vitaminc-encrypt 0.2.0-pre.1

Secure, flexible and fast encryption for Rust types. Part of the Vitamin-C cryptographic suite.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

//! `aws-lc-rs` backend for AES-256-GCM.

use aws_lc_rs::aead::{Aad as LcAad, LessSafeKey, Nonce as LcNonce, UnboundKey, AES_256_GCM};
use vitaminc_aead::Unspecified;

pub(crate) struct CipherKey(LessSafeKey);

impl CipherKey {
    pub(crate) fn new(key_bytes: &[u8; 32]) -> Result<Self, Unspecified> {
        let unbound = UnboundKey::new(&AES_256_GCM, key_bytes.as_ref()).map_err(|_| Unspecified)?;
        Ok(Self(LessSafeKey::new(unbound)))
    }

    /// Encrypts `in_out` in place and appends the authentication tag.
    pub(crate) fn seal(
        &self,
        nonce: &[u8],
        aad: &[u8],
        in_out: &mut Vec<u8>,
    ) -> Result<(), Unspecified> {
        let nonce = LcNonce::try_assume_unique_for_key(nonce).map_err(|_| Unspecified)?;
        self.0
            .seal_in_place_append_tag(nonce, LcAad::from(aad), in_out)
            .map_err(|_| Unspecified)?;
        Ok(())
    }

    /// Decrypts `in_out` (ciphertext || tag) in place. Returns the plaintext
    /// length — `in_out[..len]` is the plaintext after the call.
    pub(crate) fn open(
        &self,
        nonce: &[u8],
        aad: &[u8],
        in_out: &mut [u8],
    ) -> Result<usize, Unspecified> {
        let nonce = LcNonce::try_assume_unique_for_key(nonce).map_err(|_| Unspecified)?;
        self.0
            .open_in_place(nonce, LcAad::from(aad), in_out)
            .map(|plaintext| plaintext.len())
            .map_err(|_| Unspecified)
    }
}