Work through the open Dependabot PRs (#663)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

crates/yaak-crypto/Cargo.toml

@@ -7,7 +7,7 @@ publish = false
 [dependencies]
 base32 = "0.5.1" # For encoding human-readable key
 base64 = "0.22.1" # For encoding in the database
-chacha20poly1305 = "0.10.1"
+chacha20poly1305 = "0.11.0"
 keyring = { workspace = true, features = ["apple-native", "windows-native", "sync-secret-service"] }
 log = { workspace = true }
 serde = { workspace = true, features = ["derive"] }

crates/yaak-crypto/src/encryption.rs

@@ -1,14 +1,14 @@
 use crate::error::Error::{DecryptionError, EncryptionError, InvalidEncryptedData};
 use crate::error::Result;
-use chacha20poly1305::aead::generic_array::typenum::Unsigned;
-use chacha20poly1305::aead::{Aead, AeadCore, Key, KeyInit, OsRng};
-use chacha20poly1305::XChaCha20Poly1305;
+use chacha20poly1305::aead::array::typenum::Unsigned;
+use chacha20poly1305::aead::{Aead, AeadCore, Generate, Key, KeyInit};
+use chacha20poly1305::{XChaCha20Poly1305, XNonce};
 
 const ENCRYPTION_TAG: &str = "yA4k3nC";
 const ENCRYPTION_VERSION: u8 = 1;
 
 pub(crate) fn encrypt_data(data: &[u8], key: &Key<XChaCha20Poly1305>) -> Result<Vec<u8>> {
-    let nonce = XChaCha20Poly1305::generate_nonce(&mut OsRng);
+    let nonce = XNonce::generate();
     let cipher = XChaCha20Poly1305::new(&key);
     let ciphered_data = cipher.encrypt(&nonce, data).map_err(|_| EncryptionError)?;
 
@@ -34,11 +34,12 @@ pub(crate) fn decrypt_data(cipher_data: &[u8], key: &Key<XChaCha20Poly1305>) ->
         return Err(InvalidEncryptedData);
     }
 
-    let nonce_bytes = <XChaCha20Poly1305 as AeadCore>::NonceSize::to_usize();
+    let nonce_bytes = <XChaCha20Poly1305 as AeadCore>::NonceSize::USIZE;
     let (nonce, ciphered_data) = rest.split_at_checked(nonce_bytes).ok_or(InvalidEncryptedData)?;
 
+    let nonce: &XNonce = nonce.try_into().map_err(|_| InvalidEncryptedData)?;
     let cipher = XChaCha20Poly1305::new(&key);
-    cipher.decrypt(nonce.into(), ciphered_data).map_err(|_e| DecryptionError)
+    cipher.decrypt(nonce, ciphered_data).map_err(|_e| DecryptionError)
 }
 
 #[cfg(test)]
@@ -46,12 +47,12 @@ mod test {
     use crate::encryption::{decrypt_data, encrypt_data};
     use crate::error::Error::InvalidEncryptedData;
     use crate::error::Result;
-    use chacha20poly1305::aead::OsRng;
-    use chacha20poly1305::{KeyInit, XChaCha20Poly1305};
+    use chacha20poly1305::aead::{Generate, Key};
+    use chacha20poly1305::XChaCha20Poly1305;
 
     #[test]
     fn test_encrypt_decrypt() -> Result<()> {
-        let key = XChaCha20Poly1305::generate_key(OsRng);
+        let key = Key::<XChaCha20Poly1305>::generate();
         let encrypted = encrypt_data("hello world".as_bytes(), &key)?;
         let decrypted = decrypt_data(encrypted.as_slice(), &key)?;
         assert_eq!(String::from_utf8(decrypted).unwrap(), "hello world");
@@ -60,7 +61,7 @@ mod test {
 
     #[test]
     fn test_decrypt_empty() -> Result<()> {
-        let key = XChaCha20Poly1305::generate_key(OsRng);
+        let key = Key::<XChaCha20Poly1305>::generate();
         let encrypted = encrypt_data(&[], &key)?;
         assert_eq!(encrypted.len(), 48);
         let decrypted = decrypt_data(encrypted.as_slice(), &key)?;
@@ -70,7 +71,7 @@ mod test {
 
     #[test]
     fn test_decrypt_bad_version() -> Result<()> {
-        let key = XChaCha20Poly1305::generate_key(OsRng);
+        let key = Key::<XChaCha20Poly1305>::generate();
         let mut encrypted = encrypt_data("hello world".as_bytes(), &key)?;
         encrypted[7] = 0;
         let decrypted = decrypt_data(encrypted.as_slice(), &key);
@@ -80,7 +81,7 @@ mod test {
 
     #[test]
     fn test_decrypt_bad_tag() -> Result<()> {
-        let key = XChaCha20Poly1305::generate_key(OsRng);
+        let key = Key::<XChaCha20Poly1305>::generate();
         let mut encrypted = encrypt_data("hello world".as_bytes(), &key)?;
         encrypted[0] = 2;
         let decrypted = decrypt_data(encrypted.as_slice(), &key);
@@ -90,9 +91,29 @@ mod test {
 
     #[test]
     fn test_decrypt_unencrypted_data() -> Result<()> {
-        let key = XChaCha20Poly1305::generate_key(OsRng);
+        let key = Key::<XChaCha20Poly1305>::generate();
         let decrypted = decrypt_data("123".as_bytes(), &key);
         assert!(matches!(decrypted, Err(InvalidEncryptedData)));
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod compatibility {
+    use super::*;
+
+    /// Produced by chacha20poly1305 0.10.1. Decrypting it here proves a crate
+    /// upgrade hasn't changed the on-disk format, which users already have
+    /// rows of in their databases.
+    const V1_FROM_0_10: &str = "7941346b336e43017c7cb13467eecaa963b11734be636f9cc4152de348584fb27e95d1a70973e557cd335cf29e12d0d305d63ca0aa168f1b17003b1690a9d49140f0";
+
+    #[test]
+    fn decrypts_data_written_by_the_previous_release() {
+        let bytes: Vec<u8> = (0..V1_FROM_0_10.len())
+            .step_by(2)
+            .map(|i| u8::from_str_radix(&V1_FROM_0_10[i..i + 2], 16).unwrap())
+            .collect();
+        let key = Key::<XChaCha20Poly1305>::from([7u8; 32]);
+        assert_eq!(decrypt_data(&bytes, &key).unwrap(), b"yaak golden vector");
+    }
+}

crates/yaak-crypto/src/master_key.rs

@@ -2,7 +2,7 @@ use crate::encryption::{decrypt_data, encrypt_data};
 use crate::error::Error::GenericError;
 use crate::error::Result;
 use base32::Alphabet;
-use chacha20poly1305::aead::{Key, KeyInit, OsRng};
+use chacha20poly1305::aead::{Generate, Key};
 use chacha20poly1305::XChaCha20Poly1305;
 use keyring::{Entry, Error};
 use log::info;
@@ -24,11 +24,12 @@ impl MasterKey {
                 let without_prefix = encoded.strip_prefix(HUMAN_PREFIX).unwrap_or(&encoded);
                 let key_bytes = base32::decode(Alphabet::Crockford {}, &without_prefix)
                     .ok_or(GenericError("Failed to decode master key".to_string()))?;
-                Key::<XChaCha20Poly1305>::clone_from_slice(key_bytes.as_slice())
+                Key::<XChaCha20Poly1305>::try_from(key_bytes.as_slice())
+                    .map_err(|_| GenericError("Master key is the wrong length".to_string()))?
             }
             Err(Error::NoEntry) => {
                 info!("Creating new master key");
-                let key = XChaCha20Poly1305::generate_key(OsRng);
+                let key = Key::<XChaCha20Poly1305>::generate();
                 let encoded = base32::encode(Alphabet::Crockford {}, key.as_slice());
                 let with_prefix = format!("{HUMAN_PREFIX}{encoded}");
                 entry.set_password(&with_prefix)?;
@@ -50,9 +51,7 @@ impl MasterKey {
 
     #[cfg(test)]
     pub(crate) fn test_key() -> Self {
-        let key: Key<XChaCha20Poly1305> = Key::<XChaCha20Poly1305>::clone_from_slice(
-            "00000000000000000000000000000000".as_bytes(),
-        );
+        let key = Key::<XChaCha20Poly1305>::from(*b"00000000000000000000000000000000");
         Self { key }
     }
 }

crates/yaak-crypto/src/workspace_key.rs

@@ -2,7 +2,7 @@ use crate::encryption::{decrypt_data, encrypt_data};
 use crate::error::Error::InvalidHumanKey;
 use crate::error::Result;
 use base32::Alphabet;
-use chacha20poly1305::aead::{Key, KeyInit, OsRng};
+use chacha20poly1305::aead::{Generate, Key};
 use chacha20poly1305::{KeySizeUser, XChaCha20Poly1305};
 
 #[derive(Debug, Clone)]
@@ -39,7 +39,9 @@ impl WorkspaceKey {
     }
 
     pub(crate) fn from_raw_key(key: &[u8]) -> Self {
-        Self { key: Key::<XChaCha20Poly1305>::clone_from_slice(key) }
+        Self {
+            key: Key::<XChaCha20Poly1305>::try_from(key).expect("workspace key must be 32 bytes"),
+        }
     }
 
     pub(crate) fn raw_key(&self) -> &[u8] {
@@ -47,7 +49,7 @@ impl WorkspaceKey {
     }
 
     pub(crate) fn create() -> Result<Self> {
-        let key = XChaCha20Poly1305::generate_key(OsRng);
+        let key = Key::<XChaCha20Poly1305>::generate();
         Ok(Self::from_raw_key(key.as_slice()))
     }