Disk encryption is a lot more complicated than file encryption. I don't think you should branch out into disk encryption as well as file encryption unless you intend to make a separate tool.There are a few commented out chunks of code that should probably be removed.It looks like your code needs to be split up into more subroutines.Some of the indentation in your code makes things harder to read, but I'm not a fan of Golang for readability anyway.Unfortunately, that's really the best we can do since applying for funding is a waste of time unless the project is extremely popular. You'd be better off creating a bug bounty program on something like HackerOne to get some more people checking the source code. Barely anybody donates to open source projects compared to how many people use them, and as you've mentioned, an audit costs thousands of dollars. I suggest you stop asking for donations for an audit because there's no way you'll be able to fund an audit that way.Those sort of features should be separate tools, and that would simplify the program even more. I would get rid of the file shredder and file checksum generator features.Hashing a key typically isn't recommended.Where did the $8,500 figure for an audit come from? Your program isn't that many lines.What's your justification for the file shredder and file checksum generator features?.Why are you using SHA3 for file corruption checks when XChaCha20-Poly1305 can handle that? Is that something to do with the Reed-Solomon parity bytes?.How are you preventing truncation of encrypted files?.How are you preventing chunk reordering/removal/duplication? Is that via the nonce encryption?.Why are you randomly generating a nonce for each chunk rather than incrementing the nonce? Incrementing the nonce would be faster, and then you only have to store one nonce, which would save space and simplify the format.Why did you choose 1 MiB chunks? That seems a bit high in terms of the amount of extra data being stored and reduces the forgery bounds for XChaCha20-Poly1305.Why are you using SHA3 to check whether the key is correct instead of just viewing an error from XChaCha20-Poly1305 as the key being incorrect?.
Lastly, even though our programs are somewhat in competition, please don't see my criticism as me trying to bash your project. Therefore, I apologise in advance if anything I say is incorrect or if anything I ask has been answered somewhere already. Another thing I should mention is that I'm currently in the middle of an exam period, so I haven't spent much time looking into your program. I haven't been active in the PrivacyTools repo recently, so I'm sorry for not commenting sooner. Hi I'm the maintainer of Kryptor, and considering how your tool appears to be more popular than mine, I'm very surprised nobody has commented on this yet. I will keep the issue up-to-date if something I have said changes or I remember a connection with the software.
I intend on getting it audited, with monetary support from donations (when and if possible). I have a solid understanding of cryptography, and so I can (almost) guarantee the security of Picocrypt. I am the author of Picocrypt, and I love helping people stay private and secure. Picocrypt has also gathered a lot of attention and positive feedback on this PrivacyTools Reddit thread, which suggests that it should be considered to be added to the list of FOSS software. Picocrypt fixes that stereotype by providing a super-simple, but super-secure (and foolproof) encryption tool. Most people don't encrypt their files or don't care about privacy because it's too hard to do correctly. I created Picocrypt with the vision that due to its simplicity, it'll be used and adopted by a wider range of people (writers, artists, freelancers), and not just "techy" people.
Often, people choose not to encrypt their files because it is hard to do. Authentication is done by HMAC-SHA3 and core encryption is done by Go's standard /x/crypto/chacha20 package. It uses the secure XChaCha20 cipher as well as the respected Argon2 key derivation function. It is meant to allow anyone to securely encrypt their files, without having to go through the hassle of creating VeraCrypt volumes, or risk the security of their data by using something insecure (ie. I built it with security and simplicity in mind. Picocrypt is a very small (3MB), very simple, and very secure encryption tool.