{

auto&& decryptedDataInstance = make_unique<DecryptedData>();

//copy default encryption key

auto&& defaultEncryptionKeyCopy = defaultEncryptionKey_.copy();

auto defaultKey =

make_unique<DecryptedEncryptionKey>(defaultEncryptionKeyCopy);

decryptedDataInstance->encryptionKeys_.insert(make_pair(

defaultEncryptionKeyId_, move(defaultKey)));

lockedDecryptedData_ = move(decryptedDataInstance);

{

otherLocks_.clear();

lockedDecryptedData_.reset();

shared_ptr<DecryptedDataContainer> other)

{

if (!ownsLock())

throw DecryptedDataContainerException("unlocked/does not own lock");

if (lockedDecryptedData_ == nullptr)

throw DecryptedDataContainerException(

"nullptr lock! how did we get this far?");

otherLocks_.push_back(OtherLockedContainer(other));

unique_ptr<DecryptedEncryptionKey> decrKey, const BinaryData& kdfid) const

{

//sanity check

if (!ownsLock())

throw DecryptedDataContainerException("unlocked/does not own lock");

if (lockedDecryptedData_ == nullptr)

throw DecryptedDataContainerException(

"nullptr lock! how did we get this far?");

//does the decryption key have this derivation?

auto derivationIter = decrKey->derivedKeys_.find(kdfid);

if (derivationIter == decrKey->derivedKeys_.end())

{

//look for the kdf

auto kdfIter = kdfMap_.find(kdfid);

if (kdfIter == kdfMap_.end() || kdfIter->second == nullptr)

throw DecryptedDataContainerException("can't find kdf params for id");

//derive the key, this will insert it into the container too

decrKey->deriveKey(kdfIter->second);

}

return move(decrKey);

const BinaryData& keyid, const BinaryData& kdfid)

{

//sanity check

if (!ownsLock())

throw DecryptedDataContainerException("unlocked/does not own lock");

if (lockedDecryptedData_ == nullptr)

throw DecryptedDataContainerException(

"nullptr lock! how did we get this far?");

//lambda to insert keys back into the container

auto insertDecryptedData = [&keyid, this](

unique_ptr<DecryptedEncryptionKey> decrKey)->void

{

//if decrKey is empty, all casts failed, throw

if (decrKey == nullptr)

throw DecryptedDataContainerException(

"tried to insert empty decryption key");

//make sure insertion succeeds

lockedDecryptedData_->encryptionKeys_.erase(keyid);

auto&& keypair = make_pair(keyid, move(decrKey));

auto&& insertionPair =

lockedDecryptedData_->encryptionKeys_.insert(move(keypair));

};

//look for already decrypted data

unique_ptr<DecryptedEncryptionKey> decryptedKey = nullptr;

auto dataIter = lockedDecryptedData_->encryptionKeys_.find(keyid);

if (dataIter != lockedDecryptedData_->encryptionKeys_.end())

decryptedKey = move(dataIter->second);

if (decryptedKey == nullptr)

{

//we don't have a decrypted key, let's look for it in the encrypted map

auto encrKeyIter = encryptionKeyMap_.find(keyid);

if (encrKeyIter != encryptionKeyMap_.end())

{

//sanity check

auto encryptedKeyPtr = dynamic_pointer_cast<Asset_EncryptionKey>(

encrKeyIter->second);

if (encryptedKeyPtr == nullptr)

throw DecryptedDataContainerException(

"unexpected object for encryption key id");

//found the encrypted key, need to decrypt it first

populateEncryptionKey(

encryptedKeyPtr->cypher_->getEncryptionKeyId(),

encryptedKeyPtr->cypher_->getKdfId());

//grab encryption key from map

auto decrKeyIter =

lockedDecryptedData_->encryptionKeys_.find(

encryptedKeyPtr->cypher_->getEncryptionKeyId());

if (decrKeyIter == lockedDecryptedData_->encryptionKeys_.end())

throw DecryptedDataContainerException("failed to decrypt key");

auto&& decryptionKey = move(decrKeyIter->second);

//derive encryption key

decryptionKey = move(

deriveEncryptionKey(move(decryptionKey),

encryptedKeyPtr->cypher_->getKdfId()));

//decrypt encrypted key

auto&& rawDecryptedKey = encryptedKeyPtr->cypher_->decrypt(

decryptionKey->getDerivedKey(encryptedKeyPtr->cypher_->getKdfId()),

encryptedKeyPtr->data_);

decryptedKey = move(make_unique<DecryptedEncryptionKey>(

rawDecryptedKey));

//move decryption key back to container

insertDecryptedData(move(decryptionKey));

}

}

if (decryptedKey == nullptr)

{

//still no key, prompt the user

decryptedKey = move(promptPassphrase(keyid, kdfid));

}

//apply kdf

decryptedKey = move(deriveEncryptionKey(move(decryptedKey), kdfid));

//insert into map

insertDecryptedData(move(decryptedKey));

Cypher* const cypher, const SecureBinaryData& data)

{

//sanity check

if (cypher == nullptr)

throw DecryptedDataContainerException("null cypher");

if (!ownsLock())

throw DecryptedDataContainerException("unlocked/does not own lock");

if (lockedDecryptedData_ == nullptr)

throw DecryptedDataContainerException(

"nullptr lock! how did we get this far?");

populateEncryptionKey(cypher->getEncryptionKeyId(), cypher->getKdfId());

auto keyIter = lockedDecryptedData_->encryptionKeys_.find(

cypher->getEncryptionKeyId());

auto& derivedKey = keyIter->second->getDerivedKey(cypher->getKdfId());

return move(cypher->encrypt(derivedKey, data));

const BinaryData& keyId, const BinaryData& kdfId) const

{

while (1)

{

if (!getPassphraseLambda_)

throw DecryptedDataContainerException("empty passphrase lambda");

auto&& passphrase = getPassphraseLambda_(keyId);

if (passphrase.getSize() == 0)

throw DecryptedDataContainerException("empty passphrase");

auto keyPtr = make_unique<DecryptedEncryptionKey>(passphrase);

keyPtr = move(deriveEncryptionKey(move(keyPtr), kdfId));

if (keyId == keyPtr->getId(kdfId))

return move(keyPtr);

}

return nullptr;

const BinaryData& key, shared_ptr<Asset_EncryptedData> dataPtr)

{

//serialize db key

auto&& dbKey = WRITE_UINT8_BE(ENCRYPTIONKEY_PREFIX);

dbKey.append(key);

updateKeyOnDiskNoPrefix(dbKey, dataPtr);

const BinaryData& dbKey, shared_ptr<Asset_EncryptedData> dataPtr)

{

/*caller needs to manage db tx*/

//check if data is on disk already

CharacterArrayRef keyRef(dbKey.getSize(), dbKey.getPtr());

auto&& dataRef = dbPtr_->get_NoCopy(keyRef);

if (dataRef.len != 0)

{

BinaryDataRef bdr((uint8_t*)dataRef.data, dataRef.len);

//already have this key, is it the same data?

auto onDiskData = Asset_EncryptedData::deserialize(bdr);

//data has not changed, no need to commit

if (onDiskData->isSame(dataPtr.get()))

return;

//data has changed, wipe the existing data

deleteKeyFromDisk(dbKey);

}

auto&& serializedData = dataPtr->serialize();

CharacterArrayRef dataRef_Put(

serializedData.getSize(), serializedData.getPtr());

dbPtr_->insert(keyRef, dataRef_Put);

{

//wallet needs to create the db read/write tx

//encryption keys

for (auto& key : encryptionKeyMap_)

updateKeyOnDisk(key.first, key.second);

//kdf

for (auto& key : kdfMap_)

{

//get db key

auto&& dbKey = WRITE_UINT8_BE(KDF_PREFIX);

dbKey.append(key.first);

//fetch from db

CharacterArrayRef keyRef(dbKey.getSize(), dbKey.getPtr());

auto&& dataRef = dbPtr_->get_NoCopy(keyRef);

if (dataRef.len != 0)

{

BinaryDataRef bdr((uint8_t*)dataRef.data, dataRef.len);

//already have this key, is it the same data?

auto onDiskData = KeyDerivationFunction::deserialize(bdr);

//data has not changed, not commiting to disk

if (onDiskData->isSame(key.second.get()))

continue;

//data has changed, wipe the existing data

deleteKeyFromDisk(dbKey);

}

auto&& serializedData = key.second->serialize();

CharacterArrayRef dataRef_Put(

serializedData.getSize(), serializedData.getPtr());

dbPtr_->insert(keyRef, dataRef_Put);

}

{

/***

//sanity checks

if (!ownsLock())

throw DecryptedDataContainerException("unlocked/does not own lock");

//check db only has one RW tx

/*if (!dbEnv_->isRWLockExclusive())

CharacterArrayRef keyRef(key.getSize(), key.getCharPtr());

//check data exist son disk to begin with

{

auto dataRef = dbPtr_->get_NoCopy(keyRef);

//data is empty, nothing to wipe

if (dataRef.len == 0)

{

throw DecryptedDataContainerException(

"tried to wipe non existent entry");

}

}

//wipe it

dbPtr_->wipe(keyRef);

{

{

//encryption key and kdf entries

auto dbIter = dbPtr_->begin();

BinaryWriter bwEncrKey;

bwEncrKey.put_uint8_t(ENCRYPTIONKEY_PREFIX);

CharacterArrayRef keyRef(bwEncrKey.getSize(), bwEncrKey.getData().getPtr());

dbIter.seek(keyRef, LMDB::Iterator::Seek_GE);

while (dbIter.isValid())

{

auto iterkey = dbIter.key();

auto itervalue = dbIter.value();

if (iterkey.mv_size < 2)

throw runtime_error("empty db key");

if (itervalue.mv_size < 1)

throw runtime_error("empty value");

BinaryDataRef keyBDR((uint8_t*)iterkey.mv_data + 1, iterkey.mv_size - 1);

BinaryDataRef valueBDR((uint8_t*)itervalue.mv_data, itervalue.mv_size);

auto prefix = (uint8_t*)iterkey.mv_data;

switch (*prefix)

{

case ENCRYPTIONKEY_PREFIX:

{

auto keyPtr = Asset_EncryptedData::deserialize(valueBDR);

auto encrKeyPtr = dynamic_pointer_cast<Asset_EncryptionKey>(keyPtr);

if (encrKeyPtr == nullptr)

throw runtime_error("empty keyptr");

addEncryptionKey(encrKeyPtr);

break;

}

case KDF_PREFIX:

{

auto kdfPtr = KeyDerivationFunction::deserialize(valueBDR);

if (keyBDR != kdfPtr->getId())

throw runtime_error("kdf id mismatch");

addKdf(kdfPtr);

break;

}

}

dbIter.advance();

}

}

const BinaryData& keyID,

const SecureBinaryData& newPassphrase)

{

/***

//sanity check

if (!ownsLock())

throw DecryptedDataContainerException("unlocked/does not own lock");

if (lockedDecryptedData_ == nullptr)

throw DecryptedDataContainerException(

"nullptr lock! how did we get this far?");

auto keyIter = encryptionKeyMap_.find(keyID);

if (keyIter == encryptionKeyMap_.end())

throw DecryptedDataContainerException(

"cannot change passphrase for unknown key");

//decrypt master encryption key

auto& kdfId = keyIter->second->cypher_->getKdfId();

populateEncryptionKey(keyID, kdfId);

//grab decrypted key

auto decryptedKeyIter = lockedDecryptedData_->encryptionKeys_.find(keyID);

if (decryptedKeyIter == lockedDecryptedData_->encryptionKeys_.end())

throw DecryptedDataContainerException(

"failed to decrypt key");

auto& decryptedKey = decryptedKeyIter->second->getData();

//grab kdf for key id computation

auto masterKeyKdfId = keyIter->second->cypher_->getKdfId();

auto kdfIter = kdfMap_.find(masterKeyKdfId);

if (kdfIter == kdfMap_.end())

throw DecryptedDataContainerException("failed to grab kdf");

//copy passphrase cause the ctor will move the data in

auto newPassphraseCopy = newPassphrase;

//kdf the key to get its id

auto newEncryptionKey = make_unique<DecryptedEncryptionKey>(newPassphraseCopy);

newEncryptionKey->deriveKey(kdfIter->second);

auto newKeyId = newEncryptionKey->getId(masterKeyKdfId);

//create new cypher, pointing to the new key id

auto newCypher = keyIter->second->cypher_->getCopy(newKeyId);

//add new encryption key object to container

lockedDecryptedData_->encryptionKeys_.insert(

move(make_pair(newKeyId, move(newEncryptionKey))));

//encrypt master key

auto&& newEncryptedKey = encryptData(newCypher.get(), decryptedKey);

//create new encrypted container

auto keyIdCopy = keyID;

auto newEncryptedKeyPtr =

make_shared<Asset_EncryptionKey>(keyIdCopy, newEncryptedKey, move(newCypher));

//update

keyIter->second = newEncryptedKeyPtr;

auto&& temp_key = WRITE_UINT8_BE(ENCRYPTIONKEY_PREFIX_TEMP);

temp_key.append(keyID);

auto&& perm_key = WRITE_UINT8_BE(ENCRYPTIONKEY_PREFIX);

perm_key.append(keyID);

{

//write new encrypted key as temp key within it's own transaction

LMDBEnv::Transaction tempTx(dbEnv_, LMDB::ReadWrite);

updateKeyOnDiskNoPrefix(temp_key, newEncryptedKeyPtr);

}

{

LMDBEnv::Transaction permTx(dbEnv_, LMDB::ReadWrite);

//wipe old key from disk

deleteKeyFromDisk(perm_key);

//write new key to disk

updateKeyOnDiskNoPrefix(perm_key, newEncryptedKeyPtr);

}

{

LMDBEnv::Transaction permTx(dbEnv_, LMDB::ReadWrite);

//wipe temp entry

deleteKeyFromDisk(temp_key);

}