Implement "online authenticated encryption"

1 files changed, 21 insertions, 12 deletions

diff --git a/internal/cryptoutil/cryptoutil_test.go b/internal/cryptoutil/cryptoutil_test.go
index 79a53a9..dc9074d 100644
--- a/internal/cryptoutil/cryptoutil_test.go
+++ b/internal/cryptoutil/cryptoutil_test.go
@@ -3,6 +3,7 @@ package cryptoutil
 import (
 	"bytes"
 	"encoding/hex"
+	"io"
 	"testing"
 )
 
@@ -43,16 +44,20 @@ func TestSignature(t *testing.T) {
 func TestEncrypt(t *testing.T) {
 	key := EncryptionKey(mustHex(t, "b6de26860e0a39aa134732e58055c06ba028675453f73a6912bc932e58d5743d0e423217f06487d3e96a59980301fcc97dfcc4c6b19765f2947de3c33ab7ef9e"))
 	msg := []byte("test message")
-	encryptedMsg, err := key.Encrypt(msg)
-	if err != nil {
-		t.Fatalf("Encrypt(%q) failed: %s", msg, err)
+	encryptedMsg := new(bytes.Buffer)
+	w := key.NewWriter(encryptedMsg, nil)
+	if _, err := w.Write(msg); err != nil {
+		t.Fatalf("EncryptingWriter.Write(%q) failed: %s", msg, err)
+	}
+	if err := w.Close(); err != nil {
+		t.Fatalf("EncryptingWriter.Close() failed: %s", err)
 	}
-	got, err := key.Decrypt(encryptedMsg)
+	got, err := io.ReadAll(key.NewReader(bytes.NewReader(encryptedMsg.Bytes()), nil))
 	if err != nil {
-		t.Fatalf("Decrypt(%x) failed: %s", encryptedMsg, err)
+		t.Fatalf("DecryptingReader.Read(%x) failed: %s", encryptedMsg, err)
 	}
 	if !bytes.Equal(got, msg) {
-		t.Errorf("Decrypt(%x) = %x, want %x", encryptedMsg, got, msg)
+		t.Errorf("DecryptingReader.Read(%x) = %x, want %x", encryptedMsg, got, msg)
 	}
 }
 
@@ -71,15 +76,19 @@ func TestDeriveKey(t *testing.T) {
 		t.Fatalf("EncryptionKey() failed: %s", err)
 	}
 	msg := []byte("test message")
-	encryptedMsg, err := key.Encrypt(msg)
-	if err != nil {
-		t.Fatalf("Encrypt(%q) failed: %s", msg, err)
+	encryptedMsg := new(bytes.Buffer)
+	w := key.NewWriter(encryptedMsg, nil)
+	if _, err := w.Write(msg); err != nil {
+		t.Fatalf("EncryptingWriter.Write(%q) failed: %s", msg, err)
+	}
+	if err := w.Close(); err != nil {
+		t.Fatalf("EncryptingWriter.Close() failed: %s", err)
 	}
-	got, err := key.Decrypt(encryptedMsg)
+	got, err := io.ReadAll(key.NewReader(encryptedMsg, nil))
 	if err != nil {
-		t.Fatalf("Decrypt(%x) failed: %s", encryptedMsg, err)
+		t.Fatalf("DecryptingReader.Read(%x) failed: %s", encryptedMsg, err)
 	}
 	if !bytes.Equal(got, msg) {
-		t.Errorf("Decrypt(%x) = %x, want %x", encryptedMsg, got, msg)
+		t.Errorf("DecryptingReader.Read(%x) = %x, want %x", encryptedMsg, got, msg)
 	}
 }