From c31fa58c85e866b3a5ab04882c7aff655f0b5477 Mon Sep 17 00:00:00 2001
From: Simeon Simeonov
Date: Tue, 30 Apr 2024 11:39:20 +0200
Subject: Implement etoolkit encryption protocol v2

---
 tests/conftest.py                        |  35 ++++++++--
 tests/test_cli.py                        |  60 ++++++++++------
 tests/test_envtoolkit_instance.py        |   8 ++-
 tests/test_envtoolkit_instance_static.py | 114 ++++++++++++++++++++++++++-----
 4 files changed, 169 insertions(+), 48 deletions(-)

(limited to 'tests')

diff --git a/tests/conftest.py b/tests/conftest.py
index 5dcc456..e555a49 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -1,5 +1,5 @@
 # etoolkit
-# Copyright (C) 2021-2022 Simeon Simeonov
+# Copyright (C) 2021-2024 Simeon Simeonov
 
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -14,14 +14,16 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 """Common fixtures"""
+
 import json
 
 import pytest
 
 
-@pytest.fixture
+@pytest.fixture()
 def config_data():
     """config_data for testing"""
+
     return {
         'general': {
             'MASTER_PASSWORD_HASH': (
@@ -51,26 +53,47 @@ def config_data():
     }
 
 
-@pytest.fixture
+@pytest.fixture()
 def config_file(tmp_path, config_data):
     """temporary config file for testing that includes config_data"""
-    cf = tmp_path / "etoolkit.json"
+
+    cf = tmp_path / 'etoolkit.json'
     cf.write_text(json.dumps(config_data))
     return str(cf)
 
 
-@pytest.fixture
+@pytest.fixture()
 def non_random_bytes_32():
     """always use the same bytes instead of os.urandom(32)"""
+
     return (
         b'\xb9\x8aY3U_\x00j\xb4\x086K\xd9\xdb\x88N'
         b'\xcd;\xe8$#\xfa\x12\x05\x12\x0c~\x17\x89\xa7\xf3J'
     )
 
 
-@pytest.fixture
+@pytest.fixture()
+def non_random_bytes_61():
+    """always use the same bytes instead of os.urandom(61)"""
+
+    return (
+        b'D$\x99\xaa\xafiZ\xb4C\xa0%XTz)\xca\xedK\xcd\xa2F~\xff+\xa1[\xe2\xaa'
+        b'\xb2\xd3\x07\x13\xedb\xc2\x84\xfe\tS\r\xf0\x02_\xef\xe3\xde\xf1?e'
+        b'\xa4s(Q\x04\xcd\xc7T\x01_D\xb1'
+    )
+
+
+@pytest.fixture()
+def nonexistent_config_file(tmp_path):
+    """temporary config file for testing that includes config_data"""
+
+    return str(tmp_path / 'etoolkitt.json')
+
+
+@pytest.fixture()
 def password_hash():
     """password hash for testing, corresponding to 'The very secret passwd'"""
+
     return (
         'pbkdf2_sha256$100000$uYpZM1VfAGq0CDZL2duITs076CQj+hIFEgx+F4mn80o=$h3'
         'PSPLCd37fP15zKdW4CBGn7CXE+q5UiydaF3vbeZHo='
diff --git a/tests/test_cli.py b/tests/test_cli.py
index 684c2e7..e5db244 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -1,5 +1,5 @@
 # etoolkit
-# Copyright (C) 2021-2022 Simeon Simeonov
+# Copyright (C) 2021-2024 Simeon Simeonov
 
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -14,6 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 """Tests for the CLI (etoolkit.__main__"""
+
 import errno
 import os
 import unittest.mock
@@ -24,11 +25,9 @@ import etoolkit
 from etoolkit.__main__ import main
 
 
-@unittest.mock.patch('os.urandom')
 @unittest.mock.patch('builtins.input')
-def test_decrypt(binput, urandom, capsys, non_random_bytes_32, config_file):
-    """Tests encryption via the CLI interface"""
-    urandom.return_value = non_random_bytes_32
+def test_decrypt_v1(binput, capsys, config_file):
+    """Tests v1 decryption via the CLI interface"""
     binput.return_value = (
         'enc-val$1$uYpZM1VfAGq0CDZL2duITs076CQj+'
         'hIFEgx+F4mn80o=$xdF/1S+R2MGlEQMCOLG6OjEuzw=='
@@ -43,11 +42,29 @@ def test_decrypt(binput, urandom, capsys, non_random_bytes_32, config_file):
         assert capsys.readouterr().out.strip() == 'Decrypted value: bar'
 
 
+@unittest.mock.patch('builtins.input')
+def test_decrypt_v2(binput, capsys, config_file):
+    """Tests v2 decryption via the CLI interface"""
+    binput.return_value = (
+        'enc-val$2$RCSZqq9pWrRDoCVYVHopyu1LzaJGfv8roVviq'
+        'rLTBxM=$VW3UZ6l12yDtyaqWHb7i0QEDiS9s9np'
+        '7huAACK54BtZVV7RZoIhbu4K6zZuz+LRCyio='
+    )
+    with unittest.mock.patch.dict(
+        os.environ, {'ETOOLKIT_MASTER_PASSWORD': 'the very secret passwd'}
+    ):
+        with pytest.raises(SystemExit) as exit_info:
+            main(['-c', f'{config_file}', '-d'])
+        assert exit_info.type == SystemExit
+        assert exit_info.value.code == 0
+        assert capsys.readouterr().out.strip() == 'Decrypted value: bar'
+
+
 @unittest.mock.patch('os.urandom')
 @unittest.mock.patch('builtins.input', lambda *args: 'bar')
-def test_encrypt_with_echo(urandom, capsys, non_random_bytes_32, config_file):
+def test_encrypt_with_echo(urandom, capsys, non_random_bytes_61, config_file):
     """Tests encryption via the CLI interface"""
-    urandom.return_value = non_random_bytes_32
+    urandom.return_value = non_random_bytes_61
     with unittest.mock.patch.dict(
         os.environ, {'ETOOLKIT_MASTER_PASSWORD': 'the very secret passwd'}
     ):
@@ -56,16 +73,17 @@ def test_encrypt_with_echo(urandom, capsys, non_random_bytes_32, config_file):
         assert exit_info.type == SystemExit
         assert exit_info.value.code == 0
         assert capsys.readouterr().out.strip() == (
-            'Encrypted value: enc-val$1$uYpZM1VfAGq0CDZL2duITs076CQj+'
-            'hIFEgx+F4mn80o=$xdF/1S+R2MGlEQMCOLG6OjEuzw=='
+            'Encrypted value: enc-val$2$RCSZqq9pWrRDoCVYVHopyu1LzaJGfv8roVviq'
+            'rLTBxM=$VW3UZ6l12yDtyaqWHb7i0QEDiS9s9np'
+            '7huAACK54BtZVV7RZoIhbu4K6zZuz+LRCyio='
         )
 
 
 @unittest.mock.patch('os.urandom')
 @unittest.mock.patch('getpass.getpass', lambda *args: 'bar')
-def test_encrypt_without_echo(gpass, capsys, non_random_bytes_32, config_file):
+def test_encrypt_without_echo(gpass, capsys, non_random_bytes_61, config_file):
     """Tests encryption via the CLI interface"""
-    gpass.return_value = non_random_bytes_32
+    gpass.return_value = non_random_bytes_61
     with unittest.mock.patch.dict(
         os.environ, {'ETOOLKIT_MASTER_PASSWORD': 'the very secret passwd'}
     ):
@@ -74,19 +92,20 @@ def test_encrypt_without_echo(gpass, capsys, non_random_bytes_32, config_file):
         assert exit_info.type == SystemExit
         assert exit_info.value.code == 0
         assert capsys.readouterr().out.strip() == (
-            'Encrypted value: enc-val$1$uYpZM1VfAGq0CDZL2duITs076CQj+'
-            'hIFEgx+F4mn80o=$xdF/1S+R2MGlEQMCOLG6OjEuzw=='
+            'Encrypted value: enc-val$2$RCSZqq9pWrRDoCVYVHopyu1LzaJGfv8roVviq'
+            'rLTBxM=$VW3UZ6l12yDtyaqWHb7i0QEDiS9s9np'
+            '7huAACK54BtZVV7RZoIhbu4K6zZuz+LRCyio='
         )
 
 
-def test_list(capsys, config_file):
+def test_list(capsys, config_file, nonexistent_config_file):
     """Tests list via the CLI interface"""
     with pytest.raises(SystemExit) as exit_info:
-        main(['-l'])
+        main(['-c', nonexistent_config_file, '-l'])
     assert exit_info.type == SystemExit
     assert exit_info.value.code == errno.EIO
     with pytest.raises(SystemExit) as exit_info:
-        main(['-c', f'{config_file}', '-l'])
+        main(['-c', config_file, '-l'])
     assert exit_info.type == SystemExit
     assert exit_info.value.code == 0
     assert capsys.readouterr().out.strip() == f'dev{os.linesep}secret'
@@ -104,10 +123,7 @@ def test_help(capsys):
 @unittest.mock.patch('os.urandom')
 @unittest.mock.patch('getpass.getpass')
 def test_generate_master_password_hash(
-    gpass,
-    urandom,
-    capsys,
-    non_random_bytes_32,
+    gpass, urandom, capsys, non_random_bytes_32
 ):
     """Tests master password hash generation via the CLI interface"""
     urandom.return_value = non_random_bytes_32
@@ -117,8 +133,8 @@ def test_generate_master_password_hash(
     assert exit_info.type == SystemExit
     assert exit_info.value.code == 0
     assert capsys.readouterr().out.strip() == (
-        'Master password hash: pbkdf2_sha256$100000$uYpZM1VfAGq0CDZL2duITs076'
-        'CQj+hIFEgx+F4mn80o=$h3PSPLCd37fP15zKdW4CBGn7CXE+q5UiydaF3vbeZHo='
+        'Master password hash: pbkdf2_sha256$500000$uYpZM1VfAGq0CDZL2duITs076'
+        'CQj+hIFEgx+F4mn80o=$Msl8/5nOBj0TRchykMzXmCXR8VQVyBqUPHe1PDWeJi8='
     )
 
 
diff --git a/tests/test_envtoolkit_instance.py b/tests/test_envtoolkit_instance.py
index 09baa31..73faed6 100644
--- a/tests/test_envtoolkit_instance.py
+++ b/tests/test_envtoolkit_instance.py
@@ -1,5 +1,5 @@
 # etoolkit
-# Copyright (C) 2021-2022 Simeon Simeonov
+# Copyright (C) 2021-2024 Simeon Simeonov
 
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -14,6 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 """Tests for etoolkit.EtoolkitInstance"""
+
 import pytest
 
 import etoolkit
@@ -32,8 +33,9 @@ def test_instantiation(config_data):
     assert 'DB_CONNECTION' not in instance.sensitive_env_variables
     assert 'PASSWORD' in instance.sensitive_env_variables
     assert instance.name == 'secret'
-    assert instance.master_password_hash == (
-        config_data['general']['MASTER_PASSWORD_HASH']
+    assert (
+        instance.master_password_hash
+        == (config_data['general']['MASTER_PASSWORD_HASH'])
     )
     assert instance.master_password is None
 
diff --git a/tests/test_envtoolkit_instance_static.py b/tests/test_envtoolkit_instance_static.py
index 73a5f36..5fb9451 100644
--- a/tests/test_envtoolkit_instance_static.py
+++ b/tests/test_envtoolkit_instance_static.py
@@ -1,5 +1,5 @@
 # etoolkit
-# Copyright (C) 2021-2022 Simeon Simeonov
+# Copyright (C) 2021-2024 Simeon Simeonov
 
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -14,6 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 """Tests for etoolkit.EtoolkitInstance static methods"""
+
 import unittest.mock
 
 import pytest
@@ -35,7 +36,7 @@ def test_confirm_password_prompt(getpass, password_hash):
     )
 
 
-def test_decrypt():
+def test_decrypt_v1():
     """Tests the static EtoolkitInstance.decrypt method"""
     assert (
         etoolkit.EtoolkitInstance.decrypt(
@@ -49,39 +50,118 @@ def test_decrypt():
     )
 
     # now test with modified edata
+    edata = (
+        'enc-val$1$/cXpEMoZrTlb9yokGhw8tLTSUkqnqJ5ZoAkurNgMYx'
+        'w=$1VdkSMcZnLRwLiu1M8VlYcbelwmiVNY='
+    )
     with pytest.raises(etoolkit.EtoolkitInstanceError) as exc_info:
-        edata = (
-            'enc-val$1$/cXpEMoZrTlb9yokGhw8tLTSUkqnqJ5ZoAkurNgMYx'
-            'w=$1VdkSMcZnLRwLiu1M8VlYcbelwmiVNY='
+        etoolkit.EtoolkitInstance.decrypt('The very secret passwd', edata)
+    assert exc_info.type is etoolkit.EtoolkitInstanceError
+    assert exc_info.value.args[0] == f'Invalid tag when decrypting: {edata}'
+
+
+def test_decrypt_v2_no_padding():
+    """Tests the static EtoolkitInstance.decrypt method for v2 - no padding"""
+    assert (
+        etoolkit.EtoolkitInstance.decrypt(
+            'The very secret passwd',
+            (
+                'enc-val$2$Wer5lECGyeZhhYS58N18WVx5Zzy+rrC+BPlq3Dw89wQ=$'
+                'SQc0ox6Emf2m5rrumsiptpIZEujdpXXSR/'
+                '1VcfEZeBz4+KDSagr9ID+bkc4R2yFdxHnhig1eqQ8='
+            ),
         )
+        == 'Nobody expects the Spanish inquisition'
+    )
+
+    # now test with modified edata
+    edata = (
+        'enc-val$2$Wer5lECGyeZhhYS58N18WVx5Zzy+rrC+BPlq3Dw89wQ=$'
+        'SQc0ox6Emf2m4rrumsiptpIZEujdpXXSR/'
+        '1VcfEZeBz4+KDSagr9ID+bkc4R2yFdxHnhig1eqQ8='
+    )
+    with pytest.raises(etoolkit.EtoolkitInstanceError) as exc_info:
+        etoolkit.EtoolkitInstance.decrypt('The very secret passwd', edata)
+    assert exc_info.type is etoolkit.EtoolkitInstanceError
+    assert exc_info.value.args[0] == f'Invalid tag when decrypting: {edata}'
+
+
+def test_decrypt_v2_with_padding():
+    """Tests the static EtoolkitInstance.decrypt method for v2 with padding"""
+    assert (
         etoolkit.EtoolkitInstance.decrypt(
-            'The very secret passwd', edata
-        ) == 'secret1'
+            'The very secret passwd',
+            (
+                'enc-val$2$//kzyUbDEWNoPC5dyukhB8de8+IVaLR2ngx2HwkfOuM=$'
+                'rhRona4wP9nhnXjcHqwkjFDsiVVVjYanAs'
+                'N4kknNkgC0ix4RtJQHYDeTzw1rrR1vb2w='
+            ),
+        )
+        == 'secret1'
+    )
+
+    # now test with modified edata
+    edata = (
+        'enc-val$2$//kzyUbDEWNoPC5dyukhB8de8+IVaLR2ngx2HwkfOuM=$'
+        'rhRona4wP8nhnXjcHqwkjFDsiVVVjYanAsN4kknNkgC0ix4RtJQHYDeTzw1rrR1vb2w='
+    )
+    with pytest.raises(etoolkit.EtoolkitInstanceError) as exc_info:
+        etoolkit.EtoolkitInstance.decrypt('The very secret passwd', edata)
     assert exc_info.type is etoolkit.EtoolkitInstanceError
     assert exc_info.value.args[0] == f'Invalid tag when decrypting: {edata}'
 
 
-def test_encrypt():
-    """Tests the static EtoolkitInstance.encrypt method"""
+def test_encrypt_no_padding():
+    """Tests the static EtoolkitInstance.encrypt method with a long string"""
+    edata = etoolkit.EtoolkitInstance.encrypt(
+        'foo', 'Nobody expects the Spanish inquisition'
+    )
+    assert edata.startswith('enc-val$2$')
+    assert len(edata) == 131
+    # the edata should always be different because of random salting
+    assert edata != etoolkit.EtoolkitInstance.encrypt(
+        'foo', 'Nobody expects the Spanish inquisition'
+    )
+
+
+def test_encrypt_with_padding():
+    """Tests the static EtoolkitInstance.encrypt method with a short string"""
     edata = etoolkit.EtoolkitInstance.encrypt('foo', 'bar')
-    assert edata.startswith('enc-val$')
-    assert len(edata) == 83
+    assert edata.startswith('enc-val$2$')
+    assert len(edata) == 123
     # the edata should always be different because of random salting
     assert edata != etoolkit.EtoolkitInstance.encrypt('foo', 'bar')
 
 
 @unittest.mock.patch('os.urandom')
-def test_encrypt_staticly(urandom, non_random_bytes_32):
+def test_encrypt_staticly_no_padding(urandom, non_random_bytes_32):
     """Tests the EtoolkitInstance.encrypt method always with the same salt"""
     urandom.return_value = non_random_bytes_32
+    edata = etoolkit.EtoolkitInstance.encrypt(
+        'The very secret passwd', 'Nobody expects the Spanish inquisition'
+    )
+    assert edata == (
+        'enc-val$2$uYpZM1VfAGq0CDZL2duITs076CQj+hIFEgx+F4mn80o=$'
+        'UX/5YeRsh5/2vZ2J1UOS+BJti73Kbp6C1pJmC'
+        'o8hFSujpe35X/XpzAiYv4BV1LNwnSYECsotsgs='
+    )
+    assert len(edata) == 131
+    assert edata == etoolkit.EtoolkitInstance.encrypt(
+        'The very secret passwd', 'Nobody expects the Spanish inquisition'
+    )
+
+
+@unittest.mock.patch('os.urandom')
+def test_encrypt_staticly_with_padding(urandom, non_random_bytes_61):
+    """Tests the EtoolkitInstance.encrypt method always with the same salt"""
+    urandom.return_value = non_random_bytes_61
     edata = etoolkit.EtoolkitInstance.encrypt('The very secret passwd', 'bar')
     assert edata == (
-        'enc-val$1$uYpZM1VfAGq0CDZL2duITs076CQj+hIFEgx+F4mn80'
-        'o=$HjPFNv6xC5hbMrFc0L5lSkWdfQ=='
+        'enc-val$2$RCSZqq9pWrRDoCVYVHopyu1LzaJGfv8roVviqrLTBxM=$'
+        '+Yo6Ya2MAVcBLTQHuATkyFc+dzYsL/ESvA6ofOUDsiKZvIff35cUHAmoNxVuGG+MXv4='
     )
     assert edata == etoolkit.EtoolkitInstance.encrypt(
-        'The very secret passwd',
-        'bar',
+        'The very secret passwd', 'bar'
     )
 
 
@@ -91,7 +171,7 @@ def test_get_new_password_hash():
         'The very secret passwd'
     )
     # all pbkdf2 params are the same / hardcoded for the time being
-    assert new_hash.startswith('pbkdf2_sha256$100000$')
+    assert new_hash.startswith('pbkdf2_sha256$500000$')
     assert len(new_hash) == 110
     # the hash should always be different because of random salting
     assert new_hash != etoolkit.EtoolkitInstance.get_new_password_hash(
-- 
cgit v1.3