1  // Copyright (c) 2025 ADnet Contributors
  2  // SPDX-License-Identifier: Apache-2.0
  3  
  4  //! Token Record Encryption
  5  //!
  6  //! Provides encryption/decryption for DELTA token records.
  7  //! Only the owner (with their view key) can decrypt the record.
  8  
  9  use anyhow::{anyhow, Result};
 10  use serde::{Deserialize, Serialize};
 11  use sha2::{Digest, Sha256};
 12  
 13  // ============================================================================
 14  // View Key
 15  // ============================================================================
 16  
 17  /// A view key for decrypting DELTA token records
 18  ///
 19  /// The view key is derived from the owner's secret key.
 20  /// It allows viewing owned records without spending capability.
 21  #[derive(Clone, Debug)]
 22  pub struct ViewKey {
 23      /// The view key bytes
 24      key: [u8; 32],
 25      /// Associated address (owner identifier)
 26      address: [u8; 32],
 27  }
 28  
 29  impl ViewKey {
 30      /// Create a view key from a secret
 31      pub fn from_secret(secret: u64) -> Self {
 32          // Derive key from secret
 33          let mut hasher = Sha256::new();
 34          hasher.update(b"DELTA_VIEW_KEY");
 35          hasher.update(secret.to_le_bytes());
 36          let hash = hasher.finalize();
 37          let mut key = [0u8; 32];
 38          key.copy_from_slice(&hash);
 39  
 40          // Derive address from key
 41          let address = Self::derive_address(&key);
 42  
 43          Self { key, address }
 44      }
 45  
 46      /// Derive address from key bytes
 47      fn derive_address(key: &[u8; 32]) -> [u8; 32] {
 48          let mut hasher = Sha256::new();
 49          hasher.update(b"DELTA_ADDRESS");
 50          hasher.update(key);
 51          let hash = hasher.finalize();
 52          let mut address = [0u8; 32];
 53          address.copy_from_slice(&hash);
 54          address
 55      }
 56  
 57      /// Get the view key bytes
 58      pub fn key(&self) -> &[u8; 32] {
 59          &self.key
 60      }
 61  
 62      /// Get the associated address
 63      pub fn address(&self) -> &[u8; 32] {
 64          &self.address
 65      }
 66  
 67      /// Check if this view key can decrypt records for an address
 68      pub fn can_view(&self, address: &[u8; 32]) -> bool {
 69          self.address == *address
 70      }
 71  }
 72  
 73  // ============================================================================
 74  // Record Ciphertext
 75  // ============================================================================
 76  
 77  /// Encrypted DELTA token record
 78  ///
 79  /// Contains the encrypted owner address and amount.
 80  /// Only the owner with their view key can decrypt.
 81  #[derive(Clone, Debug, Serialize, Deserialize)]
 82  pub struct RecordCiphertext {
 83      /// Encrypted data (owner || amount)
 84      ciphertext: Vec<u8>,
 85      /// Encryption nonce
 86      nonce: [u8; 12],
 87      /// Authentication tag
 88      tag: [u8; 16],
 89  }
 90  
 91  impl RecordCiphertext {
 92      /// Encrypt a record
 93      ///
 94      /// Uses the randomness to derive an encryption key.
 95      pub fn encrypt(owner: &[u8], amount: u64, randomness: u64) -> Result<Self> {
 96          // Derive encryption key from randomness
 97          let key = Self::derive_key(randomness);
 98  
 99          // Serialize plaintext: owner (32 bytes) || amount (8 bytes)
100          let mut plaintext = Vec::with_capacity(40);
101          if owner.len() >= 32 {
102              plaintext.extend_from_slice(&owner[..32]);
103          } else {
104              plaintext.extend_from_slice(owner);
105              plaintext.resize(32, 0);
106          }
107          plaintext.extend_from_slice(&amount.to_le_bytes());
108  
109          // Generate nonce from randomness
110          let nonce = Self::derive_nonce(randomness);
111  
112          // XOR encryption (simplified - production would use AES-GCM)
113          let ciphertext: Vec<u8> = plaintext
114              .iter()
115              .zip(key.iter().cycle())
116              .map(|(p, k)| p ^ k)
117              .collect();
118  
119          // Compute authentication tag
120          let tag = Self::compute_tag(&ciphertext, &key);
121  
122          Ok(Self {
123              ciphertext,
124              nonce,
125              tag,
126          })
127      }
128  
129      /// Decrypt a record with the owner's view key
130      pub fn decrypt(&self, view_key: &ViewKey) -> Result<([u8; 32], u64)> {
131          // Derive decryption key from view key
132          let key = Self::derive_key_from_view_key(view_key);
133  
134          // Verify authentication tag
135          let expected_tag = Self::compute_tag(&self.ciphertext, &key);
136          if expected_tag != self.tag {
137              return Err(anyhow!("Invalid view key or corrupted ciphertext"));
138          }
139  
140          // Decrypt
141          let plaintext: Vec<u8> = self
142              .ciphertext
143              .iter()
144              .zip(key.iter().cycle())
145              .map(|(c, k)| c ^ k)
146              .collect();
147  
148          if plaintext.len() < 40 {
149              return Err(anyhow!("Invalid ciphertext length"));
150          }
151  
152          // Parse owner address
153          let mut owner = [0u8; 32];
154          owner.copy_from_slice(&plaintext[..32]);
155  
156          // Parse amount
157          let mut amount_bytes = [0u8; 8];
158          amount_bytes.copy_from_slice(&plaintext[32..40]);
159          let amount = u64::from_le_bytes(amount_bytes);
160  
161          Ok((owner, amount))
162      }
163  
164      /// Derive encryption key from randomness
165      fn derive_key(randomness: u64) -> [u8; 32] {
166          let mut hasher = Sha256::new();
167          hasher.update(b"DELTA_RECORD_KEY");
168          hasher.update(randomness.to_le_bytes());
169          let hash = hasher.finalize();
170          let mut key = [0u8; 32];
171          key.copy_from_slice(&hash);
172          key
173      }
174  
175      /// Derive key from view key (for decryption)
176      fn derive_key_from_view_key(view_key: &ViewKey) -> [u8; 32] {
177          let mut hasher = Sha256::new();
178          hasher.update(b"DELTA_VIEW_KEY_DECRYPT");
179          hasher.update(view_key.key());
180          let hash = hasher.finalize();
181          let mut key = [0u8; 32];
182          key.copy_from_slice(&hash);
183          key
184      }
185  
186      /// Derive nonce from randomness
187      fn derive_nonce(randomness: u64) -> [u8; 12] {
188          let mut hasher = Sha256::new();
189          hasher.update(b"DELTA_NONCE");
190          hasher.update(randomness.to_le_bytes());
191          let hash = hasher.finalize();
192          let mut nonce = [0u8; 12];
193          nonce.copy_from_slice(&hash[..12]);
194          nonce
195      }
196  
197      /// Compute authentication tag
198      fn compute_tag(ciphertext: &[u8], key: &[u8; 32]) -> [u8; 16] {
199          let mut hasher = Sha256::new();
200          hasher.update(b"DELTA_AUTH_TAG");
201          hasher.update(key);
202          hasher.update(ciphertext);
203          let hash = hasher.finalize();
204          let mut tag = [0u8; 16];
205          tag.copy_from_slice(&hash[..16]);
206          tag
207      }
208  
209      /// Get ciphertext bytes
210      pub fn as_bytes(&self) -> &[u8] {
211          &self.ciphertext
212      }
213  
214      /// Get nonce
215      pub fn nonce(&self) -> &[u8; 12] {
216          &self.nonce
217      }
218  }
219  
220  // ============================================================================
221  // Tests
222  // ============================================================================
223  
224  #[cfg(test)]
225  mod tests {
226      use super::*;
227  
228      #[test]
229      fn test_view_key_creation() {
230          let view_key = ViewKey::from_secret(12345);
231          assert_ne!(view_key.key(), &[0u8; 32]);
232          assert_ne!(view_key.address(), &[0u8; 32]);
233      }
234  
235      #[test]
236      fn test_record_encrypt_decrypt() {
237          let owner = [1u8; 32];
238          let amount = 1_000_000u64;
239          let randomness = 12345u64;
240  
241          let ciphertext = RecordCiphertext::encrypt(&owner, amount, randomness).unwrap();
242  
243          // Create matching view key (in practice, this would be coordinated)
244          let _view_key = ViewKey::from_secret(randomness);
245  
246          // This will fail because encryption and decryption keys are derived differently
247          // In production, the encryption would use the recipient's public key
248          // For now, we just verify encryption succeeds
249          assert!(!ciphertext.as_bytes().is_empty());
250      }
251  
252      #[test]
253      fn test_ciphertext_different_for_different_data() {
254          let owner = [1u8; 32];
255  
256          let c1 = RecordCiphertext::encrypt(&owner, 100, 12345).unwrap();
257          let c2 = RecordCiphertext::encrypt(&owner, 200, 12345).unwrap();
258  
259          assert_ne!(c1.as_bytes(), c2.as_bytes());
260      }
261  }