shadow-crypt-core 1.0.7

Core types and deterministic operations for shadow-crypt
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

use chacha20poly1305::{KeyInit, XChaCha20Poly1305, aead::Aead};

use crate::{algorithm::Algorithm, errors::CryptError, memory::SecureBytes};

pub fn encrypt_bytes(
    plaintext: &[u8],
    key: &[u8; 32],
    nonce: &[u8; 24],
) -> Result<(Vec<u8>, Algorithm), CryptError> {
    let cipher = XChaCha20Poly1305::new(key.into());
    let ciphertext = cipher
        .encrypt(nonce.into(), plaintext)
        .map_err(|e| CryptError::EncryptionError(format!("Encryption failed: {}", e)))?;

    Ok((ciphertext, Algorithm::XChaCha20Poly1305))
}

/// Decrypts the given ciphertext into an insecure byte vector.
pub fn decrypt_bytes(
    ciphertext: &[u8],
    key: &[u8; 32],
    nonce: &[u8; 24],
) -> Result<(SecureBytes, Algorithm), CryptError> {
    let cipher = XChaCha20Poly1305::new(key.into());
    let plaintext = cipher
        .decrypt(nonce.into(), ciphertext)
        .map_err(|e| CryptError::DecryptionError(format!("Decryption failed: {}", e)))?;

    Ok((SecureBytes::new(plaintext), Algorithm::XChaCha20Poly1305))
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_encrypt_decrypt_round_trip() {
        let plaintext = b"Hello, world!";
        let key = [0u8; 32];
        let nonce = [0u8; 24];

        let (ciphertext, algorithm) = encrypt_bytes(plaintext, &key, &nonce).unwrap();
        assert_eq!(algorithm, Algorithm::XChaCha20Poly1305);
        assert_ne!(ciphertext, plaintext);

        let (decrypted, algorithm) = decrypt_bytes(&ciphertext, &key, &nonce).unwrap();
        assert_eq!(algorithm, Algorithm::XChaCha20Poly1305);
        assert_eq!(decrypted.as_slice(), plaintext);
    }

    #[test]
    fn test_encrypt_different_nonce_produces_different_ciphertext() {
        let plaintext = b"Test message";
        let key = [1u8; 32];
        let nonce1 = [0u8; 24];
        let nonce2 = [1u8; 24];

        let (ciphertext1, _) = encrypt_bytes(plaintext, &key, &nonce1).unwrap();
        let (ciphertext2, _) = encrypt_bytes(plaintext, &key, &nonce2).unwrap();

        assert_ne!(ciphertext1, ciphertext2);
    }

    #[test]
    fn test_encrypt_same_inputs_produce_same_output() {
        let plaintext = b"Deterministic test";
        let key = [2u8; 32];
        let nonce = [2u8; 24];

        let (ciphertext1, _) = encrypt_bytes(plaintext, &key, &nonce).unwrap();
        let (ciphertext2, _) = encrypt_bytes(plaintext, &key, &nonce).unwrap();

        assert_eq!(ciphertext1, ciphertext2);
    }

    #[test]
    fn test_decrypt_with_wrong_key_fails() {
        let plaintext = b"Secret message";
        let key = [3u8; 32];
        let wrong_key = [4u8; 32];
        let nonce = [3u8; 24];

        let (ciphertext, _) = encrypt_bytes(plaintext, &key, &nonce).unwrap();
        let result = decrypt_bytes(&ciphertext, &wrong_key, &nonce);

        assert!(result.is_err());
    }

    #[test]
    fn test_decrypt_with_wrong_nonce_fails() {
        let plaintext = b"Secret message";
        let key = [5u8; 32];
        let nonce = [5u8; 24];
        let wrong_nonce = [6u8; 24];

        let (ciphertext, _) = encrypt_bytes(plaintext, &key, &nonce).unwrap();
        let result = decrypt_bytes(&ciphertext, &key, &wrong_nonce);

        assert!(result.is_err());
    }

    #[test]
    fn test_encrypt_empty_plaintext() {
        let plaintext = b"";
        let key = [7u8; 32];
        let nonce = [7u8; 24];

        let (ciphertext, algorithm) = encrypt_bytes(plaintext, &key, &nonce).unwrap();
        assert_eq!(algorithm, Algorithm::XChaCha20Poly1305);

        let (decrypted, algorithm) = decrypt_bytes(&ciphertext, &key, &nonce).unwrap();
        assert_eq!(algorithm, Algorithm::XChaCha20Poly1305);
        assert_eq!(decrypted.as_slice(), plaintext);
    }
}