crypto

Documentation

Overview

Package crypto is the authenticated-encryption layer for the secret vault.

This is a byte-compatible port of server/crypto.py: existing vaults and encrypted notes must open unchanged, so every constant and construction here is fixed by what Python already wrote to disk, not by preference.

Key derivation: Argon2id from the passphrase + a per-vault random salt. Legacy vaults created with PBKDF2-HMAC-SHA256 still unlock (the KDF is recorded per-vault). Encryption: Fernet (AES-128-CBC + HMAC-SHA256).

Fernet is implemented here rather than pulled in as a dependency: the spec is small and fully determined, and a third-party package is a supply-chain risk on the one code path that can lose a user's data.

Index

• Constants
• Variables
• func DeriveKey(passphrase string, salt []byte, kdf string) ([]byte, error)
• func NewSalt() ([]byte, error)
• func Seal(key, plaintext []byte) ([]byte, error)
• func Unseal(key, token []byte) ([]byte, error)

Constants

const (
	ArgonTime        uint32 = 3
	ArgonMemoryKiB   uint32 = 64 * 1024
	ArgonParallelism uint8  = 4
)

Argon2id parameters (OWASP-aligned: 64 MiB, t=3, p=4).

const DefaultKDF = "argon2id"

const Iterations = 240_000

Legacy PBKDF2 — only used to unlock pre-existing vaults.

Variables

var ErrInvalidToken = errors.New("wrong passphrase or corrupted data")

Functions

func DeriveKey

func DeriveKey(passphrase string, salt []byte, kdf string) ([]byte, error)

DeriveKey returns a 32-byte Fernet key, urlsafe-base64 encoded exactly as Python's derive_key does — callers pass this value straight to Seal/Unseal. kdf selects the algorithm so old vaults (pbkdf2) keep working while new ones use argon2id.

func NewSalt

func NewSalt() ([]byte, error)

NewSalt returns a fresh 16-byte salt.

func Seal

func Seal(key, plaintext []byte) ([]byte, error)

Seal encrypts plaintext into a Fernet token.

func Unseal

func Unseal(key, token []byte) ([]byte, error)

Unseal decrypts a Fernet token. It does not enforce a TTL, matching the Python side (which calls Fernet.decrypt with no ttl).