55 lines
1.5 KiB
Go
55 lines
1.5 KiB
Go
package secret
|
|
|
|
import "testing"
|
|
|
|
func TestEncryptRoundTrip(t *testing.T) {
|
|
salt, _ := NewSalt()
|
|
key, err := DeriveKey("correct horse battery staple", salt)
|
|
if err != nil {
|
|
t.Fatalf("derive: %v", err)
|
|
}
|
|
c, err := New(key)
|
|
if err != nil {
|
|
t.Fatalf("new: %v", err)
|
|
}
|
|
for _, plain := range []string{"", "hunter2", "pâßwörd 🔐", "a-very-long-tqsl-private-key-password-1234567890"} {
|
|
enc := c.Encrypt(plain)
|
|
if !IsEncrypted(enc) {
|
|
t.Fatalf("Encrypt(%q) not prefixed: %q", plain, enc)
|
|
}
|
|
got, err := c.Decrypt(enc)
|
|
if err != nil || got != plain {
|
|
t.Errorf("round trip %q: got %q err %v", plain, got, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestDecryptPlaintextPassthrough(t *testing.T) {
|
|
salt, _ := NewSalt()
|
|
key, _ := DeriveKey("pw", salt)
|
|
c, _ := New(key)
|
|
// A legacy (un-prefixed) value must come back unchanged.
|
|
if got, err := c.Decrypt("plain-password"); err != nil || got != "plain-password" {
|
|
t.Errorf("passthrough: got %q err %v", got, err)
|
|
}
|
|
}
|
|
|
|
func TestWrongPassphraseFailsVerifier(t *testing.T) {
|
|
salt, _ := NewSalt()
|
|
good, _ := DeriveKey("right", salt)
|
|
gc, _ := New(good)
|
|
v := gc.MakeVerifier()
|
|
if !gc.CheckVerifier(v) {
|
|
t.Fatal("correct passphrase should pass the verifier")
|
|
}
|
|
bad, _ := DeriveKey("wrong", salt)
|
|
bc, _ := New(bad)
|
|
if bc.CheckVerifier(v) {
|
|
t.Fatal("wrong passphrase must NOT pass the verifier")
|
|
}
|
|
// And a tampered ciphertext must not decrypt.
|
|
if _, err := gc.Decrypt(Prefix + "AAAA"); err == nil {
|
|
t.Error("forged ciphertext decrypted without error")
|
|
}
|
|
}
|