tenseleyflow/shithub / bb02d2b

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+// Package secretbox is a thin AEAD wrapper used to protect at-rest

+// secrets — currently TOTP secrets, future sprints will reuse it for

+// per-user key material (PATs, deploy keys, etc.).

+//

+// Construction: chacha20poly1305 (XChaCha20 not used — we mint nonces

+// per-row and store them, so the smaller 12-byte nonce is fine).

+//

+// Key sourcing: 32-byte key, base64-encoded in config (auth.totp_key_b64

+// or env SHITHUB_TOTP_KEY). Operators rotate by re-encrypting all rows —

+// a key change without a rotation breaks every existing 2FA login. That

+// procedure is documented in docs/internal/2fa.md.

+package secretbox

+

+import (

+	"crypto/cipher"

+	"crypto/rand"

+	"encoding/base64"

+	"errors"

+	"fmt"

+

+	"golang.org/x/crypto/chacha20poly1305"

+)

+

+// KeySize is the required key length in bytes.

+const KeySize = chacha20poly1305.KeySize // 32

+

+// NonceSize is the AEAD nonce length, stored alongside the ciphertext.

+const NonceSize = chacha20poly1305.NonceSize // 12

+

+// Box wraps a ready-to-use AEAD. Construct with FromBase64 or FromBytes.

+type Box struct {

+	aead cipher.AEAD

+}

+

+// FromBase64 decodes the supplied base64 key (standard or url alphabet)

+// and returns a Box. Returns an error if the key isn't 32 bytes.

+func FromBase64(b64 string) (*Box, error) {

+	if b64 == "" {

+		return nil, errors.New("secretbox: empty key")

+	}

+	raw, err := decodeKey(b64)

+	if err != nil {

+		return nil, fmt.Errorf("secretbox: decode key: %w", err)

+	}

+	return FromBytes(raw)

+}

+

+// FromBytes wraps raw key bytes. Returns an error if not exactly KeySize.

+func FromBytes(key []byte) (*Box, error) {

+	if len(key) != KeySize {

+		return nil, fmt.Errorf("secretbox: key must be %d bytes, got %d", KeySize, len(key))

+	}

+	aead, err := chacha20poly1305.New(key)

+	if err != nil {

+		return nil, fmt.Errorf("secretbox: aead: %w", err)

+	}

+	return &Box{aead: aead}, nil

+}

+

+// Seal encrypts plaintext under a freshly minted random nonce. Returns

+// (ciphertext, nonce). Nonces are 12 bytes — at our scale the birthday

+// bound is well above the operational lifetime of any single key.

+func (b *Box) Seal(plaintext []byte) (ciphertext, nonce []byte, err error) {

+	nonce = make([]byte, NonceSize)

+	if _, err := rand.Read(nonce); err != nil {

+		return nil, nil, fmt.Errorf("secretbox: nonce: %w", err)

+	}

+	ciphertext = b.aead.Seal(nil, nonce, plaintext, nil)

+	return ciphertext, nonce, nil

+}

+

+// Open decrypts ciphertext with the stored nonce. Authenticated decryption

+// failures (tamper, wrong key) return a non-nil error.

+func (b *Box) Open(ciphertext, nonce []byte) ([]byte, error) {

+	if len(nonce) != NonceSize {

+		return nil, fmt.Errorf("secretbox: nonce must be %d bytes, got %d", NonceSize, len(nonce))

+	}

+	pt, err := b.aead.Open(nil, nonce, ciphertext, nil)

+	if err != nil {

+		return nil, fmt.Errorf("secretbox: open: %w", err)

+	}

+	return pt, nil

+}

+

+// GenerateKey returns a fresh 32-byte key suitable for FromBytes /

+// FromBase64. Used by the test harness and an operator helper.

+func GenerateKey() ([]byte, error) {

+	k := make([]byte, KeySize)

+	if _, err := rand.Read(k); err != nil {

+		return nil, err

+	}

+	return k, nil

+}

+

+// EncodeKey returns the standard-base64 encoding suitable for placing in

+// auth.totp_key_b64.

+func EncodeKey(key []byte) string {

+	return base64.StdEncoding.EncodeToString(key)

+}

+

+func decodeKey(s string) ([]byte, error) {

+	if raw, err := base64.StdEncoding.DecodeString(s); err == nil {

+		return raw, nil

+	}

+	return base64.URLEncoding.DecodeString(s)

+}

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+package secretbox

+

+import (

+	"bytes"

+	"testing"

+)

+

+func mustBox(t *testing.T) *Box {

+	t.Helper()

+	k, err := GenerateKey()

+	if err != nil {

+		t.Fatalf("GenerateKey: %v", err)

+	}

+	b, err := FromBytes(k)

+	if err != nil {

+		t.Fatalf("FromBytes: %v", err)

+	}

+	return b

+}

+

+func TestSealOpen_RoundTrip(t *testing.T) {

+	t.Parallel()

+	b := mustBox(t)

+	plaintext := []byte("hunter2-totp-secret-bytes")

+

+	ct, nonce, err := b.Seal(plaintext)

+	if err != nil {

+		t.Fatalf("Seal: %v", err)

+	}

+	if bytes.Contains(ct, plaintext) {

+		t.Fatal("ciphertext contains plaintext substring")

+	}

+	if len(nonce) != NonceSize {

+		t.Fatalf("nonce size = %d, want %d", len(nonce), NonceSize)

+	}

+

+	got, err := b.Open(ct, nonce)

+	if err != nil {

+		t.Fatalf("Open: %v", err)

+	}

+	if !bytes.Equal(got, plaintext) {

+		t.Fatalf("Open mismatch: %s", got)

+	}

+}

+

+func TestSealOpen_DifferentNoncesEachCall(t *testing.T) {

+	t.Parallel()

+	b := mustBox(t)

+	plaintext := []byte("same input each time")

+	_, n1, _ := b.Seal(plaintext)

+	_, n2, _ := b.Seal(plaintext)

+	if bytes.Equal(n1, n2) {

+		t.Fatal("nonces collided across two Seal calls")

+	}

+}

+

+func TestOpen_RejectsTamper(t *testing.T) {

+	t.Parallel()

+	b := mustBox(t)

+	ct, nonce, _ := b.Seal([]byte("authentic"))

+	ct[0] ^= 0x01

+	if _, err := b.Open(ct, nonce); err == nil {

+		t.Fatal("expected error for tampered ciphertext")

+	}

+}

+

+func TestOpen_RejectsWrongNonce(t *testing.T) {

+	t.Parallel()

+	b := mustBox(t)

+	ct, nonce, _ := b.Seal([]byte("authentic"))

+	otherNonce := make([]byte, len(nonce))

+	copy(otherNonce, nonce)

+	otherNonce[0] ^= 0x01

+	if _, err := b.Open(ct, otherNonce); err == nil {

+		t.Fatal("expected error for wrong nonce")

+	}

+}

+

+func TestOpen_RejectsWrongKey(t *testing.T) {

+	t.Parallel()

+	a := mustBox(t)

+	b := mustBox(t)

+	ct, nonce, _ := a.Seal([]byte("alice"))

+	if _, err := b.Open(ct, nonce); err == nil {

+		t.Fatal("expected error opening with different key")

+	}

+}

+

+func TestFromBase64_InvalidLength(t *testing.T) {

+	t.Parallel()

+	if _, err := FromBase64(EncodeKey([]byte("too short"))); err == nil {

+		t.Fatal("expected error for short key")

+	}

+	if _, err := FromBase64(""); err == nil {

+		t.Fatal("expected error for empty key")

+	}

+}

+

+func TestFromBase64_RoundTrip(t *testing.T) {

+	t.Parallel()

+	k, _ := GenerateKey()

+	b1, err := FromBase64(EncodeKey(k))

+	if err != nil {

+		t.Fatalf("FromBase64: %v", err)

+	}

+	b2, err := FromBytes(k)

+	if err != nil {

+		t.Fatalf("FromBytes: %v", err)

+	}

+	pt := []byte("alice")

+	ct, n, _ := b1.Seal(pt)

+	out, err := b2.Open(ct, n)

+	if err != nil {

+		t.Fatalf("Open: %v", err)

+	}

+	if !bytes.Equal(out, pt) {

+		t.Fatal("round-trip mismatch")

+	}

+}