fix(crypto): K-02 — format v3 chunk replay protection with generation aad

src/carrier.rs

@@ -115,6 +115,7 @@ pub fn read_carrier_block(
         &chunk_rec.nonce,
         &chunk_rec.tag,
         format_version,
+        chunk_rec.generation,
     )?;
 
     // Das outer_decrypted enthält: inner_nonce (12B) || inner_tag (16B) || inner_ct_len (4B LE) || inner_ct || CSPRNG-Padding
@@ -149,6 +150,7 @@ pub fn read_carrier_block(
         &inner_nonce,
         &inner_tag,
         format_version,
+        chunk_rec.generation,
     )?;
 
     Ok(inner_plaintext)
@@ -167,6 +169,8 @@ pub fn write_carrier_block(
     plaintext: &[u8],
     format_version: u32,
 ) -> Result<()> {
+    let gen = 0u64;
+
     // 1. Innere Schicht verschlüsseln (mit dek_inner = DEK_1)
     let (inner_ct, inner_nonce, inner_tag) = encrypt_chunk(
         dek_inner,
@@ -174,6 +178,7 @@ pub fn write_carrier_block(
         block_idx,
         plaintext,
         format_version,
+        gen,
     )?;
 
     let inner_ct_len = inner_ct.len() as u32;
@@ -208,12 +213,14 @@ pub fn write_carrier_block(
         block_idx,
         &outer_plaintext,
         format_version,
+        gen,
     )?;
 
     // 4. In SQLite schreiben (in-place Überschreiben des bestehenden Chunks)
     db.write_chunk(
         carrier_node_id,
         block_idx,
+        gen,
         &outer_nonce,
         &outer_tag,
         &outer_ct,
@@ -234,17 +241,20 @@ pub fn shred_carrier_block(
     let mut noise = vec![0u8; CHUNK_SIZE];
     OsRng.fill_bytes(&mut noise);
 
+    let gen = 0u64;
     let (outer_ct, outer_nonce, outer_tag) = encrypt_chunk(
         dek_outer,
         carrier_node_id,
         block_idx,
         &noise,
         format_version,
+        gen,
     )?;
 
     db.write_chunk(
         carrier_node_id,
         block_idx,
+        gen,
         &outer_nonce,
         &outer_tag,
         &outer_ct,