refactor(general): make key derivers available in tests (#3826)

- Re-introduces the **insecure**, lightweight key deriver for
  testing **only**.
- Makes `scrypt` and `pbkdf2` derivers available in tests as well.

internal/crypto/key_derivation_testing.go

@@ -1,33 +0,0 @@
-//go:build testing
-// +build testing
-
-package crypto
-
-import (
-	"crypto/sha256"
-
-	"github.com/pkg/errors"
-)
-
-const (
-	ScryptAlgorithm = "scrypt-65536-8-1"
-
-	Pbkdf2Algorithm = "pbkdf2-sha256-600000"
-)
-
-// DeriveKeyFromPassword derives encryption key using the provided password and per-repository unique ID.
-func DeriveKeyFromPassword(password string, salt []byte, keySize int, algorithm string) ([]byte, error) {
-	switch algorithm {
-	case ScryptAlgorithm, Pbkdf2Algorithm:
-		h := sha256.New()
-		// Adjust password so that we get a different key for each algorithm
-		if _, err := h.Write([]byte(password + algorithm)); err != nil {
-			return nil, err
-		}
-
-		return h.Sum(nil), nil
-
-	default:
-		return nil, errors.Errorf("unsupported key algorithm: %v", algorithm)
-	}
-}

internal/crypto/pb_key_deriver_insecure_testing.go

@@ -0,0 +1,25 @@
+//go:build testing
+// +build testing
+
+package crypto
+
+import (
+	"crypto/sha256"
+)
+
+const TestingOnlyInsecurePBKeyDerivationAlgorithm = "testing-only-insecure"
+
+func init() {
+	registerPBKeyDeriver(TestingOnlyInsecurePBKeyDerivationAlgorithm, &insecureKeyDeriver{})
+}
+
+type insecureKeyDeriver struct{}
+
+func (s *insecureKeyDeriver) deriveKeyFromPassword(password string, salt []byte, keySize int) ([]byte, error) {
+	h := sha256.New()
+	if _, err := h.Write([]byte(password)); err != nil {
+		return nil, err
+	}
+
+	return h.Sum(nil)[:keySize], nil
+}

internal/crypto/pb_key_deriver_pbkdf2.go

@@ -1,6 +1,3 @@
-//go:build !testing
-// +build !testing
-
 package crypto
 
 import (

internal/crypto/pb_key_deriver_scrypt.go

@@ -1,6 +1,3 @@
-//go:build !testing
-// +build !testing
-
 package crypto
 
 import (

internal/crypto/pb_key_derivers.go

@@ -1,6 +1,3 @@
-//go:build !testing
-// +build !testing
-
 package crypto
 
 import (

repo/format/format_blob_key_derivation_nontesting.go

@@ -1,3 +1,6 @@
+//go:build !testing
+// +build !testing
+
 package format
 
 import "github.com/kopia/kopia/internal/crypto"

repo/format/format_blob_key_derivation_testing.go

@@ -0,0 +1,16 @@
+//go:build testing
+// +build testing
+
+package format
+
+import "github.com/kopia/kopia/internal/crypto"
+
+// DefaultKeyDerivationAlgorithm is the derivation algorithm for format encryption for new repositories.
+const DefaultKeyDerivationAlgorithm = crypto.TestingOnlyInsecurePBKeyDerivationAlgorithm
+
+// SupportedFormatBlobKeyDerivationAlgorithms returns the supported algorithms
+// for deriving the local cache encryption key when connecting to a repository
+// via the kopia API server.
+func SupportedFormatBlobKeyDerivationAlgorithms() []string {
+	return []string{crypto.ScryptAlgorithm, crypto.Pbkdf2Algorithm, crypto.TestingOnlyInsecurePBKeyDerivationAlgorithm}
+}