XChaCha20Poly1305, XNonce}; |
4 |
| -use color_eyre::eyre::{eyre, ErrReport}; |
5 |
| -use data_encoding::BASE64; |
6 |
| - |
7 |
| -use super::encrypted_database::EncryptedDatabase; |
8 |
| - |
9 |
| -const ARGON2ID_SALT_LENGTH: usize = 16; |
10 |
| -const XCHACHA20_POLY1305_NONCE_LENGTH: usize = 24; |
11 |
| -const XCHACHA20_POLY1305_KEY_LENGTH: usize = 32; |
12 |
| -const KEY_DERIVATION_CONFIG: Config = Config { |
13 |
| - variant: Variant::Argon2id, |
14 |
| - version: Version::Version13, |
15 |
| - mem_cost: 32768, |
16 |
| - time_cost: 4, |
17 |
| - lanes: 4, |
18 |
| - secret: &[], |
19 |
| - ad: &[], |
20 |
| - hash_length: XCHACHA20_POLY1305_KEY_LENGTH as u32, |
21 |
| -}; |
22 |
| - |
23 |
| -pub fn argon_derive_key(password_bytes: &[u8], salt: &[u8]) -> color_eyre::Result<Vec<u8>> { |
24 |
| - argon2::hash_raw(password_bytes, salt, &KEY_DERIVATION_CONFIG).map_err(ErrReport::from) |
25 |
| -} |
26 |
| - |
27 |
| -pub fn gen_salt() -> color_eyre::Result<[u8; ARGON2ID_SALT_LENGTH]> { |
28 |
| - let mut salt: [u8; ARGON2ID_SALT_LENGTH] = [0; ARGON2ID_SALT_LENGTH]; |
29 |
| - getrandom::fill(&mut salt).map_err(|e| eyre!(e))?; |
30 |
| - Ok(salt) |
31 |
| -} |
32 |
| - |
33 |
| -pub fn encrypt_string_with_key( |
34 |
| - plain_text: &str, |
35 |
| - key: &Vec<u8>, |
36 |
| - salt: &[u8], |
37 |
| -) -> color_eyre::Result<EncryptedDatabase> { |
38 |
| - let wrapped_key = Key::from_slice(key.as_slice()); |
39 |
| - |
40 |
| - let aead = XChaCha20Poly1305::new(wrapped_key); |
41 |
| - let mut nonce_bytes: [u8; XCHACHA20_POLY1305_NONCE_LENGTH] = |
42 |
| - [0; XCHACHA20_POLY1305_NONCE_LENGTH]; |
43 |
| - |
44 |
| - getrandom::fill(&mut nonce_bytes).map_err(|e| eyre!(e))?; |
45 |
| - |
46 |
| - let nonce = XNonce::from_slice(&nonce_bytes); |
47 |
| - let cipher_text = aead |
48 |
| - .encrypt(nonce, plain_text.as_bytes()) |
49 |
| - .map_err(|e| eyre!("Error during encryption: {e}"))?; |
50 |
| - Ok(EncryptedDatabase::new( |
51 |
| - 1, |
52 |
| - BASE64.encode(&nonce_bytes), |
53 |
| - BASE64.encode(salt), |
54 |
| - BASE64.encode(&cipher_text), |
55 |
| - )) |
56 |
| -} |
57 |
| - |
58 |
| -pub fn decrypt_string( |
59 |
| - encrypted_text: &str, |
60 |
| - password: &str, |
61 |
| -) -> color_eyre::Result<(String, Vec<u8>, Vec<u8>)> { |
62 |
| - //encrypted text is an encrypted database json serialized object |
63 |
| - let encrypted_database: EncryptedDatabase = serde_json::from_str(encrypted_text) |
64 |
| - .map_err(|e| eyre!("Error during encrypted database deserialization: {e}"))?; |
65 |
| - let nonce = BASE64 |
66 |
| - .decode(encrypted_database.nonce().as_bytes()) |
67 |
| - .expect("Cannot decode Base64 nonce"); |
68 |
| - let cipher_text = BASE64 |
69 |
| - .decode(encrypted_database.cipher().as_bytes()) |
70 |
| - .expect("Cannot decode Base64 cipher"); |
71 |
| - let salt = BASE64.decode(encrypted_database.salt().as_bytes()).unwrap(); |
72 |
| - |
73 |
| - let key: Vec<u8> = argon_derive_key(password.as_bytes(), salt.as_slice())?; |
74 |
| - |
75 |
| - let wrapped_key = Key::from_slice(&key); |
76 |
| - |
77 |
| - let aead = XChaCha20Poly1305::new(wrapped_key); |
78 |
| - let nonce = XNonce::from_slice(nonce.as_slice()); |
79 |
| - let decrypted = aead |
80 |
| - .decrypt(nonce, cipher_text.as_slice()) |
81 |
| - .map_err(|_| eyre!("Wrong password"))?; |
82 |
| - let from_utf8 = String::from_utf8(decrypted).map_err(ErrReport::from)?; |
83 |
| - Ok((from_utf8, key, salt)) |
84 |
| -} |
85 |
| - |
86 |
| -#[cfg(test)] |
87 |
| -mod tests { |
88 |
| - use crate::crypto::cryptography::{argon_derive_key, gen_salt}; |
89 |
| - |
90 |
| - use super::{decrypt_string, encrypt_string_with_key}; |
91 |
| - |
92 |
| - #[test] |
93 |
| - fn test_encryption() { |
94 |
| - let salt = gen_salt().unwrap(); |
95 |
| - let key = argon_derive_key(b"pa$$w0rd", salt.as_ref()).unwrap(); |
96 |
| - let encrypted = encrypt_string_with_key("Secret data@#[]ò", &key, salt.as_ref()).unwrap(); |
97 |
| - let (decrypted, _key, _salt) = |
98 |
| - decrypt_string(&serde_json::to_string(&encrypted).unwrap(), "pa$$w0rd").unwrap(); |
99 |
| - assert_eq!(String::from("Secret data@#[]ò"), decrypted); |
100 |
| - } |
101 |
| -} |
| 1 | +use argon2::{Config, Variant, Version}; |
| 2 | +use chacha20poly1305::aead::Aead; |
| 3 | +use chacha20poly1305::{Key, KeyInit, XChaCha20Poly1305, XNonce}; |
| 4 | +use color_eyre::eyre::{ErrReport, eyre}; |
| 5 | +use data_encoding::BASE64; |
| 6 | + |
| 7 | +use super::encrypted_database::EncryptedDatabase; |
| 8 | + |
| 9 | +const ARGON2ID_SALT_LENGTH: usize = 16; |
| 10 | +const XCHACHA20_POLY1305_NONCE_LENGTH: usize = 24; |
| 11 | +const XCHACHA20_POLY1305_KEY_LENGTH: usize = 32; |
| 12 | +const KEY_DERIVATION_CONFIG: Config = Config { |
| 13 | + variant: Variant::Argon2id, |
| 14 | + version: Version::Version13, |
| 15 | + mem_cost: 32768, |
| 16 | + time_cost: 4, |
| 17 | + lanes: 4, |
| 18 | + secret: &[], |
| 19 | + ad: &[], |
| 20 | + hash_length: XCHACHA20_POLY1305_KEY_LENGTH as u32, |
| 21 | +}; |
| 22 | + |
| 23 | +pub fn argon_derive_key(password_bytes: &[u8], salt: &[u8]) -> color_eyre::Result<Vec<u8>> { |
| 24 | + argon2::hash_raw(password_bytes, salt, &KEY_DERIVATION_CONFIG).map_err(ErrReport::from) |
| 25 | +} |
| 26 | + |
| 27 | +pub fn gen_salt() -> color_eyre::Result<[u8; ARGON2ID_SALT_LENGTH]> { |
| 28 | + let mut salt: [u8; ARGON2ID_SALT_LENGTH] = [0; ARGON2ID_SALT_LENGTH]; |
| 29 | + getrandom::fill(&mut salt).map_err(|e| eyre!(e))?; |
| 30 | + Ok(salt) |
| 31 | +} |
| 32 | + |
| 33 | +pub fn encrypt_string_with_key( |
| 34 | + plain_text: &str, |
| 35 | + key: &Vec<u8>, |
| 36 | + salt: &[u8], |
| 37 | +) -> color_eyre::Result<EncryptedDatabase> { |
| 38 | + let wrapped_key = Key::from_slice(key.as_slice()); |
| 39 | + |
| 40 | + let aead = XChaCha20Poly1305::new(wrapped_key); |
| 41 | + let mut nonce_bytes: [u8; XCHACHA20_POLY1305_NONCE_LENGTH] = |
| 42 | + [0; XCHACHA20_POLY1305_NONCE_LENGTH]; |
| 43 | + |
| 44 | + getrandom::fill(&mut nonce_bytes).map_err(|e| eyre!(e))?; |
| 45 | + |
| 46 | + let nonce = XNonce::from_slice(&nonce_bytes); |
| 47 | + let cipher_text = aead |
| 48 | + .encrypt(nonce, plain_text.as_bytes()) |
| 49 | + .map_err(|e| eyre!("Error during encryption: {e}"))?; |
| 50 | + Ok(EncryptedDatabase::new( |
| 51 | + 1, |
| 52 | + BASE64.encode(&nonce_bytes), |
| 53 | + BASE64.encode(salt), |
| 54 | + BASE64.encode(&cipher_text), |
| 55 | + )) |
| 56 | +} |
| 57 | + |
| 58 | +pub fn decrypt_string( |
| 59 | + encrypted_text: &str, |
| 60 | + password: &str, |
| 61 | +) -> color_eyre::Result<(String, Vec<u8>, Vec<u8>)> { |
| 62 | + //encrypted text is an encrypted database json serialized object |
| 63 | + let encrypted_database: EncryptedDatabase = serde_json::from_str(encrypted_text) |
| 64 | + .map_err(|e| eyre!("Error during encrypted database deserialization: {e}"))?; |
| 65 | + let nonce = BASE64 |
| 66 | + .decode(encrypted_database.nonce().as_bytes()) |
| 67 | + .expect("Cannot decode Base64 nonce"); |
| 68 | + let cipher_text = BASE64 |
| 69 | + .decode(encrypted_database.cipher().as_bytes()) |
| 70 | + .expect("Cannot decode Base64 cipher"); |
| 71 | + let salt = BASE64.decode(encrypted_database.salt().as_bytes()).unwrap(); |
| 72 | + |
| 73 | + let key: Vec<u8> = argon_derive_key(password.as_bytes(), salt.as_slice())?; |
| 74 | + |
| 75 | + let wrapped_key = Key::from_slice(&key); |
| 76 | + |
| 77 | + let aead = XChaCha20Poly1305::new(wrapped_key); |
| 78 | + let nonce = XNonce::from_slice(nonce.as_slice()); |
| 79 | + let decrypted = aead |
| 80 | + .decrypt(nonce, cipher_text.as_slice()) |
| 81 | + .map_err(|_| eyre!("Wrong password"))?; |
| 82 | + let from_utf8 = String::from_utf8(decrypted).map_err(ErrReport::from)?; |
| 83 | + Ok((from_utf8, key, salt)) |
| 84 | +} |
| 85 | + |
| 86 | +#[cfg(test)] |
| 87 | +mod tests { |
| 88 | + use crate::crypto::cryptography::{argon_derive_key, gen_salt}; |
| 89 | + |
| 90 | + use super::{decrypt_string, encrypt_string_with_key}; |
| 91 | + |
| 92 | + #[test] |
| 93 | + fn test_encryption() { |
| 94 | + let salt = gen_salt().unwrap(); |
| 95 | + let key = argon_derive_key(b"pa$$w0rd", salt.as_ref()).unwrap(); |
| 96 | + let encrypted = encrypt_string_with_key("Secret data@#[]ò", &key, salt.as_ref()).unwrap(); |
| 97 | + let (decrypted, _key, _salt) = |
| 98 | + decrypt_string(&serde_json::to_string(&encrypted).unwrap(), "pa$$w0rd").unwrap(); |
| 99 | + assert_eq!(String::from("Secret data@#[]ò"), decrypted); |
| 100 | + } |
| 101 | +} |
0 commit comments