56 lines
1.6 KiB
Crystal
56 lines
1.6 KiB
Crystal
# ===================
|
|
# ©AngelaMos | 2026
|
|
# envelope_spec.cr
|
|
# ===================
|
|
|
|
require "../../spec_helper"
|
|
require "../../../src/cre/crypto/envelope"
|
|
require "../../../src/cre/crypto/kek"
|
|
|
|
describe CRE::Crypto::Envelope do
|
|
it "encrypts and decrypts with envelope" do
|
|
ENV["KEK_TEST_HEX"] = "0" * 64
|
|
kek = CRE::Crypto::Kek::EnvKek.new("KEK_TEST_HEX", version: 1)
|
|
env = CRE::Crypto::Envelope.new(kek)
|
|
|
|
plaintext = "very secret".to_slice
|
|
aad = "ctx".to_slice
|
|
|
|
sealed = env.seal(plaintext, aad)
|
|
sealed.algorithm_id.should eq CRE::Crypto::ALGORITHM_AES_256_GCM
|
|
sealed.kek_version.should eq 1
|
|
|
|
opened = env.open(sealed, aad)
|
|
opened.should eq plaintext
|
|
ensure
|
|
ENV.delete("KEK_TEST_HEX")
|
|
end
|
|
|
|
it "fails to open with mismatched AAD" do
|
|
ENV["KEK_TEST_HEX2"] = "0" * 64
|
|
kek = CRE::Crypto::Kek::EnvKek.new("KEK_TEST_HEX2", version: 1)
|
|
env = CRE::Crypto::Envelope.new(kek)
|
|
|
|
sealed = env.seal("plaintext".to_slice, "good-aad".to_slice)
|
|
expect_raises(CRE::Crypto::Aead::Error) do
|
|
env.open(sealed, "bad-aad".to_slice)
|
|
end
|
|
ensure
|
|
ENV.delete("KEK_TEST_HEX2")
|
|
end
|
|
|
|
it "produces different ciphertexts for the same plaintext (random DEK + nonce)" do
|
|
ENV["KEK_TEST_HEX3"] = "0" * 64
|
|
kek = CRE::Crypto::Kek::EnvKek.new("KEK_TEST_HEX3", version: 1)
|
|
env = CRE::Crypto::Envelope.new(kek)
|
|
|
|
aad = "x".to_slice
|
|
a = env.seal("same".to_slice, aad)
|
|
b = env.seal("same".to_slice, aad)
|
|
a.ciphertext.should_not eq b.ciphertext
|
|
a.dek_wrapped.should_not eq b.dek_wrapped
|
|
ensure
|
|
ENV.delete("KEK_TEST_HEX3")
|
|
end
|
|
end
|