pqfile 4.3.1

Quantum-resistant file encryption: ML-KEM (512/768/1024), hybrid X25519+ML-KEM-768, ML-DSA-65 and SLH-DSA signing, multi-recipient, Shamir sharing
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

//! Constant-time statistical benchmark for the decryption error path.
//!
//! Implements the same minimal dudect-style Welch t-test as `ct_shamir.rs` to
//! verify that rejecting a tampered ciphertext takes the same time regardless
//! of *where* the corruption sits: class 0 flips the first byte of the chunk-0
//! Poly1305 tag, class 1 flips the last byte. A timing difference would
//! indicate a non-constant-time tag comparison somewhere in the reject path.
//!
//! Run with:
//!   cargo run --release --example ct_decrypt -p pqfile
//!
//! Requires a **quiet machine** (no background load). Let it run until you have
//! more than 100 000 samples. A |t| < 4.5 at that point means no detectable
//! timing side-channel. Each sample includes a full ML-KEM-768 decapsulation,
//! which is identical across classes and only adds class-independent noise.

use std::hint::black_box;
use std::time::Instant;

use pqfile::decrypt::decrypt_stream;
use pqfile::encrypt::encrypt_stream;
use pqfile::format::CHUNK_SIZE;
use pqfile::keygen::keygen_bytes;

fn main() {
    let (pub_pem, priv_pem) = keygen_bytes(768, None).expect("keygen");
    let plaintext = [0xA5u8; 1024];
    let mut ct = Vec::new();
    encrypt_stream(
        &pub_pem,
        plaintext.len() as u64,
        CHUNK_SIZE,
        &mut plaintext.as_slice(),
        &mut ct,
    )
    .expect("encrypt");

    // The single chunk's 16-byte tag is the last 16 bytes of the file.
    let tag_start = ct.len() - 16;
    let mut tampered_first = ct.clone();
    tampered_first[tag_start] ^= 0x01;
    let mut tampered_last = ct;
    tampered_last[tag_start + 15] ^= 0x01;

    // Online Welch t-test accumulators (two classes).
    let mut n = [0u64; 2];
    let mut sum = [0f64; 2];
    let mut sum_sq = [0f64; 2];

    // Seed a simple xorshift64 from the OS CSPRNG.
    let mut rng: u64 = {
        let mut buf = [0u8; 8];
        getrandom::fill(&mut buf).expect("getrandom failed");
        u64::from_le_bytes(buf)
    };

    let mut total: u64 = 0;

    loop {
        rng ^= rng << 13;
        rng ^= rng >> 7;
        rng ^= rng << 17;
        let class = (rng & 1) as usize;

        let input = if class == 0 {
            &tampered_first
        } else {
            &tampered_last
        };

        let mut sink = Vec::with_capacity(plaintext.len());
        let t0 = Instant::now();
        let result = decrypt_stream(&priv_pem, &mut input.as_slice(), &mut sink, None);
        let ns = t0.elapsed().as_nanos() as f64;
        assert!(black_box(result).is_err(), "tampered file must not decrypt");

        n[class] += 1;
        sum[class] += ns;
        sum_sq[class] += ns * ns;
        total += 1;

        if total.is_multiple_of(10_000) && n[0] > 1 && n[1] > 1 {
            let m0 = sum[0] / n[0] as f64;
            let m1 = sum[1] / n[1] as f64;
            let v0 = (sum_sq[0] / n[0] as f64) - m0 * m0;
            let v1 = (sum_sq[1] / n[1] as f64) - m1 * m1;
            let se = (v0 / n[0] as f64 + v1 / n[1] as f64).sqrt();
            let t = if se > 0.0 { (m0 - m1) / se } else { 0.0 };
            let verdict = if t.abs() < 4.5 { "PASS" } else { "FAIL" };
            println!(
                "n={total:>9}  |t|={:.3}  m0={m0:.1}ns  m1={m1:.1}ns  {verdict}",
                t.abs()
            );
        }
    }
}