enprot 0.4.0

Engyon Protected Text (EPT) — confidentiality processor and capability ledger
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144

use crate::Fixture;
use assert_cmd::prelude::*;
use predicates::prelude::*;
use std::fs;
use std::process::Command;
use tempfile::tempdir;

// Issue #39: deterministic AES-GCM variants derive the IV from the
// plaintext via HKDF + HMAC, so encrypting the same plaintext twice
// with the same password produces byte-identical ciphertext. That
// unlocks CAS deduplication for encrypted segments.

fn encrypt_to(out: &std::path::Path, cipher: &str, pbkdf_salt: &str) {
    Command::cargo_bin("enprot")
        .unwrap()
        .arg("encrypt")
        .arg("-w")
        .arg("Agent_007")
        .arg("--pbkdf")
        .arg("pbkdf2-sha256")
        .arg("--pbkdf-params")
        .arg("i=1000")
        .arg("--pbkdf-salt")
        .arg(pbkdf_salt)
        .arg("--cipher")
        .arg(cipher)
        .arg("-k")
        .arg("Agent_007=password")
        .arg("sample/test.ept")
        .arg("-o")
        .arg(out)
        .assert()
        .success();
}

#[test]
fn det_aes_256_gcm_is_deterministic() {
    let out1 = Fixture::blank("det1.ept");
    let out2 = Fixture::blank("det2.ept");
    encrypt_to(&out1.path, "aes-256-gcm-det", "0102030405060708");
    encrypt_to(&out2.path, "aes-256-gcm-det", "0102030405060708");
    assert_eq!(
        fs::read_to_string(&out1.path).unwrap(),
        fs::read_to_string(&out2.path).unwrap(),
        "deterministic variant must produce identical ciphertext for identical input"
    );

    // The cipher extfield records the det variant name so decrypt knows
    // it's plain AES-GCM underneath (IV is stored, not re-derived).
    let content = fs::read_to_string(&out1.path).unwrap();
    assert!(
        predicate::str::contains("cipher:aes-256-gcm-det$iv=").eval(&content),
        "cipher extfield should name the det variant; got: {}",
        content
    );
}

#[test]
fn det_aes_256_gcm_round_trips() {
    let casdir = tempdir().unwrap();
    let ept = Fixture::copy("sample/test.ept");
    let original = fs::read_to_string(&ept.path).unwrap();

    Command::cargo_bin("enprot")
        .unwrap()
        .arg("-c")
        .arg(casdir.path())
        .arg("encrypt")
        .arg("-w")
        .arg("Agent_007")
        .arg("--pbkdf")
        .arg("pbkdf2-sha256")
        .arg("--pbkdf-params")
        .arg("i=1000")
        .arg("--pbkdf-salt")
        .arg("0102030405060708")
        .arg("--cipher")
        .arg("aes-256-gcm-det")
        .arg("-k")
        .arg("Agent_007=password")
        .arg(&ept.path)
        .assert()
        .success();
    Command::cargo_bin("enprot")
        .unwrap()
        .arg("-c")
        .arg(casdir.path())
        .arg("decrypt")
        .arg("-w")
        .arg("Agent_007")
        .arg("-k")
        .arg("Agent_007=password")
        .arg(&ept.path)
        .assert()
        .success();
    assert_eq!(fs::read_to_string(&ept.path).unwrap(), original);
}

#[test]
fn det_aes_256_gcm_siv_is_deterministic() {
    let out1 = Fixture::blank("siv_det1.ept");
    let out2 = Fixture::blank("siv_det2.ept");
    encrypt_to(&out1.path, "aes-256-gcm-siv-det", "0102030405060708");
    encrypt_to(&out2.path, "aes-256-gcm-siv-det", "0102030405060708");
    assert_eq!(
        fs::read_to_string(&out1.path).unwrap(),
        fs::read_to_string(&out2.path).unwrap(),
    );
}

#[test]
fn det_distinct_from_nondet() {
    // Same password + plaintext + cipher backend, different IV derivation.
    // The det variant's ciphertext must differ from a random-IV encrypt.
    // (We're checking the IV really is derived differently — that the det
    // path didn't silently fall through to the random-IV path.)
    let det = Fixture::blank("det.ept");
    let rand = Fixture::blank("rand.ept");
    encrypt_to(&det.path, "aes-256-gcm-det", "0102030405060708");
    encrypt_to(&rand.path, "aes-256-gcm", "0102030405060708");
    // Random-IV variant's cipher: name doesn't have -det.
    let rand_content = fs::read_to_string(&rand.path).unwrap();
    assert!(predicate::str::contains("cipher:aes-256-gcm$iv=").eval(&rand_content));
    // And the two outputs differ in the actual ciphertext bytes.
    assert_ne!(fs::read_to_string(&det.path).unwrap(), rand_content,);
}

#[test]
fn det_aes_256_siv_rejected() {
    // AES-SIV is already deterministic by construction; -det suffix is
    // nonsensical and not in VALID_CIPHER_ALGS.
    Command::cargo_bin("enprot")
        .unwrap()
        .arg("encrypt")
        .arg("-w")
        .arg("Agent_007")
        .arg("--cipher")
        .arg("aes-256-siv-det")
        .arg("-k")
        .arg("Agent_007=password")
        .arg("sample/test.ept")
        .assert()
        .failure();
}