shadow-crypt-shell 2.0.0

Main workflows and I/O operations for shadow-crypt
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118

use rayon::prelude::*;
use shadow_crypt_core::{
    algorithm::Algorithm,
    memory::SecureString,
    progress::ProgressCounter,
    report::EncryptionReport,
    v2::{
        crypt::encrypt_bytes,
        file::{EncryptedFile, PlaintextFile},
        header::{AadPurpose, FileHeader, HeaderBinding},
        key::KeyDerivationParams,
        key_ops::derive_key,
    },
};

use crate::{
    encryption::{
        file::{EncryptionInput, EncryptionInputFile},
        file_ops::{load_plaintext_file, store_encrypted_file},
        nonce::generate_nonce,
        salt::generate_salt,
    },
    errors::{WorkflowError, WorkflowResult},
    kdf::with_kdf_memory_permit,
    ui::{display_encryption_report, display_progress},
};

pub fn run_workflow(input: EncryptionInput) -> WorkflowResult<()> {
    let params = KeyDerivationParams::from(input.security_profile);
    let total = input.files.len();
    let counter = ProgressCounter::new(total as u64);

    // Each file gets its own salt and derived key so that files encrypted in the
    // same session cannot be correlated by comparing header salts.
    let failures: usize = input
        .files
        .par_iter()
        .map(|input_file| {
            let result = process_file_encryption(
                input_file.to_owned(),
                &input.password,
                &params,
                &input.output_dir,
            );
            counter.increment();
            display_progress(&counter);
            let failed = result.is_err();
            display_encryption_report(result);
            usize::from(failed)
        })
        .sum();

    if failures > 0 {
        return Err(WorkflowError::Encryption(format!(
            "{} of {} file(s) failed to encrypt",
            failures, total
        )));
    }

    Ok(())
}

fn process_file_encryption(
    file: EncryptionInputFile,
    password: &SecureString,
    kdf_params: &KeyDerivationParams,
    output_dir: &std::path::Path,
) -> WorkflowResult<EncryptionReport> {
    let start_time = std::time::Instant::now();

    let salt: [u8; 16] = generate_salt()?;
    let (key, _) = with_kdf_memory_permit(kdf_params.memory_cost, || {
        derive_key(password.as_str().as_bytes(), salt.as_ref(), kdf_params)
    })?;

    let filename_nonce: [u8; 24] = generate_nonce()?;
    let content_nonce: [u8; 24] = generate_nonce()?;
    let plaintext_file: PlaintextFile = load_plaintext_file(&file)?;

    // Bind the header fields to both ciphertexts, with distinct domains for
    // filename and content, so neither the header nor the pairing of the two
    // ciphertexts can be tampered with undetected.
    let binding = HeaderBinding::new(&salt, kdf_params, &content_nonce, &filename_nonce);

    let (filename_ciphertext, _): (Vec<u8>, Algorithm) = encrypt_bytes(
        file.filename.as_bytes(),
        key.as_bytes(),
        &filename_nonce,
        &binding.aad(AadPurpose::Filename),
    )?;

    let (content_ciphertext, algorithm): (Vec<u8>, Algorithm) = encrypt_bytes(
        plaintext_file.content().as_slice(),
        key.as_bytes(),
        &content_nonce,
        &binding.aad(AadPurpose::Content),
    )?;

    let header = FileHeader::new(
        salt,
        kdf_params.clone(),
        content_nonce,
        filename_nonce,
        filename_ciphertext,
    )?;

    let encrypted_file = EncryptedFile::new(header, content_ciphertext);
    let output_file = store_encrypted_file(&encrypted_file, output_dir)?;

    let duration = start_time.elapsed();

    Ok(EncryptionReport::new(
        file.filename,
        output_file.filename,
        duration,
        algorithm,
    ))
}