Libsodium encryption in Golang

go get golang.org/x/crypto

package main

import (
	"crypto/rand"
	"errors"
	"fmt"

	"golang.org/x/crypto/nacl/secretbox"
)

// encryptSecretBox encrypts plaintext with a 32-byte key and returns
// nonce||ciphertext so the nonce travels with the message.
func encryptSecretBox(plaintext, key []byte) ([]byte, error) {
	if len(key) != 32 {
		return nil, errors.New("secretbox: key must be 32 bytes")
	}

	var secretKey [32]byte
	copy(secretKey[:], key)

	var nonce [24]byte
	if _, err := rand.Read(nonce[:]); err != nil {
		return nil, err
	}

	// Seal appends the ciphertext to the nonce prefix so the result is
	// nonce (24 bytes) followed by the authenticated ciphertext.
	encrypted := secretbox.Seal(nonce[:], plaintext, &nonce, &secretKey)
	return encrypted, nil
}

// decryptSecretBox reverses encryptSecretBox. A tampered or truncated
// message fails the Poly1305 check and returns an error.
func decryptSecretBox(encrypted, key []byte) ([]byte, error) {
	if len(key) != 32 {
		return nil, errors.New("secretbox: key must be 32 bytes")
	}
	if len(encrypted) < 24 {
		return nil, errors.New("secretbox: message too short")
	}

	var secretKey [32]byte
	copy(secretKey[:], key)

	var nonce [24]byte
	copy(nonce[:], encrypted[:24])

	plaintext, ok := secretbox.Open(nil, encrypted[24:], &nonce, &secretKey)
	if !ok {
		return nil, errors.New("secretbox: decryption failed")
	}
	return plaintext, nil
}

func main() {
	key := make([]byte, 32)
	if _, err := rand.Read(key); err != nil {
		panic(err)
	}

	ciphertext, err := encryptSecretBox([]byte("attack at dawn"), key)
	if err != nil {
		panic(err)
	}

	plaintext, err := decryptSecretBox(ciphertext, key)
	if err != nil {
		panic(err)
	}

	fmt.Printf("decrypted: %s\n", plaintext)
}

package main

import (
	"crypto/rand"
	"errors"
	"fmt"

	"golang.org/x/crypto/nacl/box"
)

// encryptBox encrypts a message from the sender to the recipient.
// Output is nonce||ciphertext.
func encryptBox(plaintext []byte, recipientPub, senderPriv *[32]byte) ([]byte, error) {
	var nonce [24]byte
	if _, err := rand.Read(nonce[:]); err != nil {
		return nil, err
	}

	encrypted := box.Seal(nonce[:], plaintext, &nonce, recipientPub, senderPriv)
	return encrypted, nil
}

// decryptBox decrypts a message from the sender using the recipient's key.
func decryptBox(encrypted []byte, senderPub, recipientPriv *[32]byte) ([]byte, error) {
	if len(encrypted) < 24 {
		return nil, errors.New("box: message too short")
	}

	var nonce [24]byte
	copy(nonce[:], encrypted[:24])

	plaintext, ok := box.Open(nil, encrypted[24:], &nonce, senderPub, recipientPriv)
	if !ok {
		return nil, errors.New("box: decryption failed")
	}
	return plaintext, nil
}

func main() {
	// Each party generates a key pair once.
	senderPub, senderPriv, err := box.GenerateKey(rand.Reader)
	if err != nil {
		panic(err)
	}

	recipientPub, recipientPriv, err := box.GenerateKey(rand.Reader)
	if err != nil {
		panic(err)
	}

	ciphertext, err := encryptBox([]byte("meet me at the docks"), recipientPub, senderPriv)
	if err != nil {
		panic(err)
	}

	plaintext, err := decryptBox(ciphertext, senderPub, recipientPriv)
	if err != nil {
		panic(err)
	}

	fmt.Printf("decrypted: %s\n", plaintext)
}

package main

import (
	"crypto/rand"
	"errors"
	"fmt"

	"golang.org/x/crypto/nacl/box"
)

// sealAnonymous encrypts to recipientPub without revealing the sender.
func sealAnonymous(plaintext []byte, recipientPub *[32]byte) ([]byte, error) {
	// A nil out slice means Seal allocates a fresh buffer.
	return box.SealAnonymous(nil, plaintext, recipientPub, rand.Reader)
}

// openAnonymous decrypts a sealed box using the recipient's key pair.
func openAnonymous(sealed []byte, recipientPub, recipientPriv *[32]byte) ([]byte, error) {
	plaintext, ok := box.OpenAnonymous(nil, sealed, recipientPub, recipientPriv)
	if !ok {
		return nil, errors.New("sealedbox: decryption failed")
	}
	return plaintext, nil
}

func main() {
	recipientPub, recipientPriv, err := box.GenerateKey(rand.Reader)
	if err != nil {
		panic(err)
	}

	sealed, err := sealAnonymous([]byte("anonymous tip"), recipientPub)
	if err != nil {
		panic(err)
	}

	plaintext, err := openAnonymous(sealed, recipientPub, recipientPriv)
	if err != nil {
		panic(err)
	}

	fmt.Printf("decrypted: %s\n", plaintext)
}

package main

import (
	"crypto/rand"
	"errors"
	"fmt"

	"golang.org/x/crypto/chacha20poly1305"
)

// encryptXChaCha encrypts with XChaCha20-Poly1305 and authenticates the
// additional data. Output is nonce||ciphertext.
func encryptXChaCha(plaintext, key, additionalData []byte) ([]byte, error) {
	aead, err := chacha20poly1305.NewX(key)
	if err != nil {
		return nil, err
	}

	nonce := make([]byte, aead.NonceSize())
	if _, err := rand.Read(nonce); err != nil {
		return nil, err
	}

	// Seal appends the ciphertext to the nonce prefix.
	return aead.Seal(nonce, nonce, plaintext, additionalData), nil
}

// decryptXChaCha reverses encryptXChaCha. The same additionalData must be
// supplied or authentication fails.
func decryptXChaCha(encrypted, key, additionalData []byte) ([]byte, error) {
	aead, err := chacha20poly1305.NewX(key)
	if err != nil {
		return nil, err
	}
	if len(encrypted) < aead.NonceSize() {
		return nil, errors.New("xchacha: message too short")
	}

	nonce := encrypted[:aead.NonceSize()]
	ciphertext := encrypted[aead.NonceSize():]

	return aead.Open(nil, nonce, ciphertext, additionalData)
}

func main() {
	key := make([]byte, chacha20poly1305.KeySize)
	if _, err := rand.Read(key); err != nil {
		panic(err)
	}

	aad := []byte("message-id:42")

	ciphertext, err := encryptXChaCha([]byte("secret payload"), key, aad)
	if err != nil {
		panic(err)
	}

	plaintext, err := decryptXChaCha(ciphertext, key, aad)
	if err != nil {
		panic(err)
	}

	fmt.Printf("decrypted: %s\n", plaintext)
}

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"fmt"
	"io"

	"golang.org/x/crypto/hkdf"
)

// deriveKey derives a 32-byte subkey bound to a context label. Different
// labels produce independent keys from the same master secret.
func deriveKey(master []byte, context string) ([]byte, error) {
	// salt is optional for HKDF; the context info separates purposes.
	kdf := hkdf.New(sha256.New, master, nil, []byte(context))

	subkey := make([]byte, 32)
	if _, err := io.ReadFull(kdf, subkey); err != nil {
		return nil, err
	}
	return subkey, nil
}

func main() {
	master := make([]byte, 32)
	if _, err := rand.Read(master); err != nil {
		panic(err)
	}

	encKey, err := deriveKey(master, "encryption-v1")
	if err != nil {
		panic(err)
	}

	macKey, err := deriveKey(master, "authentication-v1")
	if err != nil {
		panic(err)
	}

	fmt.Printf("encryption key: %x\n", encKey)
	fmt.Printf("authentication key: %x\n", macKey)
}

package main

import (
	"crypto/rand"
	"crypto/subtle"
	"fmt"

	"golang.org/x/crypto/argon2"
)

// Argon2id parameters. Tune time and memory to your hardware budget; these
// are reasonable interactive defaults (64 MiB, 1 pass, 4 lanes).
const (
	argonTime    = 1
	argonMemory  = 64 * 1024 // KiB
	argonThreads = 4
	argonKeyLen  = 32
	saltLen      = 16
)

// hashPassword returns a random salt and the derived 32-byte hash.
func hashPassword(password []byte) (salt, hash []byte, err error) {
	salt = make([]byte, saltLen)
	if _, err = rand.Read(salt); err != nil {
		return nil, nil, err
	}

	hash = argon2.IDKey(password, salt, argonTime, argonMemory, argonThreads, argonKeyLen)
	return salt, hash, nil
}

// verifyPassword recomputes the hash and compares in constant time.
func verifyPassword(password, salt, expected []byte) bool {
	computed := argon2.IDKey(password, salt, argonTime, argonMemory, argonThreads, argonKeyLen)
	return subtle.ConstantTimeCompare(computed, expected) == 1
}

func main() {
	salt, hash, err := hashPassword([]byte("correct horse battery staple"))
	if err != nil {
		panic(err)
	}

	fmt.Printf("valid password: %v\n", verifyPassword([]byte("correct horse battery staple"), salt, hash))
	fmt.Printf("wrong password: %v\n", verifyPassword([]byte("Tr0ub4dor&3"), salt, hash))
}