This module implements data security features for the in-memory mini file system.
It provides functions to derive an AES-256 key from a password, generate an IV, and encrypt/decrypt file content using AES-CBC.
-
Key derivation (file_sys_derive_aes_key)
- Converts a user password (variable length) into a fixed 32-byte key.
- Uses a custom mixing loop (4 rounds) combining XOR and addition to produce 32 bytes.
-
IV generation (file_sys_generate_iv)
- Produces a 16-byte IV using rand() seeded by time(NULL).
- Ensures identical plaintext encrypts to different ciphertexts when IV differs+.
-
PKCS#7 padding
- Pads plaintext to a 16-byte AES block: padding = 16 - (size % 16).
- Each padding byte equals the padding length.
| Function | Parameters | Return | Role |
|---|---|---|---|
file_sys_derive_aes_key() |
const char *password, uint8_t out_key[32] |
void |
Produce a 32-byte AES key from password. |
file_sys_generate_iv() |
uint8_t iv[16] |
void |
Generate 16-byte IV (time-seeded rand). |
file_sys_encrypt_content() |
FileMeta *file_meta, const char *password |
int |
Derive key/IV, pad and AES-CBC encrypt data in-place; update FileMeta (encrypted flag, sizes, iv). |
file_sys_decrypt_content() |
FileMeta *file_meta, const char *password |
int |
Derive key, AES-CBC decrypt, validate/remove padding, restore original size. |
- tiny-AES-c (aes.h / aes.c) — AES implementation used for block operations.
- __FileMeta struct — holds content pointer, original/encrypted sizes, encrypted flag, and stored IV.
- The custom key derivation and IV generation (srand/time + rand) are NOT cryptographically secure. Use a standard KDF (e.g., PBKDF2, Argon2) and a cryptographically secure RNG for production code.