Certificate

# ===== Award criteria =====
# Pass: >= 70% across these dimensions
#   1. Primitive choice          (15 pts)
#   2. Key management            (20 pts)
#   3. Implementation hygiene    (20 pts)
#   4. Threat modelling          (15 pts)
#   5. Tests + verification      (15 pts)
#   6. Communication             (15 pts)
# Distinction: >= 85%

# ===== Project brief =====
# Build a small library + sample app that does ONE of:
#   - Encrypted-at-rest secret blobs (envelope encryption with a KMS)
#   - Signed deployment artifacts (Ed25519 + transparency log)
#   - Authenticated cookie sessions (HMAC + rotation)
#
# Deliver:
#   - lib/   primitive wrappers + tests
#   - app/   minimal CLI or HTTP service that uses lib/
#   - report.md  (max 800 words; threat model + key rotation plan)

# ===== Sample scaffold: envelope encryption (illustrative) =====
# encrypt:
#   1. data_key = random(32)
#   2. ciphertext = AES-256-GCM(key=data_key, nonce=random(12), plaintext)
#   3. wrapped_key = KMS.encrypt(data_key)              # never store raw data_key
#   4. store { wrapped_key, nonce, ciphertext, alg, kek_id, ts }
#
# decrypt:
#   1. data_key = KMS.decrypt(wrapped_key)
#   2. plaintext = AES-256-GCM.decrypt(data_key, nonce, ciphertext)
#   3. memset(data_key, 0)                              # zeroise where supported

# Node example (using node:crypto + a mock KMS):
import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';

export function encrypt(plaintext, kms, kekId) {
  const dataKey = randomBytes(32);
  const nonce   = randomBytes(12);
  const c       = createCipheriv('aes-256-gcm', dataKey, nonce);
  const ct      = Buffer.concat([c.update(plaintext), c.final()]);
  const tag     = c.getAuthTag();
  const wrapped = kms.encrypt(kekId, dataKey);
  dataKey.fill(0);
  return { kekId, wrapped, nonce, ct, tag, alg: 'A256GCM' };
}

export function decrypt(env, kms) {
  const dataKey = kms.decrypt(env.kekId, env.wrapped);
  const d = createDecipheriv('aes-256-gcm', dataKey, env.nonce);
  d.setAuthTag(env.tag);
  const pt = Buffer.concat([d.update(env.ct), d.final()]);
  dataKey.fill(0);
  return pt;
}

# ===== Marking sheet (example) =====
# 1. Primitives           14/15  AES-GCM + KMS for KEK, no DIY
# 2. Key management       18/20  rotation plan, KEK pinned per env
# 3. Implementation       18/20  authenticated tags, zeroised buffers
# 4. Threat model         13/15  identifies key compromise + replay paths
# 5. Tests                14/15  KAT vectors + tamper detection tests
# 6. Communication        12/15  rotation runbook is clear
# Total: 89/100 -> Distinction

# ===== Patterns to internalise =====
# - Never roll your own primitives; use vetted libraries + KMS
# - AEAD only (AES-GCM, ChaCha20-Poly1305): authenticated by design
# - Random nonces of the correct length; never reuse with the same key
# - Constant-time comparisons for MAC/HMAC checks
# - Document key rotation BEFORE go-live, not after a leak

# ===== Pitfalls =====
# - ECB or unauthenticated CBC -> chosen-ciphertext attacks
# - Storing raw data keys; always wrap with a KEK from a KMS
# - Reusing nonces -> GCM collapses catastrophically
# - Comparing MACs with == -> timing side-channel
# - Logging plaintext or wrapped keys 'just for debugging'

// /certificate/crypto