Function decrypt_rules 

pub fn decrypt_rules(
    encrypted_rules: &[u8],
    file_id: FileId,
    version: VersionNumber,
    expected_hash: [u8; 32],
) -> Result<Vec<u8>>

Decrypt rules content using file-specific key derivation

This function performs the reverse of encrypt_rules:

1. Extracts the 12-byte nonce from the beginning of encrypted data
2. Derives the encryption key from file_id + version (same as encryption)
3. Decrypts using ChaCha20-Poly1305 AEAD
4. Verifies the decrypted data hash matches expected_hash

Arguments

• encrypted_rules - Encrypted data with prepended nonce (nonce || ciphertext)
• file_id - File identifier used for key derivation
• version - Version number used for key derivation and AAD
• expected_hash - Expected BLAKE3 hash of the plaintext rules

Returns

• Ok(Vec<u8>) - Decrypted plaintext rules
• Err(AionError) - On decryption failure or hash mismatch

Errors

• AionError::DecryptionFailed if:
  • Encrypted data is too short (< 12 bytes for nonce)
  • Authentication tag is invalid (tampering detected)
  • Wrong key or nonce used
• AionError::HashMismatch if decrypted data hash doesn’t match expected

Security

• Uses deterministic key derivation from file_id and version
• Verifies authentication tag (prevents tampering)
• Verifies content hash after decryption (defense in depth)
• Constant-time operations where possible

Example

use aion_context::operations::decrypt_rules;
use aion_context::types::{FileId, VersionNumber};

// Assuming we have encrypted rules from the file
// let encrypted = parser.encrypted_rules()?;
// let version_entry = parser.get_version_entry(0)?;
//
// let plaintext = decrypt_rules(
//     encrypted,
//     FileId::new(12345),
//     VersionNumber::GENESIS,
//     version_entry.rules_hash,
// )?;