Protect locally stored Acount Code on disk with system api by Mabeeck · Pull Request #3508 · PixelGuys/Cubyz

Mabeeck · 2026-08-11T19:59:14Z

This PR adds the main.protect.protect and main.protect.unprotect functions and integrates them into the PasswordEncodedAccountCode class.

protect Takes an allocator and a slice of bytes as arguments. The function returns a different slice of bytes that has been allocated with the provided allocator and can be passed to unprotect to get back the original slice of bytes. The function can fail, if the platform Cubyz is currently running on does not have an implementation yet (in which case the error will be error.Unsupported) or the syscall fails for some undisclosed reason (Windows), in which case the error will be error.syserr.
unprotect Takes an allocator and a slice of bytes that has been previously generated by protect as arguments. The function returns a different slice of bytes that has been allocated with the provided allocator and is equivalent in value to the slice of bytes that was passed to protect in order to produce the provided slice. The function can return error.Invalid if the provided input was protected on a different device; can no longer be unprotected for some reason; the current platform does not have an implementation. If something unexpected happened the function will fail with error.syserr.
canProtect Takes no arguments and returns a boolean indicating weather the protection functions have an implementation on the current platform.

Currently the protection functions only support Windows. They can later be easily expanded to support Linux as well.

Adds a protected attribute to PasswordEncodedAccountCode that indicates weather a call to unprotect is needed, before the AccountCode can be decrypted.
Functions to initialize PasswordEncodedAccountCode now take a shouldProtect boolean argument that when set to true will protect the function with the native system api, if available. Setting it to false will prevent usage of the protection api.

Adds a checkbox to Account Code saving menu for opt-out.

Contributes to #2551

Mabeeck · 2026-08-17T11:02:14Z

Done

Mabeeck · 2026-08-23T12:49:11Z

Done

Mabeeck · 2026-08-24T17:41:39Z

Done

IntegratedQuantum

Please also include a screenshot (since I cannot test this locally), also please adjust the window height to avoid a scrollbar.

Mabeeck · 2026-09-09T12:50:27Z

I think that's all of it.

IntegratedQuantum · 2026-09-14T09:28:34Z

Please rebase after #3538 to run the tests in the CI

Due to line 411 in authentication.zig and some other reasons I have decided to rework this implementation to make use of a `protected` boolean attribute instead of creating tons of extra EncodingTypes.

Obey linter and migrate to protected attribute. protect() and unprotect() now error on unsupported platforms. I felt that it would be bad, if someone assumed that a call to unprotect would always error on bad input or that a call to protect would always encrypt the data. These previously false assumptions are now true.

Yes, I blame microslop for using an uppercase in their docs.

Apparently errorcode 13 is for strings too short and errorcode 87 is for otherwise gibberish. The real reason I made this commit is that some github service was down when my last test ran and the only way to rerun it is to make another commit.

Consistency. Oh, and better to be safe than sorry.

Must test on linux

If error. Unsupported is raised, then a programmer is using the API incorrectly. Errors like these warrant a panic and do not need to be recoverable.

As I see it, this is the simplest way to have the defer directly below the recource creation. That makes one more allocation than necessary when shouldProtect is false, but if it improves readability, then that should be fine, since this is not performance critical code.

Oh, it was generic and a non-answer to the implied question. So that's why it felt like disgusting cooperate speak to me.

Mabeeck · 2026-09-14T19:09:01Z

Done

That library is already getting linked in the build script and should not be linked here.

IntegratedQuantum · 2026-09-15T12:58:00Z

+		pbDataSlice.ptr = plainblob.pbData;
+		defer {
+			std.crypto.secureZero(u8, pbDataSlice);
+			if (c.LocalFree(plainblob.pbData) != null) std.log.err("LocalFree syscall failed to free previously allocated memory. Errorcode: {}. This should never happen.", .{c.GetLastError()});


defers should always be directly after the thing you are trying to defer, i.e. the defer for LocalFree should be directly after the if (c.CryptUnprotect...) {...} block.

Well, the thing is that I shouldn't free it without secure-zeroing it first and for that I need to make a slice out of it.
I can't think of a way for the defer to come any earlier.

IntegratedQuantum · 2026-09-15T15:51:52Z

@@ -338,6 +358,18 @@ pub const PasswordEncodedAccountCode = struct { // MARK: PasswordEncodedAccountC
 	}

 	pub fn decryptFromPassword(self: PasswordEncodedAccountCode, password: []const u8, failureText: *main.ListManaged(u8)) !AccountCode {


I forgot to add tests for these. Would you mind adding them, including one for protection if available?
Some basic roundtrips (encrypting→decrypting) should suffice.

I did add them, but they end up blocking eternally on ubuntu in the CI.

Mabeeck changed the title ~~Add a protect() function~~ Protect locally stored Acount Code on disk with system api Aug 12, 2026

Mabeeck force-pushed the windows-CryptProtectData branch 2 times, most recently from 60f2598 to 92890da Compare August 12, 2026 19:19

Mabeeck marked this pull request as ready for review August 12, 2026 19:56

Wunka added this to PRs to review Aug 14, 2026

Wunka moved this to High Priority in PRs to review Aug 14, 2026

Wunka suggested changes Aug 14, 2026

View reviewed changes

Comment thread src/protect.zig Outdated

Comment thread src/protect.zig Outdated

IntegratedQuantum requested changes Aug 16, 2026

View reviewed changes

IntegratedQuantum moved this from High Priority to In review in PRs to review Aug 16, 2026

IntegratedQuantum mentioned this pull request Aug 20, 2026

Run the tests in the CI both on Windows and on Linux #3535

Closed

IntegratedQuantum requested changes Aug 20, 2026

View reviewed changes

Comment thread src/network/authentication.zig Outdated

Comment thread src/network/authentication.zig Outdated

Comment thread src/network/authentication.zig Outdated

Wunka approved these changes Aug 20, 2026

View reviewed changes

Mabeeck force-pushed the windows-CryptProtectData branch from 026d0ee to 419ec15 Compare August 23, 2026 12:28

IntegratedQuantum requested changes Aug 23, 2026

View reviewed changes

Mabeeck requested a review from IntegratedQuantum August 28, 2026 14:44

IntegratedQuantum requested changes Aug 30, 2026

View reviewed changes

Comment thread src/network/authentication.zig Outdated

Comment thread src/network/protection.zig Outdated

Comment thread src/gui/windows/authentication/encrypt_with_password.zig Outdated

Mabeeck force-pushed the windows-CryptProtectData branch from 9646ce5 to 728c5a7 Compare August 30, 2026 14:41

Mabeeck force-pushed the windows-CryptProtectData branch from 8c72e31 to 1611d7a Compare September 9, 2026 12:21

Mabeeck added 7 commits September 14, 2026 21:00

Add a Cubyz protection api and integrate it

00e53a1

Due to line 411 in authentication.zig and some other reasons I have decided to rework this implementation to make use of a `protected` boolean attribute instead of creating tons of extra EncodingTypes.

Format

e870156

All hail The Linter!

9b6ce5f

Microslop

4b29a2c

Yes, I blame microslop for using an uppercase in their docs.

Add tests and improve unprotect error detection

a7ddc04

Improve Tests and errordetection

5d3c2a5

Apparently errorcode 13 is for strings too short and errorcode 87 is for otherwise gibberish. The real reason I made this commit is that some github service was down when my last test ran and the only way to rerun it is to make another commit.

Mabeeck added 20 commits September 14, 2026 21:00

Get rid of constCast in tests

50bc560

Change Test

baf94ca

Consistency. Oh, and better to be safe than sorry.

No more quiet fallback on abnormal failure

e2815cd

Use allocator.dupe instead of @memcpy

b2db33b

Get rid of complex defers in decryptFromPassword

0d4a605

Initialize blob directly

4640c27

Add checkbox

8553de7

Must test on linux

Move protections struct to separate file

1fbe130

Make canProtect a const bool

1ef4b28

Change names to fit naming convention

1cd6953

Get rid of unnecessary pub

533a326

Update authentication.zig

c79fe97

Update authentication.zig

af5093b

Update encrypt_with_password.zig

f41a69e

Remove error.Unsupported

051844a

If error. Unsupported is raised, then a programmer is using the API incorrectly. Errors like these warrant a panic and do not need to be recoverable.

Mini naming change

504de66

Remove "Please report to maintainers" notice

25fab61

Increase window hight

a13c052

Move defer

8f0f992

As I see it, this is the simplest way to have the defer directly below the recource creation. That makes one more allocation than necessary when shouldProtect is false, but if it improves readability, then that should be fine, since this is not performance critical code.

Less generic explanation

e12828e

Oh, it was generic and a non-answer to the implied question. So that's why it felt like disgusting cooperate speak to me.

Mabeeck force-pushed the windows-CryptProtectData branch from 1611d7a to e12828e Compare September 14, 2026 19:00

Remove pragma comment

3ed6035

That library is already getting linked in the build script and should not be linked here.

IntegratedQuantum requested changes Sep 15, 2026

View reviewed changes

Mabeeck added 6 commits September 15, 2026 18:16

Change error messages & use zig wrapper for errors

c8f66b5

Move protection.zig to new authentication folder

b4075ec

Change checkbox message

ee15598

Add tests for authentication.zig

e7290ea

fmt

dd6f7a4

Improve test

defada9

		@@ -338,6 +358,18 @@ pub const PasswordEncodedAccountCode = struct { // MARK: PasswordEncodedAccountC
		}

		pub fn decryptFromPassword(self: PasswordEncodedAccountCode, password: []const u8, failureText: *main.ListManaged(u8)) !AccountCode {

Uh oh!

Conversation

Mabeeck commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mabeeck commented Aug 17, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mabeeck commented Aug 23, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mabeeck commented Aug 24, 2026

Uh oh!

IntegratedQuantum left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mabeeck commented Sep 9, 2026

Uh oh!

IntegratedQuantum commented Sep 14, 2026

Uh oh!

Mabeeck commented Sep 14, 2026

Uh oh!

Uh oh!

IntegratedQuantum Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

Mabeeck Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

IntegratedQuantum Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

Mabeeck Sep 20, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Mabeeck commented Aug 11, 2026 •

edited

Loading

Mabeeck Sep 15, 2026 •

edited

Loading