dig-capsule 0.5.0

The DIG Network .dig capsule data plane — one crate over the DIGS format, capsule read-crypto, compiler, staging, and the guest/host serve triad.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

use crate::imp::core::Bytes48;
use crate::imp::crypto::{
    bls, decrypt_and_unwrap, encrypt_chunk, BlsError, CryptoError, TamperError,
};

#[test]
fn decrypt_and_unwrap_ok_path() {
    let key = [0x21u8; 32];
    let pk = bls::SecretKey::from_seed(&[0x80u8; 32])
        .public_key()
        .to_bytes();
    let ct = encrypt_chunk(&key, b"payload");
    let out = decrypt_and_unwrap(&key, &ct, &pk).expect("valid key + valid pk");
    assert_eq!(out, b"payload");
}

#[test]
fn decrypt_and_unwrap_surfaces_tamper_error() {
    let key = [0x21u8; 32];
    let pk = bls::SecretKey::from_seed(&[0x80u8; 32])
        .public_key()
        .to_bytes();
    let mut ct = encrypt_chunk(&key, b"payload");
    ct[0] ^= 0x01;
    let err = decrypt_and_unwrap(&key, &ct, &pk).unwrap_err();
    assert_eq!(err, CryptoError::Tamper(TamperError));
}

#[test]
fn decrypt_and_unwrap_surfaces_bls_error() {
    let key = [0x21u8; 32];
    let ct = encrypt_chunk(&key, b"payload");
    let bad_pk = Bytes48([0xFFu8; 48]);
    let err = decrypt_and_unwrap(&key, &ct, &bad_pk).unwrap_err();
    assert_eq!(err, CryptoError::Bls(BlsError::InvalidPublicKey));
}