ipcrypt_rs/
lib.rs

1//! IP address encryption and obfuscation methods.
2//!
3//! This crate provides four encryption modes for IP addresses, allowing both deterministic
4//! and non-deterministic encryption, as well as prefix-preserving encryption.
5//!
6//! # Features
7//!
8//! - `ipcrypt-deterministic`: A deterministic mode in which identical inputs always produce the same output—another IP address.
9//! - `ipcrypt-pfx`: A prefix-preserving deterministic mode that maintains network structure in encrypted addresses
10//! - `ipcrypt-nd`: A non-deterministic mode that uses an 8-byte tweak
11//! - `ipcrypt-ndx`: An extended non-deterministic mode that uses a 32-byte key and 16-byte tweak
12//!
13//! # Examples
14//!
15//! ```rust
16//! use ipcrypt_rs::{Ipcrypt, IpcryptPfx, IpcryptNd, IpcryptNdx};
17//! use std::net::IpAddr;
18//! use std::str::FromStr;
19//!
20//! // Deterministic encryption
21//! # #[cfg(feature = "random")]
22//! let key = Ipcrypt::generate_key();
23//! # #[cfg(not(feature = "random"))]
24//! # let key = [0u8; 16];
25//! let ip = IpAddr::from_str("192.168.1.1").unwrap();
26//! let cipher = Ipcrypt::new(key);
27//! let encrypted = cipher.encrypt_ipaddr(ip);
28//! let decrypted = cipher.decrypt_ipaddr(encrypted);
29//! assert_eq!(ip, decrypted);
30//!
31//! // Prefix-preserving encryption
32//! # #[cfg(feature = "random")]
33//! let pfx_key = IpcryptPfx::generate_key();
34//! # #[cfg(not(feature = "random"))]
35//! # let pfx_key = {
36//! #     let mut key = [0u8; 32];
37//! #     key[0] = 1; // Make the two halves different
38//! #     key
39//! # };
40//! let cipher_pfx = IpcryptPfx::new(pfx_key);
41//! let encrypted_pfx = cipher_pfx.encrypt_ipaddr(ip);
42//! let decrypted_pfx = cipher_pfx.decrypt_ipaddr(encrypted_pfx);
43//! assert_eq!(ip, decrypted_pfx);
44//!
45//! // Non-deterministic encryption with a provided tweak
46//! let cipher_nd = IpcryptNd::new(key);
47//! let tweak = [2u8; 8];
48//! let encrypted_bytes = cipher_nd.encrypt_ipaddr(ip, Some(tweak));
49//! let decrypted = cipher_nd.decrypt_ipaddr(&encrypted_bytes);
50//! assert_eq!(ip, decrypted);
51//! ```
52//!
53//! # Security Considerations
54//!
55//! - The deterministic mode is compact and facilitates integration, but allows correlation of encrypted addresses
56//! - The prefix-preserving mode (`IpcryptPfx`) maintains network structure for analytics while encrypting actual network identities
57//! - For general use cases, prefer the non-deterministic modes (`IpcryptNd` or `IpcryptNdx`)
58//! - The extended mode (`IpcryptNdx`) provides the strongest security with a larger key and tweak size
59
60pub(crate) mod aes;
61pub(crate) mod common;
62pub(crate) mod deterministic;
63pub(crate) mod nd;
64pub(crate) mod ndx;
65pub(crate) mod pfx;
66
67pub use common::{bytes_to_ip, ip_to_bytes};
68pub use deterministic::Ipcrypt;
69pub use nd::IpcryptNd;
70pub use ndx::IpcryptNdx;
71pub use pfx::IpcryptPfx;
72
73pub mod reexports {
74    pub use aes;
75    #[cfg(feature = "random")]
76    pub use rand;
77}
ipcrypt_rs/lib.rs

ipcrypt_rs/
lib.rs
