Cybersecurity-Projects/PROJECTS/intermediate/credential-rotation-enforcer/spec/unit/crypto/envelope_spec.cr

56 lines
1.6 KiB
Crystal

# ===================
# ©AngelaMos | 2026
# envelope_spec.cr
# ===================
require "../../spec_helper"
require "../../../src/cre/crypto/envelope"
require "../../../src/cre/crypto/kek"
describe CRE::Crypto::Envelope do
it "encrypts and decrypts with envelope" do
ENV["KEK_TEST_HEX"] = "0" * 64
kek = CRE::Crypto::Kek::EnvKek.new("KEK_TEST_HEX", version: 1)
env = CRE::Crypto::Envelope.new(kek)
plaintext = "very secret".to_slice
aad = "ctx".to_slice
sealed = env.seal(plaintext, aad)
sealed.algorithm_id.should eq CRE::Crypto::ALGORITHM_AES_256_GCM
sealed.kek_version.should eq 1
opened = env.open(sealed, aad)
opened.should eq plaintext
ensure
ENV.delete("KEK_TEST_HEX")
end
it "fails to open with mismatched AAD" do
ENV["KEK_TEST_HEX2"] = "0" * 64
kek = CRE::Crypto::Kek::EnvKek.new("KEK_TEST_HEX2", version: 1)
env = CRE::Crypto::Envelope.new(kek)
sealed = env.seal("plaintext".to_slice, "good-aad".to_slice)
expect_raises(CRE::Crypto::Aead::Error) do
env.open(sealed, "bad-aad".to_slice)
end
ensure
ENV.delete("KEK_TEST_HEX2")
end
it "produces different ciphertexts for the same plaintext (random DEK + nonce)" do
ENV["KEK_TEST_HEX3"] = "0" * 64
kek = CRE::Crypto::Kek::EnvKek.new("KEK_TEST_HEX3", version: 1)
env = CRE::Crypto::Envelope.new(kek)
aad = "x".to_slice
a = env.seal("same".to_slice, aad)
b = env.seal("same".to_slice, aad)
a.ciphertext.should_not eq b.ciphertext
a.dek_wrapped.should_not eq b.dek_wrapped
ensure
ENV.delete("KEK_TEST_HEX3")
end
end