Prove OpenSSL PQ crypto in browser WASI and document the migration

1 files changed, 8 insertions, 3 deletions

diff --git a/crates/chat-crypto/src/lib.rs b/crates/chat-crypto/src/lib.rs
index 93f6674..62319e2 100644
--- a/crates/chat-crypto/src/lib.rs
+++ b/crates/chat-crypto/src/lib.rs
@@ -33,7 +33,6 @@ use pgp::serialize::{
 use pgp::types::{KeyFlags, SymmetricAlgorithm};
 use sequoia_openpgp as pgp;
 use std::io::Write;
-use wasm_bindgen::prelude::*;
 
 const PASSWORD: &str = "compatibility-test-only-not-a-real-secret";
 const TEXT: &[u8] = "stack-chat/v1: UTF-8 message — doan ↔ visitor".as_bytes();
@@ -41,7 +40,6 @@ const TEXT: &[u8] = "stack-chat/v1: UTF-8 message — doan ↔ visitor".as_bytes
 #[doc = "Exercises v6 PQ generation, protected-key import, signing and two-recipient encryption."]
 #[doc = "# Errors"]
 #[doc = "Returns a diagnostic if a required operation or integrity check fails."]
-#[wasm_bindgen]
 pub fn compatibility_probe() -> std::result::Result<String, String> {
     probe().map_err(|error| format!("{error:#}"))
 }
@@ -165,6 +163,11 @@ fn decrypt(ciphertext: &[u8], recipient: &Cert, sender: &Cert, password: &str) -
 }
 
 fn probe() -> Result<String> {
+    let backend = pgp::crypto::backend();
+    ensure!(
+        backend.starts_with("OpenSSL "),
+        "Expected OpenSSL backend, got {backend}"
+    );
     let sender = identity()?;
     let visitor = identity()?;
     ensure!(
@@ -205,7 +208,9 @@ fn probe() -> Result<String> {
         decrypt(&altered, &visitor, &sender, PASSWORD).is_err(),
         "Tampered ciphertext accepted"
     );
-    Ok("PASS: RFC 9980 ML-KEM-1024+X448, ML-DSA-87+Ed448, v6 keys, protected key import, both recipients, wrong password, wrong signer, tampering".to_owned())
+    Ok(format!(
+        "PASS: backend={backend}; RFC 9980 ML-KEM-1024+X448, ML-DSA-87+Ed448, v6 keys, protected key import, both recipients, wrong password, wrong signer, tampering"
+    ))
 }
 
 #[cfg(test)]