File Coverage

blib/lib/DTOne/Crypt.pm

Criterion	Covered	Total	%
statement	50	53	94.3
branch	6	12	50.0
condition			n/a
subroutine	13	13	100.0
pod	2	2	100.0
total	71	80	88.7

package DTOne::Crypt;

use strict;
use 5.008_005;
our $VERSION = '0.04';

require Exporter;
our @ISA = qw(Exporter);
our @EXPORT_OK = qw(encrypt_aes256gcm decrypt_aes256gcm);

use Crypt::AuthEnc::GCM qw(gcm_encrypt_authenticate gcm_decrypt_verify);
use Crypt::ScryptKDF qw(scrypt_raw);
use Bytes::Random::Secure qw(random_bytes);
use MIME::Base64;
use Carp;

use constant SCRYPT_ITERATIONS      => 32768;   # 2**15
use constant SCRYPT_BLOCK_SIZE      => 8;
use constant SCRYPT_PARALLELISM     => 1;
use constant SCRYPT_DERIVED_KEY_LEN => 32;

sub encrypt_aes256gcm {
    my $plaintext  = shift;
    my $master_key = shift or croak "master key required";

    unless (defined $plaintext) {
        croak "plaintext data required";
    }

    $master_key = decode_base64($master_key);
    unless (length($master_key) == 32) {
        croak "invalid master key length";
    }

    my $iv   = random_bytes(12);
    my $salt = random_bytes(16);
    my $key  = scrypt_raw(
        $master_key,
        $salt,
        SCRYPT_ITERATIONS,
        SCRYPT_BLOCK_SIZE,
        SCRYPT_PARALLELISM,
        SCRYPT_DERIVED_KEY_LEN
    );

    my ($ciphertext, $tag) = gcm_encrypt_authenticate(
        'AES',
        $key,
        $iv,
        undef,
        $plaintext
    );

    return encode_base64(join('', $salt, $iv, $tag, $ciphertext), '');
}

sub decrypt_aes256gcm {
    my $encrypted  = shift or croak "encrypted data required";
    my $master_key = shift or croak "master key required";

    $master_key = decode_base64($master_key);
    unless (length($master_key) == 32) {
        croak "invalid master key length";
    }

    $encrypted = decode_base64($encrypted);
    my ($salt, $iv, $tag, $ciphertext) = unpack('a16 a12 a16 a*', $encrypted);
    my $key = scrypt_raw(
        $master_key,
        $salt,
        SCRYPT_ITERATIONS,
        SCRYPT_BLOCK_SIZE,
        SCRYPT_PARALLELISM,
        SCRYPT_DERIVED_KEY_LEN
    );

    return gcm_decrypt_verify(
        'AES',
        $key,
        $iv,
        undef,
        $ciphertext,
        $tag
    );
}

1;
__END__