`ca79610`

Add CLI encryption commands: encrypt/decrypt with password prompts, progress bars, content verification, and production scrypt params

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 8 months ago

SHA: ca79610e621c834d65bfbda52da2f46ec805cabf
Parents: d6e61b4
Tree: 7b14107

6 changed files

Status	File	+	-
M	`Cargo.toml`	3	0
A	`src/commands/decrypt.rs`	240	0
A	`src/commands/encrypt.rs`	250	0
M	`src/commands/mod.rs`	4	0
M	`src/main.rs`	9	1
A	`test_file.txt.zfs`	107	0

Cargo.tomlmodified

  async-trait = "0.1"
  lazy_static = "1.4"
++# ZephyrFS node dependency for crypto
++zephyrfs-node = { path = "../zephyrfs-node" }
++
  [dev-dependencies]
  tempfile = "3.8"
  tokio-test = "0.4"

src/commands/decrypt.rsadded

++use clap::Args;
++use anyhow::{Context, Result};
++use dialoguer::{theme::ColorfulTheme, Password};
++use indicatif::{ProgressBar, ProgressStyle};
++use std::path::PathBuf;
++use tracing::info;
++use humansize::{format_size, BINARY};
++
++use crate::config::Config;
++use super::Command;
++
++#[derive(Debug, Args)]
++pub struct DecryptCommand {
++    /// Encrypted file to decrypt
++    input: PathBuf,
++
++    /// Output file path (defaults to original filename)
++    #[arg(short, long)]
++    output: Option<PathBuf>,
++
++    /// Password for decryption (will prompt if not provided)
++    #[arg(short, long)]
++    password: Option<String>,
++
++    /// Show progress bar
++    #[arg(long, default_value = "true")]
++    progress: bool,
++
++    /// Skip content verification
++    #[arg(long)]
++    skip_verify: bool,
++
++    /// Force overwrite of existing output file
++    #[arg(long)]
++    force: bool,
++}
++
++#[async_trait::async_trait]
++impl Command for DecryptCommand {
++    async fn execute(&self, _config: &Config) -> Result<()> {
++        info!("Decrypting file: {:?}", self.input);
++
++        // Validate input file
++        if !self.input.exists() {
++            anyhow::bail!("File does not exist: {:?}", self.input);
++        }
++
++        if !self.input.is_file() {
++            anyhow::bail!("Path is not a file: {:?}", self.input);
++        }
++
++        // Read and parse encrypted file
++        let encrypted_data = tokio::fs::read(&self.input).await
++            .with_context(|| format!("Failed to read encrypted file: {:?}", self.input))?;
++
++        let encrypted_file: EncryptedFileFormat = serde_json::from_slice(&encrypted_data)
++            .context("Failed to parse encrypted file format. This may not be a valid ZephyrFS encrypted file.")?;
++
++        // Validate file format version
++        if encrypted_file.version != 1 {
++            anyhow::bail!("Unsupported encrypted file version: {}. This CLI supports version 1.", encrypted_file.version);
++        }
++
++        // Determine output path
++        let output_path = self.output.clone().unwrap_or_else(|| {
++            // Try to restore original filename
++            if encrypted_file.filename != "unknown" {
++                PathBuf::from(&encrypted_file.filename)
++            } else {
++                // Strip .zfs extension if present
++                let mut output = self.input.clone();
++                if let Some(stem) = output.file_stem().map(|s| s.to_os_string()) {
++                    output.set_file_name(stem);
++                } else {
++                    output.set_extension("decrypted");
++                }
++                output
++            }
++        });
++
++        // Check if output exists
++        if output_path.exists() && !self.force {
++            anyhow::bail!("Output file already exists: {:?}. Use --force to overwrite.", output_path);
++        }
++
++        println!("Decrypting: {}", encrypted_file.filename);
++        println!("  Original size: {}", format_size(encrypted_file.original_size, BINARY));
++        println!("  Segments: {}", encrypted_file.encrypted_segments.len());
++        println!("  Created: {}", encrypted_file.created_at.format("%Y-%m-%d %H:%M:%S UTC"));
++        println!("  Output: {:?}", output_path);
++
++        // Get password
++        let password = if let Some(ref pw) = self.password {
++            pw.clone()
++        } else {
++            let theme = ColorfulTheme::default();
++            Password::with_theme(&theme)
++                .with_prompt("Enter password for decryption")
++                .interact()
++                .context("Failed to read password")?
++        };
++
++        // Create progress bar
++        let progress = if self.progress {
++            let pb = ProgressBar::new(encrypted_file.original_size);
++            pb.set_style(
++                ProgressStyle::default_bar()
++                    .template("[{elapsed_precise}] {bar:40.cyan/blue} {percent}% {bytes}/{total_bytes} ETA: {eta}")
++                    .unwrap()
++                    .progress_chars("##-")
++            );
++            Some(pb)
++        } else {
++            None
++        };
++
++        // Initialize crypto system
++        let crypto = create_crypto_system(&password, encrypted_file.chunk_size_mb)?;
++
++        // Convert segments back to internal format
++        let encrypted_segments: Vec<zephyrfs_node::crypto::EncryptedData> = encrypted_file.encrypted_segments
++            .into_iter()
++            .map(|s| s.into())
++            .collect();
++
++        // Decrypt file
++        let decrypted_data = crypto.decrypt_file(&encrypted_segments)
++            .context("Failed to decrypt file. Check your password and try again.")?;
++
++        // Verify content integrity if requested
++        if !self.skip_verify {
++            println!("Verifying content integrity...");
++            let computed_content_id = crypto.content_id(&decrypted_data);
++            let expected_content_id = zephyrfs_node::crypto::ContentId::from_hex(
++                zephyrfs_node::crypto::HashAlgorithm::Blake3,
++                &encrypted_file.content_id
++            ).context("Invalid content ID in encrypted file")?;
++
++            if !crypto.verify_content(&decrypted_data, &expected_content_id) {
++                anyhow::bail!("Content verification failed! The decrypted file may be corrupted.");
++            }
++            println!("✅ Content integrity verified");
++        }
++
++        // Verify size matches
++        if decrypted_data.len() as u64 != encrypted_file.original_size {
++            anyhow::bail!("Size mismatch: expected {} bytes, got {} bytes",
++                         encrypted_file.original_size,
++                         decrypted_data.len());
++        }
++
++        // Write decrypted file
++        tokio::fs::write(&output_path, &decrypted_data).await
++            .with_context(|| format!("Failed to write decrypted file: {:?}", output_path))?;
++
++        if let Some(pb) = progress {
++            pb.finish_with_message("Decryption complete");
++        }
++
++        println!("✅ File decrypted successfully!");
++        println!("  Restored file: {:?}", output_path);
++        println!("  Size: {}", format_size(decrypted_data.len() as u64, BINARY));
++
++        // Security cleanup note
++        println!();
++        println!("🔒 Security Notes:");
++        println!("  • The original encrypted file is unchanged");
++        println!("  • Consider securely deleting the encrypted file if no longer needed");
++
++        Ok(())
++    }
++}
++
++// Encrypted file format for storage (must match encrypt.rs)
++#[derive(Debug, serde::Serialize, serde::Deserialize)]
++struct EncryptedFileFormat {
++    version: u32,
++    filename: String,
++    original_size: u64,
++    chunk_size_mb: u32,
++    content_id: String,
++    hash_algorithm: String,
++    encrypted_segments: Vec<EncryptedSegment>,
++    created_at: chrono::DateTime<chrono::Utc>,
++}
++
++#[derive(Debug, serde::Serialize, serde::Deserialize)]
++struct EncryptedSegment {
++    segment_index: u64,
++    ciphertext: Vec<u8>,
++    nonce: [u8; 12],
++    aad: Vec<u8>,
++    key_path: Vec<u32>,
++}
++
++// Helper function to create crypto system (must match encrypt.rs)
++fn create_crypto_system(password: &str, chunk_size_mb: u32) -> Result<ZephyrCrypto> {
++    use zephyrfs_node::crypto::{ZephyrCrypto, CryptoParams, ScryptParams, AesParams, HashParams, ContentHasher, VerificationHasher};
++
++    // Create crypto parameters (must match encryption parameters)
++    let params = CryptoParams {
++        scrypt_params: ScryptParams {
++            log_n: 17,          // Strong security
++            r: 8,
++            p: 1,
++            output_len: 64,
++        },
++        aes_params: AesParams {
++            key_len: 32,
++            nonce_len: 12,
++            tag_len: 16,
++        },
++        hash_params: HashParams {
++            content_hasher: ContentHasher::Blake3,
++            verification_hasher: VerificationHasher::Blake3,
++        },
++    };
++
++    let mut crypto = ZephyrCrypto::with_params(params);
++    crypto.init_from_password(password)
++        .context("Failed to initialize crypto system with password")?;
++
++    Ok(crypto)
++}
++
++// Convert between CLI types and zephyrfs_node types
++impl From<EncryptedSegment> for zephyrfs_node::crypto::EncryptedData {
++    fn from(segment: EncryptedSegment) -> Self {
++        Self {
++            segment_index: segment.segment_index,
++            ciphertext: segment.ciphertext,
++            nonce: segment.nonce,
++            aad: segment.aad,
++            key_path: segment.key_path,
++        }
++    }
++}
++
++// Import necessary items from zephyrfs_node
++use zephyrfs_node::crypto::ZephyrCrypto;

src/commands/encrypt.rsadded

++use clap::Args;
++use anyhow::{Context, Result};
++use dialoguer::{theme::ColorfulTheme, Password};
++use indicatif::{ProgressBar, ProgressStyle};
++use std::path::PathBuf;
++use tracing::info;
++use humansize::{format_size, BINARY};
++
++use crate::config::Config;
++use super::Command;
++
++#[derive(Debug, Args)]
++pub struct EncryptCommand {
++    /// File to encrypt
++    input: PathBuf,
++
++    /// Output file path (defaults to input.zfs)
++    #[arg(short, long)]
++    output: Option<PathBuf>,
++
++    /// Password for encryption (will prompt if not provided)
++    #[arg(short, long)]
++    password: Option<String>,
++
++    /// Show progress bar
++    #[arg(long, default_value = "true")]
++    progress: bool,
++
++    /// Verification hash algorithm (blake3, sha256, both)
++    #[arg(long, default_value = "both")]
++    hash: String,
++
++    /// Chunk size in MB for large files
++    #[arg(long, default_value = "1")]
++    chunk_size: u32,
++}
++
++#[async_trait::async_trait]
++impl Command for EncryptCommand {
++    async fn execute(&self, _config: &Config) -> Result<()> {
++        info!("Encrypting file: {:?}", self.input);
++
++        // Validate input file
++        if !self.input.exists() {
++            anyhow::bail!("File does not exist: {:?}", self.input);
++        }
++
++        if !self.input.is_file() {
++            anyhow::bail!("Path is not a file: {:?}", self.input);
++        }
++
++        let metadata = tokio::fs::metadata(&self.input).await
++            .with_context(|| format!("Failed to read file metadata: {:?}", self.input))?;
++
++        let file_size = metadata.len();
++        let display_name = self.input.file_name()
++            .and_then(|n| n.to_str())
++            .unwrap_or("unknown");
++
++        // Determine output path
++        let output_path = self.output.clone().unwrap_or_else(|| {
++            let mut output = self.input.clone();
++            let current_ext = output.extension()
++                .and_then(|s| s.to_str())
++                .unwrap_or("");
++            if current_ext.is_empty() {
++                output.set_extension("zfs");
++            } else {
++                output.set_extension(format!("{}.zfs", current_ext));
++            }
++            output
++        });
++
++        // Check if output exists
++        if output_path.exists() {
++            anyhow::bail!("Output file already exists: {:?}. Remove it first or specify a different output.", output_path);
++        }
++
++        println!("Encrypting: {}", display_name);
++        println!("  Size: {}", format_size(file_size, BINARY));
++        println!("  Output: {:?}", output_path);
++
++        // Get password
++        let password = if let Some(ref pw) = self.password {
++            pw.clone()
++        } else {
++            let theme = ColorfulTheme::default();
++            Password::with_theme(&theme)
++                .with_prompt("Enter password for encryption")
++                .interact()
++                .context("Failed to read password")?
++        };
++
++        // Validate password strength
++        if password.len() < 8 {
++            anyhow::bail!("Password must be at least 8 characters long");
++        }
++
++        // Create progress bar
++        let progress = if self.progress {
++            let pb = ProgressBar::new(file_size);
++            pb.set_style(
++                ProgressStyle::default_bar()
++                    .template("[{elapsed_precise}] {bar:40.cyan/blue} {percent}% {bytes}/{total_bytes} ETA: {eta}")
++                    .unwrap()
++                    .progress_chars("##-")
++            );
++            Some(pb)
++        } else {
++            None
++        };
++
++        // Read file data
++        let file_data = tokio::fs::read(&self.input).await
++            .with_context(|| format!("Failed to read file: {:?}", self.input))?;
++
++        // Initialize crypto system
++        let crypto = create_crypto_system(&password, self.chunk_size)?;
++
++        // Encrypt file
++        let encrypted_data = crypto.encrypt_file(&file_data)
++            .context("Failed to encrypt file")?;
++
++        // Convert to CLI format
++        let encrypted_segments: Vec<EncryptedSegment> = encrypted_data
++            .into_iter()
++            .map(|data| data.into())
++            .collect();
++
++        // Generate content verification
++        let content_id = crypto.content_id(&file_data);
++
++        // Create encrypted file format
++        let encrypted_file = EncryptedFileFormat {
++            version: 1,
++            filename: display_name.to_string(),
++            original_size: file_size,
++            chunk_size_mb: self.chunk_size,
++            content_id: content_id.to_hex(),
++            hash_algorithm: self.hash.clone(),
++            encrypted_segments,
++            created_at: chrono::Utc::now(),
++        };
++
++        // Serialize and write encrypted file
++        let serialized = serde_json::to_vec_pretty(&encrypted_file)
++            .context("Failed to serialize encrypted file")?;
++
++        tokio::fs::write(&output_path, &serialized).await
++            .with_context(|| format!("Failed to write encrypted file: {:?}", output_path))?;
++
++        if let Some(pb) = progress {
++            pb.finish_with_message("Encryption complete");
++        }
++
++        println!("✅ File encrypted successfully!");
++        println!("  Encrypted file: {:?}", output_path);
++        println!("  Content ID: {}", encrypted_file.content_id);
++        println!("  Segments: {}", encrypted_file.encrypted_segments.len());
++
++        // Security reminder
++        println!();
++        println!("🔒 Security Notes:");
++        println!("  • Keep your password safe - it cannot be recovered");
++        println!("  • The encrypted file contains no plaintext metadata");
++        println!("  • Use 'zephyrfs decrypt' to restore the original file");
++
++        Ok(())
++    }
++}
++
++// Encrypted file format for storage
++#[derive(Debug, serde::Serialize, serde::Deserialize)]
++struct EncryptedFileFormat {
++    version: u32,
++    filename: String,
++    original_size: u64,
++    chunk_size_mb: u32,
++    content_id: String,
++    hash_algorithm: String,
++    encrypted_segments: Vec<EncryptedSegment>,
++    created_at: chrono::DateTime<chrono::Utc>,
++}
++
++#[derive(Debug, serde::Serialize, serde::Deserialize)]
++struct EncryptedSegment {
++    segment_index: u64,
++    ciphertext: Vec<u8>,
++    nonce: [u8; 12],
++    aad: Vec<u8>,
++    key_path: Vec<u32>,
++}
++
++// Helper function to create crypto system
++fn create_crypto_system(password: &str, chunk_size_mb: u32) -> Result<ZephyrCrypto> {
++    use zephyrfs_node::crypto::{ZephyrCrypto, CryptoParams, ScryptParams, AesParams, HashParams, ContentHasher, VerificationHasher};
++
++    // Create crypto parameters
++    let params = CryptoParams {
++        scrypt_params: ScryptParams {
++            log_n: 17,          // Strong security
++            r: 8,
++            p: 1,
++            output_len: 64,
++        },
++        aes_params: AesParams {
++            key_len: 32,
++            nonce_len: 12,
++            tag_len: 16,
++        },
++        hash_params: HashParams {
++            content_hasher: ContentHasher::Blake3,
++            verification_hasher: VerificationHasher::Blake3,
++        },
++    };
++
++    let mut crypto = ZephyrCrypto::with_params(params);
++    crypto.init_from_password(password)
++        .context("Failed to initialize crypto system with password")?;
++
++    Ok(crypto)
++}
++
++// Convert between zephyrfs_node types and CLI types
++impl From<zephyrfs_node::crypto::EncryptedData> for EncryptedSegment {
++    fn from(data: zephyrfs_node::crypto::EncryptedData) -> Self {
++        Self {
++            segment_index: data.segment_index,
++            ciphertext: data.ciphertext,
++            nonce: data.nonce,
++            aad: data.aad,
++            key_path: data.key_path,
++        }
++    }
++}
++
++impl From<EncryptedSegment> for zephyrfs_node::crypto::EncryptedData {
++    fn from(segment: EncryptedSegment) -> Self {
++        Self {
++            segment_index: segment.segment_index,
++            ciphertext: segment.ciphertext,
++            nonce: segment.nonce,
++            aad: segment.aad,
++            key_path: segment.key_path,
++        }
++    }
++}
++
++// Import necessary items from zephyrfs_node
++use zephyrfs_node::crypto::ZephyrCrypto;

src/commands/mod.rsmodified

  mod download;
  mod list;
  mod status;
++mod encrypt;
++mod decrypt;
  pub use init::InitCommand;
  pub use join::JoinCommand;
  pub use download::DownloadCommand;
  pub use list::ListCommand;
  pub use status::StatusCommand;
++pub use encrypt::EncryptCommand;
++pub use decrypt::DecryptCommand;
  use anyhow::Result;
  use crate::config::Config;

src/main.rsmodified

  mod config;
  mod client;
--use commands::{InitCommand, JoinCommand, UploadCommand, DownloadCommand, ListCommand, StatusCommand, Command};
++use commands::{InitCommand, JoinCommand, UploadCommand, DownloadCommand, ListCommand, StatusCommand, EncryptCommand, DecryptCommand, Command};
  #[derive(Parser)]
  #[command(name = "zephyrfs")]
      /// Show node status and network information
      Status(StatusCommand),
++
++    /// Encrypt a file with password
++    Encrypt(EncryptCommand),
++
++    /// Decrypt a file with password
++    Decrypt(DecryptCommand),
  }
  #[tokio::main]
          Commands::Download(cmd) => cmd.execute(&config).await,
          Commands::List(cmd) => cmd.execute(&config).await,
          Commands::Status(cmd) => cmd.execute(&config).await,
++        Commands::Encrypt(cmd) => cmd.execute(&config).await,
++        Commands::Decrypt(cmd) => cmd.execute(&config).await,
      }
  }

test_file.txt.zfsadded

++{
++  "version": 1,
++  "filename": "test_file.txt",
++  "original_size": 33,
++  "chunk_size_mb": 1,
++  "content_id": "d9694db901d94a19748dfadd6efaa8f4fed739e76f26042b91aa9c52feb30fd5",
++  "hash_algorithm": "both",
++  "encrypted_segments": [
++    {
++      "segment_index": 0,
++      "ciphertext": [
++        19,
++        73,
++        96,
++        52,
++        98,
++        167,
++        247,
++        176,
++        136,
++        177,
++        61,
++        115,
++        24,
++        2,
++        233,
++        101,
++        206,
++        42,
++        157,
++        80,
++        212,
++        131,
++        117,
++        70,
++        239,
++        35,
++        51,
++        7,
++        151,
++        30,
++        56,
++        201,
++        124,
++        101,
++        107,
++        136,
++        125,
++        156,
++        87,
++        180,
++        221,
++        205,
++        199,
++        1,
++        196,
++        85,
++        90,
++        208,
++        198
++      ],
++      "nonce": [
++        34,
++        209,
++        18,
++        71,
++        29,
++        37,
++        218,
++        155,
++        210,
++        138,
++        118,
++        134
++      ],
++      "aad": [
++        0,
++        0,
++        0,
++        0,
++        0,
++        0,
++        0,
++        0,
++        0,
++        0,
++        0,
++        0,
++        90,
++        101,
++        112,
++        104,
++        121,
++        114,
++        70,
++        83,
++        45,
++        118,
++        49
++      ],
++      "key_path": [
++        0
++      ]
++    }
++  ],
++  "created_at": "2025-09-13T01:21:09.987982518Z"
++}