(alias string, masterKey []byte)
| 132 | } |
| 133 | |
| 134 | func LoadDecryptedRecord(alias string, masterKey []byte) (*Record, error) { |
| 135 | path := filepath.Join(KeysDir(), alias+".enc") |
| 136 | b, err := os.ReadFile(path) |
| 137 | if err != nil { |
| 138 | return nil, err |
| 139 | } |
| 140 | var ef EncryptedFile |
| 141 | if err := json.Unmarshal(b, &ef); err != nil { |
| 142 | return nil, err |
| 143 | } |
| 144 | if ef.Version != "fingerpass/v1" || ef.Alias != alias || ef.KeyType != "PKCS8" { |
| 145 | return nil, errors.New("invalid record metadata") |
| 146 | } |
| 147 | salt, err := base64.StdEncoding.DecodeString(ef.HKDFSalt) |
| 148 | if err != nil { |
| 149 | return nil, err |
| 150 | } |
| 151 | nonce, err := base64.StdEncoding.DecodeString(ef.Nonce) |
| 152 | if err != nil { |
| 153 | return nil, err |
| 154 | } |
| 155 | ct, err := base64.StdEncoding.DecodeString(ef.Ciphertext) |
| 156 | if err != nil { |
| 157 | return nil, err |
| 158 | } |
| 159 | fileKey := crypt.HKDF(masterKey, salt, []byte(alias), 32) |
| 160 | der, err := crypt.DecryptAEAD(fileKey, nonce, ct, []byte(ef.Fingerprint)) |
| 161 | if err != nil { |
| 162 | return nil, err |
| 163 | } |
| 164 | return &Record{Alias: ef.Alias, Fingerprint: ef.Fingerprint, Comment: ef.Comment, PKCS8DER: der}, nil |
| 165 | } |
| 166 | |
| 167 | func ExportPKCS8PEM(rec *Record, passphrase string) ([]byte, error) { |
| 168 | block := &pem.Block{Type: "PRIVATE KEY", Bytes: rec.PKCS8DER} |
no test coverage detected