/**
 * @file crypto.h
 * @brief AES-256-GCM Crypto Operations
 */

#ifndef CRYPTO_H
#define CRYPTO_H

#include <esp_err.h>
#include <stdint.h>

/**
 * @brief Initialize crypto module
 */
esp_err_t crypto_init(void);

/**
 * @brief Derive key from HWID + salt
 * 
 * @param hwid Hardware ID
 * @param salt Salt string
 * @param key Output 32-byte key
 * @return esp_err_t ESP_OK on success
 */
esp_err_t crypto_derive_key(const char *hwid, const char *salt, uint8_t key[32]);

/**
 * @brief Decrypt AES-256-GCM ciphertext
 * 
 * @param ciphertext Input ciphertext (nonce + encrypted)
 * @param len Ciphertext length
 * @param key 32-byte key
 * @param plaintext Output plaintext (caller must free)
 * @param plaintext_len Output plaintext length
 * @return esp_err_t ESP_OK on success
 */
esp_err_t crypto_decrypt(const uint8_t *ciphertext, size_t len,
                        const uint8_t key[32], uint8_t **plaintext,
                        size_t *plaintext_len);

#endif /* CRYPTO_H */