| 61 | } |
| 62 | |
| 63 | bool decrypt_hsm_secret(const struct secret *encryption_key, |
| 64 | const struct encrypted_hsm_secret *cipher, |
| 65 | struct secret *output) |
| 66 | { |
| 67 | crypto_secretstream_xchacha20poly1305_state crypto_state; |
| 68 | |
| 69 | /* The header part */ |
| 70 | if (crypto_secretstream_xchacha20poly1305_init_pull(&crypto_state, cipher->data, |
| 71 | encryption_key->data) != 0) |
| 72 | return false; |
| 73 | /* The ciphertext part */ |
| 74 | if (crypto_secretstream_xchacha20poly1305_pull(&crypto_state, output->data, |
| 75 | NULL, 0, |
| 76 | cipher->data + HS_HEADER_LEN, |
| 77 | HS_CIPHERTEXT_LEN, |
| 78 | NULL, 0) != 0) |
| 79 | return false; |
| 80 | |
| 81 | return true; |
| 82 | } |
| 83 | |
| 84 | /* Returns -1 on error (and sets errno), 0 if not encrypted, 1 if it is */ |
| 85 | int is_hsm_secret_encrypted(const char *path) |
no outgoing calls
no test coverage detected