void_crypto/

aead.rs

//! AES-256-GCM authenticated encryption with AAD support.
//!
//! All encryption uses Additional Authenticated Data (AAD) to bind ciphertext
//! to its intended purpose. This prevents type confusion attacks where one
//! ciphertext type is misinterpreted as another.

use aes_gcm::{
    aead::{Aead, AeadInPlace, KeyInit, Payload},
    Aes256Gcm, Nonce, Tag,
};
use rand::RngCore;
use crate::{CryptoError, CryptoResult};

const NONCE_SIZE: usize = 12;
const TAG_SIZE: usize = 16;

// AAD constants for different object types.
// These prevent type confusion attacks (treating shard as commit, etc.)

/// AAD for commit objects.
pub const AAD_COMMIT: &[u8] = b"void:commit:v1";
/// AAD for metadata bundle objects.
pub const AAD_METADATA: &[u8] = b"void:metadata:v1";
/// AAD for shard objects.
pub const AAD_SHARD: &[u8] = b"void:shard:v1";
/// AAD for index objects.
pub const AAD_INDEX: &[u8] = b"void:index:v1";
/// AAD for stash objects.
pub const AAD_STASH: &[u8] = b"void:stash:v1";
/// AAD for staged content blobs.
pub const AAD_STAGED: &[u8] = b"void:staged:v1";
/// AAD for tree manifest objects.
pub const AAD_MANIFEST: &[u8] = b"void:manifest:v1";
/// AAD for shard key wrapping (content_key wraps shard_key).
pub const AAD_SHARD_KEY: &[u8] = b"void:shard-key:v1";
/// AAD for repo manifest (collaboration manifest JSON).
pub const AAD_REPO_MANIFEST: &[u8] = b"void:repo-manifest:v1";

/// Encrypts plaintext using AES-256-GCM with Additional Authenticated Data (AAD).
///
/// The AAD is authenticated but not encrypted - it binds the ciphertext to a
/// specific context (e.g., object type) without being included in the output.
///
/// Returns: nonce (12 bytes) || ciphertext || tag (16 bytes)
///
/// # Security
///
/// Uses a random 12-byte nonce. Total ciphertext overhead is 28 bytes
/// (12 nonce + 16 tag). Always use the appropriate `AAD_*` constant
/// for the object type being encrypted.
pub fn encrypt(key: &[u8; 32], plaintext: &[u8], aad: &[u8]) -> CryptoResult<Vec<u8>> {
    let cipher =
        Aes256Gcm::new_from_slice(key).map_err(|e| CryptoError::Encryption(e.to_string()))?;

    let mut nonce_bytes = [0u8; NONCE_SIZE];
    rand::thread_rng().fill_bytes(&mut nonce_bytes);
    let nonce = Nonce::from_slice(&nonce_bytes);

    let payload = Payload {
        msg: plaintext,
        aad,
    };

    let ciphertext = cipher
        .encrypt(nonce, payload)
        .map_err(|e| CryptoError::Encryption(e.to_string()))?;

    let mut output = Vec::with_capacity(NONCE_SIZE + ciphertext.len());
    output.extend_from_slice(&nonce_bytes);
    output.extend_from_slice(&ciphertext);

    Ok(output)
}

/// Decrypts ciphertext using AES-256-GCM with Additional Authenticated Data (AAD).
///
/// The AAD must match what was used during encryption, otherwise decryption fails.
///
/// Expects input format: nonce (12 bytes) || ciphertext || tag (16 bytes)
pub fn decrypt(key: &[u8; 32], ciphertext: &[u8], aad: &[u8]) -> CryptoResult<Vec<u8>> {
    if ciphertext.len() < NONCE_SIZE + TAG_SIZE {
        return Err(CryptoError::Decryption("ciphertext too short".into()));
    }

    let cipher =
        Aes256Gcm::new_from_slice(key).map_err(|e| CryptoError::Decryption(e.to_string()))?;

    let nonce = Nonce::from_slice(&ciphertext[..NONCE_SIZE]);
    let encrypted = &ciphertext[NONCE_SIZE..];

    let payload = Payload {
        msg: encrypted,
        aad,
    };

    cipher
        .decrypt(nonce, payload)
        .map_err(|e| CryptoError::Decryption(e.to_string()))
}

/// Decrypts ciphertext into a byte buffer.
///
/// Functionally identical to `decrypt()` but uses in-place decryption
/// (avoids an extra allocation for the tag-stripped copy).
pub fn decrypt_to_vec(key: &[u8; 32], ciphertext: &[u8], aad: &[u8]) -> CryptoResult<Vec<u8>> {
    if ciphertext.len() < NONCE_SIZE + TAG_SIZE {
        return Err(CryptoError::Decryption("ciphertext too short".into()));
    }

    let cipher =
        Aes256Gcm::new_from_slice(key).map_err(|e| CryptoError::Decryption(e.to_string()))?;

    let nonce = Nonce::from_slice(&ciphertext[..NONCE_SIZE]);
    let encrypted = &ciphertext[NONCE_SIZE..];
    let (body, tag_bytes) = encrypted.split_at(encrypted.len() - TAG_SIZE);
    let tag = Tag::from_slice(tag_bytes);

    let mut output = body.to_vec();

    cipher
        .decrypt_in_place_detached(nonce, aad, &mut output, tag)
        .map_err(|e| CryptoError::Decryption(e.to_string()))?;

    Ok(output)
}

/// Decrypt and parse a CBOR-encoded type.
///
/// Decrypts the ciphertext, then deserializes the plaintext as CBOR.
pub fn decrypt_and_parse<T>(key: &[u8; 32], ciphertext: &[u8], aad: &[u8]) -> CryptoResult<T>
where
    T: serde::de::DeserializeOwned,
{
    let plaintext = decrypt(key, ciphertext, aad)?;
    ciborium::from_reader(&plaintext[..])
        .map_err(|e| CryptoError::Serialization(format!("CBOR deserialization failed: {e}")))
}

/// Wrap a shard key under a content key using AES-256-GCM.
///
/// Returns a `WrappedKey` containing nonce || ciphertext || tag.
pub fn wrap_shard_key(
    content_key: &crate::ContentKey,
    shard_key: &[u8; 32],
) -> CryptoResult<crate::WrappedKey> {
    let bytes = encrypt(content_key.as_bytes(), shard_key, AAD_SHARD_KEY)?;
    Ok(crate::WrappedKey::from_bytes(bytes))
}

/// Unwrap a shard key that was wrapped under a content key.
pub fn unwrap_shard_key(
    content_key: &crate::ContentKey,
    wrapped: &crate::WrappedKey,
) -> CryptoResult<[u8; 32]> {
    let plain = decrypt(content_key.as_bytes(), wrapped.as_bytes(), AAD_SHARD_KEY)?;
    plain
        .try_into()
        .map_err(|_| CryptoError::Decryption("unwrapped shard key is not 32 bytes".into()))
}

#[cfg(test)]
mod tests {
    use super::*;

    const TEST_AAD: &[u8] = b"void:test:v1";

    #[test]
    fn encrypt_decrypt_roundtrip() {
        let key = [0x42u8; 32];
        let plaintext = b"hello, void!";

        let ciphertext = encrypt(&key, plaintext, TEST_AAD).unwrap();
        let decrypted = decrypt(&key, &ciphertext, TEST_AAD).unwrap();

        assert_eq!(decrypted, plaintext);
    }

    #[test]
    fn decrypt_wrong_key_fails() {
        let key1 = [0x42u8; 32];
        let key2 = [0x43u8; 32];
        let plaintext = b"secret";

        let ciphertext = encrypt(&key1, plaintext, TEST_AAD).unwrap();
        let result = decrypt(&key2, &ciphertext, TEST_AAD);

        assert!(result.is_err());
    }

    #[test]
    fn decrypt_wrong_aad_fails() {
        let key = [0x42u8; 32];
        let plaintext = b"secret";

        let ciphertext = encrypt(&key, plaintext, b"void:commit:v1").unwrap();
        let result = decrypt(&key, &ciphertext, b"void:shard:v1");

        assert!(result.is_err(), "Decryption with wrong AAD should fail");
    }

    #[test]
    fn decrypt_tampered_fails() {
        let key = [0x42u8; 32];
        let plaintext = b"secret";

        let mut ciphertext = encrypt(&key, plaintext, TEST_AAD).unwrap();
        if let Some(byte) = ciphertext.last_mut() {
            *byte ^= 0xff;
        }

        let result = decrypt(&key, &ciphertext, TEST_AAD);
        assert!(result.is_err());
    }

    #[test]
    fn ciphertext_too_short_fails() {
        let key = [0x42u8; 32];
        let short = vec![0u8; 10];

        let result = decrypt(&key, &short, TEST_AAD);
        assert!(result.is_err());
    }

    #[test]
    fn decrypt_to_vec_roundtrip() {
        let key = [0x42u8; 32];
        let plaintext = b"hello, void!";

        let ciphertext = encrypt(&key, plaintext, TEST_AAD).unwrap();
        let decrypted = decrypt_to_vec(&key, &ciphertext, TEST_AAD).unwrap();

        assert_eq!(&decrypted, plaintext);
    }

    #[test]
    fn decrypt_and_parse_with_simple_type() {
        #[derive(serde::Serialize, serde::Deserialize, Debug, PartialEq)]
        struct TestData {
            value: u64,
            name: String,
        }

        let key = [0x42u8; 32];
        let data = TestData {
            value: 42,
            name: "test".to_string(),
        };

        let mut serialized = Vec::new();
        ciborium::into_writer(&data, &mut serialized).unwrap();
        let ciphertext = encrypt(&key, &serialized, TEST_AAD).unwrap();

        let parsed: TestData = decrypt_and_parse(&key, &ciphertext, TEST_AAD).unwrap();

        assert_eq!(parsed, data);
    }
}

#[cfg(test)]
mod proptests {
    use super::*;
    use proptest::prelude::*;

    const TEST_AAD: &[u8] = b"void:proptest:v1";

    proptest! {
        #[test]
        fn encrypt_decrypt_roundtrip(
            key in prop::array::uniform32(any::<u8>()),
            plaintext in prop::collection::vec(any::<u8>(), 0..10000)
        ) {
            let ciphertext = encrypt(&key, &plaintext, TEST_AAD).expect("encryption should succeed");
            let decrypted = decrypt(&key, &ciphertext, TEST_AAD).expect("decryption should succeed");
            prop_assert_eq!(decrypted, plaintext);
        }

        #[test]
        fn single_bit_flip_detected(
            key in prop::array::uniform32(any::<u8>()),
            plaintext in prop::collection::vec(any::<u8>(), 1..1000),
            flip_position in any::<usize>(),
            flip_bit in 0u8..8
        ) {
            let ciphertext = encrypt(&key, &plaintext, TEST_AAD).expect("encryption should succeed");
            let mut tampered = ciphertext.clone();
            let pos = flip_position % tampered.len();
            tampered[pos] ^= 1 << flip_bit;
            let result = decrypt(&key, &tampered, TEST_AAD);
            prop_assert!(result.is_err());
        }

        #[test]
        fn ciphertext_expansion(
            key in prop::array::uniform32(any::<u8>()),
            plaintext in prop::collection::vec(any::<u8>(), 0..5000)
        ) {
            let ciphertext = encrypt(&key, &plaintext, TEST_AAD).expect("encryption should succeed");
            let expected_len = plaintext.len() + 12 + 16;
            prop_assert_eq!(ciphertext.len(), expected_len);
        }

        #[test]
        fn decrypt_to_vec_matches_regular(
            key in prop::array::uniform32(any::<u8>()),
            plaintext in prop::collection::vec(any::<u8>(), 0..5000)
        ) {
            let ciphertext = encrypt(&key, &plaintext, TEST_AAD).expect("encryption should succeed");
            let regular = decrypt(&key, &ciphertext, TEST_AAD).expect("regular decryption should succeed");
            let via_to_vec = decrypt_to_vec(&key, &ciphertext, TEST_AAD).expect("decrypt_to_vec should succeed");
            prop_assert_eq!(regular, via_to_vec);
        }

        #[test]
        fn wrong_aad_fails(
            key in prop::array::uniform32(any::<u8>()),
            plaintext in prop::collection::vec(any::<u8>(), 1..1000)
        ) {
            let ciphertext = encrypt(&key, &plaintext, b"void:commit:v1").expect("encryption should succeed");
            let result = decrypt(&key, &ciphertext, b"void:shard:v1");
            prop_assert!(result.is_err());
        }
    }
}