59f9ebc59e
From vaptvupt-codec tag v2.65.3. Output is byte-identical to 2.65.0 (same ratio, wire format v1.6 unchanged) but extreme-mode encode is ~1.6-2x faster (Sprint 132 optimal-parser speedup) and the extreme prepass window allocation is capped at wlog=20 = 8 MiB virtual instead of up to 128 MiB (Sprint 133 memory hygiene). Our AVX2 offset-read decoder guard is now UPSTREAM (dropped from the local patch set); the ANS safe-zone 2*SAFEZONE_MAX_RUN reserve is re-applied on top (still not upstream). make check 16/16, KAT 16/16, cross- version roundtrip with 5.1.0 archives verified.
89 lines
3.4 KiB
C
89 lines
3.4 KiB
C
/*
|
|
* zuptsdk easy.h — high-level API for drop-in encryption.
|
|
* SPDX-License-Identifier: AGPL-3.0-or-later
|
|
*
|
|
* Goal: 3 lines of code to encrypt/decrypt anything in any language.
|
|
* No context management, no parameter tuning, secure defaults.
|
|
*/
|
|
#ifndef ZUPTSDK_EASY_H
|
|
#define ZUPTSDK_EASY_H
|
|
|
|
#include "zuptsdk.h"
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/* ─── String/buffer encryption (PQ pubkey) ─── */
|
|
|
|
/** Encrypt with recipient pubkey file path. Returns alloc'd combined
|
|
* blob (header || ciphertext) ready to store/transmit. */
|
|
int zuptsdk_easy_encrypt(const char *recipient_pubkey_path,
|
|
const uint8_t *plaintext, size_t plaintext_sz,
|
|
uint8_t **blob_out, size_t *blob_sz);
|
|
|
|
/** Decrypt blob with recipient privkey file path. */
|
|
int zuptsdk_easy_decrypt(const char *recipient_privkey_path,
|
|
const uint8_t *blob, size_t blob_sz,
|
|
uint8_t **plaintext_out, size_t *plaintext_sz);
|
|
|
|
/* ─── Password-based encryption ─── */
|
|
|
|
/** Encrypt with password (Argon2id, MODERATE preset by default). */
|
|
int zuptsdk_easy_encrypt_password(const char *password,
|
|
const uint8_t *plaintext, size_t plaintext_sz,
|
|
uint8_t **blob_out, size_t *blob_sz);
|
|
|
|
int zuptsdk_easy_decrypt_password(const char *password,
|
|
const uint8_t *blob, size_t blob_sz,
|
|
uint8_t **plaintext_out, size_t *plaintext_sz);
|
|
|
|
/* ─── Field-level encryption (for DB columns, JSON fields) ─── */
|
|
|
|
/** Encrypt small fields with a 32-byte key. Returns base64-encoded
|
|
* string (alloc'd, NUL-terminated, free with zuptsdk_free).
|
|
* Suitable for DB columns, JSON fields, env vars. */
|
|
int zuptsdk_easy_encrypt_field(const uint8_t key[32],
|
|
const char *plaintext,
|
|
char **b64_out);
|
|
|
|
int zuptsdk_easy_decrypt_field(const uint8_t key[32],
|
|
const char *b64_input,
|
|
char **plaintext_out);
|
|
|
|
/* ─── File encryption with progress ─── */
|
|
|
|
typedef void (*zuptsdk_easy_progress_t)(uint64_t bytes_done,
|
|
uint64_t bytes_total,
|
|
void *userdata);
|
|
|
|
int zuptsdk_easy_encrypt_file(const char *recipient_pubkey_path,
|
|
const char *input_path,
|
|
const char *output_path,
|
|
zuptsdk_easy_progress_t cb, void *userdata);
|
|
|
|
int zuptsdk_easy_decrypt_file(const char *recipient_privkey_path,
|
|
const char *input_path,
|
|
const char *output_path,
|
|
zuptsdk_easy_progress_t cb, void *userdata);
|
|
|
|
/* ─── Keypair generation ─── */
|
|
|
|
/** Generate keypair and save to two paths. Convenience wrapper. */
|
|
int zuptsdk_easy_keygen(const char *pubkey_out_path,
|
|
const char *privkey_out_path);
|
|
|
|
/** Derive a deterministic 32-byte key from a password via Argon2id.
|
|
* For field encryption, derive key once at startup, reuse for many fields. */
|
|
int zuptsdk_easy_derive_key(const char *password,
|
|
const uint8_t salt[16],
|
|
uint8_t key_out[32]);
|
|
|
|
/* ─── Random salt generation ─── */
|
|
int zuptsdk_easy_random_salt(uint8_t out[16]);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|