age：一个现代化的加密工具

import "filippo.io/age/internal/bech32"

// 在 age 中私钥的别称是 Identity
type X25519Identity struct {
	secretKey, ourPublicKey []byte
}

func (i *X25519Identity) String() string {
	s, _ := bech32.Encode("AGE-SECRET-KEY-", i.secretKey)
	return strings.ToUpper(s)
}

func (i *X25519Identity) Recipient() *X25519Recipient {
	r := &X25519Recipient{}
	r.theirPublicKey = i.ourPublicKey
	return r
}

// 在 age 中公钥的别称是 Recipient
type X25519Recipient struct {
	theirPublicKey []byte
}

func (r *X25519Recipient) String() string {
	s, _ := bech32.Encode("age", r.theirPublicKey)
	return s
}

// internal/age/x25519.go

// 己方密钥不参与加密流程
// 那么这里用作 ECDH 的 x25519 key 也需要是临时生成的

// 生成一对 x25519 临时私钥
ephemeral := make([]byte, curve25519.ScalarSize)
if _, err := rand.Read(ephemeral); err != nil {
	return nil, err
}

// 根据私钥计算临时公钥
ourPublicKey, err := curve25519.X25519(ephemeral, curve25519.Basepoint)
if err != nil {
	return nil, err
}

// 计算 ECDH 共享密钥
var r *X25519Recipient
sharedSecret, err := curve25519.X25519(ephemeral, r.theirPublicKey)
if err != nil {
	return nil, err
}

// internal/age/x25519.go

const x25519Label = "age-encryption.org/v1/X25519"

salt := make([]byte, 0, len(ourPublicKey)+len(r.theirPublicKey))
// 使用我方临时公钥和对方公钥作为 HKDF 盐
salt = append(salt, ourPublicKey...)
salt = append(salt, r.theirPublicKey...)
// 使用 ECDH 公钥密钥 secret 材料生成最终的 filekey 加密密钥 wrappingKey
h := hkdf.New(sha256.New, sharedSecret, salt, []byte(x25519Label))
wrappingKey := make([]byte, chacha20poly1305.KeySize)
if _, err := io.ReadFull(h, wrappingKey); err != nil {
	return nil, err
}

// internal/age/primitives.go
func aeadEncrypt(key, plaintext []byte) ([]byte, error) {
	aead, err := chacha20poly1305.New(key)
	if err != nil {
		return nil, err
	}
	// The nonce is fixed because this function is only used in places where the
	// spec guarantees each key is only used once (by deriving it from values
	// that include fresh randomness), allowing us to save the overhead.
	// For the code that encrypts the actual payload, look at the
	// filippo.io/age/internal/stream package.
	nonce := make([]byte, chacha20poly1305.NonceSize)
	return aead.Seal(nil, nonce, plaintext, nil), nil
}

func headerMAC(fileKey []byte, hdr *format.Header) ([]byte, error) {
	// 通过 filekey 计算 mac key
	h := hkdf.New(sha256.New, fileKey, nil, []byte("header"))
	hmacKey := make([]byte, 32)
	if _, err := io.ReadFull(h, hmacKey); err != nil {
		return nil, err
	}
	hh := hmac.New(sha256.New, hmacKey)
	// 下面这个过程是计算 header 的过程，内容参考上述 header 结构
	if err := hdr.MarshalWithoutMAC(hh); err != nil {
		return nil, err
	}
	return hh.Sum(nil), nil
}

func streamKey(fileKey, nonce []byte) []byte {
	h := hkdf.New(sha256.New, fileKey, nonce, []byte("payload"))
	streamKey := make([]byte, chacha20poly1305.KeySize)
	if _, err := io.ReadFull(h, streamKey); err != nil {
		panic("age: internal error: failed to read from HKDF: " + err.Error())
	}
	return streamKey
}