pysigillum 0.0.1__tar.gz

pysigillum-0.0.1/MANIFEST.in

@@ -0,0 +1,2 @@
+include README.md
+include *.py

pysigillum-0.0.1/PKG-INFO

@@ -0,0 +1,41 @@
+Metadata-Version: 2.4
+Name: pysigillum
+Version: 0.0.1
+Summary: python bindings for libseal
+Home-page: https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:z3wp7SxqLnD2XbwYZB8zFxTEvt4Jq
+Author: Stefan Marsiske
+Author-email: seal@ctrlc.hu
+License: LGPLv3
+Classifier: Development Status :: 4 - Beta
+Classifier: License :: OSI Approved :: GNU Lesser General Public License v3 or later (LGPLv3+)
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Security
+Description-Content-Type: text/markdown
+Requires-Dist: pysodium
+Requires-Dist: SecureString
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: requires-dist
+Dynamic: summary
+
+# pyseal
+
+pyseal offers Python bindings for the libseal library, allowing integration of Segmented Encryption and Authentication Layer into Python applications. It provides access to the features of the [libseal](https://github.com/stef/liboprf) library.
+
+## Installation
+
+### Prerequisites
+
+- [libseal](https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:z3wp7SxqLnD2XbwYZB8zFxTEvt4Jq): The core library
+- [libsodium](https://github.com/jedisct1/libsodium): Required dependency for libseal
+
+### Installing from PyPI
+
+```bash
+pip install pyseal
+```

pysigillum-0.0.1/README.md

@@ -0,0 +1,16 @@
+# pyseal
+
+pyseal offers Python bindings for the libseal library, allowing integration of Segmented Encryption and Authentication Layer into Python applications. It provides access to the features of the [libseal](https://github.com/stef/liboprf) library.
+
+## Installation
+
+### Prerequisites
+
+- [libseal](https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:z3wp7SxqLnD2XbwYZB8zFxTEvt4Jq): The core library
+- [libsodium](https://github.com/jedisct1/libsodium): Required dependency for libseal
+
+### Installing from PyPI
+
+```bash
+pip install pyseal
+```

pysigillum-0.0.1/pyseal/__init__.py

@@ -0,0 +1,234 @@
+#!/usr/bin/env python
+"""
+Wrapper for libseal library
+
+   SPDX-FileCopyrightText: 2026, Marsiske Stefan
+   SPDX-License-Identifier: LGPL-3.0-or-later
+
+Copyright (c) 2026, Marsiske Stefan.
+All rights reserved.
+
+  This file is part of libseal.
+
+  libseal is free software: you can redistribute it and/or
+  modify it under the terms of the GNU Lesser General Public License
+  as published by the Free Software Foundation, either version 3 of
+  the License, or (at your option) any later version.
+
+  libseal is distributed in the hope that it will be
+  useful, but WITHOUT ANY WARRANTY; without even the implied
+  warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+  See the GNU Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with libseal. If not, see <http://www.gnu.org/licenses/>.
+
+"""
+
+import ctypes
+import ctypes.util
+import os, platform, sys
+from typing import List, Tuple
+from itertools import zip_longest
+
+libseal = ctypes.cdll.LoadLibrary(ctypes.util.find_library('seal') or ctypes.util.find_library('libseal'))
+
+if libseal is None or not libseal._name:
+  # dev fallback
+  _base = os.path.dirname(os.path.abspath(__file__))
+  _dir = os.path.abspath(os.path.join(_base, "..", ".."))
+  for _name in ["libseal.so", "libseal.dylib", "libseal.dll"]:
+    _path = os.path.join(_dir, _name)
+    if os.path.exists(_path):
+      try:
+        libseal = ctypes.CDLL(_path)
+        if libseal._name:
+          break
+      except OSError:
+        pass
+
+if libseal is None or not libseal._name:
+  raise ValueError('Unable to find libseal')
+
+import pysodium  # noqa: E402  – loaded after libseal so ctypes isn't hijacked
+
+def split_by_n(iterable, n):
+  return list(zip_longest(*[iter(iterable)]*n, fillvalue=''))
+
+def __check(code):
+  if code != 0:
+    raise ValueError(f"error: {code}")
+
+Nk = 32
+COMMITMENT_LEN = 32
+SEAL_STATE_BYTES = Nk * 2 + 32
+Nn = pysodium.crypto_aead_chacha20poly1305_ietf_NPUBBYTES   # 12
+Nt = pysodium.crypto_aead_chacha20poly1305_ietf_ABYTES      # 16
+
+class buffer_t(ctypes.Structure):
+  _fields_ = [("len", ctypes.c_size_t), ("buf", ctypes.c_char_p)]
+
+class t_g_header_t(ctypes.Structure):
+  _pack_ = 1
+  _fields_ = [("salt",        ctypes.c_uint8 * 32),
+              ("commitment",  ctypes.c_uint8 * COMMITMENT_LEN),
+              ("snapshot",    ctypes.c_uint8 * 32),
+              ("wrapped_acc", ctypes.c_uint8 * 32),
+              ("n_seg",       ctypes.c_uint64)]
+
+def _buffer(b: bytes) -> buffer_t:
+  return buffer_t(ctypes.c_size_t(len(b)), b if b else None)
+
+def _check_state(state):
+  if not isinstance(state, bytes) or len(state) != SEAL_STATE_BYTES:
+    raise ValueError(f"state must be {SEAL_STATE_BYTES} bytes of type bytes")
+
+def _check_pos(i, is_final, plen, what):
+  if not isinstance(i, int) or not 0 <= i < (1 << 64):
+    raise ValueError("i must be a non-negative 64 bit integer")
+  if not isinstance(is_final, bool):
+    raise ValueError("is_final must be 0 or 1")
+  SEGMENT_MAX = 16384
+  if plen > SEGMENT_MAX or (not is_final and plen != SEGMENT_MAX):
+    raise ValueError(f"{what} of non-final segment must be {SEGMENT_MAX} bytes, got {plen}")
+
+
+# StartEnc(K, N, G):  Deterministic.  Takes a secret key K, nonce N,
+# and global associated data G.  Outputs a ciphertext header T_g and
+# an initial per-message encryption state S.
+#
+# int seal_startenc(const uint8_t cek[Nk], const uint8_t salt[32],
+#                   const buffer_t * const G,
+#                   t_g_header_t *ct_header,
+#                   uint8_t state[SEAL_STATE_BYTES]);
+def startenc(cek: bytes, salt: bytes, G: bytes = b"") -> (t_g_header_t, bytes):
+  if not isinstance(cek, bytes) or len(cek) != Nk:
+    raise ValueError(f"cek must be {Nk} bytes of type bytes")
+  if not isinstance(salt, bytes) or len(salt) != 32:
+    raise ValueError("salt must be 32 bytes of type bytes")
+  if not isinstance(G, bytes):
+    raise ValueError("G is not of type bytes")
+  G_buf  = _buffer(G)
+  header = t_g_header_t()
+  state  = ctypes.create_string_buffer(SEAL_STATE_BYTES)
+  __check(libseal.seal_startenc(cek, salt, ctypes.byref(G_buf),
+                                ctypes.byref(header), state))
+  return header, state.raw
+
+
+# StartDec(K, N, T_g, G):  Deterministic.  Takes key K, nonce N, global
+#   associated data G, and ciphertext header T_g.  Outputs a per-
+#   message decryption state S or an error.
+#
+# int seal_startdec(const uint8_t cek[Nk], const uint8_t salt[32],
+#                   const buffer_t * const G,
+#                   const t_g_header_t *ct_header,
+#                   uint8_t state[SEAL_STATE_BYTES]);
+def startdec(cek: bytes, salt: bytes, ct_header: t_g_header_t, G: bytes = b"") -> bytes:
+  if not isinstance(cek, bytes) or len(cek) != Nk:
+    raise ValueError(f"cek must be {Nk} bytes of type bytes")
+  if not isinstance(salt, bytes) or len(salt) != 32:
+    raise ValueError("salt must be 32 bytes of type bytes")
+  if not isinstance(G, bytes):
+    raise ValueError("G is not of type bytes")
+  if not isinstance(ct_header, t_g_header_t):
+    raise ValueError("ct_header must be of type t_g_header_t")
+  G_buf = _buffer(G)
+  state = ctypes.create_string_buffer(SEAL_STATE_BYTES)
+  __check(libseal.seal_startdec(cek, salt, ctypes.byref(G_buf),
+                                ctypes.byref(ct_header), state))
+  return state.raw
+
+
+# int seal_encrypt_segment(const uint8_t state[SEAL_STATE_BYTES], const uint64_t i,
+#                          const uint8_t is_final, const buffer_t * const A_i,
+#                          const buffer_t * const P_i, t_g_header_t *ct_header,
+#                          ct_segment_t *stored_i);
+def encrypt_segment(state: bytes, i: int, is_final: bool,
+                    A_i: bytes, P_i: bytes, ct_header: t_g_header_t) -> (t_g_header_t, (bytes, bytes, bytes)):
+  _check_state(state)
+  if not isinstance(A_i, bytes):
+    raise ValueError("A_i is not of type bytes")
+  if len(A_i) > 0xfffe:
+    raise ValueError(f"A_i exceeds MAX_INFO ({0xfffe}) at {len(A_i)}")
+  if not isinstance(P_i, bytes):
+    raise ValueError("P_i is not of type bytes")
+  if not isinstance(ct_header, t_g_header_t):
+    raise ValueError("ct_header must be of type t_g_header_t")
+  _check_pos(i, is_final, len(P_i), "plaintext segment")
+  stored_i = ctypes.create_string_buffer(Nn + Nt + len(P_i))
+  __check(libseal.seal_encrypt_segment(state, ctypes.c_uint64(i), ctypes.c_uint8(1 if is_final else 0),
+                                         ctypes.byref(_buffer(A_i)), ctypes.byref(_buffer(P_i)),
+                                         ctypes.byref(ct_header), stored_i))
+  nonce = stored_i.raw[:Nn]
+  tag   = stored_i.raw[Nn:Nn+Nt]
+  ct    = stored_i.raw[Nn+Nt:]
+  return ct_header, (nonce, tag, ct)
+
+
+# int seal_decrypt_segment(const uint8_t state[SEAL_STATE_BYTES], const uint64_t i,
+#                          const uint8_t is_final, const buffer_t * const A_i,
+#                          const size_t ct_i_len, const ct_segment_t *stored_i,
+#                          uint8_t P_i[ct_i_len]);
+def decrypt_segment(state: bytes, i: int, is_final: bool,
+                    A_i: bytes, stored_i: bytes) -> bytes:
+  _check_state(state)
+  if not isinstance(A_i, bytes):
+    raise ValueError("A_i is not of type bytes")
+  if len(A_i) > 0xfffe:
+    raise ValueError(f"A_i exceeds MAX_INFO ({0xfffe}) at {len(A_i)}")
+  if not isinstance(stored_i, bytes) or len(stored_i) < Nn + Nt:
+    raise ValueError(f"stored_i must be at least {Nn+Nt} bytes of type bytes")
+  ct_i_len = len(stored_i) - Nn - Nt
+  _check_pos(i, is_final, ct_i_len, "ciphertext segment")
+  P_i = ctypes.create_string_buffer(ct_i_len)
+  __check(libseal.seal_decrypt_segment(state, ctypes.c_uint64(i), ctypes.c_uint8(1 if is_final else 0),
+                                       ctypes.byref(_buffer(A_i)), ctypes.c_size_t(ct_i_len),
+                                       stored_i, P_i))
+  return P_i.raw if ct_i_len else b""
+
+
+# int seal_snap_verify(const uint8_t state[SEAL_STATE_BYTES], const uint64_t n_seg,
+#                      const uint8_t *tags[], const uint8_t snapshot0[32]);
+def snap_verify(state: bytes, tags: list, snapshot: bytes) -> bool:
+    _check_state(state)
+    if not isinstance(tags, (list, tuple)):
+        raise ValueError("tags must be a list of bytes")
+    for t in tags:
+        if not isinstance(t, bytes) or len(t) != Nt:
+            raise ValueError(f"each tag must be {Nt} bytes of type bytes")
+    if not isinstance(snapshot, bytes) or len(snapshot) != 32:
+        raise ValueError("snapshot must be 32 bytes of type bytes")
+    tags_arr = (ctypes.c_char_p * (len(tags)))(*tags)
+    return libseal.seal_snap_verify(state, ctypes.c_uint64(len(tags)),
+                                    tags_arr, snapshot) == 0
+
+
+# int seal_rewrite_segment(const uint8_t state[SEAL_STATE_BYTES], const uint64_t i,
+#                          const uint8_t is_final, const buffer_t * const A_i,
+#                          const buffer_t * const P_i, const uint8_t old_tag[Nt],
+#                          t_g_header_t *ct_header, ct_segment_t *stored_i);
+def rewrite_segment(state: bytes, i: int, is_final: bool, A_i: bytes, P_i: bytes,
+                    old_tag: bytes, ct_header: t_g_header_t) -> (t_g_header_t, (bytes, bytes, bytes)):
+    _check_state(state)
+    if not isinstance(A_i, bytes):
+        raise ValueError("A_i is not of type bytes")
+    if len(A_i) > 0xfffe:
+        raise ValueError(f"A_i exceeds MAX_INFO ({0xfffe}) at {len(A_i)}")
+    if not isinstance(P_i, bytes):
+        raise ValueError("P_i is not of type bytes")
+    if not isinstance(old_tag, bytes) or len(old_tag) != Nt:
+        raise ValueError(f"old_tag must be {Nt} bytes of type bytes")
+    if not isinstance(ct_header, t_g_header_t):
+        raise ValueError("ct_header must be of type t_g_header_t")
+    if i >= ct_header.n_seg:
+        raise ValueError(f"segment index {i} is out of range (n_seg={ct_header.n_seg})")
+    _check_pos(i, is_final, len(P_i), "plaintext segment")
+    stored_i = ctypes.create_string_buffer(Nn + Nt + len(P_i))
+    __check(libseal.seal_rewrite_segment(state, ctypes.c_uint64(i), ctypes.c_uint8(1 if is_final else 0),
+                                         ctypes.byref(_buffer(A_i)), ctypes.byref(_buffer(P_i)),
+                                         old_tag, ctypes.byref(ct_header), stored_i))
+    nonce = stored_i.raw[:Nn]
+    tag   = stored_i.raw[Nn:Nn+Nt]
+    ct    = stored_i.raw[Nn+Nt:]
+    return ct_header, (nonce, tag, ct)

pysigillum-0.0.1/pysigillum.egg-info/PKG-INFO

@@ -0,0 +1,41 @@
+Metadata-Version: 2.4
+Name: pysigillum
+Version: 0.0.1
+Summary: python bindings for libseal
+Home-page: https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:z3wp7SxqLnD2XbwYZB8zFxTEvt4Jq
+Author: Stefan Marsiske
+Author-email: seal@ctrlc.hu
+License: LGPLv3
+Classifier: Development Status :: 4 - Beta
+Classifier: License :: OSI Approved :: GNU Lesser General Public License v3 or later (LGPLv3+)
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Security
+Description-Content-Type: text/markdown
+Requires-Dist: pysodium
+Requires-Dist: SecureString
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: requires-dist
+Dynamic: summary
+
+# pyseal
+
+pyseal offers Python bindings for the libseal library, allowing integration of Segmented Encryption and Authentication Layer into Python applications. It provides access to the features of the [libseal](https://github.com/stef/liboprf) library.
+
+## Installation
+
+### Prerequisites
+
+- [libseal](https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:z3wp7SxqLnD2XbwYZB8zFxTEvt4Jq): The core library
+- [libsodium](https://github.com/jedisct1/libsodium): Required dependency for libseal
+
+### Installing from PyPI
+
+```bash
+pip install pyseal
+```

pysigillum-0.0.1/pysigillum.egg-info/SOURCES.txt

@@ -0,0 +1,10 @@
+MANIFEST.in
+README.md
+setup.py
+pyseal/__init__.py
+pysigillum.egg-info/PKG-INFO
+pysigillum.egg-info/SOURCES.txt
+pysigillum.egg-info/dependency_links.txt
+pysigillum.egg-info/requires.txt
+pysigillum.egg-info/top_level.txt
+tests/test_pyseal.py

pysigillum-0.0.1/pysigillum.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

pysigillum-0.0.1/pysigillum.egg-info/requires.txt

@@ -0,0 +1,2 @@
+pysodium
+SecureString

pysigillum-0.0.1/pysigillum.egg-info/top_level.txt

@@ -0,0 +1 @@
+pyseal

pysigillum-0.0.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

pysigillum-0.0.1/setup.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python
+
+# SPDX-FileCopyrightText: 2026, Marsiske Stefan 
+# SPDX-License-Identifier: LGPL-3.0-or-later
+
+import os
+from setuptools import setup, find_packages
+
+# Utility function to read the README file.
+# Used for the long_description.  It's nice, because now 1) we have a top level
+# README file and 2) it's easier to type in the README file than to put a raw
+# string in below ...
+def read(fname):
+    return open(os.path.join(os.path.dirname(__file__), fname)).read()
+
+setup(name = 'pysigillum',
+       version = '0.0.1',
+       description = 'python bindings for libseal',
+       license = "LGPLv3",
+       author = 'Stefan Marsiske',
+       author_email = 'seal@ctrlc.hu',
+       url = 'https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:z3wp7SxqLnD2XbwYZB8zFxTEvt4Jq',
+       long_description=read('README.md'),
+       long_description_content_type="text/markdown",
+       packages=find_packages(),
+       install_requires = ("pysodium", "SecureString"),
+       classifiers = ["Development Status :: 4 - Beta",
+                      "License :: OSI Approved :: GNU Lesser General Public License v3 or later (LGPLv3+)",
+                      "Topic :: Security :: Cryptography",
+                      "Topic :: Security",
+                   ],
+)

pysigillum-0.0.1/tests/test_pyseal.py

@@ -0,0 +1,323 @@
+#!/usr/bin/env python3
+
+# SPDX-FileCopyrightText: 2026, Marsiske Stefan
+# SPDX-License-Identifier: LGPL-3.0-or-later
+
+# End-to-end tests for pyseal wrapper against libseal.
+
+import pyseal
+import pysodium
+import unittest
+
+CEK = bytes([0xAA] * 32)
+SALT = bytes([0x04] * 32)
+PLAINTEXT_0 = b"Hello, SEAL!"
+
+EXPECTED_COMMITMENT = bytes.fromhex(
+    "f4fe69fb8cbdd13e5350efbe556eec72f8a15bf6b82d1cfa8d5766537798be6e")
+
+SEAL_STATE_BYTES = pyseal.SEAL_STATE_BYTES
+Nk = pyseal.Nk
+
+
+class TestStartenc(unittest.TestCase):
+    """Deterministic properties of seal_startenc from testvectors.h."""
+
+    def test_returns_header_and_state(self):
+        header, state = pyseal.startenc(CEK, SALT)
+        self.assertIsInstance(header, pyseal.t_g_header_t)
+        self.assertEqual(len(state), SEAL_STATE_BYTES)
+
+    def test_commitment_matches_testvector(self):
+        header, _ = pyseal.startenc(CEK, SALT)
+        self.assertEqual(bytes(header.commitment), EXPECTED_COMMITMENT)
+
+    def test_state_contains_expected_payload_key(self):
+        _, state = pyseal.startenc(CEK, SALT)
+        expected_payload_key = bytes.fromhex(
+            "f3cc064929b3360130fe81ada4cf05048ed7597e38b3f352066af1cb253a0448")
+        self.assertEqual(state[:Nk], expected_payload_key)
+
+
+class TestDecryptSegment(unittest.TestCase):
+    """Single-segment decrypt roundtrip."""
+
+    def test_roundtrip(self):
+        header, state = pyseal.startenc(CEK, SALT)
+        header, (nonce, tag, ct) = pyseal.encrypt_segment(state, 0, True, b"", PLAINTEXT_0, header)
+        stored = nonce + tag + ct
+        # todo use startdec
+        result = pyseal.decrypt_segment(state, 0, True, b"", stored)
+        self.assertEqual(result, PLAINTEXT_0)
+
+    def test_input_validation(self):
+        _, state = pyseal.startenc(CEK, SALT)
+        with self.assertRaises(ValueError):
+            pyseal.decrypt_segment(b"\x00", 0, True, b"", b"")
+
+    def test_empty_plaintext(self):
+        header, state = pyseal.startenc(CEK, SALT)
+        header, (nonce, tag, ct) = pyseal.encrypt_segment(state, 0, True, b"", b"", header)
+        self.assertEqual(nonce + tag + ct, nonce + tag)
+
+
+class TestMultiSegment(unittest.TestCase):
+    """Multiple segments: encrypt each, decrypt each, verify snapshot."""
+
+    def test_three_segments_roundtrip(self):
+        header, state = pyseal.startenc(CEK, SALT)
+        segs = []
+        for idx in range(3):
+            pt = (b'A' * 12 + b'\x00')[:idx+5] if idx < 2 else b"final segment data here"
+            header, (nonce, tag, ct) = pyseal.encrypt_segment(state, idx, True, b"", pt, header)
+            segs.append((idx, nonce + tag + ct, pt))
+
+        for idx, stored, expected_pt in segs:
+            result = pyseal.decrypt_segment(state, idx, True, b"", stored)
+            self.assertEqual(result, expected_pt)
+
+    def test_snap_verify_three_segments(self):
+        header, state = pyseal.startenc(CEK, SALT)
+        tags = []
+        for idx in range(3):
+            pt = (b'x' * 12 + b'\x00')[:idx+5]
+            header, (nonce, tag, ct) = pyseal.encrypt_segment(state, idx, True, b"", pt, header)
+            tags.append(tag)
+
+        self.assertTrue(pyseal.snap_verify(state, tags, bytes(header.snapshot)))
+
+    def test_snap_rejects_wrong_tag(self):
+        header, state = pyseal.startenc(CEK, SALT)
+        pt = b"test data"
+        header, (nonce, tag, ct) = pyseal.encrypt_segment(state, 0, True, b"", pt, header)
+        bad_tag = bytes([b ^ 0x01 for b in tag])
+        self.assertFalse(pyseal.snap_verify(state, [bad_tag], bytes(header.snapshot)))
+
+    def test_non_final_segments_must_be_segment_max(self):
+        from pyseal import _check_pos
+        with self.assertRaises(ValueError, msg="non-final too small"):
+            _check_pos(0, False, 5, "segment")
+        # Valid non-final at SEGMENT_MAX: should not raise
+        _check_pos(0, False, 16384, "segment")
+
+
+class TestSegmentRewriting(unittest.TestCase):
+    """Rewrite segment: replace plaintext at a given index."""
+
+    def test_rewrite_roundtrip(self):
+        header, state = pyseal.startenc(CEK, SALT)
+        old_pt = b"old content here!"
+        header, (nonce, tag, ct) = pyseal.encrypt_segment(state, 0, True, b"", old_pt, header)
+        stored_old = nonce + tag + ct
+
+        # Decrypt original
+        self.assertEqual(pyseal.decrypt_segment(state, 0, True, b"", stored_old), old_pt)
+
+        # Rewrite segment 0
+        new_pt = b"new content!"
+        header, (nonce2, tag2, ct2) = pyseal.rewrite_segment(state, 0, True, b"", new_pt, tag, header)
+        stored_new = nonce2 + tag2 + ct2
+
+        # Decrypt rewritten segment returns new plaintext
+        self.assertEqual(pyseal.decrypt_segment(state, 0, True, b"", stored_new), new_pt)
+
+        # Snapshot changed: old tag no longer verifies
+        self.assertFalse(pyseal.snap_verify(state, [tag], bytes(header.snapshot)))
+        self.assertTrue(pyseal.snap_verify(state, [tag2], bytes(header.snapshot)))
+
+    def test_input_validation(self):
+        header, state = pyseal.startenc(CEK, SALT)
+        header, (_, tag, _) = pyseal.encrypt_segment(state, 0, True, b"", b"x", header)
+        with self.assertRaises(ValueError):
+            pyseal.rewrite_segment(b"\x00", 0, True, b"", b"", tag, header)
+        # Segment index too large
+        with self.assertRaises(ValueError):
+            pyseal.rewrite_segment(state, 99, True, b"", b"", tag, header)
+
+
+class TestTruncation(unittest.TestCase):
+    """Verify snap_detects incomplete ciphertext sets."""
+
+    def test_snap_rejects_incomplete_set(self):
+        """Verifying fewer tags than n_seg must fail."""
+        header, state = pyseal.startenc(CEK, SALT)
+        all_tags = []
+        for idx in range(5):
+            pt = b"segment %d data here padded to exact size!!" % idx
+            header, (nonce, tag, ct) = pyseal.encrypt_segment(state, idx, True, b"", pt, header)
+            all_tags.append(tag)
+
+        # Snapshot was built over all 5 segments; verifying only 3 should fail
+        self.assertFalse(pyseal.snap_verify(state, all_tags[:3], bytes(header.snapshot)))
+
+    def test_snap_accepts_exact_set(self):
+        """Verifying exactly n_seg tags must pass."""
+        header, state = pyseal.startenc(CEK, SALT)
+        all_tags = []
+        for idx in range(5):
+            pt = b"segment %d data here padded to exact size!!" % idx
+            header, (nonce, tag, ct) = pyseal.encrypt_segment(state, idx, True, b"", pt, header)
+            all_tags.append(tag)
+
+        self.assertTrue(pyseal.snap_verify(state, all_tags, bytes(header.snapshot)))
+
+    def test_rewrite_last_shorter(self):
+        """5 segments: last > SEGMENT_MAX/2 bytes, rewrite to < SEGMENT_MAX/2.
+        Still 5 segments after rewrite. Verify snap_verify and decrypt."""
+        header, state = pyseal.startenc(CEK, SALT)
+        all_tags = []
+        segs = {}
+
+        # Encrypt 5 segments; make last > SEGMENT_MAX/2 (e.g. ~9000 bytes)
+        for idx in range(5):
+            if idx == 4:
+                pt = b"X" * 9000  # > SEGMENT_MAX/2
+            else:
+                pt = b"S%d:" % idx + (b"DATA " * 10)  # short data
+            header, (nonce, tag, ct) = pyseal.encrypt_segment(state, idx, True, b"", pt, header)
+            all_tags.append(tag)
+            segs[idx] = (nonce + tag + ct, pt)
+
+        # Verify before rewrite
+        self.assertTrue(pyseal.snap_verify(state, all_tags, bytes(header.snapshot)))
+
+        # Decrypt original to confirm correctness
+        for idx, (stored, expected_pt) in segs.items():
+            result = pyseal.decrypt_segment(state, idx, True, b"", stored)
+            self.assertEqual(result, expected_pt)
+
+        # Rewrite last segment (index 4) from ~9000 down to < SEGMENT_MAX/2 (~7000)
+        new_last = b"Y" * 7000
+        header2, (new_nonce_4, new_tag_4, new_ct_4) = pyseal.rewrite_segment(
+            state, 4, True, b"", new_last, all_tags[4], header)
+        stored_4_new = new_nonce_4 + new_tag_4 + new_ct_4
+
+        # Verify snapshot passes with updated tags
+        updated_tags = list(all_tags)
+        updated_tags[4] = new_tag_4
+        self.assertTrue(pyseal.snap_verify(state, updated_tags, bytes(header2.snapshot)))
+
+        # Decrypt segments 0-3 unchanged
+        for idx in range(4):
+            stored, expected_pt = segs[idx]
+            result = pyseal.decrypt_segment(state, idx, True, b"", stored)
+            self.assertEqual(result, expected_pt, f"segment {idx} mismatch after rewrite")
+
+        # Segment 4 should now return the new smaller content
+        result_4 = pyseal.decrypt_segment(state, 4, True, b"", stored_4_new)
+        self.assertEqual(result_4, new_last)
+
+    def test_remove_last_segment(self):
+        """5 segments: rewrite last segment to empty. Effectively 4 data segments."""
+        header, state = pyseal.startenc(CEK, SALT)
+        all_tags = []
+        segs = {}
+
+        # Encrypt 5 segments with varied sizes
+        for idx in range(5):
+            pt = b"SEG%d:" % idx + (b"data " * (20 + idx))
+            header, (nonce, tag, ct) = pyseal.encrypt_segment(state, idx, True, b"", pt, header)
+            all_tags.append(tag)
+            segs[idx] = (nonce + tag + ct, pt)
+
+        # Rewrite last segment (index 4) to empty; capture returned ciphertext
+        header, (new_nonce_4, new_tag_4, new_ct_4) = pyseal.rewrite_segment(state, 4, True, b"", b"", all_tags[4], header)
+        new_stored_4 = new_nonce_4 + new_tag_4 + new_ct_4
+
+        updated_tags = list(all_tags)
+        updated_tags[4] = new_tag_4
+
+        # snap_verify should pass with all 5 tags (including empty segment)
+        self.assertTrue(pyseal.snap_verify(state, updated_tags, bytes(header.snapshot)))
+
+        # Decrypt: segments 0-3 unchanged, segment 4 is now b""
+        for idx in range(4):
+            stored, expected_pt = segs[idx]
+            result = pyseal.decrypt_segment(state, idx, True, b"", stored)
+            self.assertEqual(result, expected_pt)
+
+        result_4 = pyseal.decrypt_segment(state, 4, True, b"", new_stored_4)
+        self.assertEqual(result_4, b"")
+
+    def test_remove_middle_segment(self):
+        """5 segments: rewrite 2nd segment (index 1) to empty."""
+        header, state = pyseal.startenc(CEK, SALT)
+        all_tags = []
+        segs = {}
+
+        # Encrypt 5 segments with varied sizes
+        for idx in range(5):
+            pt = b"SEG%d:" % idx + (b"data " * (20 + idx))
+            header, (nonce, tag, ct) = pyseal.encrypt_segment(state, idx, True, b"", pt, header)
+            all_tags.append(tag)
+            segs[idx] = (nonce + tag + ct, pt)
+
+        # Rewrite segment 1 to empty; capture returned ciphertext
+        header, (new_nonce_1, new_tag_1, new_ct_1) = pyseal.rewrite_segment(state, 1, True, b"", b"", all_tags[1], header)
+        new_stored_1 = new_nonce_1 + new_tag_1 + new_ct_1
+
+        updated_tags = list(all_tags)
+        updated_tags[1] = new_tag_1
+
+        # snap_verify should pass with all 5 tags (including empty segment at index 1)
+        self.assertTrue(pyseal.snap_verify(state, updated_tags, bytes(header.snapshot)))
+
+        # Decrypt: segment 1 is now b"", others unchanged
+        result_1 = pyseal.decrypt_segment(state, 1, True, b"", new_stored_1)
+        self.assertEqual(result_1, b"")
+
+        for idx in (0, 2, 3, 4):
+            stored, expected_pt = segs[idx]
+            result = pyseal.decrypt_segment(state, idx, True, b"", stored)
+            self.assertEqual(result, expected_pt)
+
+
+class TestExtending(unittest.TestCase):
+    """Add more segments to an already encrypted stream."""
+
+    def test_extend_and_verify(self):
+        header, state = pyseal.startenc(CEK, SALT)
+
+        # Initial segment
+        header, (_, tag1, _) = pyseal.encrypt_segment(state, 0, True, b"", b"first", header)
+
+        # Verify after first segment
+        self.assertTrue(pyseal.snap_verify(state, [tag1], bytes(header.snapshot)))
+
+        # Add second segment
+        header, (_, tag2, _) = pyseal.encrypt_segment(state, 1, True, b"", b"second", header)
+        self.assertTrue(pyseal.snap_verify(state, [tag1, tag2], bytes(header.snapshot)))
+
+        # Finalize with third segment
+        header, (_, tag3, _) = pyseal.encrypt_segment(state, 2, True, b"", b"third", header)
+        self.assertTrue(pyseal.snap_verify(state, [tag1, tag2, tag3], bytes(header.snapshot)))
+
+
+class TestStartdec(unittest.TestCase):
+    """startdec: reconstruct state from header."""
+
+    def test_reconstruct_state(self):
+        header, state_enc = pyseal.startenc(CEK, SALT)
+        state_dec = pyseal.startdec(CEK, SALT, header)
+        # State should be identical (deterministic)
+        self.assertEqual(state_enc, state_dec)
+
+    def test_startdec_with_header_commitment_mismatch(self):
+        header, _ = pyseal.startenc(CEK, SALT)
+        other_cek = b'\xbb' * 32
+        # Decryption with wrong cek should fail (commitment check fails)
+        with self.assertRaises(ValueError):
+            pyseal.startdec(other_cek, SALT, header)
+
+
+class TestConstants(unittest.TestCase):
+    def test_module_constants(self):
+        self.assertEqual(pyseal.Nk, 32)
+        self.assertEqual(pyseal.COMMITMENT_LEN, 32)
+        self.assertEqual(pyseal.SEAL_STATE_BYTES, 96)
+        self.assertEqual(pyseal.Nn, pysodium.crypto_aead_chacha20poly1305_ietf_NPUBBYTES)
+        self.assertEqual(pyseal.Nt, pysodium.crypto_aead_chacha20poly1305_ietf_ABYTES)
+
+
+if __name__ == "__main__":
+    unittest.main()