feat: decrypt Chromium v10/v11 across host OS (#605)

crypto/crypto.go

@@ -1,9 +1,11 @@
 package crypto
 
 import (
+	"bytes"
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/des"
+	"crypto/sha1"
 	"fmt"
 )
 
@@ -50,14 +52,16 @@ func DES3Decrypt(key, iv, ciphertext []byte) ([]byte, error) {
 // same regardless of host OS (only Windows currently produces v20).
 const gcmNonceSize = 12
 
-// DecryptChromiumV20 decrypts a Chromium v20 (App-Bound Encryption) ciphertext.
-// Format: "v20" prefix (3B) + nonce (12B) + AES-GCM(payload + 16B tag).
-//
-// Cross-platform: v20 is only produced by Chrome on Windows today, but the
-// decryption math is platform-neutral. Keeping it here rather than in
-// crypto_windows.go ensures the routing in browser/chromium/decrypt.go stays
-// testable on Linux/macOS CI.
-func DecryptChromiumV20(key, ciphertext []byte) ([]byte, error) {
+// chromiumCBCIV is the fixed IV Chromium uses for AES-CBC v10/v11 (macOS/Linux).
+var chromiumCBCIV = bytes.Repeat([]byte{0x20}, aes.BlockSize)
+
+// kEmptyKey is Chromium's decrypt-only fallback for data corrupted by a KWallet
+// race in Chrome ~89 (crbug.com/40055416). Matches kEmptyKey in os_crypt_linux.cc.
+var kEmptyKey = PBKDF2Key([]byte(""), []byte("saltysalt"), 1, 16, sha1.New)
+
+// DecryptChromiumGCM decrypts a prefixed AES-GCM blob: version(3B)+nonce(12B)+ct+tag.
+// Used by Windows v10 (AES-256) and v20; the layout is identical and platform-neutral.
+func DecryptChromiumGCM(key, ciphertext []byte) ([]byte, error) {
 	if len(ciphertext) < versionPrefixLen+gcmNonceSize {
 		return nil, errShortCiphertext
 	}
@@ -66,6 +70,24 @@ func DecryptChromiumV20(key, ciphertext []byte) ([]byte, error) {
 	return AESGCMDecrypt(key, nonce, payload)
 }
 
+// DecryptChromiumCBC decrypts a prefixed AES-CBC blob (version(3B)+ct) with Chromium's
+// fixed IV, retrying with kEmptyKey to recover crbug.com/40055416 KWallet-corrupted data.
+// Used by macOS/Linux v10 and Linux v11 (both AES-128).
+func DecryptChromiumCBC(key, ciphertext []byte) ([]byte, error) {
+	if len(ciphertext) < versionPrefixLen+aes.BlockSize {
+		return nil, errShortCiphertext
+	}
+	payload := ciphertext[versionPrefixLen:]
+	plaintext, err := AESCBCDecrypt(key, chromiumCBCIV, payload)
+	if err == nil {
+		return plaintext, nil
+	}
+	if alt, altErr := AESCBCDecrypt(kEmptyKey, chromiumCBCIV, payload); altErr == nil {
+		return alt, nil
+	}
+	return nil, err
+}
+
 // AESGCMEncrypt encrypts data using AES-GCM mode.
 func AESGCMEncrypt(key, nonce, plaintext []byte) ([]byte, error) {
 	block, err := aes.NewCipher(key)