updated build system

2025-08-28 18:34:21 -05:00
parent c9362b8802
commit fa3419c7cc
12 changed files with 996 additions and 194 deletions
--- a/support/test/src/utils/encrypting_reader_test.cpp
+++ b/support/test/src/utils/encrypting_reader_test.cpp
@@ -35,7 +35,8 @@ TEST(utils_encrypting_reader, read_file_data) {
  EXPECT_TRUE(source_file);
  if (source_file) {
    utils::encryption::encrypting_reader reader(
-        "test.dat", source_file.get_path(), get_stop_requested, token);
+        "test.dat", source_file.get_path(), get_stop_requested, token,
+        std::nullopt);

    for (std::uint8_t i = 0U; i < 8U; i++) {
      data_buffer buffer(
@@ -76,14 +77,14 @@ TEST(utils_encrypting_reader, read_file_data_using_argon2id) {
  EXPECT_TRUE(source_file);
  if (source_file) {
    utils::encryption::encrypting_reader reader(
-        "test.dat", source_file.get_path(), get_stop_requested, token, cfg);
+        "test.dat", source_file.get_path(), get_stop_requested, token, cfg,
+        std::nullopt);

    std::array<std::uint8_t, utils::encryption::kdf_config::size()> hdr;
    EXPECT_EQ(hdr.size(), utils::encryption::encrypting_reader::reader_function(
                              reinterpret_cast<char *>(hdr.data()), hdr.size(),
                              1U, &reader));
    EXPECT_TRUE(utils::encryption::kdf_config::from_header(hdr, cfg));
-    // EXPECT_EQ(cfg, reader.get_kdf_config().value());

    for (std::uint8_t i = 0U; i < 8U; i++) {
      data_buffer buffer(
@@ -98,7 +99,62 @@ TEST(utils_encrypting_reader, read_file_data_using_argon2id) {

      data_buffer decrypted_data;
      EXPECT_TRUE(utils::encryption::decrypt_data(
-          token, *reader.get_kdf_config(), buffer, decrypted_data));
+          token, *reader.get_kdf_config_for_data(), buffer, decrypted_data));
+
+      EXPECT_EQ(utils::encryption::encrypting_reader::get_data_chunk_size(),
+                decrypted_data.size());
+
+      std::size_t bytes_read{};
+      data_buffer file_data(decrypted_data.size());
+      EXPECT_TRUE(source_file.read(
+          file_data,
+          utils::encryption::encrypting_reader::get_data_chunk_size() * i,
+          &bytes_read));
+      EXPECT_EQ(0, std::memcmp(file_data.data(), decrypted_data.data(),
+                               file_data.size()));
+    }
+  }
+}
+
+TEST(utils_encrypting_reader, read_file_data_using_argon2id_master_key) {
+  const auto token = std::string("moose");
+  utils::encryption::kdf_config cfg;
+
+  auto master_key =
+      utils::encryption::generate_key<utils::hash::hash_256_t>(token, cfg);
+
+  auto &source_file = test::create_random_file(
+      8U * utils::encryption::encrypting_reader::get_data_chunk_size());
+  EXPECT_TRUE(source_file);
+  if (source_file) {
+    utils::encryption::encrypting_reader reader(
+        "test.dat", source_file.get_path(), get_stop_requested, master_key, cfg,
+        std::nullopt);
+
+    std::array<std::uint8_t, utils::encryption::kdf_config::size()> hdr;
+    EXPECT_EQ(hdr.size(), utils::encryption::encrypting_reader::reader_function(
+                              reinterpret_cast<char *>(hdr.data()), hdr.size(),
+                              1U, &reader));
+    EXPECT_TRUE(utils::encryption::kdf_config::from_header(hdr, cfg));
+
+    for (std::uint8_t i = 0U; i < 8U; i++) {
+      data_buffer buffer(
+          utils::encryption::encrypting_reader::get_encrypted_chunk_size());
+      for (std::uint8_t j = 0U; j < 2U; j++) {
+        ASSERT_EQ(
+            buffer.size() / 2U,
+            utils::encryption::encrypting_reader::reader_function(
+                reinterpret_cast<char *>(&buffer[(buffer.size() / 2U) * j]),
+                buffer.size() / 2U, 1U, &reader));
+      }
+
+      auto data_cfg = *reader.get_kdf_config_for_data();
+      utils::hash::hash_256_t data_key;
+      std::tie(data_key, std::ignore) = cfg.create_subkey(
+          utils::encryption::kdf_context::data, data_cfg.unique_id, master_key);
+      data_buffer decrypted_data;
+      EXPECT_TRUE(
+          utils::encryption::decrypt_data(data_key, buffer, decrypted_data));

      EXPECT_EQ(utils::encryption::encrypting_reader::get_data_chunk_size(),
                decrypted_data.size());
@@ -122,7 +178,8 @@ TEST(utils_encrypting_reader, read_file_data_in_multiple_chunks) {
  EXPECT_TRUE(source_file);
  if (source_file) {
    utils::encryption::encrypting_reader reader(
-        "test.dat", source_file.get_path(), get_stop_requested, token);
+        "test.dat", source_file.get_path(), get_stop_requested, token,
+        std::nullopt);

    for (std::uint8_t i = 0U; i < 8U; i += 2U) {
      data_buffer buffer(
@@ -172,14 +229,14 @@ TEST(utils_encrypting_reader,
  EXPECT_TRUE(source_file);
  if (source_file) {
    utils::encryption::encrypting_reader reader(
-        "test.dat", source_file.get_path(), get_stop_requested, token, cfg);
+        "test.dat", source_file.get_path(), get_stop_requested, token, cfg,
+        std::nullopt);

    std::array<std::uint8_t, utils::encryption::kdf_config::size()> hdr;
    EXPECT_EQ(hdr.size(), utils::encryption::encrypting_reader::reader_function(
                              reinterpret_cast<char *>(hdr.data()), hdr.size(),
                              1U, &reader));
    EXPECT_TRUE(utils::encryption::kdf_config::from_header(hdr, cfg));
-    // EXPECT_EQ(cfg, reader.get_kdf_config().value());

    for (std::uint8_t i = 0U; i < 8U; i += 2U) {
      data_buffer buffer(
@@ -194,7 +251,72 @@ TEST(utils_encrypting_reader,
        data_buffer decrypted_data;
        const auto offset = (j * (buffer.size() / 2U));
        EXPECT_TRUE(utils::encryption::decrypt_data(
-            token, *reader.get_kdf_config(),
+            token, *reader.get_kdf_config_for_data(),
+            data_buffer(
+                std::next(buffer.begin(), static_cast<std::int64_t>(offset)),
+                std::next(buffer.begin(), static_cast<std::int64_t>(
+                                              offset + (buffer.size() / 2U)))),
+            decrypted_data));
+
+        EXPECT_EQ(utils::encryption::encrypting_reader::get_data_chunk_size(),
+                  decrypted_data.size());
+
+        std::size_t bytes_read{};
+        data_buffer file_data(decrypted_data.size());
+        EXPECT_TRUE(source_file.read(
+            file_data,
+            (utils::encryption::encrypting_reader::get_data_chunk_size() * i) +
+                (j *
+                 utils::encryption::encrypting_reader::get_data_chunk_size()),
+            &bytes_read));
+        EXPECT_EQ(0, std::memcmp(file_data.data(), decrypted_data.data(),
+                                 file_data.size()));
+      }
+    }
+  }
+}
+
+TEST(utils_encrypting_reader,
+     read_file_data_in_multiple_chunks_using_argon2id_master_key) {
+  const auto token = std::string("moose");
+  utils::encryption::kdf_config cfg;
+
+  auto master_key =
+      utils::encryption::generate_key<utils::hash::hash_256_t>(token, cfg);
+
+  auto &source_file = test::create_random_file(
+      8U * utils::encryption::encrypting_reader::get_data_chunk_size());
+  EXPECT_TRUE(source_file);
+  if (source_file) {
+    utils::encryption::encrypting_reader reader(
+        "test.dat", source_file.get_path(), get_stop_requested, master_key, cfg,
+        std::nullopt);
+
+    std::array<std::uint8_t, utils::encryption::kdf_config::size()> hdr;
+    EXPECT_EQ(hdr.size(), utils::encryption::encrypting_reader::reader_function(
+                              reinterpret_cast<char *>(hdr.data()), hdr.size(),
+                              1U, &reader));
+    EXPECT_TRUE(utils::encryption::kdf_config::from_header(hdr, cfg));
+
+    for (std::uint8_t i = 0U; i < 8U; i += 2U) {
+      data_buffer buffer(
+          utils::encryption::encrypting_reader::get_encrypted_chunk_size() *
+          2U);
+      EXPECT_EQ(buffer.size(),
+                utils::encryption::encrypting_reader::reader_function(
+                    reinterpret_cast<char *>(buffer.data()), buffer.size(), 1U,
+                    &reader));
+
+      auto data_cfg = *reader.get_kdf_config_for_data();
+      utils::hash::hash_256_t data_key;
+      std::tie(data_key, std::ignore) = cfg.create_subkey(
+          utils::encryption::kdf_context::data, data_cfg.unique_id, master_key);
+
+      for (std::uint8_t j = 0U; j < 2U; j++) {
+        data_buffer decrypted_data;
+        const auto offset = (j * (buffer.size() / 2U));
+        EXPECT_TRUE(utils::encryption::decrypt_data(
+            data_key,
            data_buffer(
                std::next(buffer.begin(), static_cast<std::int64_t>(offset)),
                std::next(buffer.begin(), static_cast<std::int64_t>(
@@ -226,7 +348,8 @@ TEST(utils_encrypting_reader, read_file_data_as_stream) {
  EXPECT_TRUE(source_file);
  if (source_file) {
    utils::encryption::encrypting_reader reader(
-        "test.dat", source_file.get_path(), get_stop_requested, token);
+        "test.dat", source_file.get_path(), get_stop_requested, token,
+        std::nullopt);
    auto io_stream = reader.create_iostream();
    EXPECT_FALSE(io_stream->seekg(0, std::ios_base::end).fail());
    EXPECT_TRUE(io_stream->good());
@@ -280,7 +403,8 @@ TEST(utils_encrypting_reader, read_file_data_as_stream_using_argon2id) {
  EXPECT_TRUE(source_file);
  if (source_file) {
    utils::encryption::encrypting_reader reader(
-        "test.dat", source_file.get_path(), get_stop_requested, token, cfg);
+        "test.dat", source_file.get_path(), get_stop_requested, token, cfg,
+        std::nullopt);
    auto io_stream = reader.create_iostream();
    EXPECT_FALSE(io_stream->seekg(0, std::ios_base::end).fail());
    EXPECT_TRUE(io_stream->good());
@@ -310,7 +434,73 @@ TEST(utils_encrypting_reader, read_file_data_as_stream_using_argon2id) {

      data_buffer decrypted_data;
      EXPECT_TRUE(utils::encryption::decrypt_data(
-          token, *reader.get_kdf_config(), buffer, decrypted_data));
+          token, *reader.get_kdf_config_for_data(), buffer, decrypted_data));
+
+      EXPECT_EQ(utils::encryption::encrypting_reader::get_data_chunk_size(),
+                decrypted_data.size());
+
+      std::size_t bytes_read{};
+      data_buffer file_data(decrypted_data.size());
+      EXPECT_TRUE(source_file.read(
+          file_data,
+          utils::encryption::encrypting_reader::get_data_chunk_size() * i,
+          &bytes_read));
+      EXPECT_EQ(0, std::memcmp(file_data.data(), decrypted_data.data(),
+                               file_data.size()));
+    }
+  }
+}
+
+TEST(utils_encrypting_reader,
+     read_file_data_as_stream_using_argon2id_master_key) {
+  const auto token = std::string("moose");
+  utils::encryption::kdf_config cfg;
+
+  auto master_key =
+      utils::encryption::generate_key<utils::hash::hash_256_t>(token, cfg);
+
+  auto &source_file = test::create_random_file(
+      8U * utils::encryption::encrypting_reader::get_data_chunk_size());
+  EXPECT_TRUE(source_file);
+  if (source_file) {
+    utils::encryption::encrypting_reader reader(
+        "test.dat", source_file.get_path(), get_stop_requested, master_key, cfg,
+        std::nullopt);
+    auto io_stream = reader.create_iostream();
+    EXPECT_FALSE(io_stream->seekg(0, std::ios_base::end).fail());
+    EXPECT_TRUE(io_stream->good());
+    EXPECT_EQ(reader.get_total_size(),
+              static_cast<std::uint64_t>(io_stream->tellg()));
+    EXPECT_FALSE(io_stream->seekg(0, std::ios_base::beg).fail());
+    EXPECT_TRUE(io_stream->good());
+
+    for (std::uint8_t i = 0U; i < 8U; i++) {
+      data_buffer buffer(
+          utils::encryption::encrypting_reader::get_encrypted_chunk_size());
+      EXPECT_FALSE(
+          io_stream
+              ->seekg(static_cast<std::streamoff>(
+                  i * buffer.size() + utils::encryption::kdf_config::size()))
+              .fail());
+      EXPECT_TRUE(io_stream->good());
+      for (std::uint8_t j = 0U; j < 2U; j++) {
+        EXPECT_FALSE(
+            io_stream
+                ->read(
+                    reinterpret_cast<char *>(&buffer[(buffer.size() / 2U) * j]),
+                    static_cast<std::streamsize>(buffer.size()) / 2U)
+                .fail());
+        EXPECT_TRUE(io_stream->good());
+      }
+
+      auto data_cfg = *reader.get_kdf_config_for_data();
+      utils::hash::hash_256_t data_key;
+      std::tie(data_key, std::ignore) = cfg.create_subkey(
+          utils::encryption::kdf_context::data, data_cfg.unique_id, master_key);
+
+      data_buffer decrypted_data;
+      EXPECT_TRUE(
+          utils::encryption::decrypt_data(data_key, buffer, decrypted_data));

      EXPECT_EQ(utils::encryption::encrypting_reader::get_data_chunk_size(),
                decrypted_data.size());
@@ -334,7 +524,8 @@ TEST(utils_encrypting_reader, read_file_data_in_multiple_chunks_as_stream) {
  EXPECT_TRUE(source_file);
  if (source_file) {
    utils::encryption::encrypting_reader reader(
-        "test.dat", source_file.get_path(), get_stop_requested, token);
+        "test.dat", source_file.get_path(), get_stop_requested, token,
+        std::nullopt);
    auto io_stream = reader.create_iostream();
    EXPECT_FALSE(io_stream->seekg(0, std::ios_base::end).fail());
    EXPECT_TRUE(io_stream->good());
@@ -392,7 +583,8 @@ TEST(utils_encrypting_reader,
  EXPECT_TRUE(source_file);
  if (source_file) {
    utils::encryption::encrypting_reader reader(
-        "test.dat", source_file.get_path(), get_stop_requested, token, cfg);
+        "test.dat", source_file.get_path(), get_stop_requested, token, cfg,
+        std::nullopt);
    auto io_stream = reader.create_iostream();
    EXPECT_FALSE(io_stream->seekg(0, std::ios_base::end).fail());
    EXPECT_TRUE(io_stream->good());
@@ -420,7 +612,79 @@ TEST(utils_encrypting_reader,
        data_buffer decrypted_data;
        const auto offset = (j * (buffer.size() / 2U));
        EXPECT_TRUE(utils::encryption::decrypt_data(
-            token, *reader.get_kdf_config(),
+            token, *reader.get_kdf_config_for_data(),
+            data_buffer(
+                std::next(buffer.begin(), static_cast<std::int64_t>(offset)),
+                std::next(buffer.begin(), static_cast<std::int64_t>(
+                                              offset + (buffer.size() / 2U)))),
+            decrypted_data));
+
+        EXPECT_EQ(utils::encryption::encrypting_reader::get_data_chunk_size(),
+                  decrypted_data.size());
+
+        std::size_t bytes_read{};
+        data_buffer file_data(decrypted_data.size());
+        EXPECT_TRUE(source_file.read(
+            file_data,
+            (utils::encryption::encrypting_reader::get_data_chunk_size() * i) +
+                (j *
+                 utils::encryption::encrypting_reader::get_data_chunk_size()),
+            &bytes_read));
+        EXPECT_EQ(0, std::memcmp(file_data.data(), decrypted_data.data(),
+                                 file_data.size()));
+      }
+    }
+  }
+}
+
+TEST(utils_encrypting_reader,
+     read_file_data_in_multiple_chunks_as_stream_using_argon2id_master_key) {
+  const auto token = std::string("moose");
+  utils::encryption::kdf_config cfg;
+
+  auto master_key =
+      utils::encryption::generate_key<utils::hash::hash_256_t>(token, cfg);
+
+  auto &source_file = test::create_random_file(
+      8u * utils::encryption::encrypting_reader::get_data_chunk_size());
+  EXPECT_TRUE(source_file);
+  if (source_file) {
+    utils::encryption::encrypting_reader reader(
+        "test.dat", source_file.get_path(), get_stop_requested, master_key, cfg,
+        std::nullopt);
+    auto io_stream = reader.create_iostream();
+    EXPECT_FALSE(io_stream->seekg(0, std::ios_base::end).fail());
+    EXPECT_TRUE(io_stream->good());
+    EXPECT_EQ(reader.get_total_size(),
+              static_cast<std::uint64_t>(io_stream->tellg()));
+    EXPECT_FALSE(io_stream->seekg(0, std::ios_base::beg).fail());
+    EXPECT_TRUE(io_stream->good());
+
+    EXPECT_FALSE(io_stream
+                     ->seekg(static_cast<std::streamoff>(
+                         utils::encryption::kdf_config::size()))
+                     .fail());
+
+    for (std::uint8_t i = 0U; i < 8U; i += 2U) {
+      data_buffer buffer(
+          utils::encryption::encrypting_reader::get_encrypted_chunk_size() *
+          2U);
+      EXPECT_FALSE(io_stream
+                       ->read(reinterpret_cast<char *>(buffer.data()),
+                              static_cast<std::streamsize>(buffer.size()))
+                       .fail());
+      EXPECT_TRUE(io_stream->good());
+
+      auto data_cfg = *reader.get_kdf_config_for_data();
+      utils::hash::hash_256_t data_key;
+      std::tie(data_key, std::ignore) = cfg.create_subkey(
+          utils::encryption::kdf_context::data, data_cfg.unique_id, master_key);
+
+      for (std::uint8_t j = 0U; j < 2U; j++) {
+        data_buffer decrypted_data;
+        const auto offset = (j * (buffer.size() / 2U));
+        EXPECT_TRUE(utils::encryption::decrypt_data(
+            data_key,
            data_buffer(
                std::next(buffer.begin(), static_cast<std::int64_t>(offset)),
                std::next(buffer.begin(), static_cast<std::int64_t>(
--- a/support/test/src/utils/encryption_kdf_config_test.cpp
+++ b/support/test/src/utils/encryption_kdf_config_test.cpp
@@ -27,40 +27,41 @@ namespace repertory {
 TEST(utils_encryption_kdf_config, can_construct_using_default_constructor) {
  utils::encryption::kdf_config cfg;

-  EXPECT_EQ(utils::encryption::kdf_config::repertory_magic, cfg.magic);
  EXPECT_EQ(utils::encryption::kdf_version::v1, cfg.version);
  EXPECT_EQ(utils::encryption::kdf_type::argon2id, cfg.kdf);
  EXPECT_EQ(utils::encryption::memlimit_level::level3, cfg.memlimit);
  EXPECT_EQ(utils::encryption::opslimit_level::level2, cfg.opslimit);
  EXPECT_EQ(utils::encryption::kdf_config::salt_t{}, cfg.salt);
+  EXPECT_EQ(0U, cfg.unique_id);
  EXPECT_EQ(0U, cfg.checksum);
 }

-TEST(utils_encryption_kdf_config, can_generate_salt) {
+TEST(utils_encryption_kdf_config, can_seal) {
  utils::encryption::kdf_config cfg;
-  cfg.generate_salt();
+  cfg.seal();
  EXPECT_NE(utils::encryption::kdf_config::salt_t{}, cfg.salt);

  auto orig_salt = cfg.salt;
-  cfg.generate_salt();
+  cfg.seal();
  EXPECT_NE(orig_salt, cfg.salt);
 }

 TEST(utils_encryption_kdf_config, can_generate_checksum) {
  utils::encryption::kdf_config cfg;
-  EXPECT_EQ(8853559678329530327ULL, cfg.generate_checksum());
+  EXPECT_EQ(13087047540462255120ULL, cfg.generate_checksum());
 }

-TEST(utils_encryption_kdf_config, generate_salt_calculates_checksum) {
+TEST(utils_encryption_kdf_config, seal_calculates_checksum) {
  utils::encryption::kdf_config cfg;
-  cfg.generate_salt();
+  cfg.seal();

  EXPECT_NE(0U, cfg.checksum);
 }

 TEST(utils_encryption_kdf_config, can_create_header_and_restore) {
  utils::encryption::kdf_config cfg;
-  cfg.generate_salt();
+  cfg.unique_id = 2U;
+  cfg.seal();
  auto hdr = cfg.to_header();

  EXPECT_EQ(utils::encryption::kdf_config::size(), hdr.size());
@@ -70,30 +71,20 @@ TEST(utils_encryption_kdf_config, can_create_header_and_restore) {
  auto restored_hdr = restored_cfg.to_header();

  EXPECT_EQ(hdr, restored_hdr);
-  EXPECT_EQ(cfg.magic, restored_cfg.magic);
  EXPECT_EQ(cfg.version, restored_cfg.version);
  EXPECT_EQ(cfg.kdf, restored_cfg.kdf);
  EXPECT_EQ(cfg.memlimit, restored_cfg.memlimit);
  EXPECT_EQ(cfg.opslimit, restored_cfg.opslimit);
  EXPECT_EQ(cfg.salt, restored_cfg.salt);
  EXPECT_EQ(cfg.checksum, restored_cfg.checksum);
+  EXPECT_EQ(cfg.unique_id, restored_cfg.unique_id);
  EXPECT_EQ(cfg, restored_cfg);
 }

-TEST(utils_encryption_kdf_config, header_restore_fails_if_magic_is_invalid) {
-  utils::encryption::kdf_config cfg;
-  cfg.magic = 0x11;
-  cfg.generate_salt();
-
-  auto hdr = cfg.to_header();
-  utils::encryption::kdf_config restored_cfg;
-  EXPECT_FALSE(utils::encryption::kdf_config::from_header(hdr, restored_cfg));
-}
-
 TEST(utils_encryption_kdf_config, header_restore_fails_if_version_is_invalid) {
  utils::encryption::kdf_config cfg;
  cfg.version = static_cast<utils::encryption::kdf_version>(0x11);
-  cfg.generate_salt();
+  cfg.seal();

  auto hdr = cfg.to_header();
  utils::encryption::kdf_config restored_cfg;
@@ -103,7 +94,7 @@ TEST(utils_encryption_kdf_config, header_restore_fails_if_version_is_invalid) {
 TEST(utils_encryption_kdf_config, header_restore_fails_if_kdf_is_invalid) {
  utils::encryption::kdf_config cfg;
  cfg.kdf = static_cast<utils::encryption::kdf_type>(0x11);
-  cfg.generate_salt();
+  cfg.seal();

  auto hdr = cfg.to_header();
  utils::encryption::kdf_config restored_cfg;
@@ -113,7 +104,7 @@ TEST(utils_encryption_kdf_config, header_restore_fails_if_kdf_is_invalid) {
 TEST(utils_encryption_kdf_config, header_restore_fails_if_memlimit_is_invalid) {
  utils::encryption::kdf_config cfg;
  cfg.memlimit = static_cast<utils::encryption::memlimit_level>(0x11);
-  cfg.generate_salt();
+  cfg.seal();

  auto hdr = cfg.to_header();
  utils::encryption::kdf_config restored_cfg;
@@ -123,7 +114,7 @@ TEST(utils_encryption_kdf_config, header_restore_fails_if_memlimit_is_invalid) {
 TEST(utils_encryption_kdf_config, header_restore_fails_if_opslimit_is_invalid) {
  utils::encryption::kdf_config cfg;
  cfg.opslimit = static_cast<utils::encryption::opslimit_level>(0x11);
-  cfg.generate_salt();
+  cfg.seal();

  auto hdr = cfg.to_header();
  utils::encryption::kdf_config restored_cfg;
@@ -132,13 +123,280 @@ TEST(utils_encryption_kdf_config, header_restore_fails_if_opslimit_is_invalid) {

 TEST(utils_encryption_kdf_config, header_restore_fails_if_salt_is_invalid) {
  utils::encryption::kdf_config cfg;
-  cfg.generate_salt();
+  cfg.seal();
  cfg.salt = utils::encryption::kdf_config::salt_t{};

  auto hdr = cfg.to_header();
  utils::encryption::kdf_config restored_cfg;
  EXPECT_FALSE(utils::encryption::kdf_config::from_header(hdr, restored_cfg));
 }
+
+TEST(utils_encryption_kdf_config, header_restore_fails_if_id_is_invalid) {
+  utils::encryption::kdf_config cfg;
+  cfg.seal();
+  cfg.unique_id = 22U;
+
+  auto hdr = cfg.to_header();
+  utils::encryption::kdf_config restored_cfg;
+  EXPECT_FALSE(utils::encryption::kdf_config::from_header(hdr, restored_cfg));
+}
+
+TEST(utils_encryption_kdf_config, create_subkey_sets_id_and_updates_checksum) {
+  using hash_t = utils::hash::hash_256_t;
+
+  utils::encryption::kdf_config cfg;
+  cfg.seal();
+
+  hash_t master_key =
+      utils::encryption::generate_key<hash_t>("root-master-key");
+
+  constexpr std::size_t sub_id = 42;
+  auto [subkey, out_cfg] = cfg.create_subkey<hash_t>(
+      utils::encryption::kdf_context::path, sub_id, master_key);
+
+  EXPECT_NE(subkey, hash_t{});
+  EXPECT_NE(subkey, master_key);
+
+  EXPECT_EQ(out_cfg.unique_id, static_cast<std::uint64_t>(sub_id));
+  EXPECT_EQ(out_cfg.checksum, out_cfg.generate_checksum());
+
+  EXPECT_EQ(out_cfg.version, cfg.version);
+  EXPECT_EQ(out_cfg.kdf, cfg.kdf);
+  EXPECT_EQ(out_cfg.memlimit, cfg.memlimit);
+  EXPECT_EQ(out_cfg.opslimit, cfg.opslimit);
+  EXPECT_EQ(out_cfg.salt, cfg.salt);
+}
+
+TEST(utils_encryption_kdf_config,
+     create_subkey_is_deterministic_for_same_inputs) {
+  using hash_t = utils::hash::hash_256_t;
+
+  utils::encryption::kdf_config cfg;
+  cfg.seal();
+
+  hash_t master_key =
+      utils::encryption::generate_key<hash_t>("root-master-key");
+
+  constexpr auto ctx = utils::encryption::kdf_context::data;
+  constexpr std::size_t sub_id = 7;
+
+  auto [k1, c1] = cfg.create_subkey<hash_t>(ctx, sub_id, master_key);
+  auto [k2, c2] = cfg.create_subkey<hash_t>(ctx, sub_id, master_key);
+
+  EXPECT_EQ(k1, k2);
+  EXPECT_EQ(c1.unique_id, c2.unique_id);
+  EXPECT_EQ(c1.checksum, c2.checksum);
+  EXPECT_EQ(c1, c2);
+}
+
+TEST(utils_encryption_kdf_config, create_subkey_varies_with_different_id) {
+  using hash_t = utils::hash::hash_256_t;
+
+  utils::encryption::kdf_config cfg;
+  cfg.seal();
+
+  hash_t master_key =
+      utils::encryption::generate_key<hash_t>("root-master-key");
+
+  constexpr auto ctx = utils::encryption::kdf_context::data;
+
+  auto [k1, c1] = cfg.create_subkey<hash_t>(ctx, 1, master_key);
+  auto [k2, c2] = cfg.create_subkey<hash_t>(ctx, 2, master_key);
+
+  EXPECT_NE(k1, k2);
+  EXPECT_NE(c1.unique_id, c2.unique_id);
+  EXPECT_NE(c1.checksum, c2.checksum);
+
+  EXPECT_EQ(c1.version, c2.version);
+  EXPECT_EQ(c1.kdf, c2.kdf);
+  EXPECT_EQ(c1.memlimit, c2.memlimit);
+  EXPECT_EQ(c1.opslimit, c2.opslimit);
+  EXPECT_EQ(c1.salt, c2.salt);
+}
+
+TEST(utils_encryption_kdf_config, create_subkey_varies_with_different_context) {
+  using hash_t = utils::hash::hash_256_t;
+
+  utils::encryption::kdf_config cfg;
+  cfg.seal();
+
+  hash_t master_key =
+      utils::encryption::generate_key<hash_t>("root-master-key");
+
+  constexpr std::size_t sub_id = 123;
+
+  auto [ka, ca] = cfg.create_subkey<hash_t>(
+      utils::encryption::kdf_context::data, sub_id, master_key);
+  auto [kb, cb] = cfg.create_subkey<hash_t>(
+      utils::encryption::kdf_context::path, sub_id, master_key);
+
+  EXPECT_NE(ka, kb);
+  EXPECT_EQ(ca.unique_id, cb.unique_id);
+  EXPECT_EQ(ca.checksum, cb.checksum);
+  EXPECT_EQ(ca, cb);
+}
+
+TEST(utils_encryption_kdf_config,
+     create_subkey_with_undefined_context_uses_fallback) {
+  using hash_t = utils::hash::hash_256_t;
+
+  utils::encryption::kdf_config cfg;
+  cfg.seal();
+
+  hash_t master_key =
+      utils::encryption::generate_key<hash_t>("root-master-key");
+
+  constexpr std::size_t sub_id = 55;
+
+  auto [k_def, c_def] = cfg.create_subkey<hash_t>(
+      utils::encryption::kdf_context::undefined, sub_id, master_key);
+  auto [k_dat, c_dat] = cfg.create_subkey<hash_t>(
+      utils::encryption::kdf_context::data, sub_id, master_key);
+
+  EXPECT_NE(k_def, hash_t{});
+  EXPECT_NE(k_dat, hash_t{});
+  EXPECT_NE(k_def, k_dat);
+
+  EXPECT_EQ(c_def, c_dat);
+}
+
+#if defined(PROJECT_ENABLE_JSON)
+TEST(utils_encryption_kdf_config, can_convert_kdf_config_to_and_from_json) {
+  utils::encryption::kdf_config cfg;
+  cfg.unique_id = 2U;
+  cfg.seal();
+
+  nlohmann::json json_kdf(cfg);
+
+  auto cfg2 = json_kdf.get<utils::encryption::kdf_config>();
+  EXPECT_EQ(cfg, cfg2);
+}
+#endif // defined(PROJECT_ENABLE_JSON)
+
+TEST(utils_encryption_kdf_config, equality) {
+  {
+    utils::encryption::kdf_config cfg;
+    utils::encryption::kdf_config cfg2;
+
+    EXPECT_EQ(cfg, cfg2);
+  }
+
+  {
+    utils::encryption::kdf_config cfg;
+    utils::encryption::kdf_config cfg2{cfg};
+
+    EXPECT_EQ(cfg, cfg2);
+  }
+
+  {
+    utils::encryption::kdf_config cfg;
+    cfg.seal();
+
+    utils::encryption::kdf_config cfg2{cfg};
+
+    EXPECT_EQ(cfg, cfg2);
+  }
+
+  {
+    utils::encryption::kdf_config cfg;
+    utils::encryption::kdf_config cfg2;
+    cfg2 = cfg;
+
+    EXPECT_EQ(cfg, cfg2);
+  }
+
+  {
+    utils::encryption::kdf_config cfg;
+    cfg.seal();
+
+    utils::encryption::kdf_config cfg2;
+    cfg2 = cfg;
+
+    EXPECT_EQ(cfg, cfg2);
+  }
+}
+
+TEST(utils_encryption_kdf_config, sealed_is_not_equal_to_unsealed) {
+  utils::encryption::kdf_config cfg;
+  cfg.seal();
+
+  utils::encryption::kdf_config cfg2;
+
+  EXPECT_NE(cfg, cfg2);
+}
+
+TEST(utils_encryption_kdf_config, sealed_is_not_equal_to_sealed) {
+  utils::encryption::kdf_config cfg;
+  cfg.seal();
+
+  utils::encryption::kdf_config cfg2;
+  cfg2.seal();
+
+  EXPECT_NE(cfg, cfg2);
+}
+
+TEST(utils_encryption_kdf_config, is_not_equal_to_different_id) {
+  utils::encryption::kdf_config cfg;
+  cfg.unique_id = 2UL;
+
+  utils::encryption::kdf_config cfg2;
+
+  EXPECT_NE(cfg, cfg2);
+}
+
+TEST(utils_encryption_kdf_config, is_not_equal_to_different_version) {
+  utils::encryption::kdf_config cfg;
+  cfg.version = static_cast<utils::encryption::kdf_version>(0x11);
+
+  utils::encryption::kdf_config cfg2;
+
+  EXPECT_NE(cfg, cfg2);
+}
+
+TEST(utils_encryption_kdf_config, is_not_equal_to_different_kdf) {
+  utils::encryption::kdf_config cfg;
+  cfg.kdf = static_cast<utils::encryption::kdf_type>(0x11);
+
+  utils::encryption::kdf_config cfg2;
+
+  EXPECT_NE(cfg, cfg2);
+}
+
+TEST(utils_encryption_kdf_config, is_not_equal_to_different_memlimit) {
+  utils::encryption::kdf_config cfg;
+  cfg.memlimit = static_cast<utils::encryption::memlimit_level>(0x11);
+
+  utils::encryption::kdf_config cfg2;
+
+  EXPECT_NE(cfg, cfg2);
+}
+
+TEST(utils_encryption_kdf_config, is_not_equal_to_different_opslimit) {
+  utils::encryption::kdf_config cfg;
+  cfg.opslimit = static_cast<utils::encryption::opslimit_level>(0x11);
+
+  utils::encryption::kdf_config cfg2;
+
+  EXPECT_NE(cfg, cfg2);
+}
+
+TEST(utils_encryption_kdf_config, is_not_equal_to_different_salt) {
+  utils::encryption::kdf_config cfg;
+  cfg.salt[0U] = 1U;
+
+  utils::encryption::kdf_config cfg2;
+
+  EXPECT_NE(cfg, cfg2);
+}
+
+TEST(utils_encryption_kdf_config, is_not_equal_to_different_checksum) {
+  utils::encryption::kdf_config cfg;
+  cfg.checksum = 2U;
+
+  utils::encryption::kdf_config cfg2;
+
+  EXPECT_NE(cfg, cfg2);
+}
 } // namespace repertory

 #endif // defined(PROJECT_ENABLE_LIBSODIUM) && defined(PROJECT_ENABLE_BOOST)
--- a/support/test/src/utils/encryption_test.cpp
+++ b/support/test/src/utils/encryption_test.cpp
@@ -375,6 +375,10 @@ TEST(utils_encryption, encrypt_data_pointer_using_argon2id) {
 // TEST(utils_encryption, decrypt_file_name_using_argon2id) {}

 // TEST(utils_encryption, decrypt_file_path_using_argon2id) {}
+//
+// TEST(utils_encryption, decrypt_file_name_using_argon2id_master_key) {}
+
+// TEST(utils_encryption, decrypt_file_path_using_argon2id_master_key) {}
 #endif // defined(PROJECT_ENABLE_BOOST)
 } // namespace repertory