🛡️ الأمان في Aliens Treasury

1// internal/services/encrypt.go
2func EncryptWithHKDF(masterKey, salt, plaintext []byte) ([]byte, error) {
3    uniqueKey := hkdf.Extract(sha256.New, masterKey, salt)
4    block, _ := aes.NewCipher(uniqueKey)
5    gcm, _ := cipher.NewGCM(block)
6    nonce := make([]byte, gcm.NonceSize())
7    io.ReadFull(rand.Reader, nonce)
8    return gcm.Seal(nonce, nonce, plaintext, nil), nil
9}

1// internal/services/encrypt_e2e.go
2func EncryptE2E(publicKey, plaintext []byte) ([]byte, error) {
3    ephemeral := make([]byte, 32)
4    rand.Read(ephemeral)
5    shared := curve25519.X25519(ephemeral, publicKey)
6    return encrypt(shared, plaintext), nil
7}

1// internal/services/auth_service_challenge.go
2func ChallengeResponse(privateKey ed25519.PrivateKey, nonce []byte) []byte {
3    return ed25519.Sign(privateKey, nonce)
4}

1// cmd/vault-client/internal/server/socket.go
2func authenticatePeer(conn *net.UnixConn) (*syscall.Ucred, error) {
3    file, _ := conn.File()
4    creds, _ := syscall.GetsockoptUcred(int(file.Fd()), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
5    return creds, nil
6}

1// internal/crypto/zero.go
2func SecureZero(b []byte) {
3    for i := range b { b[i] = 0 }
4    runtime.KeepAlive(b)
5}
6// PR_SET_DUMPABLE = 0
7syscall.Prctl(syscall.PR_SET_DUMPABLE, 0)