harald/sanctum
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases 14 Wiki Activity

chore(qa): format code and configure clippy lints

Browse Source
This commit is contained in:
harald
2026-09-19 10:04:53 +02:00
parent 45572b7370
commit 28a4bb6b70
16 changed files with 157 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/crypto.rs
+50 -14
View File
@@ -590,13 +590,13 @@ pub fn hmac_sha256(key: &[u8], data: &[u8]) -> [u8; 32] {
}
let mut inner_hasher = Sha256::new();
inner_hasher.update(&k_ipad);
inner_hasher.update(k_ipad);
inner_hasher.update(data);
let inner_hash = inner_hasher.finalize();
let mut outer_hasher = Sha256::new();
outer_hasher.update(&k_opad);
outer_hasher.update(&inner_hash);
outer_hasher.update(k_opad);
outer_hasher.update(inner_hash);
let out = outer_hasher.finalize();
let mut result = [0u8; 32];
@@ -840,8 +840,14 @@ mod tests {
256 * 1024,
"Default memory cost must be 256 MiB (262,144 KiB)"
);
assert_eq!(defaults.time_cost, 4, "Default time cost must be 4 iterations");
assert_eq!(defaults.parallelism, 4, "Default parallelism must be 4 threads");
assert_eq!(
defaults.time_cost, 4,
"Default time cost must be 4 iterations"
);
assert_eq!(
defaults.parallelism, 4,
"Default parallelism must be 4 threads"
);
assert!(
validate_kdf_params(&defaults).is_ok(),
"Default KDF parameters must pass validation"
@@ -923,8 +929,15 @@ mod tests {
let chunk_index = 0u32;
// 1. Chunk mit Generation 1 verschlüsseln
let (ct1, nonce1, tag1) =
encrypt_chunk(&dek, node_id, chunk_index, plaintext_v1, FORMAT_VERSION_V3, 1).unwrap();
let (ct1, nonce1, tag1) = encrypt_chunk(
&dek,
node_id,
chunk_index,
plaintext_v1,
FORMAT_VERSION_V3,
1,
)
.unwrap();
// Verifiziere reguläre Entschlüsselung mit Generation 1
let dec1 = decrypt_chunk(
@@ -957,8 +970,15 @@ mod tests {
);
// 3. Chunk überschreiben mit Generation 2
let (ct2, nonce2, tag2) =
encrypt_chunk(&dek, node_id, chunk_index, plaintext_v2, FORMAT_VERSION_V3, 2).unwrap();
let (ct2, nonce2, tag2) = encrypt_chunk(
&dek,
node_id,
chunk_index,
plaintext_v2,
FORMAT_VERSION_V3,
2,
)
.unwrap();
let dec2 = decrypt_chunk(
&dek,
node_id,
@@ -983,11 +1003,21 @@ mod tests {
FORMAT_VERSION_V3,
2,
);
assert!(attack_res.is_err(), "Replay von altem Ciphertext muss abgewehrt werden");
assert!(
attack_res.is_err(),
"Replay von altem Ciphertext muss abgewehrt werden"
);
// 5. Abwärtskompatibilität: In V2 wird generation ignoriert
let (ct_v2, nonce_v2, tag_v2) =
encrypt_chunk(&dek, node_id, chunk_index, plaintext_v1, FORMAT_VERSION_V2, 0).unwrap();
let (ct_v2, nonce_v2, tag_v2) = encrypt_chunk(
&dek,
node_id,
chunk_index,
plaintext_v1,
FORMAT_VERSION_V2,
0,
)
.unwrap();
let dec_v2 = decrypt_chunk(
&dek,
node_id,
@@ -1043,7 +1073,8 @@ mod tests {
let mut random_bytes = vec![0u8; 1000];
OsRng.fill_bytes(&mut random_bytes);
let (ct, nonce, tag) = encrypt_chunk(&dek, 1, 0, &random_bytes, FORMAT_VERSION_V2, 0).unwrap();
let (ct, nonce, tag) =
encrypt_chunk(&dek, 1, 0, &random_bytes, FORMAT_VERSION_V2, 0).unwrap();
// Da Kompression keine 64 Bytes spart, wird COMPRESSION_NONE (1 Byte) + Plaintext gespeichert
assert_eq!(ct.len(), random_bytes.len() + 1);
@@ -1353,7 +1384,12 @@ mod tests {
assert!(verify_metadata_mac(&mac_key, gen, canonical_nodes, &mac));
// Manipulierte Generation -> ungültig
assert!(!verify_metadata_mac(&mac_key, gen + 1, canonical_nodes, &mac));
assert!(!verify_metadata_mac(
&mac_key,
gen + 1,
canonical_nodes,
&mac
));
// Manipulierte Knoten-Bytes -> ungültig
assert!(!verify_metadata_mac(&mac_key, gen, b"tampered_nodes", &mac));