add ecdhMask

[andrew-fleming]

Fixes #654

Summary by CodeRabbit

• New Features
  • Added support for encrypting and decrypting a single value using recipient public keys and a domain-specific mask.
  • Returned encrypted values now include the needed ephemeral component for later recovery.
  • Added test coverage for round trips, invalid inputs, wrong keys/domains, and mask consistency.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 838ff587-79bc-41d3-916f-731680011961

📥 Commits

Reviewing files that changed from the base of the PR and between c096e31 and c3b6608.

📒 Files selected for processing (3)

• contracts/src/crypto/EcdhMask.compact
• contracts/src/crypto/test/EcdhMask.test.ts
• contracts/src/crypto/test/mocks/MockEcdhMask.compact

---

Walkthrough

This PR adds a new stateless ECDH-based one-time-pad crypto module (EcdhMask) with kdf, encrypt, and decrypt circuits operating over Jubjub points and field elements, plus a test-only mock wrapper contract and a comprehensive Vitest test suite validating correctness, confidentiality, and edge cases.

Changes

ECDH Mask Module

Layer / File(s)	Summary
Ciphertext struct and kdf derivation contracts/src/crypto/EcdhMask.compact	Introduces the module, the Ciphertext struct with ephemeralPk/ct fields, and the kdf circuit deriving a field mask from a shared point and domain tag via hashing and degradeToTransient.
Encrypt and decrypt circuits contracts/src/crypto/EcdhMask.compact	Implements encrypt (with identity/zero-ephemeral guards, shared secret and mask derivation, ct = value + mask) and decrypt (recomputes shared secret and mask, value = ct - mask).
Test mock wrapper contracts/src/crypto/test/mocks/MockEcdhMask.compact	Adds a test-only mock re-exporting Ciphertext and thin pure circuit wrappers for kdf, encrypt, and decrypt.
EcdhMask test suite contracts/src/crypto/test/EcdhMask.test.ts	Adds round-trip, property-based, pad-reuse, weak-input guard, confidentiality, and kdf determinism/uniqueness tests.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant EncryptCircuit
  participant KdfCircuit
  participant DecryptCircuit

  Caller->>EncryptCircuit: encrypt(recipientPk, value, e, domain)
  EncryptCircuit->>EncryptCircuit: assert recipientPk not identity, e != 0
  EncryptCircuit->>EncryptCircuit: ephemeralPk = g^e, sShared = recipientPk^e
  EncryptCircuit->>KdfCircuit: kdf(sShared, domain)
  KdfCircuit-->>EncryptCircuit: mask
  EncryptCircuit-->>Caller: Ciphertext{ephemeralPk, ct = value + mask}

  Caller->>DecryptCircuit: decrypt(ciphertext, ekScalar, domain)
  DecryptCircuit->>DecryptCircuit: sShared = ephemeralPk^ekScalar
  DecryptCircuit->>KdfCircuit: kdf(sShared, domain)
  KdfCircuit-->>DecryptCircuit: mask
  DecryptCircuit-->>Caller: value = ct - mask

Loading

Suggested reviewers: 0xisk

Poem

A rabbit hops through Jubjub fields so wide, 🐇
With ephemeral keys held snugly at my side,
I mask each secret, one-time-pad style,
Encrypt and decrypt — round trips worthwhile,
Domain-tagged burrows keep my carrots hidden well! 🥕

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately names the main change: adding ECDH mask support.
Linked Issues check	✅ Passed	The PR adds the requested ECDH-based module, its circuits, and tests, matching issue #654's core objective.
Out of Scope Changes check	✅ Passed	The added tests and mock are support work for the new module and do not appear unrelated to issue #654.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}