DopplerHQ / cli

The official CLI for interacting with your Doppler secrets and configuration.
https://docs.doppler.com
Apache License 2.0
214 stars 43 forks source link

Increase default number of pbkdf2 rounds to 500,000 #340

Closed Piccirello closed 1 year ago

Kunamatata commented 1 year ago

Would it be valuable to refactor aes.go into leveraging structs and methods? This could potentially have the nice effect of encapsulating and separating encoding and decoding concerns from encryption and decryption and provide an interface for those.

We could eventually go one step further and extract the encoding and decoding (base64, hex) into their own structs and pass and provide an AESEncoderDecoder interface and then pass that to the AESEncryptDecrypt struct.

The call sites would have to change to accommodate initializing the new struct.

Here's a loose initial example.

type AESEncrytertDecrypter interface {
    Encrypt(passphrase string, plaintext []byte, encoding string) (string, error)
    Decrypt(passphrase string, ciphertext []byte) (string, error)
}

type AESEncryptDecrypt struct {
    base64EncodingPrefix string
    hexEncodingPrefix    string
    pbkdf2Rounds         int
    legacyPbkdf2Rounds   int
}

func NewAESEncrypterDecypter() AESEncrytertDecrypter {
    return &AESEncryptDecrypt{
        base64EncodingPrefix: "base64",
        hexEncodingPrefix:    "hex",
        pbkdf2Rounds:         500000,
        legacyPbkdf2Rounds:   50000,
    }
}
Kunamatata commented 1 year ago

optional nit: