fix: resolve expert panel findings for wasm32 compat

- Fold aes-gcm/getrandom into encryption feature (no separate wasm flag needed)
- Enable zeroize on aes/aes-gcm deps (scrub round keys on drop)
- Add cross-backend wire format test (ring <-> aes-gcm roundtrip)
- Remove dead cfg guards inside native-only functions
- Consistency: error messages, min length expression, doc comments

Author: 27Bslash6

Cargo.toml

@@ -49,8 +49,8 @@ generic-array = { version = "0.14", optional = true }
 getrandom = { version = "0.2", features = ["js"], optional = true }
 
 # RustCrypto: pure-Rust AES-256-GCM for wasm32 targets (ring requires clang + C asm)
-aes-gcm = { version = "0.10", optional = true }
-aes = { version = "0.8", optional = true }
+aes-gcm = { version = "0.10", features = ["zeroize"], optional = true }
+aes = { version = "0.8", features = ["zeroize"], optional = true }
 
 # Byte utilities
 bytes = "1.5"
@@ -71,6 +71,7 @@ proptest = "1.4"
 serde_json = "1.0"
 blake2 = "0.10"
 hex = "0.4"
+aes-gcm = { version = "0.10", features = ["zeroize"] }
 
 [features]
 default = ["compression", "checksum", "messagepack"]
@@ -82,23 +83,26 @@ messagepack = ["dep:rmp-serde"]
 
 # Encryption (AES-256-GCM with HKDF-SHA256 key derivation)
 # Native: ring provides hardware-accelerated AES-256-GCM (target-conditional dep above)
-# wasm32: aes-gcm (pure Rust) is used instead — activated by the `wasm` feature
-# Note: `dep:ring` is valid here because ring is declared optional in the target section;
-# on wasm32 targets the dep simply doesn't exist, so Cargo ignores it safely.
+# wasm32: aes-gcm (pure Rust) is used instead — automatically selected via cfg(target_arch)
+# aes-gcm/aes/getrandom compile on native but are dead code (all usage behind wasm32 cfg);
+# the compiler optimizes them out.
 encryption = [
     "dep:ring",
     "dep:zeroize",
     "dep:hkdf",
     "dep:sha2",
     "dep:hmac",
     "dep:generic-array",
+    "dep:aes-gcm",
+    "dep:aes",
+    "dep:getrandom",
 ]
 
 # C FFI layer (generates include/cachekit.h)
 ffi = []
 
-# wasm32 support: getrandom with JS bindings for RNG + RustCrypto AES-GCM for encryption
-wasm = ["dep:getrandom", "dep:aes-gcm", "dep:aes"]
+# wasm32 support: alias for encryption (deps now folded into encryption feature)
+wasm = ["encryption"]
 
 # Kani formal verification configuration
 # Provides mathematical proofs of memory safety for unsafe code and FFI boundaries

src/encryption/core.rs

@@ -78,10 +78,10 @@ static GLOBAL_INSTANCE_COUNTER: LazyLock<AtomicU64> = LazyLock::new(|| {
 
 // ── wasm32: thread_local Cell<u64> seeded from getrandom ────────────────────
 
-/// Per-thread encryptor instance counter for wasm32 (no atomics available).
-///
-/// wasm32-unknown-unknown lacks threads, so a thread-local Cell<u64> is safe.
-/// Seeded from `getrandom` (which uses the JS crypto API via WASM).
+// Per-thread encryptor instance counter for wasm32 (no atomics available).
+//
+// wasm32-unknown-unknown lacks threads, so a thread-local Cell<u64> is safe.
+// Seeded from `getrandom` (which uses the JS crypto API via WASM).
 #[cfg(target_arch = "wasm32")]
 thread_local! {
     static WASM_INSTANCE_COUNTER: std::cell::Cell<u64> = {
@@ -347,8 +347,7 @@ impl ZeroKnowledgeEncryptor {
         key: &[u8],
         aad: &[u8],
     ) -> Result<Vec<u8>, EncryptionError> {
-        // Time encryption operation (wasm32: Instant unavailable, use 0)
-        #[cfg(not(target_arch = "wasm32"))]
+        // Time encryption operation
         let encryption_start = Instant::now();
 
         // Validate key length
@@ -381,10 +380,7 @@ impl ZeroKnowledgeEncryptor {
         result.extend_from_slice(&ciphertext);
 
         // Update metrics for observability
-        #[cfg(not(target_arch = "wasm32"))]
         let encryption_micros = encryption_start.elapsed().as_micros() as u64;
-        #[cfg(target_arch = "wasm32")]
-        let encryption_micros = 0u64;
         if let Ok(mut metrics) = self.last_metrics.lock() {
             *metrics = OperationMetrics::new()
                 .with_encryption(encryption_micros, self.hardware_acceleration_detected);
@@ -409,8 +405,7 @@ impl ZeroKnowledgeEncryptor {
         key: &[u8],
         aad: &[u8],
     ) -> Result<Vec<u8>, EncryptionError> {
-        // Time decryption operation (wasm32: Instant unavailable, use 0)
-        #[cfg(not(target_arch = "wasm32"))]
+        // Time decryption operation
         let decryption_start = Instant::now();
 
         // Validate key length
@@ -454,10 +449,7 @@ impl ZeroKnowledgeEncryptor {
         plaintext.truncate(decrypted_len);
 
         // Update metrics for observability
-        #[cfg(not(target_arch = "wasm32"))]
         let decryption_micros = decryption_start.elapsed().as_micros() as u64;
-        #[cfg(target_arch = "wasm32")]
-        let decryption_micros = 0u64;
         if let Ok(mut metrics) = self.last_metrics.lock() {
             *metrics = OperationMetrics::new()
                 .with_encryption(decryption_micros, self.hardware_acceleration_detected);
@@ -559,10 +551,10 @@ impl ZeroKnowledgeEncryptor {
             return Err(EncryptionError::InvalidKeyLength(key.len()));
         }
 
-        // Minimum: nonce(12) + tag(16) = 28 bytes
-        if ciphertext.len() < 28 {
+        // Minimum: nonce(12) + tag(16)
+        if ciphertext.len() < 12 + 16 {
             return Err(EncryptionError::InvalidCiphertext(
-                "ciphertext too short (minimum 28 bytes: 12 nonce + 16 tag)".into(),
+                "Ciphertext too short".into(),
             ));
         }
 

tests/wasm32_compat_tests.rs

@@ -57,3 +57,50 @@ mod byte_storage_roundtrip {
         assert_eq!("cbor", format);
     }
 }
+
+/// Verify that aes-gcm (wasm32 backend) produces wire-format-compatible
+/// output that ring (native backend) can decrypt, and vice versa.
+#[cfg(feature = "encryption")]
+#[test]
+fn cross_backend_wire_format_compatibility() {
+    use aes_gcm::{
+        aead::{Aead, KeyInit, Payload},
+        Aes256Gcm, Nonce as AesGcmNonce,
+    };
+    use cachekit_core::ZeroKnowledgeEncryptor;
+
+    let key = [0x42u8; 32];
+    let nonce_bytes = [1u8, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12];
+    let plaintext = b"cross-backend wire format test";
+    let aad = b"test_aad_domain";
+
+    // Encrypt with aes-gcm (simulating wasm32 path)
+    let cipher = Aes256Gcm::new_from_slice(&key).unwrap();
+    let nonce = AesGcmNonce::from_slice(&nonce_bytes);
+    let ct = cipher
+        .encrypt(nonce, Payload { msg: &plaintext[..], aad: &aad[..] })
+        .unwrap();
+
+    // Build wire format: nonce(12) || ciphertext || tag(16)
+    let mut wire = Vec::new();
+    wire.extend_from_slice(&nonce_bytes);
+    wire.extend_from_slice(&ct);
+
+    // Decrypt with ring (native path) via ZeroKnowledgeEncryptor
+    let encryptor = ZeroKnowledgeEncryptor::new().unwrap();
+    let decrypted = encryptor.decrypt_aes_gcm(&wire, &key, aad).unwrap();
+    assert_eq!(decrypted, plaintext);
+
+    // Also test the reverse: ring encrypts, aes-gcm decrypts
+    let ring_ciphertext = encryptor.encrypt_aes_gcm(plaintext, &key, aad).unwrap();
+
+    // Extract nonce and ciphertext+tag from ring output
+    let ring_nonce = &ring_ciphertext[..12];
+    let ring_ct_tag = &ring_ciphertext[12..];
+
+    let nonce2 = AesGcmNonce::from_slice(ring_nonce);
+    let decrypted2 = cipher
+        .decrypt(nonce2, Payload { msg: ring_ct_tag, aad: &aad[..] })
+        .unwrap();
+    assert_eq!(decrypted2, plaintext);
+}