Implemented key encryption.

1 files changed, 44 insertions, 12 deletions

diff --git a/lib/Kiki.hs b/lib/Kiki.hs
index f1bb27d..ef7b913 100644
--- a/lib/Kiki.hs
+++ b/lib/Kiki.hs
@@ -126,7 +126,13 @@ importAndRefresh root cmn = do
     old_umask <- setFileCreationMask(0o077);
     -- Generate secring.gpg if it does not exist...
     gotsec <- doesFileExist secring
-    when (not gotsec) $ do
+
+    let passfd = cap_passfd cmn
+
+    pwds <-
+     if gotsec
+      then return []
+      else do
         {-  ssh-keygen to create master key...
         let mkpath = home ++ "/master-key"
         mkdirFor mkpath
@@ -139,12 +145,35 @@ importAndRefresh root cmn = do
                         HomeSec
                         ( encode $ Message [mk { is_subkey = False }] )
         -}
-        master <- (\k -> k { is_subkey = False }) <$> generateKey (GenRSA $ 4096 `div` 8 )
-        mkdirFor secring
-        writeInputFileL (InputFileContext secring pubring)
-                        HomeSec
-                        $ encode $ Message [master { is_subkey = False}]
-
+        master_un <- (\k -> k { is_subkey = False }) <$> generateKey (GenRSA $ 4096 `div` 8 )
+        let default_cipher = (CAST5, IteratedSaltedS2K SHA1 4073382889203176146 7864320)
+            ctx = InputFileContext secring pubring
+            passwordop = KeyRingOperation
+                            { opFiles = Map.empty
+                            , opPassphrases = do pfd <- maybeToList passfd
+                                                 return $ PassphraseSpec Nothing Nothing pfd
+                            , opHome = homespec
+                            , opTransforms = []
+                            }
+        transcoder <- makeMemoizingDecrypter passwordop ctx Map.empty
+        master0 <- transcoder default_cipher $ MappedPacket master_un Map.empty
+        case master0 of
+            KikiSuccess master -> do
+                mkdirFor secring
+                writeInputFileL ctx
+                                HomeSec
+                                $ encode $ Message [master { is_subkey = False}]
+                putStrLn "Wrote master key"
+                return [PassphraseMemoizer transcoder]
+            er -> do
+                hPutStrLn stderr ("warning: " ++ errorString er)
+                hPutStrLn stderr "warning: keys will not be encrypted.";
+                mkdirFor secring
+                writeInputFileL ctx
+                                HomeSec
+                                $ encode $ Message [master_un { is_subkey = False}]
+                putStrLn "Wrote master key"
+                return []
     gotpub <- doesFileExist pubring
     when (not gotpub) $ do
         mkdirFor pubring
@@ -168,8 +197,7 @@ importAndRefresh root cmn = do
 
     -- First, we ensure that the tor key exists and is imported
     -- so that we know where to put the strongswan key.
-    let passfd = cap_passfd cmn
-        strm = StreamInfo { typ = KeyRingFile
+    let strm = StreamInfo { typ = KeyRingFile
                           , fill = KF_None
                           , spill = KF_All
                           , access = AutoAccess
@@ -200,8 +228,8 @@ importAndRefresh root cmn = do
                 , ( ArgFile sshcpath, (peminfo 2048 "ssh-client") )
                 , ( ArgFile sshspath, (peminfo 2048 "ssh-server") )
                 ]
-             , opPassphrases = do pfd <- maybeToList passfd
-                                  return $ PassphraseSpec Nothing Nothing pfd
+             , opPassphrases = pwds ++ do pfd <- maybeToList passfd
+                                          return $ PassphraseSpec Nothing Nothing pfd
              , opHome = homespec
              , opTransforms = []
              }
@@ -304,7 +332,11 @@ refreshCache rt rootdir = do
         let my_ks :: [Packet]
             my_ks = getSecret "ipsec"
         case my_ks of
-            sec:_ -> do report <- writeKeyToFile streaminfo { typ = PEMFile
+            se0:_ -> do sc1 <- rtPassphrases rt (Unencrypted,S2K 100 "") $ MappedPacket se0 Map.empty
+                        let sec = case sc1 of
+                                    KikiSuccess s -> s
+                                    _             -> se0
+                        report <- writeKeyToFile streaminfo { typ = PEMFile
                                                             , access = Sec
                                                             , spill = KF_All
                                                             }