1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
|
#ifndef HYBBX_CRYPTO_H
#define HYBBX_CRYPTO_H
#include "hybbx/types.h"
#include <stddef.h>
#include <stdint.h>
#ifdef __cplusplus
extern "C" {
#endif
/**
* HyBBX reversible cryptography.
*
* Defaults use bundled in-tree sources (tinyaes, monocypher). Backends are
* selectable system-wide via `[crypto]` in hybbx.ini when optional OpenSSL or
* libsodium support is enabled at build time (see hybbx/crypto_config.h).
*
* Three modern AEAD schemes:
* 1. AES-256-GCM (NIST, TLS, IPsec)
* 2. XChaCha20-Poly1305 (extended-nonce ChaCha, Monocypher)
* 3. X25519 + XChaCha20-Poly1305 sealed messages (ECIES-style, Monocypher)
*
* Password hashing (one-way) remains in hybbx/password.h (SHA-256 / MD5).
*/
typedef enum hybbx_crypto_alg {
HYBBX_CRYPTO_AES_256_GCM = 1,
HYBBX_CRYPTO_XCHACHA20_POLY1305 = 2,
HYBBX_CRYPTO_X25519_AEAD = 3
} hybbx_crypto_alg_t;
#define HYBBX_CRYPTO_KEY_SIZE 32
#define HYBBX_CRYPTO_TAG_SIZE 16
#define HYBBX_CRYPTO_AES_GCM_NONCE 12
#define HYBBX_CRYPTO_XCHACHA_NONCE 24
#define HYBBX_CRYPTO_X25519_PUBLIC_KEY 32
#define HYBBX_CRYPTO_X25519_SECRET_KEY 32
/** Sealed blob overhead: ephemeral_pk(32) + nonce(24) + tag(16). */
#define HYBBX_CRYPTO_X25519_SEAL_OVERHEAD 72
/** Fill @p buf with system random bytes. */
hybbx_result_t hybbx_crypto_random(uint8_t *buf, size_t len);
/** Human-readable cipher name. */
const char *hybbx_crypto_alg_name(hybbx_crypto_alg_t alg);
/** Required nonce length for @p alg (0 for X25519 sealed mode). */
size_t hybbx_crypto_nonce_size(hybbx_crypto_alg_t alg);
/**
* Symmetric AEAD encrypt (algorithms 1 and 2).
* @p ciphertext length equals @p plaintext_len; authentication tag is separate.
*/
hybbx_result_t hybbx_crypto_encrypt(hybbx_crypto_alg_t alg,
const uint8_t key[HYBBX_CRYPTO_KEY_SIZE],
const uint8_t *nonce, size_t nonce_len,
const uint8_t *aad, size_t aad_len,
const uint8_t *plaintext,
size_t plaintext_len,
uint8_t *ciphertext,
uint8_t tag[HYBBX_CRYPTO_TAG_SIZE]);
/** Symmetric AEAD decrypt; returns HYBBX_ERR_DENIED when the tag is invalid. */
hybbx_result_t hybbx_crypto_decrypt(hybbx_crypto_alg_t alg,
const uint8_t key[HYBBX_CRYPTO_KEY_SIZE],
const uint8_t *nonce, size_t nonce_len,
const uint8_t *aad, size_t aad_len,
const uint8_t *ciphertext,
size_t ciphertext_len,
uint8_t *plaintext,
const uint8_t tag[HYBBX_CRYPTO_TAG_SIZE]);
/** Generate an X25519 key pair (Montgomery curve, RFC 7748). */
hybbx_result_t hybbx_crypto_x25519_keypair(
uint8_t public_key[HYBBX_CRYPTO_X25519_PUBLIC_KEY],
uint8_t secret_key[HYBBX_CRYPTO_X25519_SECRET_KEY]);
/**
* Asymmetric seal for @p recipient_pk.
* Output: ephemeral_pk || nonce || ciphertext || tag.
*/
hybbx_result_t hybbx_crypto_x25519_seal(
const uint8_t recipient_pk[HYBBX_CRYPTO_X25519_PUBLIC_KEY],
const uint8_t *aad, size_t aad_len,
const uint8_t *plaintext, size_t plaintext_len,
uint8_t *sealed, size_t *sealed_len, size_t sealed_cap);
/** Open a sealed message with @p recipient_sk. */
hybbx_result_t hybbx_crypto_x25519_open(
const uint8_t recipient_sk[HYBBX_CRYPTO_X25519_SECRET_KEY],
const uint8_t *aad, size_t aad_len,
const uint8_t *sealed, size_t sealed_len,
uint8_t *plaintext, size_t *plaintext_len, size_t plaintext_cap);
#ifdef __cplusplus
}
#endif
#endif /* HYBBX_CRYPTO_H */
|
