From b8823d25be1969ed926caf1829658157417528eb Mon Sep 17 00:00:00 2001 From: CUBELinux-2 Date: Mon, 10 Aug 2026 21:01:42 -0400 Subject: [PATCH] test(cubecrypt): add persistent XTS roundtrip + non-AEAD test (was only ad-hoc verified) XTS was previously covered only by a deleted throwaway example. Fold the verification into the committed suite so it runs under ./check: 16-multiple roundtrip, short-plaintext pad/strip roundtrip, multi-block sector, and the correct non-AEAD wrong-key property (wrong key opens to different garbage). --- cubecrypt/src/lib.rs | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/cubecrypt/src/lib.rs b/cubecrypt/src/lib.rs index b265201..8cd36bf 100644 --- a/cubecrypt/src/lib.rs +++ b/cubecrypt/src/lib.rs @@ -120,6 +120,29 @@ mod tests { } } + #[test] + fn xts_roundtrip_and_non_authenticated() { + // XTS needs 16-byte-multiple plaintext for the raw mode; seal pads + // non-multiples and open strips them, so both shapes round-trip. + let key = transform::derive_key(b"xts-root-key-material-32b", b"salt"); + // exact 16-multiple (3 blocks) + let aligned: Vec = (0u8..48).collect(); + let env = transform::seal(TransformId::Aes256Xts, &key, &aligned); + assert_eq!(transform::open(&key, &env).unwrap(), aligned); + // short plaintext (padded/ stripped) + let short = b"hello"; + let env_s = transform::seal(TransformId::Aes256Xts, &key, short); + assert_eq!(transform::open(&key, &env_s).unwrap(), short); + // multi-block sector + let big = vec![0xABu8; 64]; + let env_b = transform::seal(TransformId::Aes256Xts, &key, &big); + assert_eq!(transform::open(&key, &env_b).unwrap(), big); + // XTS is non-AEAD: wrong key opens silently to *different* garbage. + let wrong = transform::derive_key(b"xts-root-key-material-32b", b"other"); + let got = transform::open(&wrong, &env).unwrap(); + assert_ne!(got, aligned, "XTS wrong-key must NOT reproduce plaintext"); + } + #[test] fn wrong_key_fails_auth() { let key = transform::derive_key(b"key-A-material", b"salt");