fix(crypto): K-02 — format v3 chunk replay protection with generation aad

2026-09-19 00:52:13 +02:00
parent ad531d8393
commit 36a4094336
9 changed files with 553 additions and 99 deletions
@@ -433,8 +433,8 @@ async fn test_sanctum_v1_backward_compatibility() {
    // V1 Chunk mit encrypt_chunk(..., FORMAT_VERSION_V1) erzeugen und direkt in DB schreiben
    let v1_plaintext = b"Legacy Sanctum V1 uncompressed data payload.";
    let (ct, nonce, tag) =
-        encrypt_chunk(&dek, node.id, 0, v1_plaintext, FORMAT_VERSION_V1).expect("encrypt v1");
-    db.write_chunk(node.id, 0, &nonce, &tag, &ct)
+        encrypt_chunk(&dek, node.id, 0, v1_plaintext, FORMAT_VERSION_V1, 0).expect("encrypt v1");
+    db.write_chunk(node.id, 0, 0, &nonce, &tag, &ct)
        .expect("write chunk");
    db.update_node_size_and_time(node.id, v1_plaintext.len() as u64, 12345678)
        .expect("update size");