32a3613a3a
Add four new infrastructure packages with CLI commands: - pkg/config: layered configuration (defaults → file → env → flags) - pkg/crypt: crypto primitives (Argon2id, AES-GCM, ChaCha20, HMAC, checksums) - pkg/plugin: plugin system with GitHub-based install/update/remove - pkg/collect: collection subsystem (GitHub, BitcoinTalk, market, papers, excavate) Fix all golangci-lint issues across the entire codebase (~100 errcheck, staticcheck SA1012/SA1019/ST1005, unused, ineffassign fixes) so that `core go qa` passes with 0 issues. Closes #167, #168, #170, #250, #251, #252, #253, #254, #255, #256 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
60 lines
1.9 KiB
Go
60 lines
1.9 KiB
Go
// Package crypt provides cryptographic utilities including encryption,
|
|
// hashing, key derivation, HMAC, and checksum functions.
|
|
package crypt
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"io"
|
|
|
|
core "github.com/host-uk/core/pkg/framework/core"
|
|
"golang.org/x/crypto/argon2"
|
|
"golang.org/x/crypto/hkdf"
|
|
"golang.org/x/crypto/scrypt"
|
|
)
|
|
|
|
// Argon2id default parameters.
|
|
const (
|
|
argon2Memory = 64 * 1024 // 64 MB
|
|
argon2Time = 3
|
|
argon2Parallelism = 4
|
|
argon2KeyLen = 32
|
|
argon2SaltLen = 16
|
|
)
|
|
|
|
// DeriveKey derives a key from a passphrase using Argon2id with default parameters.
|
|
// The salt must be argon2SaltLen bytes. keyLen specifies the desired key length.
|
|
func DeriveKey(passphrase, salt []byte, keyLen uint32) []byte {
|
|
return argon2.IDKey(passphrase, salt, argon2Time, argon2Memory, argon2Parallelism, keyLen)
|
|
}
|
|
|
|
// DeriveKeyScrypt derives a key from a passphrase using scrypt.
|
|
// Uses recommended parameters: N=32768, r=8, p=1.
|
|
func DeriveKeyScrypt(passphrase, salt []byte, keyLen int) ([]byte, error) {
|
|
key, err := scrypt.Key(passphrase, salt, 32768, 8, 1, keyLen)
|
|
if err != nil {
|
|
return nil, core.E("crypt.DeriveKeyScrypt", "failed to derive key", err)
|
|
}
|
|
return key, nil
|
|
}
|
|
|
|
// HKDF derives a key using HKDF-SHA256.
|
|
// secret is the input keying material, salt is optional (can be nil),
|
|
// info is optional context, and keyLen is the desired output length.
|
|
func HKDF(secret, salt, info []byte, keyLen int) ([]byte, error) {
|
|
reader := hkdf.New(sha256.New, secret, salt, info)
|
|
key := make([]byte, keyLen)
|
|
if _, err := io.ReadFull(reader, key); err != nil {
|
|
return nil, core.E("crypt.HKDF", "failed to derive key", err)
|
|
}
|
|
return key, nil
|
|
}
|
|
|
|
// generateSalt creates a random salt of the given length.
|
|
func generateSalt(length int) ([]byte, error) {
|
|
salt := make([]byte, length)
|
|
if _, err := rand.Read(salt); err != nil {
|
|
return nil, core.E("crypt.generateSalt", "failed to generate random salt", err)
|
|
}
|
|
return salt, nil
|
|
}
|