risingwave_common_secret/
encryption.rs

1// Copyright 2025 RisingWave Labs
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7//     http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15use aws_lc_rs::aead::{AES_128_GCM, Aad, Nonce, RandomizedNonceKey};
16use serde::{Deserialize, Serialize};
17
18use super::{SecretError, SecretResult};
19
20#[derive(Deserialize, Serialize)]
21pub struct SecretEncryption {
22    nonce: [u8; 12],
23    ciphertext: Vec<u8>,
24}
25
26impl SecretEncryption {
27    pub fn encrypt(key: &[u8], plaintext: &[u8]) -> SecretResult<Self> {
28        let encrypt_key = Self::fill_key(key);
29        let nonce_key = RandomizedNonceKey::new(&AES_128_GCM, &encrypt_key)
30            .map_err(|_| SecretError::AesError)?;
31        let mut in_out = plaintext.to_vec();
32        let nonce = nonce_key
33            .seal_in_place_append_tag(Aad::empty(), &mut in_out)
34            .map_err(|_| SecretError::AesError)?;
35        Ok(Self {
36            nonce: *nonce.as_ref(),
37            ciphertext: in_out,
38        })
39    }
40
41    pub fn decrypt(&self, key: &[u8]) -> SecretResult<Vec<u8>> {
42        let decrypt_key = Self::fill_key(key);
43        let nonce_key = RandomizedNonceKey::new(&AES_128_GCM, &decrypt_key)
44            .map_err(|_| SecretError::AesError)?;
45        let mut in_out = self.ciphertext.clone();
46        let nonce = Nonce::assume_unique_for_key(self.nonce);
47        let plaintext = nonce_key
48            .open_in_place(nonce, Aad::empty(), &mut in_out)
49            .map_err(|_| SecretError::AesError)?;
50        Ok(plaintext.to_vec())
51    }
52
53    fn fill_key(key: &[u8]) -> Vec<u8> {
54        let mut k = key[..(std::cmp::min(key.len(), 16))].to_vec();
55        k.resize_with(16, || 0);
56        k
57    }
58
59    pub fn serialize(&self) -> SecretResult<Vec<u8>> {
60        let res = bincode::serialize(&self)?;
61        Ok(res)
62    }
63
64    pub fn deserialize(data: &[u8]) -> SecretResult<Self> {
65        let res = bincode::deserialize(data)?;
66        Ok(res)
67    }
68}
69
70#[cfg(test)]
71mod test {
72    use super::*;
73    #[test]
74    fn test_secret_encryption_decyption() {
75        let key = &hex::decode("0123456789abcdef0123456789abcdef").unwrap();
76        assert!(key.len() == 16);
77        let plaintext = "Hello, world!".as_bytes();
78        let secret = SecretEncryption::encrypt(key, plaintext).unwrap();
79        let decrypted = secret.decrypt(key).unwrap();
80        assert_eq!(plaintext, decrypted.as_slice());
81    }
82}
risingwave_common_secret/encryption.rs

risingwave_common_secret/
encryption.rs
