qualia_core_db/specialized_libs/cryptographic_library/
library.rs

1// Part of the cryptographic_library module (split from the former mod.rs monolith
2// per CLAUDE.md §11 — pure code motion, no behaviour change).
3use super::*;
4
5/// Cryptographic Library Manager
6pub struct CryptographicLibrary {
7    pub(super) key_manager: KeyManager,
8    pub(super) signature_engine: SignatureEngine,
9    encryption_engine: EncryptionEngine,
10    pub(super) hash_engine: HashEngine,
11    proof_engine: ProofEngine,
12    security_monitor: SecurityMonitor,
13}
14impl CryptographicLibrary {
15    /// Create new cryptographic library
16    pub fn new() -> Self {
17        Self {
18            key_manager: KeyManager::new(),
19            signature_engine: SignatureEngine::new(),
20            encryption_engine: EncryptionEngine::new(),
21            hash_engine: HashEngine::new(),
22            proof_engine: ProofEngine::new(),
23            security_monitor: SecurityMonitor::new(),
24        }
25    }
26
27    /// Initialize the library
28    pub fn initialize(&mut self) -> Result<(), CryptographicError> {
29        // Initialize key manager
30        self.key_manager.initialize()?;
31
32        // Initialize signature engine
33        self.signature_engine.initialize()?;
34
35        // Initialize encryption engine
36        self.encryption_engine.initialize()?;
37
38        // Initialize hash engine
39        self.hash_engine.initialize()?;
40
41        // Initialize proof engine
42        self.proof_engine.initialize()?;
43
44        // Initialize security monitor
45        self.security_monitor.initialize()?;
46
47        Ok(())
48    }
49
50    /// Generate ML-DSA key pair
51    pub fn generate_mldsa_key_pair(
52        &mut self,
53        key_id: String,
54        security_level: SecurityLevel,
55    ) -> Result<CryptographicResult<(Key, Key)>, CryptographicError> {
56        let start_time = std::time::Instant::now();
57
58        // Generate a real FIPS-204 ML-DSA-65 key pair (public key is produced alongside
59        // the secret key ΓÇö it is NOT derivable from a 32-byte seed like Ed25519).
60        let (priv_k, pub_k) = MlDsaSigner::generate_keypair().map_err(|e| {
61            CryptographicError::SignatureError(format!("ML-DSA keygen failed: {e}"))
62        })?;
63
64        let now = std::time::SystemTime::now()
65            .duration_since(std::time::UNIX_EPOCH)
66            .unwrap()
67            .as_secs();
68
69        let private_id = format!("{key_id}_private");
70        let public_id = format!("{key_id}_public");
71
72        let private_key = Key {
73            key_id: private_id.clone(),
74            key_type: KeyType::Private,
75            key_algorithm: KeyAlgorithm::MLDSA,
76            key_data: priv_k.sk_bytes.clone(),
77            metadata: KeyMetadata {
78                key_id: private_id,
79                key_type: KeyType::Private,
80                key_algorithm: KeyAlgorithm::MLDSA,
81                key_size: priv_k.sk_bytes.len(),
82                created_at: now,
83                expires_at: 0,
84                last_used: 0,
85                usage_count: 0,
86                security_level: security_level.clone(),
87                access_level: AccessLevel::Secret,
88            },
89        };
90        let public_key = Key {
91            key_id: public_id.clone(),
92            key_type: KeyType::Public,
93            key_algorithm: KeyAlgorithm::MLDSA,
94            key_data: pub_k.pk_bytes.clone(),
95            metadata: KeyMetadata {
96                key_id: public_id,
97                key_type: KeyType::Public,
98                key_algorithm: KeyAlgorithm::MLDSA,
99                key_size: pub_k.pk_bytes.len(),
100                created_at: now,
101                expires_at: 0,
102                last_used: 0,
103                usage_count: 0,
104                security_level: security_level.clone(),
105                access_level: AccessLevel::Public,
106            },
107        };
108
109        // Store keys
110        self.key_manager.store_key(private_key.clone())?;
111        self.key_manager.store_key(public_key.clone())?;
112
113        // Track the KeyPair relationship in the catalog
114        self.key_manager.key_storage.key_catalog.add_relationship(
115            &private_key.key_id,
116            &public_key.key_id,
117            KeyRelationshipType::KeyPair,
118        );
119        self.key_manager
120            .key_storage
121            .key_catalog
122            .register_key(private_key.metadata.clone());
123        self.key_manager
124            .key_storage
125            .key_catalog
126            .register_key(public_key.metadata.clone());
127
128        let execution_time = start_time.elapsed().as_millis() as u64;
129
130        Ok(CryptographicResult {
131            result: (private_key, public_key),
132            execution_time,
133            memory_usage: 0,
134            security_level,
135            compliance_status: ComplianceStatus::Compliant,
136        })
137    }
138
139    /// Sign data with ML-DSA
140    pub fn sign_data(
141        &mut self,
142        key_id: &str,
143        data: &[u8],
144    ) -> Result<CryptographicResult<Signature>, CryptographicError> {
145        let start_time = std::time::Instant::now();
146
147        // Get private key
148        let private_key = self.key_manager.get_key(key_id)?;
149
150        // Validate key type
151        if private_key.key_type != KeyType::Private {
152            return Err(CryptographicError::InvalidKey(
153                "Key must be private for signing".to_string(),
154            ));
155        }
156
157        // Sign data
158        let signature = self.signature_engine.sign_data(&private_key, data)?;
159
160        let execution_time = start_time.elapsed().as_millis() as u64;
161
162        Ok(CryptographicResult {
163            result: signature,
164            execution_time,
165            memory_usage: 0,
166            security_level: private_key.metadata.security_level,
167            compliance_status: ComplianceStatus::Compliant,
168        })
169    }
170
171    /// Verify signature with ML-DSA
172    pub fn verify_signature(
173        &mut self,
174        key_id: &str,
175        signature: &Signature,
176        data: &[u8],
177    ) -> Result<CryptographicResult<bool>, CryptographicError> {
178        let start_time = std::time::Instant::now();
179
180        // Get public key
181        let public_key = self.key_manager.get_key(key_id)?;
182
183        // Validate key type
184        if public_key.key_type != KeyType::Public {
185            return Err(CryptographicError::InvalidKey(
186                "Key must be public for verification".to_string(),
187            ));
188        }
189
190        // Verify signature
191        let is_valid = self
192            .signature_engine
193            .verify_signature(&public_key, signature, data)?;
194
195        let execution_time = start_time.elapsed().as_millis() as u64;
196
197        Ok(CryptographicResult {
198            result: is_valid,
199            execution_time,
200            memory_usage: 0,
201            security_level: public_key.metadata.security_level,
202            compliance_status: ComplianceStatus::Compliant,
203        })
204    }
205
206    /// Encrypt data with AES-256-GCM
207    pub fn encrypt_data(
208        &mut self,
209        key_id: &str,
210        data: &[u8],
211        additional_data: Option<&[u8]>,
212    ) -> Result<CryptographicResult<EncryptedData>, CryptographicError> {
213        let start_time = std::time::Instant::now();
214
215        // Get symmetric key
216        let key = self.key_manager.get_key(key_id)?;
217
218        // Validate key type
219        if key.key_type != KeyType::Symmetric {
220            return Err(CryptographicError::InvalidKey(
221                "Key must be symmetric for encryption".to_string(),
222            ));
223        }
224
225        // Encrypt data
226        let encrypted_data = self
227            .encryption_engine
228            .encrypt_data(&key, data, additional_data)?;
229
230        let execution_time = start_time.elapsed().as_millis() as u64;
231
232        Ok(CryptographicResult {
233            result: encrypted_data,
234            execution_time,
235            memory_usage: 0,
236            security_level: key.metadata.security_level,
237            compliance_status: ComplianceStatus::Compliant,
238        })
239    }
240
241    /// Encrypt data with an explicitly chosen AEAD algorithm
242    /// (AES-256-GCM, ChaCha20-Poly1305, or XChaCha20-Poly1305).
243    pub fn encrypt_data_with_algorithm(
244        &mut self,
245        key_id: &str,
246        data: &[u8],
247        additional_data: Option<&[u8]>,
248        algorithm: EncryptionAlgorithm,
249    ) -> Result<CryptographicResult<EncryptedData>, CryptographicError> {
250        let start_time = std::time::Instant::now();
251
252        let key = self.key_manager.get_key(key_id)?;
253        if key.key_type != KeyType::Symmetric {
254            return Err(CryptographicError::InvalidKey(
255                "Key must be symmetric for encryption".to_string(),
256            ));
257        }
258
259        let encrypted_data =
260            self.encryption_engine
261                .encrypt_data_with(&key, data, additional_data, algorithm)?;
262
263        let execution_time = start_time.elapsed().as_millis() as u64;
264
265        Ok(CryptographicResult {
266            result: encrypted_data,
267            execution_time,
268            memory_usage: 0,
269            security_level: key.metadata.security_level,
270            compliance_status: ComplianceStatus::Compliant,
271        })
272    }
273
274    /// Decrypt data with AES-256-GCM
275    pub fn decrypt_data(
276        &mut self,
277        key_id: &str,
278        encrypted_data: &EncryptedData,
279    ) -> Result<CryptographicResult<Vec<u8>>, CryptographicError> {
280        let start_time = std::time::Instant::now();
281
282        // Get symmetric key
283        let key = self.key_manager.get_key(key_id)?;
284
285        // Validate key type
286        if key.key_type != KeyType::Symmetric {
287            return Err(CryptographicError::InvalidKey(
288                "Key must be symmetric for decryption".to_string(),
289            ));
290        }
291
292        // Decrypt data
293        let decrypted_data = self.encryption_engine.decrypt_data(&key, encrypted_data)?;
294
295        let execution_time = start_time.elapsed().as_millis() as u64;
296
297        Ok(CryptographicResult {
298            result: decrypted_data,
299            execution_time,
300            memory_usage: 0,
301            security_level: key.metadata.security_level,
302            compliance_status: ComplianceStatus::Compliant,
303        })
304    }
305
306    /// Compute hash with SHA-256
307    pub fn compute_hash(
308        &mut self,
309        data: &[u8],
310    ) -> Result<CryptographicResult<HashResult>, CryptographicError> {
311        let start_time = std::time::Instant::now();
312
313        // Compute hash
314        let hash_result = self.hash_engine.compute_hash("SHA256", data)?;
315
316        let execution_time = start_time.elapsed().as_millis() as u64;
317
318        Ok(CryptographicResult {
319            result: hash_result,
320            execution_time,
321            memory_usage: 0,
322            security_level: SecurityLevel::High,
323            compliance_status: ComplianceStatus::Compliant,
324        })
325    }
326
327    /// Compute hash with BLAKE3 (32-byte digest)
328    pub fn compute_hash_blake3(
329        &mut self,
330        data: &[u8],
331    ) -> Result<CryptographicResult<HashResult>, CryptographicError> {
332        let start_time = std::time::Instant::now();
333
334        let hash_result = self.hash_engine.compute_hash("BLAKE3", data)?;
335
336        let execution_time = start_time.elapsed().as_millis() as u64;
337
338        Ok(CryptographicResult {
339            result: hash_result,
340            execution_time,
341            memory_usage: 0,
342            security_level: SecurityLevel::High,
343            compliance_status: ComplianceStatus::Compliant,
344        })
345    }
346
347    /// Derive key material using HKDF-SHA256 (RFC 5869).
348    pub fn derive_hkdf(&self, ikm: &[u8], info: &[u8]) -> Result<Vec<u8>, CryptographicError> {
349        self.encryption_engine.derive_hkdf(ikm, info)
350    }
351
352    /// Issue an ML-DSA-signed Verifiable Credential via the fiduciary VC fragment layout.
353    pub fn issue_vc_mldsa(
354        &self,
355        claim_quins: &[crate::NQuin],
356        issuer_sk_key_id: &str,
357        issuer_did_hash: u64,
358        context: &CryptoContext,
359    ) -> Result<CryptographicResult<MlDsaVcProof>, CryptographicError> {
360        let start_time = std::time::Instant::now();
361        let sk_key = self.key_manager.get_key(issuer_sk_key_id)?;
362        if sk_key.key_type != KeyType::Private {
363            return Err(CryptographicError::InvalidKey(
364                "Issuer key must be private for VC issuance".to_string(),
365            ));
366        }
367        let proof = MlDsaVcProof::issue_vc_mldsa(
368            claim_quins,
369            &sk_key.key_data,
370            issuer_did_hash,
371            context,
372        )
373        .map_err(|e| CryptographicError::SignatureError(format!("VC issuance failed: {e}")))?;
374        let execution_time = start_time.elapsed().as_millis() as u64;
375        Ok(CryptographicResult {
376            result: proof,
377            execution_time,
378            memory_usage: 0,
379            security_level: sk_key.metadata.security_level,
380            compliance_status: ComplianceStatus::Compliant,
381        })
382    }
383
384    /// Verify an ML-DSA-signed Verifiable Credential issued via [`Self::issue_vc_mldsa`].
385    pub fn verify_vc_mldsa(
386        &self,
387        proof: &MlDsaVcProof,
388        claim_quins: &[crate::NQuin],
389        issuer_pk_key_id: &str,
390        context: &CryptoContext,
391    ) -> Result<CryptographicResult<bool>, CryptographicError> {
392        let start_time = std::time::Instant::now();
393        let pk_key = self.key_manager.get_key(issuer_pk_key_id)?;
394        if pk_key.key_type != KeyType::Public {
395            return Err(CryptographicError::InvalidKey(
396                "Issuer key must be public for VC verification".to_string(),
397            ));
398        }
399        let is_valid = proof
400            .verify_vc_mldsa(claim_quins, &pk_key.key_data, context)
401            .map_err(|e| {
402                CryptographicError::SignatureError(format!("VC verification failed: {e}"))
403            })?;
404        let execution_time = start_time.elapsed().as_millis() as u64;
405        Ok(CryptographicResult {
406            result: is_valid,
407            execution_time,
408            memory_usage: 0,
409            security_level: pk_key.metadata.security_level,
410            compliance_status: ComplianceStatus::Compliant,
411        })
412    }
413
414    /// Generate zero-knowledge proof
415    pub fn generate_zk_proof(
416        &mut self,
417        circuit_id: &str,
418        witness: &[Vec<u8>],
419        public_inputs: &[Vec<u8>],
420    ) -> Result<CryptographicResult<Proof>, CryptographicError> {
421        let start_time = std::time::Instant::now();
422
423        // Generate proof
424        let proof = self
425            .proof_engine
426            .generate_proof(circuit_id, witness, public_inputs)?;
427
428        let execution_time = start_time.elapsed().as_millis() as u64;
429
430        Ok(CryptographicResult {
431            result: proof,
432            execution_time,
433            memory_usage: 0,
434            security_level: SecurityLevel::Critical,
435            compliance_status: ComplianceStatus::Compliant,
436        })
437    }
438
439    /// Verify zero-knowledge proof
440    pub fn verify_zk_proof(
441        &mut self,
442        proof: &Proof,
443        public_inputs: &[Vec<u8>],
444    ) -> Result<CryptographicResult<bool>, CryptographicError> {
445        let start_time = std::time::Instant::now();
446
447        // Verify proof
448        let is_valid = self.proof_engine.verify_proof(proof, public_inputs)?;
449
450        let execution_time = start_time.elapsed().as_millis() as u64;
451
452        Ok(CryptographicResult {
453            result: is_valid,
454            execution_time,
455            memory_usage: 0,
456            security_level: SecurityLevel::Critical,
457            compliance_status: ComplianceStatus::Compliant,
458        })
459    }
460
461    /// Get security metrics
462    pub fn get_security_metrics(&self) -> SecurityMetrics {
463        self.security_monitor.get_metrics()
464    }
465
466    /// List all keys
467    pub fn list_keys(&self) -> Vec<String> {
468        self.key_manager.list_keys()
469    }
470
471    /// Get key information
472    pub fn get_key_info(&self, key_id: &str) -> Option<KeyMetadata> {
473        self.key_manager.get_key_metadata(key_id)
474    }
475
476    /// Rotate key
477    pub fn rotate_key(
478        &mut self,
479        key_id: &str,
480    ) -> Result<CryptographicResult<Key>, CryptographicError> {
481        let start_time = std::time::Instant::now();
482
483        // Get old key
484        let old_key = self.key_manager.get_key(key_id)?;
485
486        // Generate new key
487        let new_key = self.key_manager.rotate_key(&old_key)?;
488
489        // Track the RotatedFrom relationship in the catalog
490        self.key_manager.key_storage.key_catalog.add_relationship(
491            &new_key.key_id,
492            &old_key.key_id,
493            KeyRelationshipType::RotatedFrom,
494        );
495        self.key_manager
496            .key_storage
497            .key_catalog
498            .register_key(new_key.metadata.clone());
499
500        let execution_time = start_time.elapsed().as_millis() as u64;
501
502        Ok(CryptographicResult {
503            result: new_key,
504            execution_time,
505            memory_usage: 0,
506            security_level: old_key.metadata.security_level,
507            compliance_status: ComplianceStatus::Compliant,
508        })
509    }
510}
qualia_core_db/specialized_libs/cryptographic_library/library.rs

qualia_core_db/specialized_libs/cryptographic_library/
library.rs
