-
Notifications
You must be signed in to change notification settings - Fork 110
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: added cmd to encrypt tss keyshare file (#1744)
* added cmd to encrypt tss keyshare file, allowing empty tss password for backward compatibility. * add changelog + make generate * update go-tss version * use positional args instead * remove unnecessary struct * fix gosec issue
- Loading branch information
Showing
5 changed files
with
74 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "crypto/aes" | ||
| "crypto/cipher" | ||
| "crypto/rand" | ||
| "crypto/sha256" | ||
| "encoding/json" | ||
| "errors" | ||
| "io" | ||
| "os" | ||
| "path/filepath" | ||
|
|
||
| "github.com/spf13/cobra" | ||
| ) | ||
|
|
||
| var encTssCmd = &cobra.Command{ | ||
| Use: "tss-encrypt [file-path] [secret-key]", | ||
| Short: "Utility command to encrypt existing tss key-share file", | ||
| Args: cobra.ExactArgs(2), | ||
| RunE: EncryptTSSFile, | ||
| } | ||
|
|
||
| func init() { | ||
| RootCmd.AddCommand(encTssCmd) | ||
| } | ||
|
|
||
| func EncryptTSSFile(_ *cobra.Command, args []string) error { | ||
| filePath := args[0] | ||
| secretKey := args[1] | ||
|
|
||
| filePath = filepath.Clean(filePath) | ||
| data, err := os.ReadFile(filePath) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if !json.Valid(data) { | ||
| return errors.New("file does not contain valid json, may already be encrypted") | ||
| } | ||
|
|
||
| block, err := aes.NewCipher(getFragmentSeed(secretKey)) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| // Creating GCM mode | ||
| gcm, err := cipher.NewGCM(block) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| // Generating random nonce | ||
| nonce := make([]byte, gcm.NonceSize()) | ||
| if _, err := io.ReadFull(rand.Reader, nonce); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| cipherText := gcm.Seal(nonce, nonce, data, nil) | ||
| return os.WriteFile(filePath, cipherText, 0o600) | ||
| } | ||
|
|
||
| func getFragmentSeed(password string) []byte { | ||
| h := sha256.New() | ||
| h.Write([]byte(password)) | ||
| seed := h.Sum(nil) | ||
| return seed | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters