lich 0.1.0

Minimal password management.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

use error::Error;
use ring::aead;
use std::ops::{Deref, DerefMut};

static ALGORITHM: &'static aead::Algorithm = &aead::AES_256_GCM;

pub const NONCE_LEN: usize = 12;
const TAG_LEN: usize = 16;
const EMPTY: &'static [u8] = &[];

#[cfg_attr(feature = "serialization", derive(Serialize, Deserialize))]
pub struct Vault {
    pub nonce: [u8; NONCE_LEN],
    //TODO: Switch to DST when they become less sucky.
    pub value: Box<[u8]>,
}

pub struct Unlocked<'a> {
    len: usize,
    key: &'a [u8],
    inner: &'a mut Vault,
}

impl Vault {
    pub fn new(
        key: &[u8],
        nonce: [u8; NONCE_LEN],
        mut data: Vec<u8>
    ) -> Result<Vault, Error> {
        data.extend_from_slice(&[0; TAG_LEN]);

        aead::seal_in_place(
            &aead::SealingKey::new(ALGORITHM, key)
                .map_err(|_| Error::BadKey)?,
            &nonce,
            EMPTY,
            &mut data[..],
            TAG_LEN
        ).map_err(|_| Error::Encrypt)?;

        Ok(Vault {
            nonce: nonce,
            value: data.into_boxed_slice(),
        })
    }

    pub fn unlock<'a> (
        &'a mut self,
        key: &'a [u8]
    ) -> Result<Unlocked<'a>, Error> {
        //TODO: Avoid backup.
        let backup = self.value.clone();

        let len = aead::open_in_place(
            &aead::OpeningKey::new(ALGORITHM, key)
                .map_err(|_| Error::BadKey)?,
            &self.nonce,
            EMPTY,
            0,
            &mut self.value[..]
        ).map(|x| x.len());

        if let Ok(len) = len {
            Ok(Unlocked {
                len: len,
                key: key,
                inner: self,
            })
        } else {
            self.value = backup;
            Err(Error::Decrypt)
        }
    }
}

impl<'a> Unlocked<'a> {
    pub fn rekey (
        &mut self,
        key: &'a [u8],
        nonce: [u8; NONCE_LEN]
    ) {
        self.key = key;
        self.inner.nonce = nonce;
    }
}

impl<'a> Drop for Unlocked<'a> {
    fn drop(&mut self) {
        aead::seal_in_place(
            &aead::SealingKey::new(ALGORITHM, self.key).unwrap(),
            &self.inner.nonce,
            EMPTY,
            &mut self.inner.value[..],
            TAG_LEN
        ).unwrap();
    }
}

impl<'a> Deref for Unlocked<'a> {
    type Target = [u8];

    fn deref(&self) -> &[u8] {
        &self.inner.value[..self.len]
    }
}

impl<'a> DerefMut for Unlocked<'a> {
    fn deref_mut(&mut self) -> &mut [u8] {
        &mut self.inner.value[..self.len]
    }
}