merge main

crypto/Cargo.toml

@@ -10,12 +10,12 @@ version.workspace = true
 workspace = true
 
 [dependencies]
-aes-gcm = { version = "0.10.3", features = ["std"], optional = true }
-argon2 = { version = "0.5.3", features = ["std"], optional = true }
-cfg-if = "1.0.0"
-chacha20poly1305 = { version = "0.10.1", optional = true }
+aes-gcm = { workspace = true, features = ["std"], optional = true }
+argon2 = { workspace = true, features = ["std"], optional = true }
+cfg-if = { workspace = true }
+chacha20poly1305 = { workspace = true, optional = true }
 jsonwebtoken = { workspace = true }
-pbkdf2 = { version = "0.12.2", optional = true }
+pbkdf2 = { workspace = true, optional = true }
 rand = { workspace = true, optional = true }
 sha2 = { workspace = true, optional = true }
 thiserror.workspace = true

crypto/src/encdec/decrypt.rs

@@ -28,6 +28,97 @@ pub fn decrypt_data(password: &[u8], data: &[u8]) -> Result<Vec<u8>, crate::Erro
     }
 }
 
+// use argon2::{Argon2, PasswordHasher};
+// use argon2::password_hash::{SaltString};
+// use aes_gcm::{Aes256Gcm, Key, Nonce}; // For AES-GCM
+// use chacha20poly1305::{ChaCha20Poly1305, Key as ChaChaKey, Nonce as ChaChaNonce}; // For ChaCha20
+// use pbkdf2::pbkdf2;
+// use sha2::Sha256;
+// use std::io::{self, Read};
+// use thiserror::Error;
+
+// #[derive(Debug, Error)]
+// pub enum DecryptError {
+//     #[error("unexpected header")]
+//     UnexpectedHeader,
+//     #[error("invalid encryption algorithm ID")]
+//     InvalidAlgorithmId,
+//     #[error("IO error")]
+//     Io(#[from] io::Error),
+//     #[error("decryption error")]
+//     DecryptionError,
+// }
+
+// pub fn decrypt_data2<R: Read>(password: &str, mut data: R) -> Result<Vec<u8>, DecryptError> {
+//     // Parse the stream header
+//     let mut hdr = [0u8; 32 + 1 + 8];
+//     if data.read_exact(&mut hdr).is_err() {
+//         return Err(DecryptError::UnexpectedHeader);
+//     }
+
+//     let salt = &hdr[0..32];
+//     let id = hdr[32];
+//     let nonce = &hdr[33..41];
+
+//     let key = match id {
+//         // Argon2id + AES-GCM
+//         0x01 => {
+//             let salt = SaltString::encode_b64(salt).map_err(|_| DecryptError::DecryptionError)?;
+//             let argon2 = Argon2::default();
+//             let hashed_key = argon2.hash_password(password.as_bytes(), &salt)
+//                 .map_err(|_| DecryptError::DecryptionError)?;
+//             hashed_key.hash.unwrap().as_bytes().to_vec()
+//         }
+//         // Argon2id + ChaCha20Poly1305
+//         0x02 => {
+//             let salt = SaltString::encode_b64(salt).map_err(|_| DecryptError::DecryptionError)?;
+//             let argon2 = Argon2::default();
+//             let hashed_key = argon2.hash_password(password.as_bytes(), &salt)
+//                 .map_err(|_| DecryptError::DecryptionError)?;
+//             hashed_key.hash.unwrap().as_bytes().to_vec()
+//         }
+//         // PBKDF2 + AES-GCM
+//         // 0x03 => {
+//         //     let mut key = [0u8; 32];
+//         //     pbkdf2::<Sha256>(password.as_bytes(), salt, 10000, &mut key);
+//         //     key.to_vec()
+//         // }
+//         _ => return Err(DecryptError::InvalidAlgorithmId),
+//     };
+
+//     // Decrypt data using the corresponding cipher
+//     let mut encrypted_data = Vec::new();
+//     data.read_to_end(&mut encrypted_data)?;
+
+//     let plaintext = match id {
+//         0x01 => {
+//             let cipher = Aes256Gcm::new(Key::from_slice(&key));
+//             let nonce = Nonce::from_slice(nonce);
+//             cipher
+//                 .decrypt(nonce, encrypted_data.as_ref())
+//                 .map_err(|_| DecryptError::DecryptionError)?
+//         }
+//         0x02 => {
+//             let cipher = ChaCha20Poly1305::new(ChaChaKey::from_slice(&key));
+//             let nonce = ChaChaNonce::from_slice(nonce);
+//             cipher
+//                 .decrypt(nonce, encrypted_data.as_ref())
+//                 .map_err(|_| DecryptError::DecryptionError)?
+//         }
+//         0x03 => {
+
+//             let cipher = Aes256Gcm::new(Key::from_slice(&key));
+//             let nonce = Nonce::from_slice(nonce);
+//             cipher
+//                 .decrypt(nonce, encrypted_data.as_ref())
+//                 .map_err(|_| DecryptError::DecryptionError)?
+//         }
+//         _ => return Err(DecryptError::InvalidAlgorithmId),
+//     };
+
+//     Ok(plaintext)
+// }
+
 #[cfg(any(test, feature = "crypto"))]
 #[inline]
 fn decryp<T: aes_gcm::aead::Aead>(stream: T, nonce: &[u8], data: &[u8]) -> Result<Vec<u8>, crate::Error> {

crypto/src/encdec/encrypt.rs

@@ -42,8 +42,9 @@ fn encrypt<T: aes_gcm::aead::Aead>(
     data: &[u8],
 ) -> Result<Vec<u8>, crate::Error> {
     use crate::error::Error;
+    use aes_gcm::aead::rand_core::OsRng;
 
-    let nonce = T::generate_nonce(rand::thread_rng());
+    let nonce = T::generate_nonce(&mut OsRng);
 
     let encryptor = stream.encrypt(&nonce, data).map_err(Error::ErrEncryptFailed)?;