Skip to content

Commit 8004de8

Browse files
ErotemicErotemic
committed
Simplified use_pbkdf2 arg to kdf
1 parent 7981293 commit 8004de8

File tree

2 files changed

+42
-40
lines changed

2 files changed

+42
-40
lines changed

‎tests/test_transcrypt.py‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ class Transcrypt(ub.NiceRepr):
2424
>>> from test_transcrypt import * # NOQA
2525
>>> sandbox = DemoSandbox(verbose=1, dpath='special:cache').setup()
2626
>>> config = {'digest': 'sha256',
27-
>>> 'use_pbkdf2': '1',
27+
>>> 'kdf': 'pbkdf2',
2828
>>> 'salt_method': '665896be121e1a0a4a7b18f01780061'}
2929
>>> self = Transcrypt(sandbox.repo_dpath,
3030
>>> config=config, env=sandbox.env, verbose=1)
@@ -55,7 +55,7 @@ class Transcrypt(ub.NiceRepr):
5555
'cipher': 'aes-256-cbc',
5656
'password': None,
5757
'digest': 'md5',
58-
'use_pbkdf2': '0',
58+
'kdf': 'none',
5959
'salt_method': 'password',
6060
}
6161

@@ -87,7 +87,7 @@ def _config_args(self):
8787
"-c", self.config['cipher'],
8888
"-p", self.config['password'],
8989
"-md", self.config['digest'],
90-
"--use-pbkdf2", self.config['use_pbkdf2'],
90+
"--kdf", self.config['kdf'],
9191
"-sm", self.config['salt_method'],
9292
]
9393
args = [template.format(**self.config) for template in arg_templates]
@@ -200,7 +200,7 @@ def _load_unversioned_config(self):
200200
local_config = {
201201
'cipher': self._cmd('git config --get --local transcrypt.cipher')['out'].strip(),
202202
'digest': self._cmd('git config --get --local transcrypt.digest')['out'].strip(),
203-
'use_pbkdf2': self._cmd('git config --get --local transcrypt.use-pbkdf2')['out'].strip(),
203+
'kdf': self._cmd('git config --get --local transcrypt.kdf')['out'].strip(),
204204
'salt_method': self._cmd('git config --get --local transcrypt.salt-method')['out'].strip(),
205205
'password': self._cmd('git config --get --local transcrypt.password')['out'].strip(),
206206
'openssl_path': self._cmd('git config --get --local transcrypt.openssl-path')['out'].strip(),
@@ -371,7 +371,7 @@ def test_export_gpg(self):
371371
# FIXME
372372
is_ok = got_config == config
373373
if not is_ok:
374-
is_ok = all([got_config[k] == config[k] for k in {'digest', 'password', 'cipher', 'use_pbkdf2'}])
374+
is_ok = all([got_config[k] == config[k] for k in {'digest', 'password', 'cipher', 'kdf'}])
375375

376376
if not is_ok:
377377
print(f'got_config={got_config}')
@@ -391,7 +391,7 @@ def test_rekey(self):
391391
'cipher': 'aes-256-cbc',
392392
'password': '12345',
393393
'digest': 'sha256',
394-
'use_pbkdf2': '1',
394+
'kdf': 'pbkdf2',
395395
'salt_method': 'random',
396396
}
397397
raw_before = self.tc.show_raw(self.sandbox.secret_fpath)
@@ -406,7 +406,7 @@ def test_legacy_defaults():
406406
'cipher': 'aes-256-cbc',
407407
'password': 'correct horse battery staple',
408408
'digest': 'md5',
409-
'use_pbkdf2': '0',
409+
'kdf': 'none',
410410
'salt_method': 'password',
411411
}
412412
verbose = 1
@@ -421,7 +421,7 @@ def test_secure_defaults():
421421
'cipher': 'aes-256-cbc',
422422
'password': 'correct horse battery staple',
423423
'digest': 'sha512',
424-
'use_pbkdf2': '1',
424+
'kdf': 'pbkdf2',
425425
'salt_method': 'random',
426426
}
427427
verbose = 1
@@ -436,7 +436,7 @@ def test_configured_salt_changes_on_rekey():
436436
'cipher': 'aes-256-cbc',
437437
'password': 'correct horse battery staple',
438438
'digest': 'sha512',
439-
'use_pbkdf2': '1',
439+
'kdf': 'pbkdf2',
440440
'salt_method': 'random',
441441
}
442442
verbose = 1
@@ -448,7 +448,7 @@ def test_configured_salt_changes_on_rekey():
448448
after_config = self.tc._load_unversioned_config()
449449
assert before_config['password'] != after_config['password']
450450
assert before_config['cipher'] == after_config['cipher']
451-
assert before_config['use_pbkdf2'] == after_config['use_pbkdf2']
451+
assert before_config['kdf'] == after_config['kdf']
452452
assert before_config['salt_method'] == after_config['salt_method']
453453
assert before_config['openssl_path'] == after_config['openssl_path']
454454

@@ -473,7 +473,7 @@ def test_configuration_grid():
473473
'cipher': ['aes-256-cbc', 'aes-128-ecb'],
474474
'password': ['correct horse battery staple'],
475475
'digest': ['md5', 'sha256'],
476-
'use_pbkdf2': ['0', '1'],
476+
'kdf': ['none', 'pbkdf2'],
477477
'salt_method': ['password', 'random', 'mylittlecustomsalt'],
478478
}
479479
test_grid = list(ub.named_product(basis))

‎transcrypt‎

Lines changed: 31 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ readonly VERSION='3.0.0-pre'
2828
# the default cipher to utilize
2929
readonly DEFAULT_CIPHER='aes-256-cbc'
3030
readonly DEFAULT_DIGEST='MD5'
31-
readonly DEFAULT_USE_PBKDF2='0'
31+
readonly DEFAULT_KDF='none'
3232
readonly DEFAULT_SALT_METHOD='password'
3333

3434
# These are the implemented methods for computing deterministic salt
@@ -246,7 +246,7 @@ _load_transcrypt_config_vars() {
246246
# Populate bash vars with our config
247247
cipher=$(_load_config_var "transcrypt.cipher") || (echo "failed to load transcrypt.cipher" && false)
248248
digest=$(_load_config_var "transcrypt.digest") || (echo "failed to load transcrypt.digest" && false)
249-
use_pbkdf2=$(_load_config_var "transcrypt.use-pbkdf2") || (echo "failed to load transcrypt.use-pbkdf2" && false)
249+
kdf=$(_load_config_var "transcrypt.kdf") || (echo "failed to load transcrypt.kdf" && false)
250250
salt_method=$(_load_config_var "transcrypt.salt-method") || (echo "failed to load transcrypt.salt-method" && false)
251251
openssl_path=$(_load_config_var "transcrypt.openssl-path") || (echo "failed to load transcrypt.openssl-path" && false)
252252
password=$(_load_unversioned_config_var transcrypt.password) || (echo "failed to load transcrypt.password" && false)
@@ -257,7 +257,7 @@ _load_vars_for_encryption() {
257257
# Helper to populate variables needed to call openssl encryption
258258
_load_transcrypt_config_vars
259259

260-
if [[ "$use_pbkdf2" == "1" ]]; then
260+
if [[ "$kdf" == "1" ]] || [[ "$kdf" == "pbkdf2" ]]; then
261261
pbkdf2_args=('-pbkdf2')
262262
else
263263
pbkdf2_args=()
@@ -568,8 +568,8 @@ validate_digest() {
568568
_validate_variable_str "digest" "$valid_digests"
569569
}
570570

571-
validate_use_pbkdf2() {
572-
_validate_variable_str "use_pbkdf2" "0 1"
571+
validate_kdf() {
572+
_validate_variable_str "kdf" "0 1 none pbkdf2"
573573
}
574574

575575
validate_salt_method() {
@@ -599,14 +599,14 @@ get_cipher() {
599599
_get_user_input cipher "$DEFAULT_CIPHER" "validate_cipher" "$prompt"
600600
}
601601

602-
get_use_pbkdf2() {
602+
get_kdf() {
603603
local prompt
604-
prompt=$(printf 'Use pbkdf2? [%s] ' "$DEFAULT_USE_PBKDF2")
605-
if [[ "$use_pbkdf2" == "" ]]; then
606-
use_pbkdf2=$(_load_versioned_config_var "transcrypt.use-pbkdf2")
607-
# echo "Loaded use_pbkdf2 = $use_pbkdf2 from local config"
604+
prompt=$(printf 'Which key derivation function? [%s] ' "$DEFAULT_KDF")
605+
if [[ "$kdf" == "" ]]; then
606+
kdf=$(_load_versioned_config_var "transcrypt.kdf")
607+
# echo "Loaded kdf = $kdf from local config"
608608
fi
609-
_get_user_input use_pbkdf2 "$DEFAULT_USE_PBKDF2" "validate_use_pbkdf2" "$prompt"
609+
_get_user_input kdf "$DEFAULT_KDF" "validate_kdf" "$prompt"
610610
}
611611

612612
get_salt_method() {
@@ -650,7 +650,6 @@ ensure_salt_method() {
650650
# Check if randomized salt needs to be written
651651
if [[ "$salt_method" == "random" ]]; then
652652
# Replace random with something random.
653-
#salt_method=$(_load_versioned_config_var "transcrypt.salt-method")
654653
# If we have not configured the salt_method (or we need to rekey),
655654
# then generate new random salt
656655
salt_method=$(openssl rand -hex 32)
@@ -770,7 +769,7 @@ save_configuration() {
770769
_set_config_var "transcrypt.version" "$VERSION"
771770
_set_config_var "transcrypt.cipher" "$cipher"
772771
_set_config_var "transcrypt.digest" "$digest"
773-
_set_config_var "transcrypt.use-pbkdf2" "$use_pbkdf2"
772+
_set_config_var "transcrypt.kdf" "$kdf"
774773
_set_config_var "transcrypt.salt-method" "$salt_method"
775774
_set_unversioned_config_var "transcrypt.openssl-path" "$openssl_path"
776775
_set_unversioned_config_var "transcrypt.password" "$password"
@@ -819,7 +818,7 @@ _display_git_configuration() {
819818
# Show the config of the current runtime
820819
_display_runtime_configuration() {
821820
printf ' DIGEST: %s\n' "$digest"
822-
printf ' USE_PBKDF2: %s\n' "$use_pbkdf2"
821+
printf ' USE_PBKDF2: %s\n' "$kdf"
823822
printf ' SALT_METHOD: %s\n' "$salt_method"
824823
if [[ "$salt_method" == "configured" ]]; then
825824
printf ' CONFIG_SALT: %s\n' "$salt_method"
@@ -837,8 +836,8 @@ display_configuration() {
837836
_display_git_configuration
838837
_display_runtime_configuration
839838
printf 'Copy and paste the following command to initialize a cloned repository:\n\n'
840-
printf " transcrypt -c '%s' -p '%s' -md '%s' --use-pbkdf2 '%s' -sm '%s'\n" \
841-
"$cipher" "$escaped_password" "$digest" "$use_pbkdf2" "$salt_method"
839+
printf " transcrypt -c '%s' -p '%s' -md '%s' --kdf '%s' -sm '%s'\n" \
840+
"$cipher" "$escaped_password" "$digest" "$kdf" "$salt_method"
842841
}
843842

844843
# remove transcrypt-related settings from the repository's git config
@@ -1118,8 +1117,8 @@ export_gpg() {
11181117

11191118
local gpg_encrypt_cmd="gpg --batch --recipient $gpg_recipient --trust-model always --yes --armor --quiet --encrypt -"
11201119
#printf 'password=%s\ncipher=%s\n' "$current_password" "$current_cipher" | $gpg_encrypt_cmd >"${CRYPT_DIR}/${gpg_recipient}.asc"
1121-
printf 'password=%s\ncipher=%s\ndigest=%s\nuse_pbkdf2=%s\nsalt_method=%s\n\n' \
1122-
"$password" "$cipher" "$digest" "$use_pbkdf2" "$salt_method" |
1120+
printf 'password=%s\ncipher=%s\ndigest=%s\nkdf=%s\nsalt_method=%s\n\n' \
1121+
"$password" "$cipher" "$digest" "$kdf" "$salt_method" |
11231122
$gpg_encrypt_cmd >"${CRYPT_DIR}/${gpg_recipient}.asc"
11241123
printf "The transcrypt configuration has been encrypted and exported to:\n%s/crypt/%s.asc\n" "$GIT_DIR" "$gpg_recipient"
11251124
}
@@ -1154,7 +1153,7 @@ import_gpg() {
11541153
cipher=$(printf '%s' "$configuration" | grep '^cipher' | cut -d'=' -f 2-)
11551154
password=$(printf '%s' "$configuration" | grep '^password' | cut -d'=' -f 2-)
11561155
digest=$(printf '%s' "$configuration" | grep '^digest' | cut -d'=' -f 2-)
1157-
use_pbkdf2=$(printf '%s' "$configuration" | grep '^use_pbkdf2' | cut -d'=' -f 2-)
1156+
kdf=$(printf '%s' "$configuration" | grep '^kdf' | cut -d'=' -f 2-)
11581157
salt_method=$(printf '%s' "$configuration" | grep '^salt_method' | cut -d'=' -f 2-)
11591158
salt_method=$(printf '%s' "$configuration" | grep '^salt_method' | cut -d'=' -f 2-)
11601159
}
@@ -1199,9 +1198,12 @@ help() {
11991198
the digest used to hash the salted password;
12001199
defaults to md5
12011200
1202-
-pbkdf2, --use_pbkdf2=USE_PBKDF2
1203-
Use the pbkdf2 openssl encryption feature;
1204-
defaults to 0
1201+
--kdf=PBKDF2
1202+
the key-derivation-function to use. Currently can be either
1203+
'pbkdf2' or 'none'. Defaults to none.
1204+
1205+
-pbkdf2
1206+
equivalent to passing --kdf2='pbkdf2'
12051207
12061208
-sm, --salt_method=SALT_METHOD
12071209
Method used to compute deterministic salt; can be password, random,
@@ -1313,7 +1315,7 @@ transcrypt_main() {
13131315
uninstall=''
13141316
upgrade=''
13151317
openssl_path='openssl'
1316-
use_pbkdf2=''
1318+
kdf=''
13171319
digest=''
13181320
salt_method=''
13191321
salt_method=''
@@ -1366,14 +1368,14 @@ transcrypt_main() {
13661368
digest=${1#*=}
13671369
;;
13681370
-pbkdf2)
1369-
use_pbkdf2=1
1371+
kdf=pbkdf2
13701372
;;
1371-
--use-pbkdf2)
1372-
use_pbkdf2=${2}
1373+
--kdf)
1374+
kdf=${2}
13731375
shift
13741376
;;
1375-
--use-pbkdf2=*)
1376-
use_pbkdf2=${1#*=}
1377+
--kdf=*)
1378+
kdf=${1#*=}
13771379
;;
13781380
-sm | --salt-method)
13791381
salt_method=$2
@@ -1520,7 +1522,7 @@ transcrypt_main() {
15201522
# perform function calls to configure transcrypt
15211523
get_cipher
15221524
get_digest
1523-
get_use_pbkdf2
1525+
get_kdf
15241526
get_salt_method
15251527
get_password
15261528

0 commit comments

Comments
 (0)