pq_crypto-seal 0.1.0

data/lib/pq_crypto/seal.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require "pq_crypto"
+require "pq_crypto/seal/version"
+require "pq_crypto/seal/errors"
+require "pq_crypto/seal/native"
+require "pq_crypto/seal/binary"
+require "pq_crypto/seal/padding"
+require "pq_crypto/seal/format"
+require "pq_crypto/seal/core"
+require "pq_crypto/seal/io"
+
+module PQCrypto
+  module Seal
+    IO_DELEGATES = %i[
+      encrypt_io decrypt_io encrypt_frame_io decrypt_frame_io
+      encrypt_file decrypt_file rebuild_recipients_file
+      add_recipient_file drop_recipient_stanza_file rotate_dek_file
+      inspect_file
+    ].freeze
+
+    class << self
+      IO_DELEGATES.each do |name|
+        define_method(name) do |*args, **kwargs|
+          IOAPI.public_send(name, *args, **kwargs)
+        end
+      end
+    end
+
+    private_constant :Native
+  end
+end

data/pq_crypto-seal.gemspec

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require_relative "lib/pq_crypto/seal/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "pq_crypto-seal"
+  spec.version = PQCrypto::Seal::VERSION
+  spec.authors = ["Roman Khaidarov"]
+  spec.email = ["roman-haidarov@users.noreply.github.com"]
+
+  spec.summary = "Post-quantum envelope encryption for Ruby"
+  spec.description = "Versioned multi-recipient document encryption using PQCrypto hybrid KEM, HKDF-SHA256, and vendored AEGIS-256."
+  spec.homepage = "https://github.com/roman-haidarov/pq_crypto-seal"
+  spec.license = "MIT"
+  spec.required_ruby_version = Gem::Requirement.new(">= 2.7.1")
+
+  spec.metadata["source_code_uri"] = spec.homepage
+  spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/main/CHANGELOG.md"
+
+  spec.files = Dir.chdir(__dir__) do
+    Dir["{lib,ext,test,script,fuzz,.github}/**/*", "pq_crypto-seal.gemspec", "Gemfile", "Rakefile", "README.md", "GET_STARTED.md", "FORMAT.md", "SECURITY.md", "RELEASING.md", "CHANGELOG.md", "LICENSE.txt", "VENDORING.md"]
+      .select { |path| File.file?(path) }
+      .reject do |path|
+        path.match?(/(?:\.o|\.so|\.bundle|\.gem)\z/) ||
+          path.end_with?("/Makefile", "/mkmf.log") ||
+          path.include?("/.DS_Store") || false
+      end
+  end
+  spec.bindir = "exe"
+  spec.require_paths = ["lib"]
+  spec.extensions = ["ext/pq_crypto_seal/extconf.rb"]
+
+  spec.add_runtime_dependency "pq_crypto", "~> 0.6.4"
+  spec.add_development_dependency "minitest", "~> 5.14"
+  spec.add_development_dependency "rake", "~> 13.0"
+  spec.add_development_dependency "rake-compiler", "~> 1.2"
+end

data/script/vendor_libs.rb

@@ -0,0 +1,79 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "net/http"
+require "tmpdir"
+require "uri"
+
+ROOT = File.expand_path("..", __dir__)
+VENDOR = File.join(ROOT, "ext/pq_crypto_seal/vendor/libaegis")
+VERSION = "0.10.3"
+URL = "https://github.com/aegis-aead/libaegis/archive/refs/tags/#{VERSION}.tar.gz"
+ARCHIVE_SHA256 = "2f2682c1d08d9a5510caca1c82e3f8ea91f7085fef2ecbed0c398b2a921c79b1"
+TREE_SHA256_FILE = File.join(VENDOR, "TREE_SHA256")
+
+def download(uri, limit = 5)
+  abort "too many redirects while downloading libaegis" if limit <= 0
+  response = Net::HTTP.get_response(uri)
+  case response
+  when Net::HTTPSuccess
+    response.body
+  when Net::HTTPRedirection
+    location = response["location"]
+    abort "download redirect without Location" unless location
+    download(URI.join(uri.to_s, location), limit - 1)
+  else
+    abort "download failed: HTTP #{response.code}"
+  end
+end
+
+def tree_sha256(directory)
+  digest = Digest::SHA256.new
+  Dir.chdir(directory) do
+    Dir.glob("**/*", File::FNM_DOTMATCH).sort.each do |path|
+      next if path == "." || path == ".." || path == "TREE_SHA256"
+      next unless File.file?(path)
+      bytes = File.binread(path)
+      digest << [path.bytesize].pack("N") << path.b
+      digest << [bytes.bytesize].pack("Q>") << bytes
+    end
+  end
+  digest.hexdigest
+end
+
+def verify!
+  expected = File.read(TREE_SHA256_FILE).strip
+  actual = tree_sha256(VENDOR)
+  abort "libaegis vendor tree mismatch\nexpected: #{expected}\nactual:   #{actual}" unless actual == expected
+  puts "libaegis #{VERSION} vendor tree verified: #{actual}"
+end
+
+def update!
+  Dir.mktmpdir("libaegis") do |tmp|
+    archive = File.join(tmp, "libaegis.tar.gz")
+    uri = URI(URL)
+    File.binwrite(archive, download(uri))
+    actual = Digest::SHA256.file(archive).hexdigest
+    abort "archive checksum mismatch: #{actual}" unless actual == ARCHIVE_SHA256
+    abort "tar extraction failed" unless system("tar", "-xzf", archive, "-C", tmp)
+    extracted = Dir[File.join(tmp, "libaegis-*")].find { |path| File.directory?(path) }
+    abort "extracted libaegis directory not found" unless extracted
+    FileUtils.rm_rf(VENDOR)
+    FileUtils.mkdir_p(VENDOR)
+    FileUtils.cp_r(File.join(extracted, "src"), VENDOR)
+    FileUtils.cp(File.join(extracted, "LICENSE"), VENDOR)
+    File.write(TREE_SHA256_FILE, tree_sha256(VENDOR) + "\n")
+  end
+  verify!
+end
+
+case ARGV.first
+when nil, "--check"
+  verify!
+when "--update"
+  update!
+else
+  abort "usage: #{$PROGRAM_NAME} [--check|--update]"
+end

data/test/aegis_vectors_test.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+require_relative "test_helper"
+
+class AegisVectorsTest < Minitest::Test
+  def native
+    PQCrypto::Seal.const_get(:Native, false)
+  end
+
+  KEY = ["1001000000000000000000000000000000000000000000000000000000000000"].pack("H*")
+  NONCE = ["1000020000000000000000000000000000000000000000000000000000000000"].pack("H*")
+
+  POSITIVE = [
+    ["", "00000000000000000000000000000000", "754fc3d8c973246dcc6d741412a4b236", "1181a1d18091082bf0266f66297d167d2e68b845f61a3b0527d31fc7b7b89f13"],
+    ["", "", "", "6a348c930adbd654896e1666aad67de989ea75ebaa2b82fb588977b1ffec864a"],
+    ["0001020304050607", "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "f373079ed84b2709faee373584585d60accd191db310ef5d8b11833df9dec711", "b7d28d0c3c0ebd409fd22b44160503073a547412da0854bfb9723020dab8da1a"],
+    ["0001020304050607", "000102030405060708090a0b0c0d", "f373079ed84b2709faee37358458", "8c1cc703c81281bee3f6d9966e14948b4a175b2efbdc31e61a98b4465235c2d9"],
+    ["000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20212223242526272829", "101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637", "57754a7d09963e7c787583a2e7b859bb24fa1e04d49fd550b2511a358e3bca252a9b1b8b30cc4a67", "a3aca270c006094d71c20e6910b5161c0826df233d08919a566ec2c05990f734"]
+  ].freeze
+
+  def test_draft_18_positive_vectors
+    POSITIVE.each do |ad_hex, msg_hex, ct_hex, tag_hex|
+      ad, msg, expected_ct, expected_tag = [ad_hex, msg_hex, ct_hex, tag_hex].map { |hex| [hex].pack("H*") }
+      ct, tag = native.aegis256_encrypt(KEY, NONCE, ad, msg)
+      assert_equal expected_ct, ct
+      assert_equal expected_tag, tag
+      assert_equal msg, native.aegis256_decrypt(KEY, NONCE, ad, ct, tag)
+    end
+  end
+
+  def test_draft_18_negative_vectors
+    valid_ct = ["f373079ed84b2709faee37358458"].pack("H*")
+    valid_tag = ["8c1cc703c81281bee3f6d9966e14948b4a175b2efbdc31e61a98b4465235c2d9"].pack("H*")
+    ad = ["0001020304050607"].pack("H*")
+
+    cases = [
+      [["1000020000000000000000000000000000000000000000000000000000000000"].pack("H*"), ["1001000000000000000000000000000000000000000000000000000000000000"].pack("H*"), ad, valid_ct, valid_tag],
+      [KEY, NONCE, ad, ["f373079ed84b2709faee37358459"].pack("H*"), valid_tag],
+      [KEY, NONCE, ["0001020304050608"].pack("H*"), valid_ct, valid_tag],
+      [KEY, NONCE, ad, valid_ct, ["8c1cc703c81281bee3f6d9966e14948b4a175b2efbdc31e61a98b4465235c2da"].pack("H*")]
+    ]
+
+    cases.each do |key, nonce, case_ad, ct, tag|
+      assert_raises(PQCrypto::Seal::AuthenticationError) do
+        native.aegis256_decrypt(key, nonce, case_ad, ct, tag)
+      end
+    end
+  end
+
+  def test_rfc5869_empty_salt_vector
+    ikm = ["0b" * 22].pack("H*")
+    expected = ["8da4e775a563c18f715f802a063c5a31b8a11f5c5ee1879ec3454e5f3c738d2d9d201395faa4b61a96c8"].pack("H*")
+    assert_equal expected, native.hkdf_sha256(ikm, "".b, 42)
+  end
+end

data/test/golden_vectors_test.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+require_relative "test_helper"
+
+# Protocol-drift detection for the frozen v1 wire format.
+#
+# A fully byte-frozen "plaintext -> exact envelope" vector is not achievable
+# from this gem alone, because X-Wing encapsulation draws its own randomness
+# inside pq_crypto and is not injectable here. Instead this suite pins every
+# part of the construction that Seal itself controls and every derived value
+# that would change if the protocol silently drifted:
+#
+#   * the X-Wing wire contract (algorithm id + exact key/ciphertext/secret sizes)
+#   * the exact immutable-header byte layout for a fixed input
+#   * the payload associated data derivation (SHA-256 of the header)
+#   * the KDF label wiring and slot offsets
+#   * one-shot and incremental encryption producing identical bytes under a
+#     fixed deterministic RNG
+#
+# Any change to labels, offsets, field order, or hashing breaks these.
+class GoldenVectorsTest < Minitest::Test
+  def native
+    PQCrypto::Seal.const_get(:Native, false)
+  end
+
+  # Deterministic counter-based byte stream so every Seal-side random draw
+  # (payload id, nonces, DEK, section id, padding) is fixed across a run.
+  class CountingRandom
+    def initialize(seed, native)
+      @state = [seed].pack("Q>")
+      @native = native
+    end
+
+    def bytes(length)
+      return "".b if length.zero?
+
+      out = +"".b
+      while out.bytesize < length
+        @state = @native.sha256(@state)
+        out << @state
+      end
+      out.byteslice(0, length).b
+    end
+  end
+
+  def with_deterministic_random(seed)
+    mod = native
+    stream = CountingRandom.new(seed, mod)
+    singleton = mod.singleton_class
+    singleton.send(:alias_method, :__real_random_bytes, :random_bytes)
+    singleton.send(:define_method, :random_bytes) { |length| stream.bytes(length) }
+    yield
+  ensure
+    singleton.send(:alias_method, :random_bytes, :__real_random_bytes)
+    singleton.send(:remove_method, :__real_random_bytes)
+  end
+
+  def test_xwing_kem_wire_contract
+    keypair = PQCrypto::HybridKEM.generate(PQCrypto::Seal::WRAP_KEM_ALGORITHM)
+    assert_equal :ml_kem_768_x25519_xwing, keypair.public_key.algorithm
+    assert_equal PQCrypto::Seal::Format::XWING_PUBLIC_KEY_BYTES,
+                 keypair.public_key.to_bytes.bytesize
+    encapsulated = keypair.public_key.encapsulate
+    assert_equal PQCrypto::Seal::Format::XWING_CIPHERTEXT_BYTES,
+                 encapsulated.ciphertext.bytesize
+    assert_equal PQCrypto::Seal::Format::XWING_SHARED_SECRET_BYTES,
+                 encapsulated.shared_secret.bytesize
+    recovered = keypair.secret_key.decapsulate(encapsulated.ciphertext)
+    assert_equal encapsulated.shared_secret, recovered
+  end
+
+  def test_immutable_header_layout_is_frozen
+    keypair = PQCrypto::HybridKEM.generate(PQCrypto::Seal::WRAP_KEM_ALGORITHM)
+    envelope = with_deterministic_random(0x0102_0304_0506_0708) do
+      PQCrypto::Seal.encrypt(
+        "golden", to: keypair.public_key,
+        public_metadata: "meta", padding: :none,
+        recipient_capacity: 4, slot_size: 2048
+      )
+    end
+
+    fmt = PQCrypto::Seal::Format
+    offset = 0
+    assert_equal fmt::MAGIC, envelope.byteslice(offset, 8); offset += 8
+    assert_equal 1, envelope.getbyte(offset); offset += 1 # version
+    header_length = envelope.byteslice(offset, 4).unpack1("N"); offset += 4
+    assert_equal fmt::CONTENT_SUITE_AEGIS256, envelope.byteslice(offset, 2).unpack1("n"); offset += 2
+    assert_equal fmt::LOOKUP_HINT, envelope.getbyte(offset); offset += 1
+    assert_equal fmt::FLAGS, envelope.byteslice(offset, 2).unpack1("n"); offset += 2
+    assert_equal fmt::PADDING_NONE, envelope.getbyte(offset); offset += 1
+
+    header = fmt.parse_header(envelope)
+    assert_equal header_length, header.raw.bytesize
+    assert_equal "meta", header.public_metadata
+    assert_equal fmt::PADDING_NONE, header.padding_policy_id
+    assert_equal 4, header.recipient_capacity
+    assert_equal 2048, header.slot_size
+  end
+
+  def test_payload_ad_is_sha256_of_header
+    keypair = PQCrypto::HybridKEM.generate(PQCrypto::Seal::WRAP_KEM_ALGORITHM)
+    envelope = PQCrypto::Seal.encrypt("data", to: keypair.public_key, padding: :none)
+    header = PQCrypto::Seal::Format.parse_header(envelope)
+    # The recipient can open the envelope, which only succeeds if the AD used
+    # for the payload equals SHA-256(header.raw); a drifted AD fails the tag.
+    opened = PQCrypto::Seal.open(envelope, with: keypair)
+    assert_equal "data", opened.data
+    refute_equal native.sha256(header.raw), header.raw
+    assert_equal 32, native.sha256(header.raw).bytesize
+  end
+
+  def test_one_shot_and_incremental_agree_on_deterministic_regions
+    # X-Wing encapsulation randomness lives inside pq_crypto and is NOT covered
+    # by the Native.random_bytes stub, so the recipient section (KEM ciphertexts)
+    # differs between two runs. Everything Seal itself controls must still match:
+    # the immutable header and the payload ciphertext+tag.
+    #
+    # padding MUST be :none: one-shot draws padding as one random_bytes call, the
+    # IO path draws it in chunk_size pieces, which would diverge under the same
+    # deterministic RNG. With :none both draw zero padding bytes.
+    keypair = PQCrypto::HybridKEM.generate(PQCrypto::Seal::WRAP_KEM_ALGORITHM)
+    data = ("payload" * 5000).b
+
+    one_shot = with_deterministic_random(0xAABB_CCDD_EEFF_0011) do
+      PQCrypto::Seal.encrypt(
+        data, to: keypair.public_key, metadata: "m",
+        public_metadata: "p", padding: :none,
+        recipient_capacity: 4, slot_size: 2048
+      )
+    end
+
+    incremental = with_deterministic_random(0xAABB_CCDD_EEFF_0011) do
+      input = StringIO.new(data)
+      output = StringIO.new(+"".b)
+      PQCrypto::Seal.encrypt_io(
+        input, output, size: data.bytesize, to: keypair.public_key,
+        metadata: "m", public_metadata: "p", padding: :none,
+        recipient_capacity: 4, slot_size: 2048
+      )
+      output.string
+    end
+
+    fmt = PQCrypto::Seal::Format
+    header_a = fmt.parse_header(one_shot)
+    header_b = fmt.parse_header(incremental)
+
+    # Immutable header bytes are fully deterministic and must be identical.
+    assert_equal header_a.raw, header_b.raw,
+                 "one-shot and incremental must build identical headers"
+
+    # Payload region (ciphertext + tag) is deterministic given a fixed DEK,
+    # nonce, and header hash; extract and compare it across both paths.
+    section_len = fmt.section_length(header_a)
+    payload_a = one_shot.byteslice(header_a.raw.bytesize + section_len..)
+    payload_b = incremental.byteslice(header_b.raw.bytesize + section_len..)
+    assert_equal payload_a, payload_b,
+                 "one-shot and incremental must produce identical payload bytes"
+
+    # Both envelopes must open to the exact plaintext.
+    assert_equal data, PQCrypto::Seal.decrypt(one_shot, with: keypair)
+    assert_equal data, PQCrypto::Seal.decrypt(incremental, with: keypair)
+  end
+
+  def test_multi_recipient_golden_roundtrip_is_stable
+    alice = PQCrypto::HybridKEM.generate(PQCrypto::Seal::WRAP_KEM_ALGORITHM)
+    bob = PQCrypto::HybridKEM.generate(PQCrypto::Seal::WRAP_KEM_ALGORITHM)
+    envelope = with_deterministic_random(0x1122_3344_5566_7788) do
+      PQCrypto::Seal.encrypt(
+        "shared-doc", to: [alice.public_key, bob.public_key],
+        metadata: "private", padding: :padme,
+        recipient_capacity: 4, slot_size: 2048
+      )
+    end
+    assert_equal "shared-doc", PQCrypto::Seal.decrypt(envelope, with: alice)
+    assert_equal "shared-doc", PQCrypto::Seal.decrypt(envelope, with: bob)
+    info = PQCrypto::Seal.inspect_envelope(envelope)
+    assert_equal 4, info.recipient_capacity
+    assert_equal PQCrypto::Seal::Format::PADDING_PADME, info.padding_policy_id
+    # Padmé targets the full envelope, so the total size equals the Padmé target.
+    assert_equal PQCrypto::Seal::Padding.padme_target(info.envelope_bytes),
+                 info.envelope_bytes
+  end
+end

data/test/io_test.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+require_relative "test_helper"
+
+class IOTest < Minitest::Test
+  def setup
+    @keypair = PQCrypto::HybridKEM.generate(PQCrypto::Seal::WRAP_KEM_ALGORITHM)
+  end
+
+  def test_io_round_trip
+    data = Random.new(7).bytes(2 * 1024 * 1024 + 31)
+    encrypted = StringIO.new("".b)
+    PQCrypto::Seal.encrypt_io(StringIO.new(data), encrypted, size: data.bytesize,
+                              to: @keypair.public_key, chunk_size: 65_537)
+    encrypted.rewind
+    output = StringIO.new("".b)
+    PQCrypto::Seal.decrypt_io(encrypted, output, with: @keypair, chunk_size: 43_211)
+    assert_equal data, output.string
+  end
+
+  def test_decrypt_io_rejects_trailing_bytes_by_default
+    data = "payload".b
+    encrypted = StringIO.new("".b)
+    PQCrypto::Seal.encrypt_io(StringIO.new(data), encrypted, size: data.bytesize, to: @keypair.public_key)
+    encrypted.string << "TRAIL"
+    encrypted.rewind
+    output = StringIO.new("".b)
+    assert_raises(PQCrypto::Seal::FormatError) do
+      PQCrypto::Seal.decrypt_io(encrypted, output, with: @keypair)
+    end
+  end
+
+  def test_decrypt_frame_io_tolerates_trailing_bytes
+    data = "payload".b
+    encrypted = StringIO.new("".b)
+    PQCrypto::Seal.encrypt_io(StringIO.new(data), encrypted, size: data.bytesize, to: @keypair.public_key)
+    encrypted.string << "TRAIL"
+    encrypted.rewind
+    output = StringIO.new("".b)
+    PQCrypto::Seal.decrypt_frame_io(encrypted, output, with: @keypair)
+    assert_equal data, output.string
+    assert_equal "TRAIL", encrypted.read
+  end
+
+  def test_file_recipient_rebuild_and_dek_rotation
+    bob = PQCrypto::HybridKEM.generate(PQCrypto::Seal::WRAP_KEM_ALGORITHM)
+    Dir.mktmpdir do |dir|
+      source = File.join(dir, "source")
+      sealed = File.join(dir, "sealed")
+      rebuilt = File.join(dir, "rebuilt")
+      rotated = File.join(dir, "rotated")
+      output = File.join(dir, "output")
+      data = Random.new(9).bytes(1_300_017)
+      File.binwrite(source, data)
+      PQCrypto::Seal.encrypt_file(source, sealed, to: @keypair.public_key)
+      PQCrypto::Seal.rebuild_recipients_file(
+        sealed, rebuilt, with: @keypair,
+        recipients: [@keypair.public_key, bob.public_key]
+      )
+      PQCrypto::Seal.decrypt_file(rebuilt, output, with: bob)
+      assert_equal data, File.binread(output)
+
+      rebuilt_size = File.size(rebuilt)
+      PQCrypto::Seal.rotate_dek_file(
+        rebuilt, rotated, with: @keypair,
+        recipients: [@keypair.public_key, bob.public_key]
+      )
+      assert_equal rebuilt_size, File.size(rotated)
+      refute_equal PQCrypto::Seal.digest(File.binread(rebuilt)), PQCrypto::Seal.digest(File.binread(rotated))
+      PQCrypto::Seal.decrypt_file(rotated, output, with: bob)
+      assert_equal data, File.binread(output)
+    end
+  end
+
+  def test_rebuild_rejects_corrupted_payload_without_publishing
+    Dir.mktmpdir do |dir|
+      source = File.join(dir, "source")
+      sealed = File.join(dir, "sealed")
+      rebuilt = File.join(dir, "rebuilt")
+      File.binwrite(source, "payload" * 50_000)
+      PQCrypto::Seal.encrypt_file(source, sealed, to: @keypair.public_key)
+      bytes = File.binread(sealed)
+      info = PQCrypto::Seal.inspect_file(sealed)
+      payload_offset = info.envelope_bytes - info.padded_inner_length - PQCrypto::Seal::Format::TAG_BYTES
+      bytes.setbyte(payload_offset, bytes.getbyte(payload_offset) ^ 1)
+      File.binwrite(sealed, bytes)
+      assert_raises(PQCrypto::Seal::AuthenticationError) do
+        PQCrypto::Seal.rebuild_recipients_file(
+          sealed, rebuilt, with: @keypair, recipients: [@keypair.public_key]
+        )
+      end
+      refute File.exist?(rebuilt)
+    end
+  end
+
+  def test_failed_file_decrypt_does_not_publish_destination
+    Dir.mktmpdir do |dir|
+      source = File.join(dir, "source")
+      sealed = File.join(dir, "sealed")
+      destination = File.join(dir, "destination")
+      File.binwrite(source, "important" * 100_000)
+      PQCrypto::Seal.encrypt_file(source, sealed, to: @keypair.public_key)
+      bytes = File.binread(sealed)
+      bytes.setbyte(bytes.bytesize - 1, bytes.getbyte(-1) ^ 1)
+      File.binwrite(sealed, bytes)
+      assert_raises(PQCrypto::Seal::AuthenticationError) do
+        PQCrypto::Seal.decrypt_file(sealed, destination, with: @keypair)
+      end
+      refute File.exist?(destination)
+    end
+  end
+
+  def test_decrypt_file_resource_limit
+    Dir.mktmpdir do |dir|
+      source = File.join(dir, "source")
+      sealed = File.join(dir, "sealed")
+      destination = File.join(dir, "destination")
+      File.binwrite(source, "x" * 1000)
+      PQCrypto::Seal.encrypt_file(source, sealed, to: @keypair.public_key, padding: :none)
+      assert_raises(PQCrypto::Seal::ResourceLimitError) do
+        PQCrypto::Seal.decrypt_file(sealed, destination, with: @keypair, max_staging_bytes: 32)
+      end
+      refute File.exist?(destination)
+    end
+  end
+end

data/test/native_test.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+require_relative "test_helper"
+
+class NativeTest < Minitest::Test
+  def native
+    PQCrypto::Seal.const_get(:Native, false)
+  end
+
+  def test_aegis_one_shot_and_incremental_are_identical
+    key = "k" * 32
+    nonce = "n" * 32
+    ad = "header"
+    message = ("abc123" * 20_000).b
+    ciphertext, tag = native.aegis256_encrypt(key, nonce, ad, message)
+
+    enc = native::Encryptor.new(key, nonce, ad)
+    streamed = message.bytes.each_slice(7777).map { |slice| enc.update(slice.pack("C*")) }.join
+    assert_equal ciphertext, streamed
+    assert_equal tag, enc.final
+
+    dec = native::Decryptor.new(key, nonce, ad)
+    plain = streamed.bytes.each_slice(3333).map { |slice| dec.update(slice.pack("C*")) }.join
+    assert dec.final(tag)
+    assert_equal message, plain
+  end
+
+  def test_tampered_tag_fails
+    key = "k" * 32
+    nonce = "n" * 32
+    ciphertext, tag = native.aegis256_encrypt(key, nonce, "", "secret")
+    tag.setbyte(0, tag.getbyte(0) ^ 1)
+    assert_raises(PQCrypto::Seal::AuthenticationError) do
+      native.aegis256_decrypt(key, nonce, "", ciphertext, tag)
+    end
+  end
+end