LOCK YOUR
PRIVATE PHOTOS
FOR GOOD.

import CryptoKit

final class VaultCrypto {

 /// Encrypts photo data with ChaCha20-Poly1305 AEAD
 static func encryptData(_ data: Data, key: SymmetricKey) throws -> Data {
  // ChaCha20-Poly1305 provides:
  // - Confidentiality (encryption)
  // - Authenticity (HMAC)
  // - Integrity (tampering detection)
  let sealedBox = try ChaChaPoly.seal(data, using: key)

  return sealedBox.combined // Nonce + Ciphertext + Tag
 }

 /// Decrypts vault photo
 static func decryptData(_ encryptedData: Data, key: SymmetricKey) throws -> Data {
  let sealedBox = try ChaChaPoly.SealedBox(combined: encryptedData)

  // Authentication tag verified automatically
  // Throws error if data has been tampered with
  let decryptedData = try ChaChaPoly.open(sealedBox, using: key)

  return decryptedData
 }

 /// Generates vault encryption key with entropy validation
 static func generateVaultKey() throws -> SymmetricKey {
  let key = SymmetricKey(size: .bits256)

  // Validate entropy meets NIST SP 800-90B standards
  let keyData = key.withUnsafeBytes { Data($0) }
  let entropy = calculateEntropy(keyData)

  guard entropy >= 7.5 else {
   throw CryptoError.insufficientEntropy
  }

  return key
 }
}