zurik 1.0.3 → 1.0.5

package/lib/crypto.js

@@ -3,9 +3,9 @@ import crypto from "crypto";
 const ALGO = "aes-256-gcm";
 const IV_LENGTH = 16;
 
-function deriveKey(password) {
+function deriveKey(password, salt) {
   return new Promise((resolve, reject) => {
-    crypto.scrypt(password, "zurik_fixed_salt", 32, (err, key) => {
+    crypto.scrypt(password, salt, 32, (err, key) => {
       if (err) reject(err);
       else resolve(key);
     });
@@ -13,29 +13,27 @@ function deriveKey(password) {
 }
 
 export async function encryptData(data, password) {
-  const key = await deriveKey(password);
+  const salt = crypto.randomBytes(16);
+  const key = await deriveKey(password, salt);
   const iv = crypto.randomBytes(IV_LENGTH);
   const cipher = crypto.createCipheriv(ALGO, key, iv);
 
   const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
   const tag = cipher.getAuthTag();
 
-  return Buffer.concat([iv, tag, encrypted]).toString("base64");
+  return Buffer.concat([salt, iv, tag, encrypted]).toString("base64");
 }
 
 export async function decryptData(base64, password) {
   const buffer = Buffer.from(base64, "base64");
+  const salt = buffer.subarray(0, 16);
+  const iv = buffer.subarray(16, 32);
+  const tag = buffer.subarray(32, 48);
+  const ciphertext = buffer.subarray(48);
 
-  const iv = buffer.subarray(0, 16);
-  const tag = buffer.subarray(16, 32);
-  const ciphertext = buffer.subarray(32);
-
-  const key = await deriveKey(password);
+  const key = await deriveKey(password, salt);
   const decipher = crypto.createDecipheriv(ALGO, key, iv);
   decipher.setAuthTag(tag);
 
-  return Buffer.concat([
-    decipher.update(ciphertext),
-    decipher.final()
-  ]);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zurik",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "CLI tool for encrypting and decrypting sensitive project files into a single .zurik bundle.",
   "type": "module",
   "bin": {