File Coverage

blib/lib/Vigil/Crypt.pm

Criterion	Covered	Total	%
statement	66	83	79.5
branch	8	16	50.0
condition	10	28	35.7
subroutine	12	14	85.7
pod	6	7	85.7
total	102	148	68.9

package Vigil::Crypt;

use strict;
use warnings;

use Bytes::Random::Secure qw(random_bytes);
use Crypt::AuthEnc::ChaCha20Poly1305;
use Digest::SHA qw(sha256);
use Crypt::Argon2 qw(argon2id_pass argon2_verify);

our $VERSION = '2.1.2';

sub new {
    my ($class, $encryption_key) = @_;
    unless(defined $encryption_key && length($encryption_key) == 64) {
        warn 'Vigil::Crypt was given an invalid encryption key.';
        return;
    }
    bless { _encryption_key => pack("H*", $encryption_key), _last_error => '' }, $class;
}

sub last_error { return $_[0]->{_last_error} // ''; }

# ----------------------
# Encrypt a plaintext string
# ----------------------
sub encrypt {
    my ($self, $plaintext, $aad1, $aad2) = @_;

    $self->{_last_error} = '';

    # validate plaintext
    unless (defined $plaintext && length $plaintext) {
        $self->{_last_error} = "missing plaintext";
        return;
    }

    my $aad = $self->_derive_key($aad1, $aad2);

    # optional: if _derive_key returns undef, just use empty string
    $aad //= '';

    my $nonce = random_bytes(12);

    my $blob;
    eval {
        my $cipher = Crypt::AuthEnc::ChaCha20Poly1305->new($self->{_encryption_key}, $nonce);
        $cipher->adata_add($aad);
        my $ct  = $cipher->encrypt_add($plaintext);
        my $tag = $cipher->encrypt_done();
        $blob = $nonce . $ct . $tag;   # assign to outer $blob
        1;
    } or do {
        my $err = $@ || 'Unknown encryption error';
        $self->{_last_error} = "encrypt failed: $err";
        return;
    };

    # return hex string for storage
    return unpack("H*", $blob);
}

# ----------------------
# Decrypt a hex-encoded ciphertext string
# ----------------------
sub decrypt {
    my ($self, $blob_hex, $aad1, $aad2) = @_;

    $self->{_last_error} = '';

    unless (defined $blob_hex && length $blob_hex) {
        $self->{_last_error} = "missing blob";
        return;
    }

    my $decoded = eval { pack("H*", $blob_hex) };
    if ($@ || !defined $decoded) {
        $self->{_last_error} = "invalid hex blob";
        return;
    }

    if (length($decoded) < 28) {
        $self->{_last_error} = "blob too short";
        return;
    }

    my $aad = $self->_derive_key($aad1, $aad2);
    $aad //= '';

	my $nonce = substr($decoded, 0, 12);
	my $tag   = substr($decoded, -16);           # last 16 bytes is the Poly1305 tag
	my $ciphertext = substr($decoded, 12, -16);  # between nonce and tag

	my $cipher = Crypt::AuthEnc::ChaCha20Poly1305->new($self->{_encryption_key}, $nonce);
	$cipher->adata_add($aad);
	my $plaintext = $cipher->decrypt_add($ciphertext);
	my $ok = $cipher->decrypt_done($tag);        # returns 1 if auth ok
	unless ($ok) {
		$self->{_last_error} = "decrypt failed: authentication failed";
		return;
	}
	return $plaintext;
}

# ----------------------
# Hashing functions
# ----------------------
sub hash {
    my ($self, $password, $pepper) = @_;
    $pepper //= '';
    return argon2id_pass(
        sha256($password . $pepper),
        random_bytes(16),
        3, '32M', 1, 32
    );
}

sub verify_hash {
    my ($self, $user_input, $stored_hash, $pepper) = @_;
    $pepper //= '';
    return argon2_verify($stored_hash, sha256($user_input . $pepper));
}

sub verify_password { return shift->verify_hash(@_); }

sub _derive_key {
    my ($self, $a, $b) = @_;
    $a //= '';
    $b //= '';
    my $pepper = substr("1010" . $a, -4, 4) . substr($b . "101010101", 0, 9);
    return undef unless length($pepper) == 13;
    return $pepper;
}

1;


__END__