// OpenKey tries do decrypt the key specified by name with the given password. func OpenKey(s *Repository, name string, password string) (*Key, error) { k, err := LoadKey(s, name) if err != nil { debug.Log("LoadKey(%v) returned error %v", name[:12], err) return nil, err } // check KDF if k.KDF != "scrypt" { return nil, errors.New("only supported KDF is scrypt()") } // derive user key params := crypto.KDFParams{ N: k.N, R: k.R, P: k.P, } k.user, err = crypto.KDF(params, k.Salt, password) if err != nil { return nil, errors.Wrap(err, "crypto.KDF") } // decrypt master keys buf := make([]byte, len(k.Data)) n, err := crypto.Decrypt(k.user, buf, k.Data) if err != nil { return nil, err } buf = buf[:n] // restore json k.master = &crypto.Key{} err = json.Unmarshal(buf, k.master) if err != nil { debug.Log("Unmarshal() returned error %v", err) return nil, errors.Wrap(err, "Unmarshal") } k.name = name if !k.Valid() { return nil, errors.New("Invalid key for repository") } return k, nil }
// OpenKey tries do decrypt the key specified by name with the given password. func OpenKey(s *Repository, name string, password string) (*Key, error) { k, err := LoadKey(s, name) if err != nil { debug.Log("OpenKey", "LoadKey(%v) returned error %v", name[:12], err) return nil, err } // check KDF if k.KDF != "scrypt" { return nil, errors.New("only supported KDF is scrypt()") } // derive user key k.user, err = crypto.KDF(k.N, k.R, k.P, k.Salt, password) if err != nil { return nil, err } // decrypt master keys buf, err := crypto.Decrypt(k.user, []byte{}, k.Data) if err != nil { return nil, err } // restore json k.master = &crypto.Key{} err = json.Unmarshal(buf, k.master) if err != nil { debug.Log("OpenKey", "Unmarshal() returned error %v", err) return nil, err } k.name = name if !k.Valid() { return nil, errors.New("Invalid key for repository") } return k, nil }
// AddKey adds a new key to an already existing repository. func AddKey(s *Repository, password string, template *crypto.Key) (*Key, error) { // make sure we have valid KDF parameters if KDFParams == nil { p, err := crypto.Calibrate(KDFTimeout, KDFMemory) if err != nil { return nil, errors.Wrap(err, "Calibrate") } KDFParams = &p debug.Log("calibrated KDF parameters are %v", p) } // fill meta data about key newkey := &Key{ Created: time.Now(), KDF: "scrypt", N: KDFParams.N, R: KDFParams.R, P: KDFParams.P, } hn, err := os.Hostname() if err == nil { newkey.Hostname = hn } usr, err := user.Current() if err == nil { newkey.Username = usr.Username } // generate random salt newkey.Salt, err = crypto.NewSalt() if err != nil { panic("unable to read enough random bytes for salt: " + err.Error()) } // call KDF to derive user key newkey.user, err = crypto.KDF(*KDFParams, newkey.Salt, password) if err != nil { return nil, err } if template == nil { // generate new random master keys newkey.master = crypto.NewRandomKey() } else { // copy master keys from old key newkey.master = template } // encrypt master keys (as json) with user key buf, err := json.Marshal(newkey.master) if err != nil { return nil, errors.Wrap(err, "Marshal") } newkey.Data, err = crypto.Encrypt(newkey.user, nil, buf) // dump as json buf, err = json.Marshal(newkey) if err != nil { return nil, errors.Wrap(err, "Marshal") } // store in repository and return h := restic.Handle{ Type: restic.KeyFile, Name: restic.Hash(buf).String(), } err = s.be.Save(h, buf) if err != nil { return nil, err } newkey.name = h.Name return newkey, nil }
// AddKey adds a new key to an already existing repository. func AddKey(s *Repository, password string, template *crypto.Key) (*Key, error) { // fill meta data about key newkey := &Key{ Created: time.Now(), KDF: "scrypt", N: scryptN, R: scryptR, P: scryptP, } hn, err := os.Hostname() if err == nil { newkey.Hostname = hn } usr, err := user.Current() if err == nil { newkey.Username = usr.Username } // generate random salt newkey.Salt = make([]byte, scryptSaltsize) n, err := rand.Read(newkey.Salt) if n != scryptSaltsize || err != nil { panic("unable to read enough random bytes for salt") } // call KDF to derive user key newkey.user, err = crypto.KDF(newkey.N, newkey.R, newkey.P, newkey.Salt, password) if err != nil { return nil, err } if template == nil { // generate new random master keys newkey.master = crypto.NewRandomKey() } else { // copy master keys from old key newkey.master = template } // encrypt master keys (as json) with user key buf, err := json.Marshal(newkey.master) if err != nil { return nil, err } newkey.Data, err = crypto.Encrypt(newkey.user, nil, buf) // dump as json buf, err = json.Marshal(newkey) if err != nil { return nil, err } // store in repository and return h := backend.Handle{ Type: backend.Key, Name: backend.Hash(buf).String(), } err = s.be.Save(h, buf) if err != nil { return nil, err } newkey.name = h.Name return newkey, nil }