Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
151 changes: 67 additions & 84 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

18 changes: 9 additions & 9 deletions Cargo.toml
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
[workspace]
members = [
"crates/common",
"crates/cryptography",
"crates/examples",
"crates/keycloak",
"crates/ledger",
"crates/ledgrpc",
"crates/registry",
"crates/wallet",
"crates/common",
"crates/cryptography",
"crates/examples",
"crates/keycloak",
"crates/ledger",
"crates/ledgrpc",
"crates/registry",
"crates/wallet",
]
resolver = "2"

Expand All @@ -16,7 +16,7 @@ edition = "2024"
license = "MIT"
version = "0.2.0"

[workspace.profile.release]
[profile.release]
opt-level = 3
strip = "debuginfo"
codegen-units = 1
Expand Down
6 changes: 6 additions & 0 deletions crates/cryptography/Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,9 @@ version.workspace = true
base64 = { workspace = true }

aes-gcm = "0.10"

[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
getrandom = { version = "0.2" }

[target.'cfg(target_arch = "wasm32")'.dependencies]
getrandom = { version = "0.2", features = ["js"] }
18 changes: 13 additions & 5 deletions crates/cryptography/src/symmetric/aes_256_gcm.rs
Original file line number Diff line number Diff line change
@@ -1,9 +1,16 @@
use aes_gcm::aead::{Aead, KeyInit, OsRng};
use aes_gcm::{AeadCore, Aes256Gcm, Nonce};
use aes_gcm::aead::{Aead, KeyInit};
use aes_gcm::{Aes256Gcm, Nonce};
use base64::{Engine as _, engine::general_purpose};

pub const PREFIX: &str = "aes-256-gcm";

/// Generate a random 12-byte nonce using getrandom (WASM-compatible)
fn generate_nonce() -> Result<[u8; 12], String> {
let mut nonce = [0u8; 12];
getrandom::getrandom(&mut nonce).map_err(|e| format!("RNG error: {}", e))?;
Ok(nonce)
}

/// Encrypt a UTF-8 string using AES-256-GCM.
/// Returns a base64-encoded string containing both the nonce and ciphertext.
#[allow(dead_code)]
Expand All @@ -14,14 +21,15 @@ pub fn encrypt_string(key: String, plaintext: String) -> Result<String, String>

let cipher =
Aes256Gcm::new_from_slice(&key_bytes).map_err(|e| format!("Cipher init: {}", e))?;
let nonce = Aes256Gcm::generate_nonce(&mut OsRng);
let nonce_bytes = generate_nonce()?;
let nonce = Nonce::from_slice(&nonce_bytes);

let ciphertext = cipher
.encrypt(&nonce, plaintext.as_bytes())
.encrypt(nonce, plaintext.as_bytes())
.map_err(|e| format!("Encrypt error: {}", e))?;

let mut combined = Vec::with_capacity(12 + ciphertext.len());
combined.extend_from_slice(&nonce);
combined.extend_from_slice(&nonce_bytes);
combined.extend_from_slice(&ciphertext);
Ok(general_purpose::STANDARD.encode(combined))
}
Expand Down
Loading