File Coverage

blib/lib/DTOne/Crypt.pm

Criterion	Covered	Total	%
statement	65	65	100.0
branch	15	16	93.7
condition			n/a
subroutine	15	15	100.0
pod	2	2	100.0
total	97	98	98.9

package DTOne::Crypt;

use strict;
use 5.008_005;
our $VERSION = '0.06';

require Exporter;
our @ISA = qw(Exporter);
our @EXPORT_OK = qw(encrypt_aes256gcm decrypt_aes256gcm);

use Crypt::AuthEnc::GCM qw(gcm_encrypt_authenticate gcm_decrypt_verify);
use Crypt::ScryptKDF qw(scrypt_raw);
use Bytes::Random::Secure qw(random_bytes);
use MIME::Base64;
use Carp;

use constant PROTOCOL_VERSION       => 2;

# v1 constants
use constant SCRYPT_ITERATIONS      => 32768;   # 2**15
use constant SCRYPT_BLOCK_SIZE      => 8;
use constant SCRYPT_PARALLELISM     => 1;
use constant SCRYPT_DERIVED_KEY_LEN => 32;

sub encrypt_aes256gcm {
    my $plaintext  = shift;
    my $master_key = shift or croak "master key required";

    unless (defined $plaintext) {
        croak "plaintext data required";
    }

    $master_key = decode_base64($master_key);
    unless (length($master_key) == 32) {
        croak "invalid master key length";
    }

    my $iv = random_bytes(12);
    my ($ciphertext, $tag) = gcm_encrypt_authenticate(
        'AES',
        $master_key,
        $iv,
        undef,
        $plaintext
    );

    my $composite = encode_base64(join('', $iv, $tag, $ciphertext), '');

    return '$'.join('$', PROTOCOL_VERSION, $composite);
}

sub decrypt_aes256gcm {
    my $encrypted  = shift or croak "encrypted data required";
    my $master_key = shift or croak "master key required";

    $master_key = decode_base64($master_key);
    unless (length($master_key) == 32) {
        croak "invalid master key length";
    }

    my $key;
    my $iv;
    my $tag;
    my $ciphertext;
    if (_is_v2_format($encrypted)) {
        (undef, my $version, $encrypted) = split(/\$/, $encrypted);
        $encrypted = decode_base64($encrypted);

        ($iv, $tag, $ciphertext) = unpack('a12 a16 a*', $encrypted);
        $key = $master_key;
    } else {
        $encrypted = decode_base64($encrypted);
        (my $salt, $iv, $tag, $ciphertext) = unpack('a16 a12 a16 a*', $encrypted);

        $key = scrypt_raw(
            $master_key,
            $salt,
            SCRYPT_ITERATIONS,
            SCRYPT_BLOCK_SIZE,
            SCRYPT_PARALLELISM,
            SCRYPT_DERIVED_KEY_LEN
        );
    }

    return gcm_decrypt_verify(
        'AES',
        $key,
        $iv,
        undef,
        $ciphertext,
        $tag
    );
}

sub _is_v2_format {
    my $encrypted = shift or croak "encrypted data required";
    return substr($encrypted, 0, 1) eq '$';
}

1;
__END__