Port shared secret encryption from nucypher-core

packages/shared/package.json

@@ -42,6 +42,8 @@
   "dependencies": {
     "@ethersproject/abi": "^5.8.0",
     "@ethersproject/providers": "^5.8.0",
+    "@noble/ciphers": "^1.2.1",
+    "@noble/hashes": "^1.7.1",
     "@nucypher/nucypher-contracts": "^0.23.0",
     "@nucypher/nucypher-core": "^0.14.5",
     "axios": "^1.8.4",

packages/shared/src/encryption/errors.ts

@@ -0,0 +1,66 @@
+/**
+ * Errors during encryption.
+ */
+export class EncryptionError extends Error {
+    readonly code: EncryptionErrorCode;
+
+    constructor(code: EncryptionErrorCode) {
+        let message: string;
+        switch (code) {
+            case EncryptionErrorCode.PlaintextTooLarge:
+                message = 'Plaintext is too large to encrypt';
+                break;
+            default:
+                message = 'Unknown encryption error';
+        }
+        super(message);
+        this.name = 'EncryptionError';
+        this.code = code;
+    }
+}
+
+/**
+ * Error codes for encryption operations.
+ */
+export enum EncryptionErrorCode {
+    PlaintextTooLarge = 'PlaintextTooLarge',
+}
+
+/**
+ * Errors during decryption.
+ */
+export class DecryptionError extends Error {
+    readonly code: DecryptionErrorCode;
+    readonly details?: string;
+
+    constructor(code: DecryptionErrorCode, details?: string) {
+        let message: string;
+        switch (code) {
+            case DecryptionErrorCode.CiphertextTooShort:
+                message = 'The ciphertext must include the nonce';
+                break;
+            case DecryptionErrorCode.AuthenticationFailed:
+                message = 'Decryption of ciphertext failed: ' +
+                    'either someone tampered with the ciphertext or ' +
+                    'you are using an incorrect decryption key.';
+                break;
+            case DecryptionErrorCode.DeserializationFailed:
+                message = details ? `deserialization failed: ${details}` : 'deserialization failed';
+                break;
+            default:
+                message = 'Unknown decryption error';
+        }
+        super(message);
+        this.name = 'DecryptionError';
+        this.code = code;
+    }
+}
+
+/**
+ * Error codes for decryption operations.
+ */
+export enum DecryptionErrorCode {
+    CiphertextTooShort = 'CiphertextTooShort',
+    AuthenticationFailed = 'AuthenticationFailed',
+    DeserializationFailed = 'DeserializationFailed',
+}

packages/shared/src/encryption/index.ts

@@ -0,0 +1,2 @@
+export * from './errors';
+export * from './shared-secret';

packages/shared/src/encryption/shared-secret.ts

@@ -0,0 +1,44 @@
+import { chacha20poly1305 } from '@noble/ciphers/chacha';
+import { randomBytes } from '@noble/hashes/utils';
+
+import {
+  DecryptionError,
+  DecryptionErrorCode,
+  EncryptionError,
+  EncryptionErrorCode,
+} from './errors';
+
+export function encryptWithSharedSecret(
+  sharedSecret: Uint8Array,
+  plaintext: Uint8Array,
+): Uint8Array {
+  const nonce = randomBytes(12); // Generate a 12-byte nonce
+  const cipher = chacha20poly1305(sharedSecret, nonce); // Use an object with key
+  try {
+    const ciphertext = cipher.encrypt(plaintext);
+    const result = new Uint8Array(nonce.length + ciphertext.length);
+    result.set(nonce);
+    result.set(ciphertext, nonce.length);
+    return result;
+  } catch (error) {
+    throw new EncryptionError(EncryptionErrorCode.PlaintextTooLarge);
+  }
+}
+
+export function decryptWithSharedSecret(
+  sharedSecret: Uint8Array,
+  ciphertext: Uint8Array,
+): Uint8Array {
+  const nonceLength = 12; // ChaCha20Poly1305 uses a 12-byte nonce
+  if (ciphertext.length < nonceLength) {
+    throw new DecryptionError(DecryptionErrorCode.CiphertextTooShort);
+  }
+  const nonce = ciphertext.slice(0, nonceLength);
+  const encryptedData = ciphertext.slice(nonceLength);
+  const cipher = chacha20poly1305(sharedSecret, nonce); // Use an object with key
+  try {
+    return cipher.decrypt(encryptedData);
+  } catch (error) {
+    throw new DecryptionError(DecryptionErrorCode.AuthenticationFailed);
+  }
+}

packages/shared/test/fixtures/shared-secret-vectors.json

@@ -0,0 +1,235 @@
+{
+  "test_vectors": [
+    {
+      "id": "vector1",
+      "description": "Fixed nonce encryption with known plaintext",
+      "shared_secret": [
+        0,
+        1,
+        2,
+        3,
+        4,
+        5,
+        6,
+        7,
+        8,
+        9,
+        10,
+        11,
+        12,
+        13,
+        14,
+        15,
+        16,
+        17,
+        18,
+        19,
+        20,
+        21,
+        22,
+        23,
+        24,
+        25,
+        26,
+        27,
+        28,
+        29,
+        30,
+        31
+      ],
+      "plaintext": "This is a test message",
+      "fixed_nonce": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ],
+      "expected_ciphertext": "0000000000000000000000004cd02b428d8fd5f172412804dc376e4a9dc2809486c8b548d407dad8f75ee84d6d9e92a42c4a"
+    },
+    {
+      "id": "vector2",
+      "description": "Fixed nonce encryption with alternative values",
+      "shared_secret": [
+        31,
+        30,
+        29,
+        28,
+        27,
+        26,
+        25,
+        24,
+        23,
+        22,
+        21,
+        20,
+        19,
+        18,
+        17,
+        16,
+        15,
+        14,
+        13,
+        12,
+        11,
+        10,
+        9,
+        8,
+        7,
+        6,
+        5,
+        4,
+        3,
+        2,
+        1,
+        0
+      ],
+      "plaintext": "",
+      "fixed_nonce": [
+        1,
+        1,
+        1,
+        1,
+        1,
+        1,
+        1,
+        1,
+        1,
+        1,
+        1,
+        1
+      ],
+      "expected_ciphertext": "0101010101010101010101018726c5f2d5b81872a86493ef5232aaa1"
+    },
+    {
+      "id": "vector3",
+      "description": "Rust-generated ciphertext for TypeScript compatibility check",
+      "shared_secret": [
+        0,
+        1,
+        2,
+        3,
+        4,
+        5,
+        6,
+        7,
+        8,
+        9,
+        10,
+        11,
+        12,
+        13,
+        14,
+        15,
+        16,
+        17,
+        18,
+        19,
+        20,
+        21,
+        22,
+        23,
+        24,
+        25,
+        26,
+        27,
+        28,
+        29,
+        30,
+        31
+      ],
+      "rust_generated_ciphertext": [
+        87,
+        119,
+        14,
+        255,
+        68,
+        116,
+        249,
+        152,
+        58,
+        121,
+        245,
+        185,
+        157,
+        62,
+        23,
+        3,
+        50,
+        163,
+        150,
+        212,
+        167,
+        157,
+        244,
+        227,
+        159,
+        130,
+        110,
+        26,
+        30,
+        161,
+        173,
+        70,
+        232,
+        207,
+        110,
+        161,
+        252,
+        228,
+        149,
+        42,
+        173,
+        185,
+        61,
+        157,
+        144,
+        163,
+        128,
+        200,
+        87,
+        80,
+        172,
+        63,
+        235,
+        241,
+        169,
+        124,
+        248,
+        158,
+        213,
+        62,
+        241,
+        209,
+        117,
+        216,
+        202,
+        230,
+        106,
+        248,
+        170,
+        150,
+        126,
+        40,
+        203,
+        34,
+        14,
+        44,
+        71,
+        186,
+        234,
+        92,
+        13,
+        248
+      ],
+      "expected_plaintext": "This is a message encrypted by the Rust implementation"
+    }
+  ]
+}