From 20cb29c2f8c5c87bc590896854a20b1473ceb358 Mon Sep 17 00:00:00 2001 From: "info@mode42.com" Date: Sat, 8 Aug 2026 03:54:55 +0000 Subject: #2 --- include/hybbx/crypto.h | 101 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 101 insertions(+) create mode 100644 include/hybbx/crypto.h (limited to 'include/hybbx/crypto.h') diff --git a/include/hybbx/crypto.h b/include/hybbx/crypto.h new file mode 100644 index 0000000..5411e5e --- /dev/null +++ b/include/hybbx/crypto.h @@ -0,0 +1,101 @@ +#ifndef HYBBX_CRYPTO_H +#define HYBBX_CRYPTO_H + +#include "hybbx/types.h" + +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * HyBBX reversible cryptography. + * + * Defaults use bundled in-tree sources (tinyaes, monocypher). Backends are + * selectable system-wide via `[crypto]` in hybbx.ini when optional OpenSSL or + * libsodium support is enabled at build time (see hybbx/crypto_config.h). + * + * Three modern AEAD schemes: + * 1. AES-256-GCM (NIST, TLS, IPsec) + * 2. XChaCha20-Poly1305 (extended-nonce ChaCha, Monocypher) + * 3. X25519 + XChaCha20-Poly1305 sealed messages (ECIES-style, Monocypher) + * + * Password hashing (one-way) remains in hybbx/password.h (SHA-256 / MD5). + */ + +typedef enum hybbx_crypto_alg { + HYBBX_CRYPTO_AES_256_GCM = 1, + HYBBX_CRYPTO_XCHACHA20_POLY1305 = 2, + HYBBX_CRYPTO_X25519_AEAD = 3 +} hybbx_crypto_alg_t; + +#define HYBBX_CRYPTO_KEY_SIZE 32 +#define HYBBX_CRYPTO_TAG_SIZE 16 +#define HYBBX_CRYPTO_AES_GCM_NONCE 12 +#define HYBBX_CRYPTO_XCHACHA_NONCE 24 +#define HYBBX_CRYPTO_X25519_PUBLIC_KEY 32 +#define HYBBX_CRYPTO_X25519_SECRET_KEY 32 +/** Sealed blob overhead: ephemeral_pk(32) + nonce(24) + tag(16). */ +#define HYBBX_CRYPTO_X25519_SEAL_OVERHEAD 72 + +/** Fill @p buf with system random bytes. */ +hybbx_result_t hybbx_crypto_random(uint8_t *buf, size_t len); + +/** Human-readable cipher name. */ +const char *hybbx_crypto_alg_name(hybbx_crypto_alg_t alg); + +/** Required nonce length for @p alg (0 for X25519 sealed mode). */ +size_t hybbx_crypto_nonce_size(hybbx_crypto_alg_t alg); + +/** + * Symmetric AEAD encrypt (algorithms 1 and 2). + * @p ciphertext length equals @p plaintext_len; authentication tag is separate. + */ +hybbx_result_t hybbx_crypto_encrypt(hybbx_crypto_alg_t alg, + const uint8_t key[HYBBX_CRYPTO_KEY_SIZE], + const uint8_t *nonce, size_t nonce_len, + const uint8_t *aad, size_t aad_len, + const uint8_t *plaintext, + size_t plaintext_len, + uint8_t *ciphertext, + uint8_t tag[HYBBX_CRYPTO_TAG_SIZE]); + +/** Symmetric AEAD decrypt; returns HYBBX_ERR_DENIED when the tag is invalid. */ +hybbx_result_t hybbx_crypto_decrypt(hybbx_crypto_alg_t alg, + const uint8_t key[HYBBX_CRYPTO_KEY_SIZE], + const uint8_t *nonce, size_t nonce_len, + const uint8_t *aad, size_t aad_len, + const uint8_t *ciphertext, + size_t ciphertext_len, + uint8_t *plaintext, + const uint8_t tag[HYBBX_CRYPTO_TAG_SIZE]); + +/** Generate an X25519 key pair (Montgomery curve, RFC 7748). */ +hybbx_result_t hybbx_crypto_x25519_keypair( + uint8_t public_key[HYBBX_CRYPTO_X25519_PUBLIC_KEY], + uint8_t secret_key[HYBBX_CRYPTO_X25519_SECRET_KEY]); + +/** + * Asymmetric seal for @p recipient_pk. + * Output: ephemeral_pk || nonce || ciphertext || tag. + */ +hybbx_result_t hybbx_crypto_x25519_seal( + const uint8_t recipient_pk[HYBBX_CRYPTO_X25519_PUBLIC_KEY], + const uint8_t *aad, size_t aad_len, + const uint8_t *plaintext, size_t plaintext_len, + uint8_t *sealed, size_t *sealed_len, size_t sealed_cap); + +/** Open a sealed message with @p recipient_sk. */ +hybbx_result_t hybbx_crypto_x25519_open( + const uint8_t recipient_sk[HYBBX_CRYPTO_X25519_SECRET_KEY], + const uint8_t *aad, size_t aad_len, + const uint8_t *sealed, size_t sealed_len, + uint8_t *plaintext, size_t *plaintext_len, size_t plaintext_cap); + +#ifdef __cplusplus +} +#endif + +#endif /* HYBBX_CRYPTO_H */ -- cgit v1.3.1