chacha20poly1305guard

README

ChaCha20Poly1305Guard

A pure Go implementation of ChaCha20Poly1305 and its extended nonce variant XChaCha20Poly1305 with MemGuard in order to protect the key in memory.

Before using read the Warning

The implementation is based on https://github.com/codahale/chacha20poly1305

Download/Install

go get -u github.com/alexzava/chacha20poly1305guard

Usage

Import

import (
	"fmt"	
	"log"
	"crypto/rand"

	"github.com/awnumar/memguard"
	"github.com/alexzava/chacha20poly1305guard"
)

ChaCha20Poly1305

	message := []byte("Hello World!")
	
	//Generate random nonce
	nonce := make([]byte, 8)
	_, err := rand.Read(nonce)
	if err != nil {
		log.Fatal(err)
	}

	//Generate random encryption key with memguard
	key, err := memguard.NewImmutableRandom(32)
	if err != nil {
		log.Println(err)
		memguard.SafeExit(1)
	}
	defer key.Destroy()

	c, err := chacha20poly1305guard.New(key)
	if err != nil {
		log.Fatal(err)
	}

	//Encrypt
	ciphertext := c.Seal(nil, nonce, message, nil)
	fmt.Printf("%x\n", ciphertext)

	//Decrypt
	plaintext, err := c.Open(nil, nonce, ciphertext, nil)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Printf("%s\n", plaintext)

XChaCha20Poly1305

	message := []byte("Hello World!")

	//Generate random nonce
	nonce := make([]byte, 24)
	_, err := rand.Read(nonce)
	if err != nil {
		log.Fatal(err)
	}

	//Generate random encryption key with memguard
	key, err := memguard.NewImmutableRandom(32)
	if err != nil {
		log.Println(err)
		memguard.SafeExit(1)
	}
	defer key.Destroy()

	c, err := chacha20poly1305guard.NewX(key)
	if err != nil {
		log.Fatal(err)
	}

	//Encrypt
	ciphertext := c.Seal(nil, nonce, message, nil)
	fmt.Printf("%x\n", ciphertext)

	//Decrypt
	plaintext, err := c.Open(nil, nonce, ciphertext, nil)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Printf("%s\n", plaintext)

Warning

The code may contain bugs or vulnerabilities, currently they have not been found but this does not guarantee absolute security.

Check the repository often because the code could be updated frequently.

Notes

If you find bugs or vulnerabilities please let me know so they can be fixed.

If you want to help improve the code contact me.

License

This project is licensed under MIT License - see the LICENSE file for details.

Documentation

Index

• Variables
• func New(key *memguard.LockedBuffer) (cipher.AEAD, error)
• func NewX(key *memguard.LockedBuffer) (cipher.AEAD, error)

Variables

var (
	// ErrAuthFailed is returned when the message authentication is invalid due
	// to tampering.
	ErrAuthFailed = errors.New("message authentication failed")

	// ErrInvalidKey is returned when the provided key is the wrong size.
	ErrInvalidKey = errors.New("invalid key size")

	// ErrInvalidNonce is returned when the provided nonce is the wrong size.
	ErrInvalidNonce = errors.New("invalid nonce size")

	// KeySize is the required size of ChaCha20 keys.
	KeySize = chacha20guard.KeySize
)

Functions

func New

func New(key *memguard.LockedBuffer) (cipher.AEAD, error)

New returns a ChaCha20Poly1305 AEAD. The key must be 256 bits long, and the nonce must be 64 bits long. The nonce must be randomly generated or used only once.

func NewX

func NewX(key *memguard.LockedBuffer) (cipher.AEAD, error)

NewX returns a XChaCha20Poly1305 AEAD. The key must be 256 bits long, and the nonce must be 192 bits long.