Don't use salt for encryption

[overonion] / overonion

#!/bin/bash

umask 077

hash_dir=$(mktemp -d)

function die() {
  echo "$*" >&2
  exit 1
}

if (( $# != 2));then
  die "usage: overonion e|d keyfile"
fi
mode=$1
if [[ "$mode" != e && "$mode" != d ]];then
  die "Use 'e' for encrypt or 'd' for decrypt"
fi
keyfile=$2
if [[ ! -e "$keyfile" ]];then
  die "Keyfile not found"
fi
if [[ ! -r "$keyfile" ]];then
  die "Cannot read keyfile"
fi

num_layers=$(wc -l < "$keyfile")
if (( num_layers < 20 ));then
  die "Keyfile doesn't have enough layers to be an onion"
fi

hash_fields=$(awk '/^openssl-dgst / { print NF }' "$keyfile" | uniq )

if [[ "$mode" == e ]];then
  first_layer=$num_layers
  next_layer=-1
  openssl_decrypt=""
  if [[ "$hash_fields" != 4 ]];then
    die "Refusing to encrypt with already-used key"
  fi
else
  first_layer=1
  next_layer=1
  openssl_decrypt="-d"
  if [[ "$hash_fields" != 5 ]];then
    die "Key does not appear to have been used for encryption (it has no embedded hashes).  Refusing to decrypt."
  fi
fi

function go() {
  layer=$1
  if (( layer == 0 || layer > num_layers ));then
    cat
  else
    operation=$(sed -n "${layer}{;s/ .*//;p;}" "$keyfile")
    if [[ "$operation" == openssl-enc ]];then
      openssl enc $openssl_decrypt "-$(sed -rn "${layer}s/[^ ]+ ([^ ]+) .*/\\1/p" "$keyfile")" \
              -nosalt -pass fd:37 37< <(sed -rn "${layer}s/^[^ ]+ [^ ]+ //p" "$keyfile")
    elif [[ "$operation" == reverse ]];then
      reverse
    elif [[ "$operation" == openssl-dgst ]];then
      tee >(echo "$(sed -n "${layer}p" "$keyfile") $(
            {
              awk -vlayer="$layer" 'NR == layer { print $3 }' "$keyfile" | base64 -d
              cat
              awk -vlayer="$layer" 'NR == layer { print $4 }' "$keyfile" | base64 -d
            } |
              openssl dgst -binary "-$(sed -rn "${layer}s/^[^ ]+ ([^ ]+).*/\\1/p" "$keyfile")" |
              base64 --wrap=0)" > "$hash_dir/$layer")
    else
      die "Unknown operation"
    fi |
      go $(( layer + next_layer ))
  fi
}

go "$first_layer"

for hash_result in "$hash_dir"/*;do
  layer=$(basename "$hash_result")
  if [[ "$mode" == e ]];then
    # Add the hashes to keyfile
    key_aside_dir=$(mktemp -d "$keyfile.XXXXXXXXXX")
    key_aside="$key_aside_dir/key.orig"
    mv "$keyfile" "$key_aside"
    sed "${layer}s,.*,$(< "$hash_result")," "$key_aside" > "$keyfile"
    shred -u "$key_aside"
    rmdir "$key_aside_dir"
  else
    # Verify the hashes
    if [[ "$(awk '{ print $5 == $6 ? "hash ok" : "mismatch" }' "$hash_result")" != "hash ok" ]];then
      die "Hash check $layer failed"
    fi
  fi
done

rm -r "$hash_dir"