Add a chunked encryption recipe implementing c2sp.org/chunked-encryption

[alex]

Resolves #2358

This adds cryptography.chunked_encryption, a top-level recipe (à la Fernet) for streaming authenticated encryption of large messages, implementing the C2SP chunked-encryption specification instantiated with SHA-256 and AES-128-GCM:

from cryptography.chunked_encryption import Decrypter, Encrypter

key = Encrypter.generate_key()
enc = Encrypter(key, context=b"myapp backup encryption")
ciphertext = enc.update(b"a secret message") + enc.finalize()
dec = Decrypter(key, context=b"myapp backup encryption")
assert dec.update(ciphertext) + dec.finalize() == b"a secret message"

Design notes:

• The core is implemented in Rust, on top of the existing AesGcm AEAD and HkdfExpand implementations. For each message a fresh AEAD key, base nonce, and 32-byte key commitment are derived with HKDF-Expand-SHA-256 from the input key, a random 24-byte salt, and a caller-provided context; the message is encrypted in 16 KiB chunks with AES-128-GCM, with the chunk counter XOR'd into the base nonce. The ciphertext is salt || commitment || chunks.
• Buffering is minimal: full 16 KiB chunks are encrypted/decrypted directly from the caller's input into the output, so only sub-chunk remainders are copied into the internal buffer. update_into() variants let callers supply their own output buffers.
• The internals are parameterized over the AEAD (IANA name, key/tag lengths) so other AEADs could be added later, but the public API is AES-128-GCM only, per the spec's recommended instantiation.
• The decrypter checks the commitment before decrypting anything, releases plaintext only for authenticated chunks, and enforces the short-final-chunk truncation rule at finalize().
• Auth failures raise cryptography.exceptions.InvalidTag; any further use of a finalized or failed context raises AlreadyFinalized.

Tests cover the test vectors from the chunked reference implementation (vendored into cryptography_vectors), plus round-trip, streaming-granularity, tampering, reordering, truncation, extension, and API misuse cases.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Uyk58oD6F8BJwKHE4qCMA8