Initial commit

This commit is contained in:
Quentin 2020-06-01 14:20:34 +02:00
commit f89b327373
3 changed files with 157 additions and 0 deletions

35
README.md Normal file
View File

@ -0,0 +1,35 @@
# Chlorure
*Under heavy development*
For now, chlorure uses the old way to manage go dependencies (ie: not go mod).
Given you are new to go and not set any environment variable, the following should work for you:
```
GOPATH=$HOME/go
GOBIN=$GOPATH/bin
go get ./...
```
Then
```
go run ./cli.go
```
## Scratchpad
- https://golang.org/pkg/crypto/cipher/ --> c'est pas clé en main, c'est soit streaming soit authentication
- https://www.imperialviolet.org/2014/06/27/streamingencryption.html --> gpg ne fait pas l'authentication correctement
- https://github.com/FiloSottile/age --> age fait de l'authentication et du streaming
- https://rclone.org/crypt/ --> rclone fait de l'auth+streaming de la même manière que age mais avec un format de fichier différent (stockage du nonce, infos sur les algos utilisés)
- https://neilmadden.blog/2019/12/30/a-few-comments-on-age/ --> une critique plutôt négative de age qui ne me donne pas envie de l'utiliser, pas plus que rclone du coup
- https://moxie.org/2011/12/13/the-cryptographic-doom-principle.html
--> cité par l'article précédent, je ne comprends pas trop mais je crois que pas simple
- https://godoc.org/golang.org/x/crypto/nacl/box --> du coup je pense me limiter à un lib très reconnue comme nacl/sodium, si possible une implem officielle. Mais là pas de streaming, à nous de chunker et de gérer la rotation des nonces
- Est ce qu'on a besoin d'authentication ?
- Oui en fait il y a plein d'attaques apparemment
- https://blog.minio.io/data-at-rest-encryption-done-right-7446c644ddb6 --> Minio a sa solution mais elle a des requirements bizarres (une clé par fichier, il faut donc un HKDF)
- https://www.imperialviolet.org/2017/05/14/aesgcmsiv.html --> AES GCM SIV does not break crypto if you reuse nonces (but you should still try to supply unique ones to have different cipher if you encode the same plaintext twice)

83
cli.go Normal file
View File

@ -0,0 +1,83 @@
package main
import (
"github.com/hashicorp/consul/api"
"errors"
"log"
"fmt"
"os"
"encoding/base64"
/*"github.com/aws/aws-sdk-go/service/s3"*/
)
const consul_addr string = "KV2S3_CONSUL_ADDR"
const enc_key string = "KV2S3_ENC_KEY"
const key_exp_bits int = 256
const key_exp_bytes int = key_exp_bits / 8
func errIsPanic(err error, format string, a ...interface{}) {
if err != nil {
log.Panicf(format, a...)
}
}
func absentIsErr(present bool) error {
if !present {
return errors.New("Environement variable is not set.")
}
return nil
}
func main() {
log.Println("starting consul kv backup...")
//--- Ask Consul to Snapshot our KV
var present bool
conf := api.DefaultConfig()
conf.Address, present = os.LookupEnv(consul_addr)
err := absentIsErr(present)
errIsPanic(err, "%v env required. %v", consul_addr, err)
//@FIXME add later support for HTTPS
options := api.QueryOptions {
// Prevent from backuping forever silently a desynchronized node
AllowStale: false,
}
consul, err := api.NewClient(conf)
errIsPanic(err, "Unable to build a new client. %v", err)
reader, _, err := consul.Snapshot().Save(&options)
defer reader.Close()
errIsPanic(err, "Snapshot failed. %v", err)
//--- Get encryption key and check it
b64_key, present := os.LookupEnv(enc_key)
err = absentIsErr(present)
errIsPanic(err, "%v env required. %v", enc_key, err)
raw_key, err := base64.StdEncoding.DecodeString(b64_key)
errIsPanic(err, "Unable to decode base64 key. %v", err)
err = nil
key_size_bytes := len(raw_key)
key_size_bits := key_size_bytes
if key_size_bytes != key_exp_bytes {
msg := fmt.Sprintf(
"Key size is %d bits (%d bytes) instead of %d bits (%d bytes).",
key_size_bits,
key_size_bytes,
key_exp_bits,
key_exp_bytes)
err = errors.New(msg)
}
errIsPanic(err, "We deliberately support only 256 bits (32 bytes) keys. %v", err)
//--- Encryption
// Not a simple thing to do it in a streaming manner - is it only a good idea?
// https://neilmadden.blog/2019/12/30/a-few-comments-on-age/
// https://moxie.org/2011/12/13/the-cryptographic-doom-principle.html
}

39
sodium/secret_stream.go Normal file
View File

@ -0,0 +1,39 @@
package main
/*
#cgo CFLAGS: -g -Wall
#cgo LDFLAGS: -lsodium
#include <sodium.h>
*/
import "C"
import "log"
const block_size int = 16 * 1024 // 16 KiB
// Should take a reader as input and be a reader
func (*Saliere) Read(p []byte) (n int, err error)
func main() {
log.Println("Test cgo")
ret := C.sodium_init()
if ret < 0 {
log.Panic("Failed to init sodium.")
}
//unsigned char array as requested
var key [C.crypto_secretstream_xchacha20poly1305_KEYBYTES]C.uchar
C.crypto_secretstream_xchacha20poly1305_keygen(&key[0])
var state C.crypto_secretstream_xchacha20poly1305_state
var header [C.crypto_secretstream_xchacha20poly1305_HEADERBYTES]C.uchar
C.crypto_secretstream_xchacha20poly1305_init_push(&state, &header[0], &key[0])
log.Print("key", key)
log.Print("header", header)
var plain [block_size]C.uchar
var c1 [block_size + C.crypto_secretstream_xchacha20poly1305_ABYTES]C.uchar
C.crypto_secretstream_xchacha20poly1305_push(&state, &c1[0], nil, &plain[0], C.ulonglong(len(plain)), nil, 0, 0)
log.Print("c1", c1)
}