chore: add RustCrypto aes-gcm backend for wasm32 encryption

ring doesn't compile on wasm32-unknown-unknown (requires clang for C asm).
Move ring to a target-conditional dep (native only), add aes-gcm from
RustCrypto for wasm32. Both produce identical AES-256-GCM wire format:
[nonce(12)][ciphertext][auth_tag(16)]

Native targets continue using ring for hardware-accelerated performance.
wasm32 targets use aes-gcm (pure Rust) when wasm+encryption features active.

key_derivation.rs unchanged — already uses RustCrypto hkdf/sha2, compiles
on both targets without modification.

Author: 27Bslash6

Cargo.toml

@@ -36,10 +36,9 @@ lz4_flex = { version = "0.11", features = ["frame", "std"], optional = true }
 # xxHash3-64: ~36 GB/s, sufficient for corruption detection (security via AES-GCM auth tag)
 xxhash-rust = { version = "0.8", features = ["xxh3"], optional = true }
 
-
 # Encryption dependencies (all optional, gated by encryption feature)
 # Uses HKDF-SHA256 for key derivation (NOT Blake2b - that's only for Python cache keys)
-ring = { version = "0.17", optional = true }
+# ring is native-only (see [target.'cfg(not(target_arch = "wasm32"))'.dependencies])
 zeroize = { version = "1.8", features = ["derive"], optional = true }
 hkdf = { version = "0.12", optional = true }
 sha2 = { version = "0.10", optional = true }
@@ -49,10 +48,20 @@ generic-array = { version = "0.14", optional = true }
 # wasm32 RNG: getrandom with JS feature for wasm32-unknown-unknown targets
 getrandom = { version = "0.2", features = ["js"], optional = true }
 
+# RustCrypto: pure-Rust AES-256-GCM for wasm32 targets (ring requires clang + C asm)
+aes-gcm = { version = "0.10", optional = true }
+aes = { version = "0.8", optional = true }
+
 # Byte utilities
 bytes = "1.5"
 byteorder = "1.5"
 
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+# ring: hardware-accelerated AES-256-GCM for native targets only.
+# Does NOT compile on wasm32-unknown-unknown (requires clang for C asm).
+# Kept optional so it is only compiled when the `encryption` feature is active.
+ring = { version = "0.17", optional = true }
+
 [build-dependencies]
 # C header generation (required for ffi feature)
 cbindgen = "0.29"
@@ -72,6 +81,10 @@ checksum = ["dep:xxhash-rust"]
 messagepack = ["dep:rmp-serde"]
 
 # Encryption (AES-256-GCM with HKDF-SHA256 key derivation)
+# Native: ring provides hardware-accelerated AES-256-GCM (target-conditional dep above)
+# wasm32: aes-gcm (pure Rust) is used instead — activated by the `wasm` feature
+# Note: `dep:ring` is valid here because ring is declared optional in the target section;
+# on wasm32 targets the dep simply doesn't exist, so Cargo ignores it safely.
 encryption = [
     "dep:ring",
     "dep:zeroize",
@@ -84,8 +97,8 @@ encryption = [
 # C FFI layer (generates include/cachekit.h)
 ffi = []
 
-# wasm32 support: getrandom with JS bindings for RNG on wasm32-unknown-unknown
-wasm = ["dep:getrandom"]
+# wasm32 support: getrandom with JS bindings for RNG + RustCrypto AES-GCM for encryption
+wasm = ["dep:getrandom", "dep:aes-gcm", "dep:aes"]
 
 # Kani formal verification configuration
 # Provides mathematical proofs of memory safety for unsafe code and FFI boundaries

src/encryption/core.rs

@@ -20,10 +20,20 @@
 //! for a total of 2^96 unique nonces - far exceeding any practical usage.
 
 use crate::metrics::OperationMetrics;
+
+// Native: ring for AES-256-GCM (hardware-accelerated, requires clang)
+#[cfg(not(target_arch = "wasm32"))]
 use ring::{
     aead::{Aad, LessSafeKey, Nonce, UnboundKey, AES_256_GCM},
     rand::{SecureRandom, SystemRandom},
 };
+
+// wasm32: RustCrypto aes-gcm (pure Rust, compiles on wasm32-unknown-unknown)
+#[cfg(target_arch = "wasm32")]
+use aes_gcm::{
+    aead::{Aead, KeyInit, Payload},
+    Aes256Gcm, Nonce as AesGcmNonce,
+};
 #[cfg(not(target_arch = "wasm32"))]
 use std::sync::atomic::{AtomicU64, Ordering};
 #[cfg(not(target_arch = "wasm32"))]
@@ -330,6 +340,7 @@ impl ZeroKnowledgeEncryptor {
     ///
     /// # Returns
     /// Encrypted data in format: `[nonce(12)][ciphertext+auth_tag]`
+    #[cfg(not(target_arch = "wasm32"))]
     pub fn encrypt_aes_gcm(
         &self,
         plaintext: &[u8],
@@ -391,6 +402,7 @@ impl ZeroKnowledgeEncryptor {
     ///
     /// # Returns
     /// Decrypted plaintext data
+    #[cfg(not(target_arch = "wasm32"))]
     pub fn decrypt_aes_gcm(
         &self,
         ciphertext: &[u8],
@@ -489,6 +501,91 @@ impl ZeroKnowledgeEncryptor {
                 .into(),
         ))
     }
+
+    /// Encrypt data using AES-256-GCM with authenticated additional data (wasm32)
+    ///
+    /// Uses RustCrypto's `aes-gcm` crate (pure Rust, compiles on wasm32-unknown-unknown).
+    /// Produces identical wire format to the native `ring` path:
+    /// `[nonce(12)][ciphertext][auth_tag(16)]`
+    #[cfg(target_arch = "wasm32")]
+    pub fn encrypt_aes_gcm(
+        &self,
+        plaintext: &[u8],
+        key: &[u8],
+        aad: &[u8],
+    ) -> Result<Vec<u8>, EncryptionError> {
+        if key.len() != 32 {
+            return Err(EncryptionError::InvalidKeyLength(key.len()));
+        }
+
+        let nonce_bytes = self.generate_nonce()?;
+
+        let cipher = Aes256Gcm::new_from_slice(key)
+            .map_err(|e| EncryptionError::EncryptionFailed(format!("key error: {e}")))?;
+
+        let nonce = AesGcmNonce::from_slice(&nonce_bytes);
+
+        // encrypt() returns ciphertext || tag (no nonce) — same layout as ring's seal_in_place_append_tag
+        let ciphertext_with_tag = cipher
+            .encrypt(nonce, Payload { msg: plaintext, aad })
+            .map_err(|e| EncryptionError::EncryptionFailed(format!("AES-GCM encrypt failed: {e}")))?;
+
+        // Wire format: nonce(12) || ciphertext || tag(16) — identical to native ring output
+        let mut result = Vec::with_capacity(12 + ciphertext_with_tag.len());
+        result.extend_from_slice(&nonce_bytes);
+        result.extend_from_slice(&ciphertext_with_tag);
+
+        // Metrics: Instant unavailable on wasm32
+        if let Ok(mut metrics) = self.last_metrics.lock() {
+            *metrics = OperationMetrics::new().with_encryption(0u64, false);
+        }
+
+        Ok(result)
+    }
+
+    /// Decrypt data using AES-256-GCM with authenticated additional data (wasm32)
+    ///
+    /// Uses RustCrypto's `aes-gcm` crate (pure Rust, compiles on wasm32-unknown-unknown).
+    /// Expects identical wire format to the native `ring` path:
+    /// `[nonce(12)][ciphertext][auth_tag(16)]`
+    #[cfg(target_arch = "wasm32")]
+    pub fn decrypt_aes_gcm(
+        &self,
+        ciphertext: &[u8],
+        key: &[u8],
+        aad: &[u8],
+    ) -> Result<Vec<u8>, EncryptionError> {
+        if key.len() != 32 {
+            return Err(EncryptionError::InvalidKeyLength(key.len()));
+        }
+
+        // Minimum: nonce(12) + tag(16) = 28 bytes
+        if ciphertext.len() < 28 {
+            return Err(EncryptionError::InvalidCiphertext(
+                "ciphertext too short (minimum 28 bytes: 12 nonce + 16 tag)".into(),
+            ));
+        }
+
+        let nonce_bytes = &ciphertext[..12];
+        let encrypted_data = &ciphertext[12..]; // ciphertext + tag
+
+        let cipher = Aes256Gcm::new_from_slice(key)
+            .map_err(|e| EncryptionError::DecryptionFailed(format!("key error: {e}")))?;
+
+        let nonce = AesGcmNonce::from_slice(nonce_bytes);
+
+        // decrypt() verifies auth tag and returns plaintext
+        let plaintext = cipher
+            .decrypt(nonce, Payload { msg: encrypted_data, aad })
+            .map_err(|_| EncryptionError::AuthenticationFailed)?;
+
+        // Metrics: Instant unavailable on wasm32
+        if let Ok(mut metrics) = self.last_metrics.lock() {
+            *metrics = OperationMetrics::new().with_encryption(0u64, false);
+        }
+
+        Ok(plaintext)
+    }
 }
 
 // Note: Default is intentionally NOT implemented.