Encryption Tool

Example Code

```rust
// Cargo.toml dependencies:
// [dependencies]
// aes-gcm = "0.10"
// hex = "0.4"
// rand_core = { version = "0.6", features = ["std"] }

use aes_gcm::{
    aead::{Aead, KeyInit, OsRng},
    Aes256Gcm, Key, Nonce
};
use hex::{encode, decode};
use rand_core::RngCore; // Required for OsRng.fill_bytes

// Helper function to encrypt data using AES-256 GCM
fn encrypt_data(
    plaintext: &[u8],
    key: &Key<Aes256Gcm>,
    nonce: &Nonce<Aes256Gcm>,
) -> Result<Vec<u8>, String> {
    let cipher = Aes256Gcm::new(key);
    cipher.encrypt(nonce, plaintext.as_ref())
        .map_err(|e| format!("Encryption failed: {:?}", e))
}

// Helper function to decrypt data using AES-256 GCM
fn decrypt_data(
    ciphertext: &[u8],
    key: &Key<Aes256Gcm>,
    nonce: &Nonce<Aes256Gcm>,
) -> Result<Vec<u8>, String> {
    let cipher = Aes256Gcm::new(key);
    cipher.decrypt(nonce, ciphertext.as_ref())
        .map_err(|e| format!("Decryption failed: {:?}", e))
}

fn main() {
    println!("--- Rust Encryption Tool Example (AES-256 GCM) ---");

    // 1. Original data to encrypt
    let original_text = "This is a secret message that needs to be encrypted.";
    let original_bytes = original_text.as_bytes();
    println!("Original message: \"{}\"", original_text);

    // 2. Generate a random AES-256 key
    // Key length for AES-256 is 32 bytes (256 bits).
    // In a production application, keys would be securely generated and managed.
    let key = Aes256Gcm::generate_key(&mut OsRng);
    println!("Generated Key (hex): {}", encode(&key));

    // 3. Generate a random Nonce (Initialization Vector)
    // Nonce length for AES-GCM is 12 bytes (96 bits).
    // A nonce MUST be unique for every encryption with the same key. 
    // It does not need to be secret but must be unpredictable if not derived properly.
    let mut nonce_bytes = [0u8; 12]; // GCM recommends 12-byte nonces
    OsRng.fill_bytes(&mut nonce_bytes);
    let nonce = Nonce::from_slice(&nonce_bytes);
    println!("Generated Nonce (hex): {}", encode(nonce_bytes));

    // 4. Encrypt the data
    match encrypt_data(original_bytes, &key, &nonce) {
        Ok(encrypted_bytes) => {
            let encrypted_hex = encode(&encrypted_bytes);
            println!("Encrypted ciphertext (hex): {}", encrypted_hex);

            // 5. Decrypt the data
            // The same key and nonce must be used for decryption.
            match decrypt_data(&encrypted_bytes, &key, &nonce) {
                Ok(decrypted_bytes) => {
                    let decrypted_text = String::from_utf8_lossy(&decrypted_bytes);
                    println!("Decrypted message: \"{}\"", decrypted_text);

                    assert_eq!(original_text, decrypted_text);
                    println!("\nEncryption and decryption successful!");
                },
                Err(e) => eprintln!("Failed to decrypt: {}", e),
            }
        },
        Err(e) => eprintln!("Failed to encrypt: {}", e),
    }

    // --- Example of expected decryption failures ---

    // Attempting decryption with a wrong key
    println!("\n--- Attempting decryption with a wrong key (expected to fail) ---");
    let wrong_key = Aes256Gcm::generate_key(&mut OsRng);
    match encrypt_data(original_bytes, &key, &nonce) { // Encrypt with original key
        Ok(encrypted_bytes) => {
            match decrypt_data(&encrypted_bytes, &wrong_key, &nonce) { // Try decrypting with wrong key
                Ok(_) => println!("Unexpected success with wrong key! (This shouldn't happen)"),
                Err(e) => println!("Decryption with wrong key correctly failed: {}", e),
            }
        },
        Err(e) => eprintln!("Failed to encrypt for wrong key test: {}", e),
    }

    // Attempting decryption with corrupted ciphertext
    println!("\n--- Attempting decryption with corrupted ciphertext (expected to fail) ---");
    match encrypt_data(original_bytes, &key, &nonce) { // Encrypt with original key
        Ok(mut encrypted_bytes) => {
            // Corrupt one byte of the ciphertext to simulate tampering
            if let Some(byte) = encrypted_bytes.get_mut(0) {
                *byte = byte.wrapping_add(1); // Introduce a small change
            } else {
                eprintln!("Ciphertext too short to corrupt.\n");
                return;
            }

            match decrypt_data(&encrypted_bytes, &key, &nonce) { // Try decrypting corrupted ciphertext
                Ok(_) => println!("Unexpected success with corrupted ciphertext! (This shouldn't happen)"),
                Err(e) => println!("Decryption with corrupted ciphertext correctly failed: {}", e),
            }
        },
        Err(e) => eprintln!("Failed to encrypt for corrupted ciphertext test: {}", e),
    }
}
```