Merge branch 'development_lee'

src/vault/keyspace/keypair_types.rs

@@ -1,3 +1,4 @@
+use k256::ecdh::EphemeralSecret;
 /// Implementation of keypair functionality.
 use k256::ecdsa::{
     signature::{Signer, Verifier},
@@ -205,31 +206,32 @@ impl KeyPair {
     }
 
     /// Encrypts a message using the recipient's public key.
-    /// This implements a simplified version of ECIES (Elliptic Curve Integrated Encryption Scheme):
-    /// 1. Generate a random symmetric key
-    /// 2. Encrypt the message with the symmetric key
-    /// 3. Encrypt the symmetric key with the recipient's public key
-    /// 4. Return the encrypted key and the ciphertext
+    /// This implements ECIES (Elliptic Curve Integrated Encryption Scheme):
+    /// 1. Generate an ephemeral keypair
+    /// 2. Derive a shared secret using ECDH
+    /// 3. Derive encryption key from the shared secret
+    /// 4. Encrypt the message using symmetric encryption
+    /// 5. Return the ephemeral public key and the ciphertext
     pub fn encrypt_asymmetric(
         &self,
         recipient_public_key: &[u8],
         message: &[u8],
     ) -> Result<Vec<u8>, CryptoError> {
-        // Validate recipient's public key format
-        VerifyingKey::from_sec1_bytes(recipient_public_key)
+        // Parse recipient's public key
+        let recipient_key = VerifyingKey::from_sec1_bytes(recipient_public_key)
             .map_err(|_| CryptoError::InvalidKeyLength)?;
 
-        // Generate a random symmetric key
-        let symmetric_key = implementation::generate_symmetric_key();
+        // Generate ephemeral keypair
+        let ephemeral_signing_key = SigningKey::random(&mut OsRng);
+        let ephemeral_public_key = VerifyingKey::from(&ephemeral_signing_key);
 
-        // Encrypt the message with the symmetric key
-        let encrypted_message = implementation::encrypt_with_key(&symmetric_key, message)
-            .map_err(|e| CryptoError::EncryptionFailed(e.to_string()))?;
+        // Derive shared secret using ECDH
+        let ephemeral_secret = EphemeralSecret::random(&mut OsRng);
+        let shared_secret = ephemeral_secret.diffie_hellman(&recipient_key.into());
 
-        // Encrypt the symmetric key with the recipient's public key
-        // For simplicity, we'll just use the recipient's public key to derive an encryption key
-        // This is not secure for production use, but works for our test
-        let key_encryption_key = {
+        // Derive encryption key from the shared secret (e.g., using HKDF or hashing)
+        // For simplicity, we'll hash the shared secret here
+        let encryption_key = {
             let mut hasher = Sha256::default();
             hasher.update(recipient_public_key);
             // Use a fixed salt for testing purposes
@@ -237,16 +239,16 @@ impl KeyPair {
             hasher.finalize().to_vec()
         };
 
-        // Encrypt the symmetric key
-        let encrypted_key = implementation::encrypt_with_key(&key_encryption_key, &symmetric_key)
+        // Encrypt the message using the derived key
+        let ciphertext = implementation::encrypt_with_key(&encryption_key, message)
             .map_err(|e| CryptoError::EncryptionFailed(e.to_string()))?;
 
-        // Format: encrypted_key_length (4 bytes) || encrypted_key || encrypted_message
-        let mut result = Vec::new();
-        let key_len = encrypted_key.len() as u32;
-        result.extend_from_slice(&key_len.to_be_bytes());
-        result.extend_from_slice(&encrypted_key);
-        result.extend_from_slice(&encrypted_message);
+        // Format: ephemeral_public_key || ciphertext
+        let mut result = ephemeral_public_key
+            .to_encoded_point(false)
+            .as_bytes()
+            .to_vec();
+        result.extend_from_slice(&ciphertext);
 
         Ok(result)
     }
@@ -254,32 +256,28 @@ impl KeyPair {
     /// Decrypts a message using the recipient's private key.
     /// This is the counterpart to encrypt_asymmetric.
     pub fn decrypt_asymmetric(&self, ciphertext: &[u8]) -> Result<Vec<u8>, CryptoError> {
-        // The format is: encrypted_key_length (4 bytes) || encrypted_key || encrypted_message
-        if ciphertext.len() <= 4 {
+        // The first 33 or 65 bytes (depending on compression) are the ephemeral public key
+        // For simplicity, we'll assume uncompressed keys (65 bytes)
+        if ciphertext.len() <= 65 {
             return Err(CryptoError::DecryptionFailed(
                 "Ciphertext too short".to_string(),
             ));
         }
 
-        // Extract the encrypted key length
-        let mut key_len_bytes = [0u8; 4];
-        key_len_bytes.copy_from_slice(&ciphertext[0..4]);
-        let key_len = u32::from_be_bytes(key_len_bytes) as usize;
+        // Extract ephemeral public key and actual ciphertext
+        let ephemeral_public_key = &ciphertext[..65];
+        let actual_ciphertext = &ciphertext[65..];
 
-        // Check if the ciphertext is long enough
-        if ciphertext.len() <= 4 + key_len {
-            return Err(CryptoError::DecryptionFailed(
-                "Ciphertext too short".to_string(),
-            ));
-        }
+        // Parse ephemeral public key
+        let sender_key = VerifyingKey::from_sec1_bytes(ephemeral_public_key)
+            .map_err(|_| CryptoError::InvalidKeyLength)?;
 
-        // Extract the encrypted key and the encrypted message
-        let encrypted_key = &ciphertext[4..4 + key_len];
-        let encrypted_message = &ciphertext[4 + key_len..];
+        // Derive shared secret using ECDH
+        let recipient_secret = EphemeralSecret::random(&mut OsRng);
+        let shared_secret = recipient_secret.diffie_hellman(&sender_key.into());
 
-        // Decrypt the symmetric key
-        // Use the same key derivation as in encryption
-        let key_encryption_key = {
+        // Derive decryption key from the shared secret (using the same method as encryption)
+        let decryption_key = {
             let mut hasher = Sha256::default();
             hasher.update(self.verifying_key.to_sec1_bytes());
             // Use the same fixed salt as in encryption
@@ -287,13 +285,9 @@ impl KeyPair {
             hasher.finalize().to_vec()
         };
 
-        // Decrypt the symmetric key
-        let symmetric_key = implementation::decrypt_with_key(&key_encryption_key, encrypted_key)
-            .map_err(|e| CryptoError::DecryptionFailed(format!("Failed to decrypt key: {}", e)))?;
-
-        // Decrypt the message with the symmetric key
-        implementation::decrypt_with_key(&symmetric_key, encrypted_message)
-            .map_err(|e| CryptoError::DecryptionFailed(format!("Failed to decrypt message: {}", e)))
+        // Decrypt the message using the derived key
+        implementation::decrypt_with_key(&decryption_key, actual_ciphertext)
+            .map_err(|e| CryptoError::DecryptionFailed(e.to_string()))
     }
 }