Crate reach_encryption

Reach Encryption

This crate provides symmetric encryption using generic encrypt/decrypt traits for various data types with XChaCha20-Poly1305 authenticated encryption (via the RustCrypto implementation). For public key encryption, it supports multiple recipients using X-Wing Hybrid KEM (eprint) construction that combines X25519 (via dalek) and ML-KEM (via RustCrypto), implements SIGMA-I style authenticated encryption using reach-signatures, and includes HMAC verification for verifying key authenticity.

Core Traits

• Encryptable: Types that can be encrypted with symmetric or public key encryption
• Decryptable: Types that can be decrypted from ciphertext with nonce or key material
• Ciphertext: Types that contain encrypted data
• Nonce: Types that provide nonces for encryption/decryption operations
• PublicKeyEncrypted: Types encrypted with the X-Wingy hybrid KEM
• ParticipantSecretKeys: Provides access to EC and PQ secret keys for decryption

The crate is designed to work across different Reach components including Reaching Link, Reachable Secrets, and the Reach Attestant.

Traits

Authenticate

Authenticates encrypted data using SIGMA-I-style verification.

AuthenticatingWrapperFromParts

Construct type from a wrapped value and authentication components.

Ciphertext

Contains encrypted data.

Decryptable

Decryptable from data structures that include nonces.

DecryptableWithNonce

Decryptable when provided with an explicit nonce.

Encryptable

Encryptable using symmetric encryption.

HintTaker

Secret keys that “take” (decrypt) hints using ECDH-OMR.

Nonce

Provides nonces for encryption/decryption operations.

ParticipantSecretKeys

Provides access to both elliptic curve and post-quantum secret keys.

PublicKeyDecrypter

Decrypts public key encrypted data.

PublicKeyEncryptable

Encryptable using SIGMA-I-style authenticated public key encryption.

PublicKeyEncrypted

Encrypted with hybrid public key cryptography.

PublicKeyEncryptedFromParts

Constructed type from public key encryption components.

VerifiableMac

Generates and verifies HMAC tags for key authentication.

Functions

authenticated_encrypt_key

Encrypt a symmetric encryption key for multiple recipients using SIGMA-I-style authenticated encryption.

binding_digest

Cryptographic bind ephemeral material and participant keys.

blind_public_key

Blind a participant’s public key.

build_envelope_seed

Build an [EnvelopeSeed] containing all components needed for secure message delivery.

cipher_and_material_for

Generate cipher and cryptographic material for public key encryption.

cipher_with_secrets

Create a cipher instance using secret keys and encrypted material.

open_envelope

Open and authenticate an envelope.