-
Notifications
You must be signed in to change notification settings - Fork 0
/
cryptor.go
108 lines (90 loc) · 2.8 KB
/
cryptor.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
// Copyright (C) 2022 CYBERCRYPT
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published
// by the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see <https://www.gnu.org/licenses/>.
package crypto
import (
"bytes"
"encoding/gob"
"fmt"
)
const EncryptionKeyLength = 32
const WrapperKeyLength = 32
var ErrInvalidKeyLength = fmt.Errorf("invalid key length, accepted key length is %d bytes", WrapperKeyLength)
// Cryptor implements the CryptorInterface.
type Cryptor struct {
random RandomInterface
keyWrapper KeyWrapperInterface
aead AEADInterface
}
// NewAESCryptor creates a Cryptor which uses AES-256 in GCM mode.
func NewAESCryptor(KEK []byte) (Cryptor, error) {
if len(KEK) != WrapperKeyLength {
return Cryptor{}, ErrInvalidKeyLength
}
keyWrapper, err := NewKWP(KEK)
if err != nil {
return Cryptor{}, err
}
return Cryptor{
random: &NativeRandom{},
keyWrapper: keyWrapper,
aead: &AES256GCM{&NativeRandom{}},
}, nil
}
func (c *Cryptor) Encrypt(plaintext, data interface{}) ([]byte, []byte, error) {
var plaintextBuffer bytes.Buffer
enc := gob.NewEncoder(&plaintextBuffer)
if err := enc.Encode(plaintext); err != nil {
return nil, nil, err
}
var dataBuffer bytes.Buffer
enc = gob.NewEncoder(&dataBuffer)
if err := enc.Encode(data); err != nil {
return nil, nil, err
}
key, err := c.random.GetBytes(EncryptionKeyLength)
if err != nil {
return nil, nil, err
}
ciphertext, err := c.aead.Encrypt(plaintextBuffer.Bytes(), dataBuffer.Bytes(), key)
if err != nil {
return nil, nil, err
}
wrappedKey, err := c.keyWrapper.Wrap(key)
if err != nil {
return nil, nil, err
}
return wrappedKey, ciphertext, nil
}
func (c *Cryptor) Decrypt(plaintext, data interface{}, wrappedKey, ciphertext []byte) error {
key, err := c.keyWrapper.Unwrap(wrappedKey)
if err != nil {
return err
}
var buffer bytes.Buffer
enc := gob.NewEncoder(&buffer)
if err := enc.Encode(data); err != nil {
return err
}
dataBytes := buffer.Bytes()
// Need to copy here, as AEADInterface is allowed to modify the array.
ciphertextCopy := make([]byte, len(ciphertext))
copy(ciphertextCopy, ciphertext)
plaintextBytes, err := c.aead.Decrypt(ciphertextCopy, dataBytes, key)
if err != nil {
return err
}
dec := gob.NewDecoder(bytes.NewReader(plaintextBytes))
return dec.Decode(plaintext)
}