API Documentation

// Constants
const MAGIC = new Uint8Array([0x49, 0x48, 0x45, 0x31]); // "IHE1"
const VERSION = 0x01;
const IV_LENGTH = 12;

// Generate a random 256-bit key
async function generateKey() {
    return await crypto.subtle.generateKey(
        { name: 'AES-GCM', length: 256 },
        true,  // extractable
        ['encrypt', 'decrypt']
    );
}

// Encrypt image data
async function encryptImage(imageData, key) {
    // Generate random IV
    const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));

    // Encrypt with AES-256-GCM
    const ciphertext = await crypto.subtle.encrypt(
        { name: 'AES-GCM', iv: iv, tagLength: 128 },
        key,
        imageData
    );

    // Build output: magic + version + iv + ciphertext
    const header = new Uint8Array([...MAGIC, VERSION]);
    const result = new Uint8Array(
        header.length + iv.length + ciphertext.byteLength
    );
    result.set(header, 0);
    result.set(iv, header.length);
    result.set(new Uint8Array(ciphertext), header.length + iv.length);

    return result;
}

// Export key as URL-safe base64 (for sharing)
async function exportKeyForSharing(key) {
    const raw = await crypto.subtle.exportKey('raw', key);
    const base64 = btoa(String.fromCharCode(...new Uint8Array(raw)));
    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
}

// Usage
const imageFile = /* File from input */;
const imageData = await imageFile.arrayBuffer();
const key = await generateKey();
const encrypted = await encryptImage(imageData, key);
const keyString = await exportKeyForSharing(key);

// Upload encrypted blob to API
// Share URL: https://example.com/v/abc123#${keyString}

import os
import base64
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

# Constants
MAGIC = b'IHE1'
VERSION = b'\x01'
IV_LENGTH = 12
KEY_LENGTH = 32  # 256 bits

def generate_key() -> bytes:
    """Generate a random 256-bit key."""
    return os.urandom(KEY_LENGTH)

def encrypt_image(image_data: bytes, key: bytes) -> bytes:
    """Encrypt image data using AES-256-GCM."""
    # Generate random IV
    iv = os.urandom(IV_LENGTH)

    # Encrypt
    aesgcm = AESGCM(key)
    ciphertext = aesgcm.encrypt(iv, image_data, None)

    # Build output: magic + version + iv + ciphertext
    return MAGIC + VERSION + iv + ciphertext

def key_to_url_safe(key: bytes) -> str:
    """Convert key to URL-safe base64 for sharing."""
    return base64.urlsafe_b64encode(key).rstrip(b'=').decode()

# Usage
with open('image.png', 'rb') as f:
    image_data = f.read()

key = generate_key()
encrypted = encrypt_image(image_data, key)
key_string = key_to_url_safe(key)

# Upload 'encrypted' to the API
# Share URL: https://example.com/v/abc123#{key_string}

# Python decryption example
def decrypt_image(encrypted_data: bytes, key: bytes) -> bytes:
    # Verify magic header
    if encrypted_data[:4] != MAGIC:
        raise ValueError("Invalid magic header")

    # Verify version
    if encrypted_data[4:5] != VERSION:
        raise ValueError("Unsupported version")

    # Extract IV and ciphertext
    iv = encrypted_data[5:5 + IV_LENGTH]
    ciphertext = encrypted_data[5 + IV_LENGTH:]

    # Decrypt
    aesgcm = AESGCM(key)
    return aesgcm.decrypt(iv, ciphertext, None)