grokify/mogo

// aesutil provides AES crypto utilities including writing and reading
// AES encrypted files
package aesutil

import (
    "crypto/aes"
    "crypto/cipher"
    "crypto/rand"
    "encoding/base64"
    "encoding/json"
    "errors"
    "io"
    "os"
    "path"

    base58 "github.com/itchyny/base58-go"
)

func EncryptAESBase58JSON(plainitem any, key []byte, encoding *base58.Encoding) ([]byte, error) {
    plaintext, err := json.Marshal(plainitem)
    if err != nil {
        return plaintext, err
    }
    return EncryptAESBase58(plaintext, key, encoding)
}

func DecryptAESBase58JSON(ciphertext []byte, key []byte, encoding *base58.Encoding, item any) error {
    plaintext, err := DecryptAESBase58(ciphertext, key, encoding)
    if err != nil {
        return err
    }
    return json.Unmarshal(plaintext, item)
}

func EncryptAESBase58(plaintext []byte, key []byte, encoding *base58.Encoding) ([]byte, error) {
    bytes, err := EncryptAES(plaintext, key)
    if err != nil {
        return bytes, err
    }
    return encoding.Encode(bytes)
}

func DecryptAESBase58(ciphertext []byte, key []byte, encoding *base58.Encoding) ([]byte, error) {
    bytes, err := encoding.Decode(ciphertext)
    if err != nil {
        return bytes, err
    }
    return DecryptAES(bytes, key)
}

// EncryptAes provides a ciphertext byte array given a plaintext bytearray and key.
func EncryptAES(plaintext []byte, key []byte) ([]byte, error) {
    block, err := aes.NewCipher(key)
    if err != nil {
        return nil, err
    }
    plaintextBase64 := base64.StdEncoding.EncodeToString(plaintext)
    ciphertext := make([]byte, aes.BlockSize+len(plaintextBase64))
    iv := ciphertext[:aes.BlockSize]
    if _, err := io.ReadFull(rand.Reader, iv); err != nil {
        return nil, err
    }
    cfb := cipher.NewCFBEncrypter(block, iv)
    cfb.XORKeyStream(ciphertext[aes.BlockSize:], []byte(plaintextBase64))
    return ciphertext, nil
}

func DecryptAESBase64String(ciphertextBase64 string, key []byte) ([]byte, error) {
    ciphertext, err := base64.StdEncoding.DecodeString(ciphertextBase64)
    if err != nil {
        return []byte{}, err
    }
    return DecryptAES(ciphertext, key)
}

func DecryptAES(text []byte, key []byte) ([]byte, error) {
    block, err := aes.NewCipher(key)
    if err != nil {
        return nil, err
    }
    if len(text) < aes.BlockSize {
        return nil, errors.New("400: ciphertext is too short")
    }
    iv := text[:aes.BlockSize]
    text = text[aes.BlockSize:]
    cfb := cipher.NewCFBDecrypter(block, iv)
    cfb.XORKeyStream(text, text)
    plaintext, err := base64.StdEncoding.DecodeString(string(text))
    if err != nil {
        return nil, err
    }
    return plaintext, nil
}

func ReadFileAES(filename string, key []byte) ([]byte, error) {
    baFileEnc, err := os.ReadFile(filename)
    if err != nil {
        return []byte{}, err
    }
    return DecryptAES(baFileEnc, key)
}

func WriteFileAES(filename string, baFileUnc []byte, perm os.FileMode, key []byte) error {
    baFileEnc, err := EncryptAES(baFileUnc, key)
    if err != nil {
        return err
    }
    return os.WriteFile(filename, baFileEnc, perm)
}

func EncryptFileAES(filenameUnc string, filenameEnc string, perm os.FileMode, key []byte) error {
    baFileUnc, err := os.ReadFile(filenameUnc)
    if err != nil {
        return err
    }
    if len(filenameEnc) == 0 {
        filenameEnc = filenameUnc
    }
    return WriteFileAES(filenameEnc, baFileUnc, perm, key)
}

func EncryptDirectoryFilesAES(dirUnc string, dirEnc string, perm os.FileMode, key []byte) error {
    aFilesSrc, err := os.ReadDir(dirUnc)
    if err != nil {
        return err
    }
    for _, f := range aFilesSrc {
        if f.IsDir() {
            continue
        }
        fileUnc := f.Name()
        fileEnc := fileUnc + ".enc"
        pathUnc := path.Join(dirUnc, fileUnc)
        pathEnc := path.Join(dirEnc, fileEnc)
        err := EncryptFileAES(pathUnc, pathEnc, perm, key)
        if err != nil {
            return err
        }
    }
    return nil
}