go-synapse-backupper/pkg/adapters/crypto/composite/composite_test.go

package composite

import (
	"bytes"
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"encoding/binary"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"os"
	"testing"

	"git.tswf.io/infra/go-synapse-backupper/pkg/domain/crypto"
)

// ---------------------------------------------------------------------------
// Test KEM harness
//
// The composite format pins slot 0 = PQ (schemeID 0x0006, ciphertext length
// 1088) and slot 1 = classical (schemeID 0x0007, ciphertext length 32),
// matching the real mlkem768 + x25519 adapter contracts. Adapters' priv types
// are unexported and reject type-asserted impostors at Decapsulate, and the
// composite todo's scope forbids touching adapter packages — so tests exercise
// the composite with deterministic fake KEMs (registered under the SAME
// schemeIDs as the real adapters). The committed golden fixture uses these
// fakes; the composite production code is exercised end-to-end on the format,
// the HKDF combiner, AES-256-GCM wrapping, and chunked AEAD.
// ---------------------------------------------------------------------------

const (
	fakePqSchemeID        uint16 = 0x0006
	fakeClassicalSchemeID uint16 = 0x0007
	fakePqCtLen           int    = 1088 // matches crypto/mlkem EncapsulateKey768 ciphertext length
	fakeClassicalCtLen    int    = 32   // matches X25519 ephemeral pubkey length
	fakeSeedLen           int    = 32
)

// fakeKem derives a deterministic shared secret per pub/ct pair:
//
//	ss = SHA256(pub_raw_or_priv_raw || ct)
//
// where pub.raw and priv.raw are both the random seed; randomness lives only
// in the ct (the call site's rand supplies ct bytes), so decapsulation with
// the matching priv always recovers the encryption-time ss.
type fakeKem struct {
	schemeIDValue uint16
	ctLenValue    int
}

func newFakePqKem() crypto.KEM {
	return &fakeKem{schemeIDValue: fakePqSchemeID, ctLenValue: fakePqCtLen}
}

func newFakeClassicalKem() crypto.KEM {
	return &fakeKem{schemeIDValue: fakeClassicalSchemeID, ctLenValue: fakeClassicalCtLen}
}

func (k *fakeKem) SchemeID() uint16 { return k.schemeIDValue }

func (k *fakeKem) GenerateKeyPair(
	rand io.Reader,
) (
	crypto.RecipientPub,
	crypto.RecipientPriv,
	error,
) {
	seed := make([]byte, fakeSeedLen)
	if _, err := io.ReadFull(rand, seed); err != nil {
		return nil, nil, err
	}
	return newFakePub(k.schemeIDValue, seed), newFakePriv(k.schemeIDValue, seed), nil
}

func (k *fakeKem) Encapsulate(
	pub crypto.RecipientPub,
	rand io.Reader,
) (
	ciphertext []byte,
	sharedSecret []byte,
	err error,
) {
	p, ok := pub.(*fakePub)
	if !ok {
		return nil, nil, errors.New("fakeKem: invalid pub type")
	}
	ciphertext = make([]byte, k.ctLenValue)
	if _, err := io.ReadFull(rand, ciphertext); err != nil {
		return nil, nil, err
	}
	return ciphertext, deriveFakeSS(p.raw, ciphertext), nil
}

func (k *fakeKem) Decapsulate(
	priv crypto.RecipientPriv,
	ciphertext []byte,
) (
	sharedSecret []byte,
	err error,
) {
	p, ok := priv.(*fakePriv)
	if !ok {
		return nil, errors.New("fakeKem: invalid priv type")
	}
	if len(ciphertext) != k.ctLenValue {
		return nil, errors.New("fakeKem: invalid ciphertext length")
	}
	return deriveFakeSS(p.raw, ciphertext), nil
}

func (k *fakeKem) LoadPriv(
	raw []byte,
) (
	crypto.RecipientPriv,
	error,
) {
	return newFakePriv(k.schemeIDValue, raw), nil
}

func deriveFakeSS(
	raw, ciphertext []byte,
) []byte {
	h := sha256.New()
	h.Write(raw)
	h.Write(ciphertext)
	return h.Sum(nil)
}

// fakePub / fakePriv — deterministic raw-bytes-backed recipients.
type fakePub struct {
	scheme uint16
	raw    []byte
	keyID  []byte
}

func newFakePub(
	scheme uint16,
	raw []byte,
) *fakePub {
	h := sha256.Sum256(raw)
	return &fakePub{
		scheme: scheme,
		raw:    append([]byte(nil), raw...),
		keyID:  h[:8],
	}
}

func (f *fakePub) SchemeID() uint16 { return f.scheme }
func (f *fakePub) KeyID() []byte    { return f.keyID }
func (f *fakePub) Raw() []byte      { return f.raw }

type fakePriv struct {
	scheme uint16
	raw    []byte
	keyID  []byte
}

func newFakePriv(
	scheme uint16,
	raw []byte,
) *fakePriv {
	h := sha256.Sum256(raw)
	return &fakePriv{
		scheme: scheme,
		raw:    append([]byte(nil), raw...),
		keyID:  h[:8],
	}
}

func (f *fakePriv) SchemeID() uint16 { return f.scheme }
func (f *fakePriv) KeyID() []byte    { return f.keyID }
func (f *fakePriv) Raw() []byte      { return f.raw }

// fakeRegistry returns a Registry with the two fake KEMs registered under
// the v2 slot schemeIDs.
func fakeRegistry(
	t *testing.T,
) crypto.Registry {
	t.Helper()
	reg := crypto.NewRegistry()
	if err := reg.Register(fakePqSchemeID, newFakePqKem); err != nil {
		t.Fatalf("register pq fake: %v", err)
	}
	if err := reg.Register(fakeClassicalSchemeID, newFakeClassicalKem); err != nil {
		t.Fatalf("register classical fake: %v", err)
	}
	return reg
}

// generateFakeKeyPair generates (pub, priv) for slot schemeID from rand.
func generateFakeKeyPair(
	t *testing.T,
	reg crypto.Registry,
	schemeID uint16,
	rand io.Reader,
) (
	crypto.RecipientPub,
	crypto.RecipientPriv,
) {
	t.Helper()
	factory, err := reg.Lookup(schemeID)
	if err != nil {
		t.Fatalf("lookup 0x%04x: %v", schemeID, err)
	}
	pub, priv, err := factory().GenerateKeyPair(rand)
	if err != nil {
		t.Fatalf("generate 0x%04x: %v", schemeID, err)
	}
	return pub, priv
}

// standardHeaderLen returns the fixed artifact-header length given the two
// slot ciphertext lengths: 11 (magic+version+flags+nRecipients) +
// per-slot (14 + ctLen) + 72 (wrapNonce+wrappedCEK+firstPayloadNonce).
func standardHeaderLen(
	pqCtLen, classicalCtLen int,
) int {
	return 11 + (14 + pqCtLen) + (14 + classicalCtLen) + (12 + 48 + 12)
}

// countingReader wraps an io.Reader and counts how many bytes have been read
// — used by the adversarial-parser tests to assert the parser does NOT
// consume past the header before bailing out.
type countingReader struct {
	r io.Reader
	n int64
}

func (c *countingReader) Read(
	p []byte,
) (int, error) {
	readN, err := c.r.Read(p)
	c.n += int64(readN)
	return readN, err
}

// ---------------------------------------------------------------------------
// Tests (a) through (p)
// ---------------------------------------------------------------------------

// (a) Golden format fixture.
func TestGoldenFormat(
	t *testing.T,
) {
	goldenBytes := mustReadFile(t, "testdata/golden-1byte.pqenc")

	// Header byte offsets pinned verbatim — if any of these breaks, the
	// on-disk format has drifted and old .pqenc files won't decrypt.
	//   [0:4]    magic u32 BE      = 0x47535051
	//   [4:6]    version u16 BE    = 0x0002
	//   [6:10]   flags u32 BE      = 0x00000000
	//   [10]     nRecipients u8    = 0x02
	//   [11:13]  slot0 schemeID    = 0x0006
	//   [13:21]  slot0 keyID 8B
	//   [21:25]  slot0 ctLen u32   = 1088
	//   [25:1113]  slot0 ciphertext (1088 bytes)
	//   [1113:1115] slot1 schemeID = 0x0007
	if binary.BigEndian.Uint32(goldenBytes[0:4]) != 0x47535051 {
		t.Errorf("magic = 0x%08x, want 0x47535051", binary.BigEndian.Uint32(goldenBytes[0:4]))
	}
	if binary.BigEndian.Uint16(goldenBytes[4:6]) != 0x0002 {
		t.Errorf("version = 0x%04x, want 0x0002", binary.BigEndian.Uint16(goldenBytes[4:6]))
	}
	if binary.BigEndian.Uint32(goldenBytes[6:10]) != 0x00000000 {
		t.Errorf("flags = 0x%08x, want 0", binary.BigEndian.Uint32(goldenBytes[6:10]))
	}
	if goldenBytes[10] != 0x02 {
		t.Errorf("nRecipients = 0x%02x, want 0x02", goldenBytes[10])
	}
	if binary.BigEndian.Uint16(goldenBytes[11:13]) != 0x0006 {
		t.Errorf("slot0 schemeID = 0x%04x, want 0x0006", binary.BigEndian.Uint16(goldenBytes[11:13]))
	}
	if binary.BigEndian.Uint16(goldenBytes[1113:1115]) != 0x0007 {
		t.Errorf("slot1 schemeID = 0x%04x, want 0x0007", binary.BigEndian.Uint16(goldenBytes[1113:1115]))
	}

	// Decrypt-equality: reconstruct privs from committed golden-keys.json
	// and assert Decrypt yields the 0xAA plaintext committed via golden_generate.
	pqPriv, classicalPriv := loadGoldenPrivs(t, "testdata/golden-keys.json")

	dec := NewDecryptor(fakeRegistry(t))
	out := &bytes.Buffer{}
	if err := dec.Decrypt(
		bytes.NewReader(goldenBytes),
		[]crypto.RecipientPriv{pqPriv, classicalPriv},
		out,
	); err != nil {
		t.Fatalf("Decrypt(golden) failed: %v", err)
	}
	if !bytes.Equal(out.Bytes(), []byte{0xAA}) {
		t.Errorf("decrypted = %x, want [0xAA]", out.Bytes())
	}
}

// (b) Round-trip on canonical input sizes.
func TestRoundTrip(
	t *testing.T,
) {
	sizes := []int{0, 1, 64*1024 - 1, 64 * 1024, 64*1024 + 1, 1 << 20}
	for _, size := range sizes {
		t.Run(fmt.Sprintf("size=%d", size), func(t *testing.T) {
			plaintext := make([]byte, size)
			for i := 0; i < size; i++ {
				plaintext[i] = byte(i)
			}

			reg := fakeRegistry(t)
			enc := NewEncryptor(reg)
			dec := NewDecryptor(reg)

			pqPub, pqPriv := generateFakeKeyPair(t, reg, fakePqSchemeID, rand.Reader)
			classicalPub, classicalPriv := generateFakeKeyPair(t, reg, fakeClassicalSchemeID, rand.Reader)

			var encrypted bytes.Buffer
			if err := enc.Encrypt(
				bytes.NewReader(plaintext),
				[]crypto.RecipientPub{pqPub, classicalPub},
				&encrypted,
				rand.Reader,
			); err != nil {
				t.Fatalf("Encrypt: %v", err)
			}

			out := &bytes.Buffer{}
			if err := dec.Decrypt(
				bytes.NewReader(encrypted.Bytes()),
				[]crypto.RecipientPriv{pqPriv, classicalPriv},
				out,
			); err != nil {
				t.Fatalf("Decrypt: %v", err)
			}
			if !bytes.Equal(out.Bytes(), plaintext) {
				t.Errorf("round-trip mismatch: got %d bytes, want %d", out.Len(), len(plaintext))
			}
		})
	}
}

// (c) Empty plaintext produces exactly ONE chunk with flags=0x01 and a 16B
// (tag-only) ciphertext.
func TestEmptyPlaintextSingleFinalChunk(
	t *testing.T,
) {
	reg := fakeRegistry(t)
	enc := NewEncryptor(reg)

	pqPub, _ := generateFakeKeyPair(t, reg, fakePqSchemeID, rand.Reader)
	classicalPub, _ := generateFakeKeyPair(t, reg, fakeClassicalSchemeID, rand.Reader)

	var encrypted bytes.Buffer
	if err := enc.Encrypt(
		bytes.NewReader(nil),
		[]crypto.RecipientPub{pqPub, classicalPub},
		&encrypted,
		rand.Reader,
	); err != nil {
		t.Fatalf("Encrypt: %v", err)
	}

	headerLen := standardHeaderLen(fakePqCtLen, fakeClassicalCtLen)
	chunks := encrypted.Bytes()[headerLen:]

	// Expected record: [len=16 u32 (4B)][flags=0x01 (1B)][ciphertext (16B)].
	if len(chunks) != 4+1+16 {
		t.Fatalf("expected 21-byte chunk record, got %d bytes", len(chunks))
	}
	if ctLen := binary.BigEndian.Uint32(chunks[0:4]); ctLen != 16 {
		t.Errorf("ctLen = %d, want 16 (tag-only)", ctLen)
	}
	if chunks[4] != 0x01 {
		t.Errorf("flags = 0x%02x, want 0x01", chunks[4])
	}
	if len(chunks[5:]) != 16 {
		t.Errorf("ciphertext = %d bytes, want 16 (tag-only)", len(chunks[5:]))
	}
}

// (d) Exactly-64KiB input produces TWO chunks: full body (flags=0x00) and
// zero-length final marker (flags=0x01).
func TestExactly64KiBTwoChunks(
	t *testing.T,
) {
	reg := fakeRegistry(t)
	enc := NewEncryptor(reg)

	pqPub, _ := generateFakeKeyPair(t, reg, fakePqSchemeID, rand.Reader)
	classicalPub, _ := generateFakeKeyPair(t, reg, fakeClassicalSchemeID, rand.Reader)

	plaintext := bytes.Repeat([]byte{0xCC}, 64*1024)
	var encrypted bytes.Buffer
	if err := enc.Encrypt(
		bytes.NewReader(plaintext),
		[]crypto.RecipientPub{pqPub, classicalPub},
		&encrypted,
		rand.Reader,
	); err != nil {
		t.Fatalf("Encrypt: %v", err)
	}

	headerLen := standardHeaderLen(fakePqCtLen, fakeClassicalCtLen)
	chunks := encrypted.Bytes()[headerLen:]

	// Chunk 1: full body. ct = 64 KiB plaintext + 16B tag.
	const bodyCtLen = 64*1024 + 16
	if ctLen := binary.BigEndian.Uint32(chunks[0:4]); ctLen != bodyCtLen {
		t.Errorf("chunk1 ctLen = %d, want %d", ctLen, bodyCtLen)
	}
	if chunks[4] != 0x00 {
		t.Errorf("chunk1 flags = 0x%02x, want 0x00", chunks[4])
	}

	// Chunk 2: zero-length final marker (ct = 16B tag), flags = 0x01.
	chunk2Start := 4 + 1 + bodyCtLen
	if chunk2Start+5 > len(chunks) {
		t.Fatalf("file truncated before chunk 2: need offset %d, have %d", chunk2Start+5, len(chunks))
	}
	if ctLen := binary.BigEndian.Uint32(chunks[chunk2Start : chunk2Start+4]); ctLen != 16 {
		t.Errorf("chunk2 ctLen = %d, want 16 (zero-length marker)", ctLen)
	}
	if chunks[chunk2Start+4] != 0x01 {
		t.Errorf("chunk2 flags = 0x%02x, want 0x01", chunks[chunk2Start+4])
	}

	chunk3Start := chunk2Start + 4 + 1 + 16
	if chunk3Start != len(chunks) {
		t.Errorf("expected exactly 2 chunks; remaining = %d bytes after chunk 2", len(chunks)-chunk3Start)
	}
}

// (e) Counter wrap-around: with chunkNonce[4:12]=0xFFFFFFFFFFFFFFFF, an
// attempt to encrypt a SECOND body chunk fails on counter increment and
// returns ErrNonceCounterWrapped.
func TestCounterWraparound(
	t *testing.T,
) {
	// firstPayloadNonce: slot 0..3 = arbitrary base; slot 4..11 = 0xFF*8.
	firstPayloadNonce := make([]byte, 12)
	firstPayloadNonce[0] = 0xde
	firstPayloadNonce[1] = 0xad
	firstPayloadNonce[2] = 0xbe
	firstPayloadNonce[3] = 0xef
	for i := 4; i < 12; i++ {
		firstPayloadNonce[i] = 0xFF
	}

	cek := make([]byte, 32)
	if _, err := io.ReadFull(rand.Reader, cek); err != nil {
		t.Fatalf("rand: %v", err)
	}
	block, err := aes.NewCipher(cek)
	if err != nil {
		t.Fatalf("aes: %v", err)
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		t.Fatalf("gcm: %v", err)
	}

	// 64 KiB + 1 byte forces 2 body chunks; incrementing after chunk 1
	// wraps to 0 and ErrNonceCounterWrapped (the second chunk's emission
	// never happens).
	input := make([]byte, chunkSize+1)
	var out bytes.Buffer
	err = encryptChunks(bytes.NewReader(input), &out, gcm, firstPayloadNonce)
	if !errors.Is(err, ErrNonceCounterWrapped) {
		t.Errorf("expected ErrNonceCounterWrapped, got %v", err)
	}
}

// (f) Tamper 1 byte in payload → ErrTamperingDetected.
func TestTamperPayload(
	t *testing.T,
) {
	reg := fakeRegistry(t)
	enc := NewEncryptor(reg)
	dec := NewDecryptor(reg)

	pqPub, pqPriv := generateFakeKeyPair(t, reg, fakePqSchemeID, rand.Reader)
	classicalPub, classicalPriv := generateFakeKeyPair(t, reg, fakeClassicalSchemeID, rand.Reader)

	plaintext := bytes.Repeat([]byte{0x88}, 64*1024+1) // enough to produce a body chunk + final
	var encrypted bytes.Buffer
	if err := enc.Encrypt(
		bytes.NewReader(plaintext),
		[]crypto.RecipientPub{pqPub, classicalPub},
		&encrypted,
		rand.Reader,
	); err != nil {
		t.Fatalf("Encrypt: %v", err)
	}

	buf := encrypted.Bytes()
	headerLen := standardHeaderLen(fakePqCtLen, fakeClassicalCtLen)
	tamperIdx := headerLen + 4 + 1 + 8 // into first chunk ciphertext, past len + flags
	if tamperIdx >= len(buf) {
		t.Fatalf("file too small to tamper: idx=%d len=%d", tamperIdx, len(buf))
	}
	buf[tamperIdx] ^= 0x01

	out := &bytes.Buffer{}
	err := dec.Decrypt(
		bytes.NewReader(buf),
		[]crypto.RecipientPriv{pqPriv, classicalPriv},
		out,
	)
	if !errors.Is(err, ErrTamperingDetected) {
		t.Errorf("expected ErrTamperingDetected, got %v", err)
	}
}

// (g) Tamper 1 byte in wrappedCEK → ErrTamperingDetected.
func TestTamperWrappedCEK(
	t *testing.T,
) {
	reg := fakeRegistry(t)
	enc := NewEncryptor(reg)
	dec := NewDecryptor(reg)

	pqPub, pqPriv := generateFakeKeyPair(t, reg, fakePqSchemeID, rand.Reader)
	classicalPub, classicalPriv := generateFakeKeyPair(t, reg, fakeClassicalSchemeID, rand.Reader)

	var encrypted bytes.Buffer
	if err := enc.Encrypt(
		bytes.NewReader([]byte{0xAA}),
		[]crypto.RecipientPub{pqPub, classicalPub},
		&encrypted,
		rand.Reader,
	); err != nil {
		t.Fatalf("Encrypt: %v", err)
	}

	buf := encrypted.Bytes()

	// wrappedCEK starts at: header-prefix (11) + slot0 (+ct) + slot1 (+ct) + wrapNonce (12).
	wrapOffset := 11 + (14 + fakePqCtLen) + (14 + fakeClassicalCtLen) + 12
	if wrapOffset+wrappedCekLen > len(buf) {
		t.Fatalf("file too short for wrappedCEK")
	}
	buf[wrapOffset+5] ^= 0x01

	out := &bytes.Buffer{}
	err := dec.Decrypt(
		bytes.NewReader(buf),
		[]crypto.RecipientPriv{pqPriv, classicalPriv},
		out,
	)
	if !errors.Is(err, ErrTamperingDetected) {
		t.Errorf("expected ErrTamperingDetected, got %v", err)
	}
}

// (h) Wrong priv key (swap pq.priv with another) → ErrWrongKeys.
func TestWrongPrivKey(
	t *testing.T,
) {
	reg := fakeRegistry(t)
	enc := NewEncryptor(reg)
	dec := NewDecryptor(reg)

	pqPub, _ := generateFakeKeyPair(t, reg, fakePqSchemeID, rand.Reader)
	classicalPub, classicalPriv := generateFakeKeyPair(t, reg, fakeClassicalSchemeID, rand.Reader)

	// Different PQ priv — fresh seed, hence different KeyID.
	_, wrongPqPriv := generateFakeKeyPair(t, reg, fakePqSchemeID, rand.Reader)
	// Sanity: the wrong priv's keyID must not collide with the original
	// pub's (otherwise this test would degrade into a keyID-collision case).
	if bytes.Equal(wrongPqPriv.KeyID(), pqPub.KeyID()) {
		t.Fatalf("wrongPqPriv keyID accidentally collides with pqPub keyID; reseed")
	}

	var encrypted bytes.Buffer
	if err := enc.Encrypt(
		bytes.NewReader([]byte{0x11, 0x22, 0x33}),
		[]crypto.RecipientPub{pqPub, classicalPub},
		&encrypted,
		rand.Reader,
	); err != nil {
		t.Fatalf("Encrypt: %v", err)
	}

	out := &bytes.Buffer{}
	err := dec.Decrypt(
		bytes.NewReader(encrypted.Bytes()),
		[]crypto.RecipientPriv{wrongPqPriv, classicalPriv},
		out,
	)
	if !errors.Is(err, ErrWrongKeys) {
		t.Errorf("expected ErrWrongKeys, got %v", err)
	}
}

// (i) Format conformance: magic, version, nRecipients.
func TestFormatConformance(
	t *testing.T,
) {
	reg := fakeRegistry(t)
	enc := NewEncryptor(reg)
	pqPub, _ := generateFakeKeyPair(t, reg, fakePqSchemeID, rand.Reader)
	classicalPub, _ := generateFakeKeyPair(t, reg, fakeClassicalSchemeID, rand.Reader)

	var out bytes.Buffer
	if err := enc.Encrypt(
		bytes.NewReader([]byte{0x42}),
		[]crypto.RecipientPub{pqPub, classicalPub},
		&out,
		rand.Reader,
	); err != nil {
		t.Fatalf("Encrypt: %v", err)
	}

	outBytes := out.Bytes()
	if binary.BigEndian.Uint32(outBytes[0:4]) != 0x47535051 {
		t.Errorf("magic = 0x%08x, want 0x47535051", binary.BigEndian.Uint32(outBytes[0:4]))
	}
	if binary.BigEndian.Uint16(outBytes[4:6]) != 0x0002 {
		t.Errorf("version = 0x%04x, want 0x0002", binary.BigEndian.Uint16(outBytes[4:6]))
	}
	if outBytes[10] != 0x02 {
		t.Errorf("nRecipients = 0x%02x, want 0x02", outBytes[10])
	}
}

// (j) Adversarial parser: version==0x0001 → ErrUnsupportedVersion, with no
// GCM operations attempted (proven by the post-validation byte counter
// remaining at the prefix length — the parser does not consume past the
// header before bailing).
func TestUnsupportedVersionNoGCM(
	t *testing.T,
) {
	reg := fakeRegistry(t)
	dec := NewDecryptor(reg)

	// File: magic + version=0x0001 + flags + nRecipients=0x02 + filler.
	var buf bytes.Buffer
	_ = binary.Write(&buf, binary.BigEndian, uint32(0x47535051)) // magic
	_ = binary.Write(&buf, binary.BigEndian, uint16(0x0001))     // version (downgrade probe)
	buf.Write(make([]byte, 200))                                 // filler

	// Dummy privs — irrelevant because the parser bails at version check,
	// but Decrypt accepts the slice shape.
	_, pqPriv := generateFakeKeyPair(t, reg, fakePqSchemeID, rand.Reader)
	_, classicalPriv := generateFakeKeyPair(t, reg, fakeClassicalSchemeID, rand.Reader)

	reader := &countingReader{r: bytes.NewReader(buf.Bytes())}
	out := &bytes.Buffer{}
	err := dec.Decrypt(
		reader,
		[]crypto.RecipientPriv{pqPriv, classicalPriv},
		out,
	)
	if !errors.Is(err, ErrUnsupportedVersion) {
		t.Errorf("expected ErrUnsupportedVersion, got %v", err)
	}

	// The parser consumed only the 11-byte prefix — no further bytes read,
	// hence no GCM operations attempted.
	if reader.n != 11 {
		t.Errorf("Decrypt consumed %d bytes post-validation; expected exactly 11 (the fixed prefix)", reader.n)
	}
}

// (k) nRecipients==0 → ErrMalformedHeader.
func TestZeroRecipients(
	t *testing.T,
) {
	var buf bytes.Buffer
	_ = binary.Write(&buf, binary.BigEndian, uint32(0x47535051)) // magic
	_ = binary.Write(&buf, binary.BigEndian, uint16(0x0002))     // version
	_ = binary.Write(&buf, binary.BigEndian, uint32(0))          // flags
	buf.WriteByte(0x00)                                          // nRecipients = 0
	buf.Write(make([]byte, 64))                                  // filler

	dec := NewDecryptor(fakeRegistry(t))
	err := dec.Decrypt(bytes.NewReader(buf.Bytes()), nil, &bytes.Buffer{})
	if !errors.Is(err, ErrMalformedHeader) {
		t.Errorf("expected ErrMalformedHeader, got %v", err)
	}
}

// (l) nRecipients>2 OR ctLen > maxRecipientCiphertextLen →
// ErrMalformedHeader BEFORE io.ReadFull attempts to allocate the
// oversized ciphertext buffer.
func TestMalformedHeaderCtLenOverflow(
	t *testing.T,
) {
	t.Run("nRecipients_gt_2", func(t *testing.T) {
		var buf bytes.Buffer
		_ = binary.Write(&buf, binary.BigEndian, uint32(0x47535051)) // magic
		_ = binary.Write(&buf, binary.BigEndian, uint16(0x0002))     // version
		_ = binary.Write(&buf, binary.BigEndian, uint32(0))          // flags
		buf.WriteByte(0x03)                                          // nRecipients = 3
		buf.Write(make([]byte, 200))                                 // filler

		dec := NewDecryptor(fakeRegistry(t))
		err := dec.Decrypt(bytes.NewReader(buf.Bytes()), nil, &bytes.Buffer{})
		if !errors.Is(err, ErrMalformedHeader) {
			t.Errorf("expected ErrMalformedHeader, got %v", err)
		}
	})

	t.Run("ctLen_overflow", func(t *testing.T) {
		var buf bytes.Buffer
		_ = binary.Write(&buf, binary.BigEndian, uint32(0x47535051)) // magic
		_ = binary.Write(&buf, binary.BigEndian, uint16(0x0002))     // version
		_ = binary.Write(&buf, binary.BigEndian, uint32(0))          // flags
		buf.WriteByte(0x02)                                          // nRecipients = 2

		// Slot 0 metadata only — schemeID, keyID, ctLen = 2 MiB (over the
		// 1<<20 cap). The parser validates ctLen BEFORE allocating and
		// reading per-slot ciphertext bytes, so it must reject at this
		// point without attempting io.ReadFull of an oversized buffer.
		_ = binary.Write(&buf, binary.BigEndian, uint16(0x0006))
		buf.Write(make([]byte, 8))                                    // keyID
		_ = binary.Write(&buf, binary.BigEndian, uint32(2*1024*1024)) // ctLen

		reader := &countingReader{r: bytes.NewReader(buf.Bytes())}
		dec := NewDecryptor(fakeRegistry(t))
		_, pqPriv := generateFakeKeyPair(t, fakeRegistry(t), fakePqSchemeID, rand.Reader)
		_, classicalPriv := generateFakeKeyPair(t, fakeRegistry(t), fakeClassicalSchemeID, rand.Reader)
		err := dec.Decrypt(
			reader,
			[]crypto.RecipientPriv{pqPriv, classicalPriv},
			&bytes.Buffer{},
		)
		if !errors.Is(err, ErrMalformedHeader) {
			t.Errorf("expected ErrMalformedHeader, got %v", err)
		}
		// Consumed exactly prefix(11) + slot0 metadata(14) = 25 bytes — the
		// ctLen validation fired before reading any slot1 metadata or any
		// per-slot ciphertext.
		if reader.n != 25 {
			t.Errorf("Decrypt consumed %d bytes; expected 25 (no io.ReadFull of oversized ct)", reader.n)
		}
	})
}

// (m) Chunk record with length==0 AND flags&0x01==0 → ErrMalformedChunk
// (prevents an infinite-loop DoS where the parser keeps scanning zero-size
// non-final chunks).
func TestZeroLengthNonFinalChunk(
	t *testing.T,
) {
	reg := fakeRegistry(t)
	enc := NewEncryptor(reg)
	dec := NewDecryptor(reg)

	pqPub, pqPriv := generateFakeKeyPair(t, reg, fakePqSchemeID, rand.Reader)
	classicalPub, classicalPriv := generateFakeKeyPair(t, reg, fakeClassicalSchemeID, rand.Reader)

	var encrypted bytes.Buffer
	if err := enc.Encrypt(
		bytes.NewReader([]byte{0xAA}),
		[]crypto.RecipientPub{pqPub, classicalPub},
		&encrypted,
		rand.Reader,
	); err != nil {
		t.Fatalf("Encrypt: %v", err)
	}

	headerLen := standardHeaderLen(fakePqCtLen, fakeClassicalCtLen)
	var corrupt bytes.Buffer
	corrupt.Write(encrypted.Bytes()[:headerLen])
	_ = binary.Write(&corrupt, binary.BigEndian, uint32(0)) // ctLen = 0
	corrupt.WriteByte(0x00)                                 // flags = 0x00 (NOT final)

	out := &bytes.Buffer{}
	err := dec.Decrypt(
		bytes.NewReader(corrupt.Bytes()),
		[]crypto.RecipientPriv{pqPriv, classicalPriv},
		out,
	)
	if !errors.Is(err, ErrMalformedChunk) {
		t.Errorf("expected ErrMalformedChunk, got %v", err)
	}
}

// (n) Chunk record with length > 64*1024+16 → ErrMalformedChunk.
func TestOversizedChunk(
	t *testing.T,
) {
	reg := fakeRegistry(t)
	enc := NewEncryptor(reg)
	dec := NewDecryptor(reg)

	pqPub, pqPriv := generateFakeKeyPair(t, reg, fakePqSchemeID, rand.Reader)
	classicalPub, classicalPriv := generateFakeKeyPair(t, reg, fakeClassicalSchemeID, rand.Reader)

	var encrypted bytes.Buffer
	if err := enc.Encrypt(
		bytes.NewReader([]byte{0xAA}),
		[]crypto.RecipientPub{pqPub, classicalPub},
		&encrypted,
		rand.Reader,
	); err != nil {
		t.Fatalf("Encrypt: %v", err)
	}

	headerLen := standardHeaderLen(fakePqCtLen, fakeClassicalCtLen)
	var corrupt bytes.Buffer
	corrupt.Write(encrypted.Bytes()[:headerLen])
	_ = binary.Write(&corrupt, binary.BigEndian, uint32(chunkSize+gcmTagLen+1)) // oversized
	corrupt.WriteByte(0x00)                                                     // flags = 0x00

	out := &bytes.Buffer{}
	err := dec.Decrypt(
		bytes.NewReader(corrupt.Bytes()),
		[]crypto.RecipientPriv{pqPriv, classicalPriv},
		out,
	)
	if !errors.Is(err, ErrMalformedChunk) {
		t.Errorf("expected ErrMalformedChunk, got %v", err)
	}
}

// (o) End-of-stream reached BEFORE any chunk with flags&0x01==1
// (truncated file after a body chunk with no final marker) →
// ErrUnexpectedEOF.
func TestPrematureEOF(
	t *testing.T,
) {
	reg := fakeRegistry(t)
	enc := NewEncryptor(reg)
	dec := NewDecryptor(reg)

	pqPub, pqPriv := generateFakeKeyPair(t, reg, fakePqSchemeID, rand.Reader)
	classicalPub, classicalPriv := generateFakeKeyPair(t, reg, fakeClassicalSchemeID, rand.Reader)

	plaintext := bytes.Repeat([]byte{0xAB}, 64*1024+1) // 2 body chunks + final marker
	var encrypted bytes.Buffer
	if err := enc.Encrypt(
		bytes.NewReader(plaintext),
		[]crypto.RecipientPub{pqPub, classicalPub},
		&encrypted,
		rand.Reader,
	); err != nil {
		t.Fatalf("Encrypt: %v", err)
	}

	headerLen := standardHeaderLen(fakePqCtLen, fakeClassicalCtLen)
	bodyCtLen := 64*1024 + 1 + gcmTagLen
	bodyChunkRecord := 4 + 1 + bodyCtLen
	truncatedLen := headerLen + bodyChunkRecord

	if truncatedLen >= len(encrypted.Bytes()) {
		t.Fatalf("encrypted file shorter than expected: %d vs expected truncation at %d",
			len(encrypted.Bytes()), truncatedLen)
	}

	out := &bytes.Buffer{}
	err := dec.Decrypt(
		bytes.NewReader(encrypted.Bytes()[:truncatedLen]),
		[]crypto.RecipientPriv{pqPriv, classicalPriv},
		out,
	)
	if !errors.Is(err, ErrUnexpectedEOF) {
		t.Errorf("expected ErrUnexpectedEOF, got %v", err)
	}
}

// (p) Truncated header → ErrMalformedHeader BEFORE any recipient allocation.
func TestTruncatedHeader(
	t *testing.T,
) {
	dec := NewDecryptor(fakeRegistry(t))

	// File is shorter than the fixed 11-byte prefix + per-recipient metadata
	// (2×14=28 = 39 bytes minimum): only 30 bytes total.
	var buf bytes.Buffer
	_ = binary.Write(&buf, binary.BigEndian, uint32(0x47535051)) // magic
	_ = binary.Write(&buf, binary.BigEndian, uint16(0x0002))     // version
	_ = binary.Write(&buf, binary.BigEndian, uint32(0))          // flags
	buf.WriteByte(0x02)                                          // nRecipients = 2
	buf.Write(make([]byte, 20))                                  // only 20 of the needed 28 metadata bytes

	reader := &countingReader{r: bytes.NewReader(buf.Bytes())}
	err := dec.Decrypt(reader, nil, &bytes.Buffer{})
	if !errors.Is(err, ErrMalformedHeader) {
		t.Errorf("expected ErrMalformedHeader, got %v", err)
	}
	// No recipient ct allocation happened — only the prefix (11) + partial
	// metadata (20) = 31 bytes consumed; well shy of a full prefix+meta
	// read that would precede any per-recipient ct allocation.
	if reader.n > 39 {
		t.Errorf("Decrypt consumed %d bytes; expected ≤ 39 — no recipient allocation occurred", reader.n)
	}
}

// ---------------------------------------------------------------------------
// Shared test helpers
// ---------------------------------------------------------------------------

func mustReadFile(
	t *testing.T,
	path string,
) []byte {
	t.Helper()
	data, err := os.ReadFile(path)
	if err != nil {
		t.Fatalf("read %s: %v", path, err)
	}
	return data
}

func mustB64Decode(
	t *testing.T,
	s string,
) []byte {
	t.Helper()
	b, err := base64.StdEncoding.DecodeString(s)
	if err != nil {
		t.Fatalf("base64 decode: %v", err)
	}
	return b
}

// loadGoldenPrivs reconstructs the two fake privs from the committed
// golden-keys.json (the file produced by //go:build golden_generate).
type goldenKeyFile struct {
	Pq        string `json:"pq"`
	Classical string `json:"classical"`
}

func loadGoldenPrivs(
	t *testing.T,
	path string,
) (
	*fakePriv,
	*fakePriv,
) {
	t.Helper()
	data := mustReadFile(t, path)
	var keys goldenKeyFile
	if err := json.Unmarshal(data, &keys); err != nil {
		t.Fatalf("unmarshal golden keys: %v", err)
	}
	pqRaw := mustB64Decode(t, keys.Pq)
	classicalRaw := mustB64Decode(t, keys.Classical)
	if len(pqRaw) != fakeSeedLen {
		t.Fatalf("pq raw len = %d, want %d", len(pqRaw), fakeSeedLen)
	}
	if len(classicalRaw) != fakeSeedLen {
		t.Fatalf("classical raw len = %d, want %d", len(classicalRaw), fakeSeedLen)
	}
	return newFakePriv(fakePqSchemeID, pqRaw), newFakePriv(fakeClassicalSchemeID, classicalRaw)
}