shadow_crypt_core/v2/
key_ops.rs

1use argon2::{Algorithm, Argon2, Params, Version};
2use zeroize::Zeroize;
3
4use crate::{
5    errors::KeyDerivationError, memory::SecureKey, report::KeyDerivationReport,
6    v2::key::KeyDerivationParams,
7};
8
9pub fn derive_key(
10    password: &[u8],
11    salt: &[u8],
12    kdf_params: &KeyDerivationParams,
13) -> Result<(SecureKey, KeyDerivationReport), KeyDerivationError> {
14    let start_time = std::time::Instant::now();
15    let algorithm = Algorithm::Argon2id;
16    let version = Version::V0x13; // Version 19
17    let params = Params::new(
18        kdf_params.memory_cost,
19        kdf_params.time_cost,
20        kdf_params.parallelism,
21        Some(kdf_params.key_size as usize),
22    )
23    .map_err(|e| KeyDerivationError::InvalidParameters(format!("Invalid KDF parameters: {}", e)))?;
24    let context = Argon2::new(algorithm, version, params);
25
26    let mut buffer = [0u8; 32];
27    context
28        .hash_password_into(password, salt, &mut buffer)
29        .map_err(|e| {
30            KeyDerivationError::DerivationFailed(format!("Key derivation failed: {}", e))
31        })?;
32
33    let key = SecureKey::new(buffer);
34    buffer.zeroize(); // Clear sensitive data from memory
35
36    let duration = start_time.elapsed();
37    let report = KeyDerivationReport::new(
38        "Argon2id".to_string(),
39        format!("{}", version as u8),
40        kdf_params.memory_cost,
41        kdf_params.time_cost,
42        kdf_params.parallelism,
43        kdf_params.key_size,
44        duration,
45    );
46
47    Ok((key, report))
48}
49
50#[cfg(test)]
51mod tests {
52    use super::*;
53    use crate::{profile::SecurityProfile, v2::key::KeyDerivationParams};
54
55    fn get_test_params() -> KeyDerivationParams {
56        KeyDerivationParams::from(SecurityProfile::Test)
57    }
58
59    #[test]
60    fn test_derive_key_success() {
61        let password = b"test_password";
62        let salt = b"test_salt_16_bytes";
63        let params = get_test_params();
64
65        let (key, report) = derive_key(password, salt, &params).unwrap();
66        assert_eq!(key.as_bytes().len(), 32);
67        assert_eq!(report.algorithm, "Argon2id");
68        assert_eq!(report.algorithm_version, "19");
69        assert_eq!(report.memory_cost_kib, params.memory_cost);
70    }
71
72    #[test]
73    fn test_derive_key_deterministic() {
74        let password = b"test_password";
75        let salt = b"test_salt_16_bytes";
76        let params = get_test_params();
77
78        let (key1, _) = derive_key(password, salt, &params).unwrap();
79        let (key2, _) = derive_key(password, salt, &params).unwrap();
80
81        assert_eq!(key1.as_bytes(), key2.as_bytes());
82    }
83
84    #[test]
85    fn test_derive_key_different_passwords() {
86        let salt = b"test_salt_16_bytes";
87        let params = get_test_params();
88
89        let (key1, _) = derive_key(b"password1", salt, &params).unwrap();
90        let (key2, _) = derive_key(b"password2", salt, &params).unwrap();
91
92        assert_ne!(key1.as_bytes(), key2.as_bytes());
93    }
94
95    #[test]
96    fn test_derive_key_invalid_parameters() {
97        let invalid_params = KeyDerivationParams::new(0, 1, 1, 32);
98        let result = derive_key(b"pw", b"test_salt_16_bytes", &invalid_params);
99        assert!(matches!(
100            result,
101            Err(KeyDerivationError::InvalidParameters(_))
102        ));
103    }
104}
shadow_crypt_core/v2/key_ops.rs

shadow_crypt_core/v2/
key_ops.rs
