nx_chacha20_poly1305.nx

nx_chacha20_poly1305.nx -- AEAD per RFC 8439 §2.8. Phase 0b §A.2 of the Nishi TLS 1.3 stack per docs/NISHI_TLS13_GAP_AUDIT.md. Composes the already-shipped ChaCha20 stream cipher and Poly1305 universal hash into the Authenticated Encryption with Associated Data primitive that TLS 1.3, QUIC, WireGuard, Signal, and Noise all use. Construction: 1. otk = ChaCha20(key, counter=0, nonce)[0..32] -- the per-message Poly1305 key, fresh because nonce is fresh 2. ciphertext = ChaCha20(key, counter=1, nonce, plaintext) -- counter starts at 1 because counter 0 was burnt on the OTK 3. mac_data = aad || pad16(aad) || ct || pad16(ct) || u64_le(|aad|) || u64_le(|ct|) 4. tag = Poly1305(otk, mac_data) Decrypt is symmetric: recompute tag, constant-time compare, then XOR ciphertext with the same keystream. Tag check FIRST, decrypt AFTER -- this matters because returning plaintext when the tag failed would let an attacker probe for valid ciphertexts byte-by-byte (the classic CBC-padding-oracle attack pattern, ported to AEAD by careless implementations). What it does today: - encrypt + tag in one call - decrypt + verify in one call; constant-time tag compare - sealed AEAD verdict (OK / TAG_MISMATCH) What it doesn't do yet: - chunked / streaming encryption (one-shot only; matches TLS 1.3 record-layer usage which is bounded by 2^14 + 256) - extended XChaCha20-Poly1305 (24-byte nonce variant; Signal + libsodium use this; not yet in TLS 1.3) KAT verified: - RFC 8439 §2.8.2 worked example (114-byte Sunscreen vector + 12-byte AAD; both ciphertext and tag match spec) - internal round-trip on random-ish data - tampered-tag rejection - tampered-ciphertext rejection