7407b89b8d
Remove banned imports (fmt, strings, os, errors, path/filepath) across all production and test files, replace with core.* primitives, coreio.ReadStream, and coreerr.E. Upgrade dappco.re/go/core v0.5.0 → v0.7.0 for core.PathBase and core.Is. Fix isRepoScoped to exclude pr.* capabilities (enforcement is at the forge layer, not the policy engine). Add Good/Bad/Ugly test coverage to all packages missing the mandatory three-category naming convention. Co-Authored-By: Virgil <virgil@lethean.io>
63 lines
1.9 KiB
Go
63 lines
1.9 KiB
Go
// Package crypt provides cryptographic utilities including encryption,
|
|
// hashing, key derivation, HMAC, and checksum functions.
|
|
package crypt
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"io"
|
|
|
|
coreerr "dappco.re/go/core/log"
|
|
|
|
"golang.org/x/crypto/argon2"
|
|
"golang.org/x/crypto/hkdf"
|
|
"golang.org/x/crypto/scrypt"
|
|
)
|
|
|
|
// Argon2id default parameters.
|
|
const (
|
|
argon2Memory = 64 * 1024 // 64 MB
|
|
argon2Time = 3
|
|
argon2Parallelism = 4
|
|
argon2KeyLen = 32
|
|
argon2SaltLen = 16
|
|
)
|
|
|
|
// DeriveKey derives a key from a passphrase using Argon2id with default parameters.
|
|
//
|
|
// key := crypt.DeriveKey([]byte("passphrase"), salt16, 32)
|
|
func DeriveKey(passphrase, salt []byte, keyLen uint32) []byte {
|
|
return argon2.IDKey(passphrase, salt, argon2Time, argon2Memory, argon2Parallelism, keyLen)
|
|
}
|
|
|
|
// DeriveKeyScrypt derives a key from a passphrase using scrypt.
|
|
//
|
|
// key, err := crypt.DeriveKeyScrypt([]byte("passphrase"), salt16, 32)
|
|
func DeriveKeyScrypt(passphrase, salt []byte, keyLen int) ([]byte, error) {
|
|
key, err := scrypt.Key(passphrase, salt, 32768, 8, 1, keyLen)
|
|
if err != nil {
|
|
return nil, coreerr.E("crypt.DeriveKeyScrypt", "failed to derive key", err)
|
|
}
|
|
return key, nil
|
|
}
|
|
|
|
// HKDF derives a key using HKDF-SHA256.
|
|
// secret is the input keying material, salt is optional (can be nil),
|
|
// info is optional context, and keyLen is the desired output length.
|
|
func HKDF(secret, salt, info []byte, keyLen int) ([]byte, error) {
|
|
reader := hkdf.New(sha256.New, secret, salt, info)
|
|
key := make([]byte, keyLen)
|
|
if _, err := io.ReadFull(reader, key); err != nil {
|
|
return nil, coreerr.E("crypt.HKDF", "failed to derive key", err)
|
|
}
|
|
return key, nil
|
|
}
|
|
|
|
// generateSalt creates a random salt of the given length.
|
|
func generateSalt(length int) ([]byte, error) {
|
|
salt := make([]byte, length)
|
|
if _, err := rand.Read(salt); err != nil {
|
|
return nil, coreerr.E("crypt.generateSalt", "failed to generate random salt", err)
|
|
}
|
|
return salt, nil
|
|
}
|