From 065e0adbfdcfde68db6d94038ea0973d8308cbf6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Julio=20L=C3=B3pez?=
 <1953782+julio-lopez@users.noreply.github.com>
Date: Tue, 30 Apr 2024 17:21:11 -0700
Subject: [PATCH] refactor(general): make key derivers available in tests
 (#3826)

- Re-introduces the **insecure**, lightweight key deriver for
  testing **only**.
- Makes `scrypt` and `pbkdf2` derivers available in tests as well.
---
 internal/crypto/key_derivation_testing.go     | 33 -------------------
 .../crypto/pb_key_deriver_insecure_testing.go | 25 ++++++++++++++
 internal/crypto/pb_key_deriver_pbkdf2.go      |  3 --
 internal/crypto/pb_key_deriver_scrypt.go      |  3 --
 ...rivation_nontest.go => pb_key_derivers.go} |  3 --
 ... format_blob_key_derivation_nontesting.go} |  3 ++
 .../format_blob_key_derivation_testing.go     | 16 +++++++++
 7 files changed, 44 insertions(+), 42 deletions(-)
 delete mode 100644 internal/crypto/key_derivation_testing.go
 create mode 100644 internal/crypto/pb_key_deriver_insecure_testing.go
 rename internal/crypto/{key_derivation_nontest.go => pb_key_derivers.go} (97%)
 rename repo/format/{format_blob_key_derivation.go => format_blob_key_derivation_nontesting.go} (93%)
 create mode 100644 repo/format/format_blob_key_derivation_testing.go

diff --git a/internal/crypto/key_derivation_testing.go b/internal/crypto/key_derivation_testing.go
deleted file mode 100644
index 7107d4f58..000000000
--- a/internal/crypto/key_derivation_testing.go
+++ /dev/null
@@ -1,33 +0,0 @@
-//go:build testing
-// +build testing
-
-package crypto
-
-import (
-	"crypto/sha256"
-
-	"github.com/pkg/errors"
-)
-
-const (
-	ScryptAlgorithm = "scrypt-65536-8-1"
-
-	Pbkdf2Algorithm = "pbkdf2-sha256-600000"
-)
-
-// DeriveKeyFromPassword derives encryption key using the provided password and per-repository unique ID.
-func DeriveKeyFromPassword(password string, salt []byte, keySize int, algorithm string) ([]byte, error) {
-	switch algorithm {
-	case ScryptAlgorithm, Pbkdf2Algorithm:
-		h := sha256.New()
-		// Adjust password so that we get a different key for each algorithm
-		if _, err := h.Write([]byte(password + algorithm)); err != nil {
-			return nil, err
-		}
-
-		return h.Sum(nil), nil
-
-	default:
-		return nil, errors.Errorf("unsupported key algorithm: %v", algorithm)
-	}
-}
diff --git a/internal/crypto/pb_key_deriver_insecure_testing.go b/internal/crypto/pb_key_deriver_insecure_testing.go
new file mode 100644
index 000000000..961e71f22
--- /dev/null
+++ b/internal/crypto/pb_key_deriver_insecure_testing.go
@@ -0,0 +1,25 @@
+//go:build testing
+// +build testing
+
+package crypto
+
+import (
+	"crypto/sha256"
+)
+
+const TestingOnlyInsecurePBKeyDerivationAlgorithm = "testing-only-insecure"
+
+func init() {
+	registerPBKeyDeriver(TestingOnlyInsecurePBKeyDerivationAlgorithm, &insecureKeyDeriver{})
+}
+
+type insecureKeyDeriver struct{}
+
+func (s *insecureKeyDeriver) deriveKeyFromPassword(password string, salt []byte, keySize int) ([]byte, error) {
+	h := sha256.New()
+	if _, err := h.Write([]byte(password)); err != nil {
+		return nil, err
+	}
+
+	return h.Sum(nil)[:keySize], nil
+}
diff --git a/internal/crypto/pb_key_deriver_pbkdf2.go b/internal/crypto/pb_key_deriver_pbkdf2.go
index ebcf00d99..b071015b8 100644
--- a/internal/crypto/pb_key_deriver_pbkdf2.go
+++ b/internal/crypto/pb_key_deriver_pbkdf2.go
@@ -1,6 +1,3 @@
-//go:build !testing
-// +build !testing
-
 package crypto
 
 import (
diff --git a/internal/crypto/pb_key_deriver_scrypt.go b/internal/crypto/pb_key_deriver_scrypt.go
index f1a2a6cc6..765fddbfc 100644
--- a/internal/crypto/pb_key_deriver_scrypt.go
+++ b/internal/crypto/pb_key_deriver_scrypt.go
@@ -1,6 +1,3 @@
-//go:build !testing
-// +build !testing
-
 package crypto
 
 import (
diff --git a/internal/crypto/key_derivation_nontest.go b/internal/crypto/pb_key_derivers.go
similarity index 97%
rename from internal/crypto/key_derivation_nontest.go
rename to internal/crypto/pb_key_derivers.go
index 9aee6ad6f..2b664c027 100644
--- a/internal/crypto/key_derivation_nontest.go
+++ b/internal/crypto/pb_key_derivers.go
@@ -1,6 +1,3 @@
-//go:build !testing
-// +build !testing
-
 package crypto
 
 import (
diff --git a/repo/format/format_blob_key_derivation.go b/repo/format/format_blob_key_derivation_nontesting.go
similarity index 93%
rename from repo/format/format_blob_key_derivation.go
rename to repo/format/format_blob_key_derivation_nontesting.go
index 7d0141c97..40170ffc0 100644
--- a/repo/format/format_blob_key_derivation.go
+++ b/repo/format/format_blob_key_derivation_nontesting.go
@@ -1,3 +1,6 @@
+//go:build !testing
+// +build !testing
+
 package format
 
 import "github.com/kopia/kopia/internal/crypto"
diff --git a/repo/format/format_blob_key_derivation_testing.go b/repo/format/format_blob_key_derivation_testing.go
new file mode 100644
index 000000000..171e7d4e8
--- /dev/null
+++ b/repo/format/format_blob_key_derivation_testing.go
@@ -0,0 +1,16 @@
+//go:build testing
+// +build testing
+
+package format
+
+import "github.com/kopia/kopia/internal/crypto"
+
+// DefaultKeyDerivationAlgorithm is the derivation algorithm for format encryption for new repositories.
+const DefaultKeyDerivationAlgorithm = crypto.TestingOnlyInsecurePBKeyDerivationAlgorithm
+
+// SupportedFormatBlobKeyDerivationAlgorithms returns the supported algorithms
+// for deriving the local cache encryption key when connecting to a repository
+// via the kopia API server.
+func SupportedFormatBlobKeyDerivationAlgorithms() []string {
+	return []string{crypto.ScryptAlgorithm, crypto.Pbkdf2Algorithm, crypto.TestingOnlyInsecurePBKeyDerivationAlgorithm}
+}