nano64 0.1.0

64-bit Time-Sortable Identifiers for Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144

use crate::{
    Clock, Hex, IV_LENGTH, Nano64, Nano64Encrypted, Nano64Error, PAYLOAD_LENGTH,
    RandomNumberGeneratorImpl, default_rng, time_now_since_epoch_ms,
};
use aes_gcm::{
    Aes256Gcm, Key,
    aead::{Aead, KeyInit, OsRng, generic_array::GenericArray, rand_core::RngCore},
};

pub struct Nano64EncryptionFactory {
    gcm: Aes256Gcm,
    clock: Clock,
    rng: RandomNumberGeneratorImpl,
}

impl Nano64EncryptionFactory {
    pub fn new(
        aes_key: &[u8],
        clock: Option<Clock>,
        rng: Option<RandomNumberGeneratorImpl>,
    ) -> Result<Self, Nano64Error> {
        if aes_key.len() != 32 {
            return Err(Nano64Error::Error("AES-256 key must be 32 bytes!".into()));
        }

        let rng = if let Some(_rng) = rng {
            _rng
        } else {
            default_rng
        };

        let clock = if let Some(_clock) = clock {
            _clock
        } else {
            time_now_since_epoch_ms
        };

        let key = Key::<Aes256Gcm>::from_slice(aes_key);
        let gcm = Aes256Gcm::new(key);

        Ok(Self { gcm, clock, rng })
    }

    pub fn encrypt(&self, id: Nano64) -> Result<Nano64Encrypted, Nano64Error> {
        let iv = self.generate_iv();
        let nonce = GenericArray::from_slice(&iv);
        let plaintext = id.value.to_be_bytes();
        let ciphertext = self
            .gcm
            .encrypt(nonce, plaintext.as_ref())
            .map_err(|e| Nano64Error::Error(format!("Error during encryption! {e}")))?;

        if ciphertext.len() != 8 + 16 {
            return Err(Nano64Error::Error(format!(
                "unexpected AES-GCM output length: {}",
                ciphertext.len()
            )));
        }

        let mut payload = [0u8; PAYLOAD_LENGTH];
        payload[..IV_LENGTH].copy_from_slice(&iv);
        payload[IV_LENGTH..].copy_from_slice(&ciphertext);

        Ok(Nano64Encrypted {
            id,
            payload,
            gcm: self.gcm.clone(),
        })
    }

    pub fn generate_encrypted(&self, timestamp: u64) -> Result<Nano64Encrypted, Nano64Error> {
        let mut ts = timestamp;
        if ts == 0 {
            ts = (self.clock)();
        }
        let id = Nano64::generate(ts, Some(self.rng))?;
        self.encrypt(id)
    }

    pub fn generate_encrypted_now(&self) -> Result<Nano64Encrypted, Nano64Error> {
        self.generate_encrypted((self.clock)())
    }

    #[allow(clippy::wrong_self_convention)]
    pub fn from_encrypted_bytes(&self, bytes: &[u8]) -> Result<Nano64Encrypted, Nano64Error> {
        if bytes.len() != PAYLOAD_LENGTH {
            return Err(Nano64Error::Error(format!(
                "encrypted payload must be {} bytes, got {}",
                PAYLOAD_LENGTH,
                bytes.len()
            )));
        }

        // Split into IV and ciphertext
        let iv = &bytes[..IV_LENGTH];
        let ciphertext = &bytes[IV_LENGTH..];

        // Decrypt
        let nonce = GenericArray::from_slice(iv);
        let plaintext = self
            .gcm
            .decrypt(nonce, ciphertext)
            .map_err(|_| Nano64Error::Error("decryption failed".into()))?;

        if plaintext.len() != 8 {
            return Err(Nano64Error::Error(format!(
                "decryption yielded invalid length: {}",
                plaintext.len()
            )));
        }

        let mut arr = [0u8; 8];
        arr.copy_from_slice(&plaintext);
        let value = u64::from_be_bytes(arr);

        let mut payload = [0u8; PAYLOAD_LENGTH];
        payload.copy_from_slice(bytes);

        Ok(Nano64Encrypted {
            id: Nano64 { value },
            payload,
            gcm: self.gcm.clone(),
        })
    }

    #[allow(clippy::wrong_self_convention)]
    pub fn from_encrypted_hex(&self, hex: String) -> Result<Nano64Encrypted, Nano64Error> {
        let bytes = Hex::to_bytes(hex.as_str())?;
        if bytes.len() != PAYLOAD_LENGTH {
            return Err(Nano64Error::Error(format!(
                "Encrypted payload must be {} len, got {}",
                PAYLOAD_LENGTH,
                bytes.len()
            )));
        }
        self.from_encrypted_bytes(&bytes)
    }

    fn generate_iv(&self) -> [u8; IV_LENGTH] {
        let mut iv = [0u8; IV_LENGTH];
        OsRng.fill_bytes(&mut iv);
        iv
    }
}