Xconfess/Xconfess

[Wave 6] Add E2E encryption round-trip test suite (rotation + malformed payload cases)

Open

#1,669 opened on Jul 28, 2026

View on GitHubContributor guide
 (2 comments) (0 reactions) (0 assignees)TypeScript (187 forks)auto 404
Backendhelp wantedsecuritytest

Repository metrics

Stars
 (14 stars)
PR merge metrics
 (PR metrics pending)

Description

Problem

The private messaging E2E encryption (X25519 / HKDF-SHA256 / AES-256-GCM) has no dedicated round-trip test suite covering key rotation or malformed-payload handling — only implicit coverage via feature tests.

Tasks

  • Add a dedicated encryption test suite: encrypt/decrypt round trip for standard payloads
  • Add malformed-payload cases: truncated ciphertext, wrong nonce length, tampered auth tag (should fail decryption, not throw an unhandled exception)
  • Add a key-rotation case: message encrypted under an old ephemeral key still decrypts correctly on the recipient side
  • Add a large-payload case (near any message size limit) to catch buffer-handling bugs

Acceptance Criteria

  • All new tests pass in pm run backend:test
  • Tampered ciphertext/auth tag produces a clean, typed error rather than a crash
  • Test suite is referenced in xconfess-backend/README.md under testing

Labels

Backend, security, test, help wanted, Stellar Wave

Contributor guide

Research direction
Locate the backend encryption module implementing X25519, HKDF SHA256, and AES 256 GCM. Review how it is called in existing feature tests. Then add a dedicated test suite that covers round trip encryption, malformed ciphertext (truncated, wrong nonce, tampered auth tag), key rotation, and a large payload. Follow the test conventions in the backend README.
Tech stack
typescriptnodejs
Domain
backend
Issue type
Test
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitTypeScriptnpm
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
68