file-encrypt 0.2.1

CLI tool for encrypting local files
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102

use aes_gcm::{
    aead::{Aead, AeadCore, KeyInit},
    Aes256Gcm, Key, Nonce,
};
use anyhow::{anyhow, Result};
use argon2::PasswordHash;
use base64::prelude::*;
use rand_core::OsRng;
use std::{ffi::OsString, fs, path::PathBuf};

use crate::hash_algos::argon_hash;

pub fn encrypt_file(
    file_path: String,
    passphrase: String,
    output_file: String,
) -> Result<(OsString, String)> {
    // Hash passphrase
    let argon_pch: String = argon_hash::hash_passphrase(passphrase);
    let hash = PasswordHash::new(&argon_pch).unwrap();
    let hash = match hash.hash {
        Some(hash) => hash.to_string(),
        None => {
            eprintln!("[-] Error with argon2 hash");
            return Err(anyhow!("Unable to get hash from Argon2 PCH"));
        }
    };

    // Argon2 hash is encoded in base64
    // Must decode to extract 32-byte key needed
    let hash = BASE64_STANDARD_NO_PAD.decode(hash)?;

    // Generate iv, cipher, and key for encryption
    let key = Key::<Aes256Gcm>::from_slice(&hash);
    let nonce = Aes256Gcm::generate_nonce(&mut OsRng);
    let cipher = Aes256Gcm::new(&key);

    // Read in file data and encrpyt
    let file_data = fs::read(file_path.clone())?;
    let mut enc_data = match cipher.encrypt(&nonce, file_data.as_ref()) {
        Ok(enc_data) => enc_data,
        Err(e) => {
            let e = e.to_string();
            return Err(anyhow!("Unable to encrypt data: {e}"));
        }
    };

    // Attach nonce to encrypted data
    // Needed for decryption
    let mut nonce_and_data = nonce.to_vec();
    nonce_and_data.append(&mut enc_data);

    // Write out encrypted data to new file path
    let new_file = PathBuf::from(output_file);
    fs::write(new_file.clone(), nonce_and_data)?;

    Ok((new_file.into(), argon_pch))
}

pub fn decrypt_file(
    file_path: String,
    passphrase: String,
    expected_pch: String,
    output_file: String,
) -> Result<()> {
    // Verify provided passphrase
    let (res, hash_opt) = argon_hash::check_hash(passphrase, expected_pch);
    if res == false {
        eprintln!("[-] Invalid passphrase provided");
        return Err(anyhow!("Invalid passphrase"));
    }

    // Convet hash to argon2 PCH object
    let hash = hash_opt.unwrap();
    let hash = PasswordHash::new(&hash).unwrap();
    let hash = hash.hash.unwrap().to_string();

    let hash = BASE64_STANDARD_NO_PAD.decode(hash)?;

    // Generate iv, cipher, and key for encryption
    let key = Key::<Aes256Gcm>::from_slice(&hash);
    let cipher = Aes256Gcm::new(&key);

    // Read in encrpyted data and get nonce
    let mut nonce_and_data = fs::read(file_path.clone())?;
    let data = nonce_and_data.split_off(12);
    let nonce = nonce_and_data;
    let nonce = Nonce::from_slice(&nonce);

    let plain_data = match cipher.decrypt(nonce, data.as_ref()) {
        Ok(data) => data,
        Err(e) => {
            let e = e.to_string();
            return Err(anyhow!("Unable to decrypt file: {e}"));
        }
    };

    let new_file = PathBuf::from(output_file);
    fs::write(new_file, plain_data)?;

    Ok(())
}