promocrypt_core/

encryption.rs

//! Cryptographic operations for promocrypt-core.
//!
//! Implements the two-key encryption system using:
//! - Argon2id for key derivation
//! - AES-256-GCM for authenticated encryption
//! - AES-256-SIV for deterministic storage encryption

use argon2::{Algorithm, Argon2, Params, Version};
use base64::{Engine, engine::general_purpose::STANDARD};
use ring::aead::{AES_256_GCM, Aad, LessSafeKey, Nonce, UnboundKey};
use ring::digest::{SHA256, digest};
use ring::rand::{SecureRandom, SystemRandom};

use crate::error::{PromocryptError, Result};

/// Argon2 memory cost in KiB (64 MB)
pub const ARGON2_MEMORY_COST: u32 = 65536;

/// Argon2 time cost (iterations)
pub const ARGON2_TIME_COST: u32 = 3;

/// Argon2 parallelism
pub const ARGON2_PARALLELISM: u32 = 1;

/// Salt size in bytes
pub const SALT_SIZE: usize = 16;

/// Nonce size for AES-256-GCM
pub const NONCE_SIZE: usize = 12;

/// Tag size for AES-256-GCM
pub const TAG_SIZE: usize = 16;

/// Encrypted key size (32 bytes key + 16 bytes tag)
pub const ENCRYPTED_KEY_SIZE: usize = 48;

/// Derive a 32-byte key from a password/secret using Argon2id.
///
/// # Arguments
/// * `input` - Password, secret, or machine ID bytes
/// * `salt` - 16-byte random salt
///
/// # Returns
/// 32-byte derived key
pub fn derive_key(input: &[u8], salt: &[u8; SALT_SIZE]) -> Result<[u8; 32]> {
    let params = Params::new(
        ARGON2_MEMORY_COST,
        ARGON2_TIME_COST,
        ARGON2_PARALLELISM,
        Some(32),
    )
    .map_err(|e| PromocryptError::EncryptionFailed(format!("Argon2 params error: {}", e)))?;

    let argon2 = Argon2::new(Algorithm::Argon2id, Version::V0x13, params);

    let mut output = [0u8; 32];
    argon2
        .hash_password_into(input, salt, &mut output)
        .map_err(|e| PromocryptError::EncryptionFailed(format!("Argon2 hash error: {}", e)))?;

    Ok(output)
}

/// Generate a random 32-byte key.
pub fn generate_random_key() -> Result<[u8; 32]> {
    let rng = SystemRandom::new();
    let mut key = [0u8; 32];
    rng.fill(&mut key).map_err(|_| {
        PromocryptError::EncryptionFailed("Failed to generate random key".to_string())
    })?;
    Ok(key)
}

/// Generate a random 16-byte salt.
pub fn generate_salt() -> Result<[u8; SALT_SIZE]> {
    let rng = SystemRandom::new();
    let mut salt = [0u8; SALT_SIZE];
    rng.fill(&mut salt)
        .map_err(|_| PromocryptError::EncryptionFailed("Failed to generate salt".to_string()))?;
    Ok(salt)
}

/// Generate a random 12-byte nonce.
pub fn generate_nonce() -> Result<[u8; NONCE_SIZE]> {
    let rng = SystemRandom::new();
    let mut nonce = [0u8; NONCE_SIZE];
    rng.fill(&mut nonce)
        .map_err(|_| PromocryptError::EncryptionFailed("Failed to generate nonce".to_string()))?;
    Ok(nonce)
}

/// Encrypt data with AES-256-GCM.
///
/// # Arguments
/// * `key` - 32-byte encryption key
/// * `plaintext` - Data to encrypt
/// * `nonce` - 12-byte nonce (must be unique per encryption with same key)
///
/// # Returns
/// Ciphertext with appended authentication tag (plaintext.len() + 16 bytes)
pub fn encrypt(key: &[u8; 32], plaintext: &[u8], nonce: &[u8; NONCE_SIZE]) -> Result<Vec<u8>> {
    let unbound_key = UnboundKey::new(&AES_256_GCM, key)
        .map_err(|_| PromocryptError::EncryptionFailed("Invalid key".to_string()))?;
    let less_safe_key = LessSafeKey::new(unbound_key);

    let nonce = Nonce::assume_unique_for_key(*nonce);

    // ring encrypts in-place, so we need to allocate space for the tag
    let mut in_out = plaintext.to_vec();
    in_out.reserve(TAG_SIZE);

    less_safe_key
        .seal_in_place_append_tag(nonce, Aad::empty(), &mut in_out)
        .map_err(|_| PromocryptError::EncryptionFailed("Encryption failed".to_string()))?;

    Ok(in_out)
}

/// Decrypt data with AES-256-GCM.
///
/// # Arguments
/// * `key` - 32-byte decryption key
/// * `ciphertext` - Encrypted data with appended tag
/// * `nonce` - 12-byte nonce used during encryption
///
/// # Returns
/// Decrypted plaintext
pub fn decrypt(key: &[u8; 32], ciphertext: &[u8], nonce: &[u8; NONCE_SIZE]) -> Result<Vec<u8>> {
    if ciphertext.len() < TAG_SIZE {
        return Err(PromocryptError::DecryptionFailed);
    }

    let unbound_key =
        UnboundKey::new(&AES_256_GCM, key).map_err(|_| PromocryptError::DecryptionFailed)?;
    let less_safe_key = LessSafeKey::new(unbound_key);

    let nonce = Nonce::assume_unique_for_key(*nonce);

    let mut in_out = ciphertext.to_vec();
    let plaintext = less_safe_key
        .open_in_place(nonce, Aad::empty(), &mut in_out)
        .map_err(|_| PromocryptError::DecryptionFailed)?;

    Ok(plaintext.to_vec())
}

/// Encrypt a 32-byte data key for storage.
///
/// Used to encrypt the data_key with either machineID or secret.
///
/// # Arguments
/// * `data_key` - 32-byte key to encrypt
/// * `password_or_machine_id` - Password/secret or machine ID to derive encryption key from
/// * `salt` - Salt for key derivation
/// * `nonce` - Nonce for encryption
///
/// # Returns
/// 48 bytes: encrypted key (32) + tag (16)
pub fn encrypt_data_key(
    data_key: &[u8; 32],
    password_or_machine_id: &[u8],
    salt: &[u8; SALT_SIZE],
    nonce: &[u8; NONCE_SIZE],
) -> Result<[u8; ENCRYPTED_KEY_SIZE]> {
    let derived_key = derive_key(password_or_machine_id, salt)?;
    let ciphertext = encrypt(&derived_key, data_key, nonce)?;

    if ciphertext.len() != ENCRYPTED_KEY_SIZE {
        return Err(PromocryptError::EncryptionFailed(format!(
            "Unexpected ciphertext length: {}",
            ciphertext.len()
        )));
    }

    let mut result = [0u8; ENCRYPTED_KEY_SIZE];
    result.copy_from_slice(&ciphertext);
    Ok(result)
}

/// Decrypt a 32-byte data key from storage.
///
/// # Arguments
/// * `encrypted` - 48 bytes: encrypted key + tag
/// * `password_or_machine_id` - Password/secret or machine ID to derive decryption key from
/// * `salt` - Salt used during encryption
/// * `nonce` - Nonce used during encryption
///
/// # Returns
/// Decrypted 32-byte data key
pub fn decrypt_data_key(
    encrypted: &[u8; ENCRYPTED_KEY_SIZE],
    password_or_machine_id: &[u8],
    salt: &[u8; SALT_SIZE],
    nonce: &[u8; NONCE_SIZE],
) -> Result<[u8; 32]> {
    let derived_key = derive_key(password_or_machine_id, salt)?;
    let plaintext = decrypt(&derived_key, encrypted, nonce)?;

    if plaintext.len() != 32 {
        return Err(PromocryptError::DecryptionFailed);
    }

    let mut result = [0u8; 32];
    result.copy_from_slice(&plaintext);
    Ok(result)
}

/// Encrypt data with a data key (for config/mutable sections).
///
/// # Arguments
/// * `data_key` - 32-byte data key
/// * `plaintext` - Data to encrypt
/// * `nonce` - 12-byte nonce
///
/// # Returns
/// Ciphertext with appended tag
pub fn encrypt_data(
    data_key: &[u8; 32],
    plaintext: &[u8],
    nonce: &[u8; NONCE_SIZE],
) -> Result<Vec<u8>> {
    encrypt(data_key, plaintext, nonce)
}

/// Decrypt data with a data key.
///
/// # Arguments
/// * `data_key` - 32-byte data key
/// * `ciphertext` - Encrypted data with tag
/// * `nonce` - 12-byte nonce used during encryption
///
/// # Returns
/// Decrypted plaintext
pub fn decrypt_data(
    data_key: &[u8; 32],
    ciphertext: &[u8],
    nonce: &[u8; NONCE_SIZE],
) -> Result<Vec<u8>> {
    decrypt(data_key, ciphertext, nonce)
}

// ==================== Storage Encryption (Deterministic) ====================
//
// For database storage, we need deterministic encryption so that:
// 1. Same code always encrypts to the same ciphertext (for lookups)
// 2. The encryption is still authenticated
//
// We use AES-256-GCM with a synthetic nonce derived from the key and plaintext.
// This is similar to AES-SIV but using GCM for the AEAD.

/// Derive a deterministic nonce from the key and plaintext.
///
/// Uses HMAC-SHA256 truncated to 12 bytes.
fn derive_deterministic_nonce(key: &[u8; 32], plaintext: &[u8]) -> [u8; NONCE_SIZE] {
    // Create a synthetic IV using: SHA256(key || plaintext)
    let mut input = Vec::with_capacity(32 + plaintext.len());
    input.extend_from_slice(key);
    input.extend_from_slice(plaintext);

    let hash = digest(&SHA256, &input);
    let mut nonce = [0u8; NONCE_SIZE];
    nonce.copy_from_slice(&hash.as_ref()[..NONCE_SIZE]);
    nonce
}

/// Encrypt a code for database storage (deterministic).
///
/// Uses deterministic encryption so the same code always produces the same
/// ciphertext, allowing for database lookups without decryption.
///
/// # Arguments
/// * `storage_key` - 32-byte storage encryption key
/// * `code` - The promotional code to encrypt
///
/// # Returns
/// Base64-encoded ciphertext (deterministic: same code = same output)
pub fn encrypt_code_for_storage(storage_key: &[u8; 32], code: &str) -> Result<String> {
    let plaintext = code.as_bytes();
    let nonce = derive_deterministic_nonce(storage_key, plaintext);
    let ciphertext = encrypt(storage_key, plaintext, &nonce)?;

    // Include nonce in output for decryption (even though it's derivable)
    // Format: base64(nonce || ciphertext)
    let mut output = Vec::with_capacity(NONCE_SIZE + ciphertext.len());
    output.extend_from_slice(&nonce);
    output.extend_from_slice(&ciphertext);

    Ok(STANDARD.encode(&output))
}

/// Decrypt a code from database storage.
///
/// # Arguments
/// * `storage_key` - 32-byte storage encryption key
/// * `encrypted` - Base64-encoded ciphertext
///
/// # Returns
/// The decrypted promotional code
pub fn decrypt_code_from_storage(storage_key: &[u8; 32], encrypted: &str) -> Result<String> {
    let data = STANDARD
        .decode(encrypted)
        .map_err(|_| PromocryptError::DecryptionFailed)?;

    if data.len() < NONCE_SIZE + TAG_SIZE {
        return Err(PromocryptError::DecryptionFailed);
    }

    let mut nonce = [0u8; NONCE_SIZE];
    nonce.copy_from_slice(&data[..NONCE_SIZE]);

    let ciphertext = &data[NONCE_SIZE..];
    let plaintext = decrypt(storage_key, ciphertext, &nonce)?;

    String::from_utf8(plaintext).map_err(|_| PromocryptError::DecryptionFailed)
}

/// Encrypt multiple codes for storage (batch operation).
pub fn encrypt_codes_for_storage(storage_key: &[u8; 32], codes: &[&str]) -> Result<Vec<String>> {
    codes
        .iter()
        .map(|code| encrypt_code_for_storage(storage_key, code))
        .collect()
}

/// Decrypt multiple codes from storage (batch operation).
pub fn decrypt_codes_from_storage(
    storage_key: &[u8; 32],
    encrypted: &[&str],
) -> Result<Vec<String>> {
    encrypted
        .iter()
        .map(|enc| decrypt_code_from_storage(storage_key, enc))
        .collect()
}

/// Hash a secret for storage in history (using SHA256).
pub fn hash_secret(secret: &str) -> String {
    let hash = digest(&SHA256, secret.as_bytes());
    hex::encode(hash.as_ref())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_derive_key() {
        let password = b"test-password";
        let salt = [0u8; SALT_SIZE];

        let key1 = derive_key(password, &salt).unwrap();
        let key2 = derive_key(password, &salt).unwrap();

        assert_eq!(key1, key2);
        assert_eq!(key1.len(), 32);
    }

    #[test]
    fn test_derive_key_different_inputs() {
        let salt = [0u8; SALT_SIZE];

        let key1 = derive_key(b"password1", &salt).unwrap();
        let key2 = derive_key(b"password2", &salt).unwrap();

        assert_ne!(key1, key2);
    }

    #[test]
    fn test_derive_key_different_salts() {
        let password = b"test-password";

        let key1 = derive_key(password, &[0u8; SALT_SIZE]).unwrap();
        let key2 = derive_key(password, &[1u8; SALT_SIZE]).unwrap();

        assert_ne!(key1, key2);
    }

    #[test]
    fn test_encrypt_decrypt_roundtrip() {
        let key = generate_random_key().unwrap();
        let nonce = generate_nonce().unwrap();
        let plaintext = b"Hello, World!";

        let ciphertext = encrypt(&key, plaintext, &nonce).unwrap();
        let decrypted = decrypt(&key, &ciphertext, &nonce).unwrap();

        assert_eq!(decrypted, plaintext);
    }

    #[test]
    fn test_encrypt_decrypt_empty() {
        let key = generate_random_key().unwrap();
        let nonce = generate_nonce().unwrap();
        let plaintext = b"";

        let ciphertext = encrypt(&key, plaintext, &nonce).unwrap();
        let decrypted = decrypt(&key, &ciphertext, &nonce).unwrap();

        assert_eq!(decrypted, plaintext);
    }

    #[test]
    fn test_decrypt_wrong_key() {
        let key1 = generate_random_key().unwrap();
        let key2 = generate_random_key().unwrap();
        let nonce = generate_nonce().unwrap();
        let plaintext = b"Secret data";

        let ciphertext = encrypt(&key1, plaintext, &nonce).unwrap();
        let result = decrypt(&key2, &ciphertext, &nonce);

        assert!(result.is_err());
    }

    #[test]
    fn test_decrypt_wrong_nonce() {
        let key = generate_random_key().unwrap();
        let nonce1 = generate_nonce().unwrap();
        let nonce2 = generate_nonce().unwrap();
        let plaintext = b"Secret data";

        let ciphertext = encrypt(&key, plaintext, &nonce1).unwrap();
        let result = decrypt(&key, &ciphertext, &nonce2);

        assert!(result.is_err());
    }

    #[test]
    fn test_data_key_encrypt_decrypt() {
        let data_key = generate_random_key().unwrap();
        let password = b"my-secret-password";
        let salt = generate_salt().unwrap();
        let nonce = generate_nonce().unwrap();

        let encrypted = encrypt_data_key(&data_key, password, &salt, &nonce).unwrap();
        let decrypted = decrypt_data_key(&encrypted, password, &salt, &nonce).unwrap();

        assert_eq!(data_key, decrypted);
    }

    #[test]
    fn test_data_key_wrong_password() {
        let data_key = generate_random_key().unwrap();
        let salt = generate_salt().unwrap();
        let nonce = generate_nonce().unwrap();

        let encrypted = encrypt_data_key(&data_key, b"correct-password", &salt, &nonce).unwrap();
        let result = decrypt_data_key(&encrypted, b"wrong-password", &salt, &nonce);

        assert!(result.is_err());
    }

    #[test]
    fn test_generate_salt_unique() {
        let salt1 = generate_salt().unwrap();
        let salt2 = generate_salt().unwrap();

        // Statistically should never be equal
        assert_ne!(salt1, salt2);
    }

    #[test]
    fn test_generate_nonce_unique() {
        let nonce1 = generate_nonce().unwrap();
        let nonce2 = generate_nonce().unwrap();

        assert_ne!(nonce1, nonce2);
    }

    #[test]
    fn test_ciphertext_size() {
        let key = generate_random_key().unwrap();
        let nonce = generate_nonce().unwrap();

        // Test various plaintext sizes
        for size in [0, 1, 16, 32, 100, 1000] {
            let plaintext = vec![0u8; size];
            let ciphertext = encrypt(&key, &plaintext, &nonce).unwrap();
            assert_eq!(ciphertext.len(), size + TAG_SIZE);
        }
    }
}