pq_crypto-seal 0.1.0

data/ext/pq_crypto_seal/vendor/libaegis/src/raf/raf_aegis128x2.c

@@ -0,0 +1,20 @@
+#include <stddef.h>
+#include <stdint.h>
+
+#include "raf_internal.h"
+
+#include "../include/aegis128x2.h"
+
+#define VARIANT   aegis128x2
+#define KEYBYTES  aegis128x2_KEYBYTES
+#define NPUBBYTES aegis128x2_NPUBBYTES
+#define ALG_ID    AEGIS_RAF_ALG_128X2
+
+#define VARIANT_encrypt_detached aegis128x2_encrypt_detached
+#define VARIANT_decrypt_detached aegis128x2_decrypt_detached
+#define VARIANT_mac_init         aegis128x2_mac_init
+#define VARIANT_mac_update       aegis128x2_mac_update
+#define VARIANT_mac_final        aegis128x2_mac_final
+#define VARIANT_mac_verify       aegis128x2_mac_verify
+
+#include "raf_variant.h"

data/ext/pq_crypto_seal/vendor/libaegis/src/raf/raf_aegis128x4.c

@@ -0,0 +1,20 @@
+#include <stddef.h>
+#include <stdint.h>
+
+#include "raf_internal.h"
+
+#include "../include/aegis128x4.h"
+
+#define VARIANT   aegis128x4
+#define KEYBYTES  aegis128x4_KEYBYTES
+#define NPUBBYTES aegis128x4_NPUBBYTES
+#define ALG_ID    AEGIS_RAF_ALG_128X4
+
+#define VARIANT_encrypt_detached aegis128x4_encrypt_detached
+#define VARIANT_decrypt_detached aegis128x4_decrypt_detached
+#define VARIANT_mac_init         aegis128x4_mac_init
+#define VARIANT_mac_update       aegis128x4_mac_update
+#define VARIANT_mac_final        aegis128x4_mac_final
+#define VARIANT_mac_verify       aegis128x4_mac_verify
+
+#include "raf_variant.h"

data/ext/pq_crypto_seal/vendor/libaegis/src/raf/raf_aegis256.c

@@ -0,0 +1,20 @@
+#include <stddef.h>
+#include <stdint.h>
+
+#include "raf_internal.h"
+
+#include "../include/aegis256.h"
+
+#define VARIANT   aegis256
+#define KEYBYTES  aegis256_KEYBYTES
+#define NPUBBYTES aegis256_NPUBBYTES
+#define ALG_ID    AEGIS_RAF_ALG_256
+
+#define VARIANT_encrypt_detached aegis256_encrypt_detached
+#define VARIANT_decrypt_detached aegis256_decrypt_detached
+#define VARIANT_mac_init         aegis256_mac_init
+#define VARIANT_mac_update       aegis256_mac_update
+#define VARIANT_mac_final        aegis256_mac_final
+#define VARIANT_mac_verify       aegis256_mac_verify
+
+#include "raf_variant.h"

data/ext/pq_crypto_seal/vendor/libaegis/src/raf/raf_aegis256x2.c

@@ -0,0 +1,20 @@
+#include <stddef.h>
+#include <stdint.h>
+
+#include "raf_internal.h"
+
+#include "../include/aegis256x2.h"
+
+#define VARIANT   aegis256x2
+#define KEYBYTES  aegis256x2_KEYBYTES
+#define NPUBBYTES aegis256x2_NPUBBYTES
+#define ALG_ID    AEGIS_RAF_ALG_256X2
+
+#define VARIANT_encrypt_detached aegis256x2_encrypt_detached
+#define VARIANT_decrypt_detached aegis256x2_decrypt_detached
+#define VARIANT_mac_init         aegis256x2_mac_init
+#define VARIANT_mac_update       aegis256x2_mac_update
+#define VARIANT_mac_final        aegis256x2_mac_final
+#define VARIANT_mac_verify       aegis256x2_mac_verify
+
+#include "raf_variant.h"

data/ext/pq_crypto_seal/vendor/libaegis/src/raf/raf_aegis256x4.c

@@ -0,0 +1,20 @@
+#include <stddef.h>
+#include <stdint.h>
+
+#include "raf_internal.h"
+
+#include "../include/aegis256x4.h"
+
+#define VARIANT   aegis256x4
+#define KEYBYTES  aegis256x4_KEYBYTES
+#define NPUBBYTES aegis256x4_NPUBBYTES
+#define ALG_ID    AEGIS_RAF_ALG_256X4
+
+#define VARIANT_encrypt_detached aegis256x4_encrypt_detached
+#define VARIANT_decrypt_detached aegis256x4_decrypt_detached
+#define VARIANT_mac_init         aegis256x4_mac_init
+#define VARIANT_mac_update       aegis256x4_mac_update
+#define VARIANT_mac_final        aegis256x4_mac_final
+#define VARIANT_mac_verify       aegis256x4_mac_verify
+
+#include "raf_variant.h"

data/ext/pq_crypto_seal/vendor/libaegis/src/raf/raf_internal.h

@@ -0,0 +1,152 @@
+#ifndef raf_internal_H
+#define raf_internal_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "../common/common.h"
+#include "../include/aegis_raf.h"
+#include "raf_merkle.h"
+
+#ifndef EBADMSG
+#    define EBADMSG 77
+#endif
+
+#ifndef EINVAL
+#    define EINVAL 22
+#endif
+
+#ifndef EEXIST
+#    define EEXIST 17
+#endif
+
+#ifndef ENOENT
+#    define ENOENT 2
+#endif
+
+#ifndef ENOMEM
+#    define ENOMEM 12
+#endif
+
+#ifndef EOVERFLOW
+#    define EOVERFLOW 75
+#endif
+
+#ifndef ENOTSUP
+#    define ENOTSUP 95
+#endif
+
+static const uint8_t AEGIS_RAF_MAGIC[8] = { 'A', 'E', 'G', 'I', 'S', 'R', 'A', 'F' };
+
+#define AEGIS_RAF_VERSION 1
+
+typedef struct aegis_raf_ctx_internal {
+    aegis_raf_io            io;
+    aegis_raf_rng           rng;
+    uint8_t                *scratch_buf;
+    size_t                  scratch_len;
+    uint8_t                *record_buf;
+    uint8_t                *chunk_buf;
+    size_t                  record_buf_size;
+    size_t                  chunk_buf_size;
+    size_t                  keybytes;
+    size_t                  npubbytes;
+    aegis_raf_merkle_config merkle_cfg;
+    uint64_t                file_size;
+    uint8_t                 enc_key[32];
+    uint8_t                 hdr_key[32];
+    uint8_t                 file_id[AEGIS_RAF_FILE_ID_BYTES];
+    uint32_t                chunk_size;
+    int                     merkle_enabled;
+    uint8_t                 alg_id;
+    uint8_t                 version;
+} aegis_raf_ctx_internal;
+
+#define LOAD64_LE(SRC) load64_le(SRC)
+static inline uint64_t
+load64_le(const uint8_t src[8])
+{
+#ifdef NATIVE_LITTLE_ENDIAN
+    uint64_t w;
+    memcpy(&w, src, sizeof w);
+    return w;
+#else
+    uint64_t w = (uint64_t) src[0];
+    w |= (uint64_t) src[1] << 8;
+    w |= (uint64_t) src[2] << 16;
+    w |= (uint64_t) src[3] << 24;
+    w |= (uint64_t) src[4] << 32;
+    w |= (uint64_t) src[5] << 40;
+    w |= (uint64_t) src[6] << 48;
+    w |= (uint64_t) src[7] << 56;
+    return w;
+#endif
+}
+
+#define STORE64_LE(DST, W) store64_le((DST), (W))
+static inline void
+store64_le(uint8_t dst[8], uint64_t w)
+{
+#ifdef NATIVE_LITTLE_ENDIAN
+    memcpy(dst, &w, sizeof w);
+#else
+    dst[0] = (uint8_t) w;
+    w >>= 8;
+    dst[1] = (uint8_t) w;
+    w >>= 8;
+    dst[2] = (uint8_t) w;
+    w >>= 8;
+    dst[3] = (uint8_t) w;
+    w >>= 8;
+    dst[4] = (uint8_t) w;
+    w >>= 8;
+    dst[5] = (uint8_t) w;
+    w >>= 8;
+    dst[6] = (uint8_t) w;
+    w >>= 8;
+    dst[7] = (uint8_t) w;
+#endif
+}
+
+#define STORE16_LE(DST, W) store16_le((DST), (W))
+static inline void
+store16_le(uint8_t dst[2], uint16_t w)
+{
+    dst[0] = (uint8_t) w;
+    dst[1] = (uint8_t) (w >> 8);
+}
+
+#define LOAD16_LE(SRC) load16_le(SRC)
+static inline uint16_t
+load16_le(const uint8_t src[2])
+{
+    return (uint16_t) src[0] | ((uint16_t) src[1] << 8);
+}
+
+#define AAD_BYTES (AEGIS_RAF_FILE_ID_BYTES + 8 + 4)
+
+static inline void
+build_aad(uint8_t aad[AAD_BYTES], const uint8_t file_id[AEGIS_RAF_FILE_ID_BYTES],
+          uint64_t chunk_idx, uint32_t chunk_size)
+{
+    memcpy(aad, file_id, AEGIS_RAF_FILE_ID_BYTES);
+    STORE64_LE(aad + AEGIS_RAF_FILE_ID_BYTES, chunk_idx);
+    STORE32_LE(aad + AEGIS_RAF_FILE_ID_BYTES + 8, chunk_size);
+}
+
+static inline void
+build_commitment_context(uint8_t       out[AEGIS_RAF_COMMITMENT_CONTEXT_BYTES],
+                         uint8_t       version,
+                         uint8_t       alg_id,
+                         uint32_t      chunk_size,
+                         const uint8_t file_id[AEGIS_RAF_FILE_ID_BYTES])
+{
+    out[0] = version;
+    out[1] = alg_id;
+    STORE32_LE(out + 2, chunk_size);
+    memcpy(out + 6, file_id, AEGIS_RAF_FILE_ID_BYTES);
+    out[30] = 0;
+    out[31] = 0;
+}
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/raf/raf_merkle.c

@@ -0,0 +1,268 @@
+#include "raf_merkle.h"
+#include "raf_internal.h"
+
+uint64_t
+raf_merkle_level_node_count(uint64_t max_chunks, uint32_t level)
+{
+    uint64_t count = max_chunks;
+    uint32_t i     = 0;
+
+    if (max_chunks == 0) {
+        return 0;
+    }
+
+    while (1) {
+        if (i == level) {
+            return count;
+        }
+        if (count <= 1) {
+            return 0;
+        }
+        count = (count + 1) / 2;
+        i++;
+    }
+}
+
+size_t
+aegis_raf_merkle_buffer_size(const aegis_raf_merkle_config *cfg)
+{
+    uint64_t total_nodes = 0;
+    uint64_t count;
+    uint64_t size;
+
+    if (cfg == NULL || cfg->max_chunks == 0 || cfg->hash_len == 0) {
+        return 0;
+    }
+
+    count = cfg->max_chunks;
+    while (count > 0) {
+        if (total_nodes > UINT64_MAX - count) {
+            return SIZE_MAX;
+        }
+        total_nodes += count;
+        if (count == 1) {
+            break;
+        }
+        count = (count + 1) / 2;
+    }
+
+    if (total_nodes > SIZE_MAX / cfg->hash_len) {
+        return SIZE_MAX;
+    }
+    size = total_nodes * cfg->hash_len;
+    if (size > SIZE_MAX) {
+        return SIZE_MAX;
+    }
+
+    return (size_t) size;
+}
+
+size_t
+raf_merkle_level_offset(uint64_t max_chunks, uint32_t hash_len, uint32_t level)
+{
+    size_t   offset = 0;
+    uint64_t count  = max_chunks;
+    uint32_t i;
+
+    if (max_chunks == 0 || hash_len == 0) {
+        return 0;
+    }
+
+    for (i = 0; i < level && count > 0; i++) {
+        offset += (size_t) (count * hash_len);
+        if (count == 1) {
+            break;
+        }
+        count = (count + 1) / 2;
+    }
+
+    return offset;
+}
+
+size_t
+raf_merkle_node_offset(uint64_t max_chunks, uint32_t hash_len, uint32_t level, uint64_t node_idx)
+{
+    size_t level_off = raf_merkle_level_offset(max_chunks, hash_len, level);
+    return level_off + (size_t) (node_idx * hash_len);
+}
+
+static size_t
+aegis_raf_merkle_leaf_offset(const aegis_raf_merkle_config *cfg, uint64_t chunk_idx)
+{
+    if (cfg == NULL || chunk_idx >= cfg->max_chunks) {
+        return 0;
+    }
+    return (size_t) (chunk_idx * cfg->hash_len);
+}
+
+int
+aegis_raf_merkle_config_validate(const aegis_raf_merkle_config *cfg)
+{
+    size_t required;
+
+    if (cfg == NULL) {
+        errno = EINVAL;
+        return -1;
+    }
+
+    if (cfg->buf == NULL || cfg->max_chunks == 0) {
+        errno = EINVAL;
+        return -1;
+    }
+    if (cfg->hash_len < AEGIS_RAF_MERKLE_HASH_MIN || cfg->hash_len > AEGIS_RAF_MERKLE_HASH_MAX) {
+        errno = EINVAL;
+        return -1;
+    }
+
+    if (cfg->hash_leaf == NULL || cfg->hash_parent == NULL || cfg->hash_empty == NULL ||
+        cfg->hash_commitment == NULL) {
+        errno = EINVAL;
+        return -1;
+    }
+
+    required = aegis_raf_merkle_buffer_size(cfg);
+    if (required == SIZE_MAX || cfg->len < required) {
+        errno = EINVAL;
+        return -1;
+    }
+
+    return 0;
+}
+
+int
+raf_merkle_update_leaf(const aegis_raf_merkle_config *cfg, const uint8_t *chunk_data,
+                       size_t chunk_len, uint64_t chunk_idx)
+{
+    size_t leaf_off;
+
+    if (cfg == NULL || chunk_idx >= cfg->max_chunks) {
+        errno = EINVAL;
+        return -1;
+    }
+
+    leaf_off = aegis_raf_merkle_leaf_offset(cfg, chunk_idx);
+
+    return cfg->hash_leaf(cfg->user, cfg->buf + leaf_off, cfg->hash_len, chunk_data, chunk_len,
+                          chunk_idx);
+}
+
+int
+raf_merkle_clear_leaf(const aegis_raf_merkle_config *cfg, uint64_t chunk_idx)
+{
+    size_t leaf_off;
+
+    if (cfg == NULL || chunk_idx >= cfg->max_chunks) {
+        errno = EINVAL;
+        return -1;
+    }
+
+    leaf_off = aegis_raf_merkle_leaf_offset(cfg, chunk_idx);
+
+    return cfg->hash_empty(cfg->user, cfg->buf + leaf_off, cfg->hash_len, 0, chunk_idx);
+}
+
+int
+raf_merkle_update_parents(const aegis_raf_merkle_config *cfg, uint64_t first_chunk,
+                          uint64_t last_chunk)
+{
+    uint32_t levels;
+    uint32_t level;
+    uint64_t first_idx;
+    uint64_t last_idx;
+    uint64_t level_count;
+    uint64_t i;
+    size_t   left_off;
+    size_t   right_off;
+    size_t   parent_off;
+    uint8_t  empty_hash[AEGIS_RAF_MERKLE_HASH_MAX];
+    int      ret;
+
+    if (cfg == NULL || first_chunk > last_chunk || last_chunk >= cfg->max_chunks) {
+        errno = EINVAL;
+        return -1;
+    }
+
+    levels = aegis_raf_merkle_level_count(cfg);
+    if (levels <= 1) {
+        return 0;
+    }
+
+    first_idx = first_chunk;
+    last_idx  = last_chunk;
+
+    for (level = 0; level < levels - 1; level++) {
+        level_count = raf_merkle_level_node_count(cfg->max_chunks, level);
+
+        first_idx = first_idx / 2;
+        last_idx  = last_idx / 2;
+
+        for (i = first_idx; i <= last_idx; i++) {
+            uint64_t left_child  = i * 2;
+            uint64_t right_child = i * 2 + 1;
+
+            left_off = raf_merkle_node_offset(cfg->max_chunks, cfg->hash_len, level, left_child);
+
+            if (right_child < level_count) {
+                right_off =
+                    raf_merkle_node_offset(cfg->max_chunks, cfg->hash_len, level, right_child);
+
+                parent_off = raf_merkle_node_offset(cfg->max_chunks, cfg->hash_len, level + 1, i);
+
+                ret = cfg->hash_parent(cfg->user, cfg->buf + parent_off, cfg->hash_len,
+                                       cfg->buf + left_off, cfg->buf + right_off, level, i);
+            } else {
+                ret = cfg->hash_empty(cfg->user, empty_hash, cfg->hash_len, level, right_child);
+                if (ret != 0) {
+                    return ret;
+                }
+
+                parent_off = raf_merkle_node_offset(cfg->max_chunks, cfg->hash_len, level + 1, i);
+
+                ret = cfg->hash_parent(cfg->user, cfg->buf + parent_off, cfg->hash_len,
+                                       cfg->buf + left_off, empty_hash, level, i);
+            }
+
+            if (ret != 0) {
+                return ret;
+            }
+        }
+    }
+
+    return 0;
+}
+
+int
+raf_merkle_update_chunk(const aegis_raf_merkle_config *cfg, const uint8_t *chunk_data,
+                        size_t chunk_len, uint64_t chunk_idx)
+{
+    int ret;
+
+    ret = raf_merkle_update_leaf(cfg, chunk_data, chunk_len, chunk_idx);
+    if (ret != 0) {
+        return ret;
+    }
+
+    return raf_merkle_update_parents(cfg, chunk_idx, chunk_idx);
+}
+
+int
+raf_merkle_clear_range(const aegis_raf_merkle_config *cfg, uint64_t first_chunk,
+                       uint64_t last_chunk)
+{
+    uint64_t i;
+    int      ret;
+
+    if (cfg == NULL || first_chunk > last_chunk || last_chunk >= cfg->max_chunks) {
+        errno = EINVAL;
+        return -1;
+    }
+
+    for (i = first_chunk; i <= last_chunk; i++) {
+        ret = raf_merkle_clear_leaf(cfg, i);
+        if (ret != 0) {
+            return ret;
+        }
+    }
+
+    return raf_merkle_update_parents(cfg, first_chunk, last_chunk);
+}

data/ext/pq_crypto_seal/vendor/libaegis/src/raf/raf_merkle.h

@@ -0,0 +1,165 @@
+#ifndef raf_merkle_H
+#define raf_merkle_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "../common/common.h"
+#include "../include/aegis_raf.h"
+
+/*
+ * Internal Merkle tree helpers for RAF.
+ *
+ * The Merkle buffer stores nodes level by level:
+ *   Level 0: max_chunks leaves (one per chunk)
+ *   Level 1: ceil(max_chunks / 2) nodes
+ *   ...
+ *   Level L-1: 1 node (root)
+ *
+ * Each node is hash_len bytes. Levels are stored consecutively without padding.
+ */
+
+/*
+ * Returns the number of nodes at the given level for a tree with max_chunks leaves.
+ * Level 0 has max_chunks nodes; each subsequent level has ceil(prev / 2).
+ */
+uint64_t raf_merkle_level_node_count(uint64_t max_chunks, uint32_t level);
+
+/*
+ * Returns the byte offset of the start of the given level within the buffer.
+ */
+size_t raf_merkle_level_offset(uint64_t max_chunks, uint32_t hash_len, uint32_t level);
+
+/*
+ * Returns the byte offset of a specific node within the buffer.
+ * node_idx is relative to the start of the level.
+ */
+size_t raf_merkle_node_offset(uint64_t max_chunks, uint32_t hash_len, uint32_t level,
+                              uint64_t node_idx);
+
+/*
+ * Update a single leaf hash. Computes hash_leaf for the given chunk data and
+ * stores it at the appropriate position in the buffer.
+ *
+ * chunk_data:    Plaintext chunk contents (may be less than chunk_size for final chunk).
+ * chunk_len:     Actual length of chunk data (plaintext bytes in this chunk).
+ * chunk_idx:     Index of the chunk (0-based).
+ * cfg:           Merkle configuration with buffer and callbacks.
+ *
+ * Returns 0 on success, -1 on error.
+ */
+int raf_merkle_update_leaf(const aegis_raf_merkle_config *cfg, const uint8_t *chunk_data,
+                           size_t chunk_len, uint64_t chunk_idx);
+
+/*
+ * Mark a leaf as empty. Computes hash_empty for the given chunk index and
+ * stores it at the appropriate position in the buffer.
+ *
+ * chunk_idx:     Index of the chunk to mark as empty.
+ * cfg:           Merkle configuration with buffer and callbacks.
+ *
+ * Returns 0 on success, -1 on error.
+ */
+int raf_merkle_clear_leaf(const aegis_raf_merkle_config *cfg, uint64_t chunk_idx);
+
+/*
+ * Update parents from the given range of leaves up to the root.
+ * Call this after updating one or more consecutive leaves.
+ *
+ * first_chunk:   First leaf index in the updated range.
+ * last_chunk:    Last leaf index in the updated range (inclusive).
+ * cfg:           Merkle configuration with buffer and callbacks.
+ *
+ * Returns 0 on success, -1 on error.
+ */
+int raf_merkle_update_parents(const aegis_raf_merkle_config *cfg, uint64_t first_chunk,
+                              uint64_t last_chunk);
+
+/*
+ * Update a single leaf and propagate changes to the root.
+ * Convenience wrapper that calls update_leaf then update_parents.
+ *
+ * Returns 0 on success, -1 on error.
+ */
+int raf_merkle_update_chunk(const aegis_raf_merkle_config *cfg, const uint8_t *chunk_data,
+                            size_t chunk_len, uint64_t chunk_idx);
+
+/*
+ * Clear a range of leaves (mark as empty) and propagate changes to the root.
+ * Used when shrinking a file to invalidate leaves beyond the new EOF.
+ *
+ * first_chunk:   First leaf index to clear.
+ * last_chunk:    Last leaf index to clear (inclusive).
+ * cfg:           Merkle configuration with buffer and callbacks.
+ *
+ * Returns 0 on success, -1 on error.
+ */
+int raf_merkle_clear_range(const aegis_raf_merkle_config *cfg, uint64_t first_chunk,
+                           uint64_t last_chunk);
+
+/*
+ * Validate a Merkle configuration. Returns 0 if valid, -1 with errno set if not.
+ * Checks that buf is non-NULL, hash_len > 0, max_chunks > 0, all callbacks are
+ * provided, and the buffer is large enough.
+ */
+int aegis_raf_merkle_config_validate(const aegis_raf_merkle_config *cfg);
+
+static inline uint32_t
+aegis_raf_merkle_level_count(const aegis_raf_merkle_config *cfg)
+{
+    uint32_t levels = 0;
+    uint64_t count;
+
+    if (cfg == NULL || cfg->max_chunks == 0) {
+        return 0;
+    }
+
+    count = cfg->max_chunks;
+    while (count > 0) {
+        levels++;
+        if (count == 1) {
+            break;
+        }
+        count = (count + 1) / 2;
+    }
+
+    return levels;
+}
+
+static inline int
+aegis_raf_merkle_root(const aegis_raf_merkle_config *cfg, uint8_t *out, size_t out_len,
+                      const uint8_t *ctx, size_t ctx_len, uint64_t file_size)
+{
+    uint32_t       levels;
+    size_t         root_offset;
+    const uint8_t *structural_root;
+
+    if (cfg == NULL || cfg->buf == NULL || cfg->max_chunks == 0) {
+        errno = EINVAL;
+        return -1;
+    }
+    if (out == NULL || out_len < cfg->hash_len) {
+        errno = EINVAL;
+        return -1;
+    }
+    if (cfg->hash_commitment == NULL) {
+        errno = EINVAL;
+        return -1;
+    }
+    if (ctx == NULL && ctx_len > 0) {
+        errno = EINVAL;
+        return -1;
+    }
+    if (ctx_len == 0) {
+        ctx = NULL;
+    }
+
+    levels          = aegis_raf_merkle_level_count(cfg);
+    root_offset     = raf_merkle_level_offset(cfg->max_chunks, cfg->hash_len, levels - 1);
+    structural_root = cfg->buf + root_offset;
+
+    return cfg->hash_commitment(cfg->user, out, cfg->hash_len, structural_root, ctx, ctx_len,
+                                file_size);
+}
+
+#endif