1 files changed, 17 insertions, 58 deletions

diff --git a/internal/cryptokit/yubicrypt.go b/internal/cryptokit/yubicrypt.go
index 851d564..d9b641d 100644
--- a/internal/cryptokit/yubicrypt.go
+++ b/internal/cryptokit/yubicrypt.go
@@ -12,6 +12,23 @@ import (
 
 const maxYubiCryptMessageBytes = 64 << 20
 
+type limitedBuffer struct {
+	buffer bytes.Buffer
+	limit  int
+}
+
+func (b *limitedBuffer) Write(value []byte) (int, error) {
+	remaining := b.limit - b.buffer.Len()
+	if remaining <= 0 {
+		return len(value), nil
+	}
+	if len(value) > remaining {
+		_, _ = b.buffer.Write(value[:remaining])
+		return len(value), nil
+	}
+	return b.buffer.Write(value)
+}
+
 var yubiCryptCandidates = []string{
 	"/home/gabriel1/bin/yubicrypt",
 	"/home/gabriel1/bin/yubicrpt-cli",
@@ -120,37 +137,6 @@ func checkYubiMessageSize(message []byte) error {
 	return nil
 }
 
-// EncryptYubiCrypt encrypts with an RSA public certificate/key accepted by
-// yubicrypt-cli. The private decryption key remains inside the YubiKey PIV
-// slot 9d and is never read by Aegis.
-func EncryptYubiCrypt(message []byte, recipientKeyPEM string) ([]byte, error) {
-	if err := checkYubiMessageSize(message); err != nil {
-		return nil, err
-	}
-	if strings.TrimSpace(recipientKeyPEM) == "" {
-		return nil, errors.New("YubiCrypt RSA recipient certificate is required")
-	}
-	var result []byte
-	err := withYubiTemp(func(directory string) error {
-		messagePath, err := writeYubiTemp(directory, "message.bin", message)
-		if err != nil {
-			return err
-		}
-		keyPath, err := writeYubiTemp(directory, "recipient.pem", []byte(recipientKeyPEM))
-		if err != nil {
-			return err
-		}
-		result, err = runYubiCrypt([]string{
-			"encrypt", "--quiet", "--key", keyPath, "--input", messagePath, "--output", "-",
-		}, nil)
-		if err != nil {
-			return fmt.Errorf("YubiCrypt encryption failed: %w", err)
-		}
-		return nil
-	})
-	return result, err
-}
-
 func requireYubiPIN(pin string) ([]byte, error) {
 	pin = strings.TrimRight(pin, "\r\n")
 	if pin == "" {
@@ -186,33 +172,6 @@ func SignYubiCrypt(message []byte, pin string) ([]byte, error) {
 	return result, err
 }
 
-// DecryptYubiCrypt decrypts with the YubiKey PIV slot 9d. The ciphertext is
-// kept in a temporary file while the PIN is supplied only on stdin.
-func DecryptYubiCrypt(ciphertext []byte, pin string) ([]byte, error) {
-	if err := checkYubiMessageSize(ciphertext); err != nil {
-		return nil, err
-	}
-	pinInput, err := requireYubiPIN(pin)
-	if err != nil {
-		return nil, err
-	}
-	var result []byte
-	err = withYubiTemp(func(directory string) error {
-		ciphertextPath, err := writeYubiTemp(directory, "ciphertext.yc", ciphertext)
-		if err != nil {
-			return err
-		}
-		result, err = runYubiCrypt([]string{
-			"decrypt", "--quiet", "--pin-stdin", "--input", ciphertextPath, "--output", "-",
-		}, pinInput)
-		if err != nil {
-			return fmt.Errorf("YubiCrypt decryption failed: %w", err)
-		}
-		return nil
-	})
-	return result, err
-}
-
 // VerifyYubiCrypt verifies a yubicrypt signature block and returns the
 // original message only after the CLI has authenticated it.
 func VerifyYubiCrypt(signedMessage []byte) ([]byte, error) {