Encryptor
Post-repair wire transforms: XOR, ChaCha20, TLS record, pipelines.
Optional encryption and framing applied after integrity repair and before wire send. Pure Rust (ChaCha20 RFC 8439, optional Poly1305, TLS record framing) — no external crypto libraries.
Module
src/plugin/encryptor.rs + src/plugin/crypto.rs. Default encryptor is null.
CLI / env
nexsiz -m http -e null -v
nexsiz -m http -e xor -k secret -v
nexsiz -m http -e chacha20 -k 0x0123... -v
nexsiz -m http -e chacha20+tls -v
export NEXSIZ_ENC_KEY='0x...'
export NEXSIZ_ENC_NONCE='0x...'
export NEXSIZ_NONCE_MODE=fixed # or incrementing | random
Flags: -e / --enc / --encryptor, -k / --key. Config: encryptor, enc_key.
Implementations
| Name | Aliases | Role |
|---|---|---|
null | none | Identity |
xor | — | Rolling XOR; skips protected fields |
chacha20 | chacha | RFC 8439 stream; counter reset per message by default |
chacha20-poly1305 | aead, chacha-poly | AEAD; output ciphertext ‖ 16-byte tag |
tls-record | tls | TLS record framing (type/ver/len/payload); fragment >16 KiB |
tls-handshake / tls-alert | — | Content-type variants |
chacha20+tls | chacha+tls | Stream encrypt then TLS frame |
chacha20-poly1305+tls | aead+tls | AEAD then TLS frame |
xor+tls | xor+tls-record | XOR then TLS frame |
Nonce modes
fixed— deterministic (default; reproducible campaigns)incrementing— monotonic per messagerandom— high-entropy per message
Key/nonce: hex (0x…) or raw string via CLI or NEXSIZ_ENC_KEY / NEXSIZ_ENC_NONCE.
Operational note
Prefer env for long-lived keys. Encryptor is for protocol-realistic wire shape and opaque channels during authorised testing — not a general-purpose crypto product API.