Restore encrypted backups safely

import 'dart:convert';
import 'dart:math';
import 'package:cryptography/cryptography.dart';

final aad = utf8.encode('AFLEARN1');
final algorithm = AesGcm.with256bits();
List<int> randomBytes(int length) {
  final random = Random.secure();
  return List.generate(length, (_) => random.nextInt(256));
}

Future<SecretKey> keyFor(String password, List<int> salt) => Pbkdf2(
  macAlgorithm: Hmac.sha256(),
  iterations: 600000,
  bits: 256,
).deriveKey(secretKey: SecretKey(utf8.encode(password)), nonce: salt);
Future<String> encrypt(String password, List<String> names) async {
  final salt = randomBytes(16);
  final nonce = randomBytes(12);
  final box = await algorithm.encrypt(
    utf8.encode(jsonEncode(names)),
    secretKey: await keyFor(password, salt),
    nonce: nonce,
    aad: aad,
  );
  return jsonEncode({
    'format': 'vehicle_learning',
    'version': 1,
    'salt': base64Encode(salt),
    'nonce': base64Encode(nonce),
    'cipher': base64Encode(box.cipherText),
    'mac': base64Encode(box.mac.bytes),
  });
}

Future<List<String>> decrypt(String password, String input) async {
  if (utf8.encode(input).length > 1024 * 1024)
    throw FormatException('Backup too large');
  final value = jsonDecode(input);
  if (value is! Map<String, dynamic> ||
      value['format'] != 'vehicle_learning' ||
      value['version'] != 1) {
    throw FormatException('Unknown backup');
  }
  List<int> bytes(String key) {
    final text = value[key];
    if (text is! String) throw FormatException('Missing field');
    return base64Decode(text);
  }

  final salt = bytes('salt');
  final nonce = bytes('nonce');
  final mac = bytes('mac');
  if (salt.length != 16 || nonce.length != 12 || mac.length != 16)
    throw FormatException('Invalid header');
  final plaintext = await algorithm.decrypt(
    SecretBox(bytes('cipher'), nonce: nonce, mac: Mac(mac)),
    secretKey: await keyFor(password, salt),
    aad: aad,
  );
  final names = jsonDecode(utf8.decode(plaintext));
  if (names is! List ||
      names.any((name) => name is! String || name.trim().isEmpty)) {
    throw FormatException('Invalid records');
  }
  return names.cast<String>();
}

Future<void> main() async {
  final backup = await encrypt('learning-password', ['Family car']);
  print(await decrypt('learning-password', backup));
  try {
    await decrypt('wrong-password', backup);
    throw StateError('Accepted wrong password');
  } on SecretBoxAuthenticationError {
    print('Wrong password rejected');
  }
}