feat(sdk): implement single-segment TDF3 encrypt in WASM module

Replace the tdf_encrypt stub with a complete single-segment TDF3 encrypt
path running inside the WASM sandbox. All crypto is delegated to the host
via hostcrypto; manifest construction, policy binding, HS256 integrity,
and ZIP assembly run inside WASM using tinyjson types and zipstream.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: pflynn-virtru

go.work

@@ -8,6 +8,8 @@ use (
 	./lib/ocrypto
 	./protocol/go
 	./sdk
+	./sdk/experimental/tdf/wasm/tinyjson
+	./sdk/experimental/tdf/wasm/zipstream
 	./service
 	./tests-bdd
 )

sdk/experimental/tdf/wasm/encrypt.go

@@ -0,0 +1,192 @@
+//go:build wasip1
+
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/hex"
+	"hash/crc32"
+
+	"github.com/opentdf/platform/sdk/experimental/tdf/wasm/hostcrypto"
+	"github.com/opentdf/platform/sdk/experimental/tdf/wasm/tinyjson/types"
+	zs "github.com/opentdf/platform/sdk/experimental/tdf/wasm/zipstream/zipstream"
+)
+
+// encrypt performs a single-segment TDF3 encryption. All crypto is delegated
+// to the host via hostcrypto; manifest construction, integrity computation,
+// and ZIP assembly run inside the WASM sandbox.
+func encrypt(kasPubPEM, kasURL string, attrs []string, plaintext []byte) ([]byte, error) {
+	// 1. Generate 32-byte AES-256 DEK
+	dek, err := hostcrypto.RandomBytes(32)
+	if err != nil {
+		return nil, err
+	}
+
+	// 2. RSA-OAEP wrap DEK with KAS public key
+	wrappedKey, err := hostcrypto.RsaOaepSha1Encrypt(kasPubPEM, dek)
+	if err != nil {
+		return nil, err
+	}
+
+	// 3. Generate pseudo-UUID for policy
+	uuid, err := generatePseudoUUID()
+	if err != nil {
+		return nil, err
+	}
+
+	// 4. Build policy JSON using tinyjson types
+	policyJSON, err := buildPolicyJSON(uuid, attrs)
+	if err != nil {
+		return nil, err
+	}
+
+	// 5. Base64-encode policy
+	base64Policy := base64.StdEncoding.EncodeToString(policyJSON)
+
+	// 6. Policy binding: HMAC-SHA256(dek, base64Policy) → hex → base64
+	// Double-encoding required for Go SDK decrypt compatibility
+	bindingHMAC, err := hostcrypto.HmacSHA256(dek, []byte(base64Policy))
+	if err != nil {
+		return nil, err
+	}
+	bindingHash := base64.StdEncoding.EncodeToString([]byte(hex.EncodeToString(bindingHMAC)))
+
+	// 7. Encrypt plaintext with AES-256-GCM
+	// Returns [nonce(12) || ciphertext || tag(16)]
+	fullCT, err := hostcrypto.AesGcmEncrypt(dek, plaintext)
+	if err != nil {
+		return nil, err
+	}
+
+	// 8. cipher = fullCT[12:] (ciphertext+tag, without nonce)
+	cipher := fullCT[12:]
+
+	// 9. Segment integrity: HMAC-SHA256(dek, cipher) → base64
+	segmentSig, err := hostcrypto.HmacSHA256(dek, cipher)
+	if err != nil {
+		return nil, err
+	}
+	segmentHash := base64.StdEncoding.EncodeToString(segmentSig)
+
+	// 10. Root signature: HMAC-SHA256(dek, raw_segment_hmac) → base64
+	// For single segment, input is the raw segment HMAC bytes directly
+	rootSig, err := hostcrypto.HmacSHA256(dek, segmentSig)
+	if err != nil {
+		return nil, err
+	}
+	rootSigB64 := base64.StdEncoding.EncodeToString(rootSig)
+
+	// 11. Build manifest
+	manifest := types.Manifest{
+		TDFVersion: "4.3.0",
+		EncryptionInformation: types.EncryptionInformation{
+			KeyAccessType: "split",
+			Policy:        base64Policy,
+			KeyAccessObjs: []types.KeyAccess{{
+				KeyType:    "wrapped",
+				KasURL:     kasURL,
+				Protocol:   "kas",
+				WrappedKey: base64.StdEncoding.EncodeToString(wrappedKey),
+				PolicyBinding: types.PolicyBinding{
+					Alg:  "HS256",
+					Hash: bindingHash,
+				},
+			}},
+			Method: types.Method{
+				Algorithm:    "AES-256-GCM",
+				IsStreamable: true,
+			},
+			IntegrityInformation: types.IntegrityInformation{
+				RootSignature: types.RootSignature{
+					Algorithm: "HS256",
+					Signature: rootSigB64,
+				},
+				SegmentHashAlgorithm:    "HS256",
+				DefaultSegmentSize:      int64(len(plaintext)),
+				DefaultEncryptedSegSize: int64(len(fullCT)),
+				Segments: []types.Segment{{
+					Hash:          segmentHash,
+					Size:          int64(len(plaintext)),
+					EncryptedSize: int64(len(fullCT)),
+				}},
+			},
+		},
+		Payload: types.Payload{
+			Type:        "reference",
+			URL:         "0.payload",
+			Protocol:    "zip",
+			MimeType:    "application/octet-stream",
+			IsEncrypted: true,
+		},
+	}
+
+	manifestJSON, err := manifest.MarshalJSON()
+	if err != nil {
+		return nil, err
+	}
+
+	// 12. Assemble ZIP
+	crc32Sum := crc32.ChecksumIEEE(fullCT)
+	sw := zs.NewSegmentTDFWriter(1)
+	ctx := context.Background()
+
+	header, err := sw.WriteSegment(ctx, 0, uint64(len(fullCT)), crc32Sum)
+	if err != nil {
+		return nil, err
+	}
+
+	tail, err := sw.Finalize(ctx, manifestJSON)
+	if err != nil {
+		return nil, err
+	}
+
+	// result = header + fullCT + tail
+	var result bytes.Buffer
+	result.Grow(len(header) + len(fullCT) + len(tail))
+	result.Write(header)
+	result.Write(fullCT)
+	result.Write(tail)
+
+	return result.Bytes(), nil
+}
+
+// generatePseudoUUID generates a UUID v4-like string from 16 random bytes.
+// Format: xxxxxxxx-xxxx-4xxx-Nxxx-xxxxxxxxxxxx (version 4, variant 1).
+func generatePseudoUUID() (string, error) {
+	b, err := hostcrypto.RandomBytes(16)
+	if err != nil {
+		return "", err
+	}
+	// Set version 4 (bits 12-15 of time_hi_and_version)
+	b[6] = (b[6] & 0x0f) | 0x40
+	// Set variant 1 (bits 6-7 of clock_seq_hi_and_reserved)
+	b[8] = (b[8] & 0x3f) | 0x80
+
+	return hex.EncodeToString(b[0:4]) + "-" +
+		hex.EncodeToString(b[4:6]) + "-" +
+		hex.EncodeToString(b[6:8]) + "-" +
+		hex.EncodeToString(b[8:10]) + "-" +
+		hex.EncodeToString(b[10:16]), nil
+}
+
+// buildPolicyJSON constructs a TDF policy and marshals it to JSON via tinyjson.
+func buildPolicyJSON(uuid string, attrs []string) ([]byte, error) {
+	dataAttrs := make([]types.PolicyAttribute, len(attrs))
+	for i, attr := range attrs {
+		dataAttrs[i] = types.PolicyAttribute{
+			Attribute: attr,
+		}
+	}
+
+	policy := types.Policy{
+		UUID: uuid,
+		Body: types.PolicyBody{
+			DataAttributes: dataAttrs,
+			Dissem:         []string{},
+		},
+	}
+
+	return policy.MarshalJSON()
+}

sdk/experimental/tdf/wasm/main.go

@@ -4,27 +4,20 @@
 //
 // This is the entry point for the hybrid WASM TDF engine. All crypto
 // operations are delegated to the host via the hostcrypto package;
-// the TDF logic (manifest construction, ZIP packaging, key splitting,
-// integrity) runs inside the WASM sandbox.
+// the TDF logic (manifest construction, ZIP packaging, integrity)
+// runs inside the WASM sandbox.
 //
-// EXPECTED TO FAIL under TinyGo until the spike work is complete.
 // See: docs/adr/spike-wasm-core-tinygo-hybrid.md
-//
-// Blockers:
-//   - lib/ocrypto → replaced by hostcrypto (go:wasmimport host functions)
-//   - github.com/google/uuid → generate on host or use TinyGo-compatible lib
-//   - protocol/go/policy → decouple from writer or provide lightweight types
-//   - log/slog → replace with minimal logger or remove
 package main
 
 import (
-	"context"
+	"strings"
 	"unsafe"
-
-	"github.com/opentdf/platform/sdk/experimental/tdf"
-	"github.com/opentdf/platform/sdk/experimental/tdf/wasm/hostcrypto"
 )
 
+// lastError holds the most recent error message for the host to retrieve.
+var lastError string
+
 // ── Exported WASM functions ─────────────────────────────────────────
 // Called by the host to perform TDF operations.
 
@@ -39,6 +32,21 @@ func wasmFree(_ uint32) {
 	// No-op with leaking GC; tracked for future improvement
 }
 
+//go:wasmexport get_error
+func getError(outPtr, outCapacity uint32) uint32 {
+	if lastError == "" {
+		return 0
+	}
+	msg := lastError
+	if uint32(len(msg)) > outCapacity {
+		msg = msg[:outCapacity]
+	}
+	dst := unsafe.Slice((*byte)(unsafe.Pointer(uintptr(outPtr))), len(msg))
+	copy(dst, msg)
+	lastError = ""
+	return uint32(len(msg))
+}
+
 //go:wasmexport tdf_encrypt
 func tdfEncrypt(
 	kasPubPtr, kasPubLen uint32,
@@ -47,23 +55,47 @@ func tdfEncrypt(
 	ptPtr, ptLen uint32,
 	outPtr, outCapacity uint32,
 ) uint32 {
-	// Stub — spike will implement the full encrypt path here
-	ctx := context.Background()
+	kasPubPEM := ptrToString(kasPubPtr, kasPubLen)
+	kasURL := ptrToString(kasURLPtr, kasURLLen)
+
+	var attrs []string
+	if attrLen > 0 {
+		attrStr := ptrToString(attrPtr, attrLen)
+		attrs = strings.Split(attrStr, "\n")
+	}
 
-	// Validate that the tdf package is reachable
-	w, err := tdf.NewWriter(ctx)
+	plaintext := ptrToBytes(ptPtr, ptLen)
+
+	result, err := encrypt(kasPubPEM, kasURL, attrs, plaintext)
 	if err != nil {
+		lastError = err.Error()
 		return 0
 	}
-	_ = w
 
-	// Validate that host crypto wrappers are linked
-	_, err = hostcrypto.RandomBytes(32)
-	if err != nil {
+	if uint32(len(result)) > outCapacity {
+		lastError = "output buffer too small"
 		return 0
 	}
 
-	return 0
+	dst := unsafe.Slice((*byte)(unsafe.Pointer(uintptr(outPtr))), len(result))
+	copy(dst, result)
+	return uint32(len(result))
+}
+
+// ── WASM memory helpers ─────────────────────────────────────────────
+
+func ptrToString(ptr, length uint32) string {
+	if length == 0 {
+		return ""
+	}
+	return unsafe.String((*byte)(unsafe.Pointer(uintptr(ptr))), length)
+}
+
+func ptrToBytes(ptr, length uint32) []byte {
+	if length == 0 {
+		return nil
+	}
+	return unsafe.Slice((*byte)(unsafe.Pointer(uintptr(ptr))), length)
 }
 
 func main() {