Prove OpenSSL PQ crypto in browser WASI and document the migration

2 files changed, 31 insertions, 3 deletions

diff --git a/crates/chat-crypto/src/lib.rs b/crates/chat-crypto/src/lib.rs
index 93f6674..62319e2 100644
--- a/crates/chat-crypto/src/lib.rs
+++ b/crates/chat-crypto/src/lib.rs
@@ -33,7 +33,6 @@ use pgp::serialize::{
 use pgp::types::{KeyFlags, SymmetricAlgorithm};
 use sequoia_openpgp as pgp;
 use std::io::Write;
-use wasm_bindgen::prelude::*;
 
 const PASSWORD: &str = "compatibility-test-only-not-a-real-secret";
 const TEXT: &[u8] = "stack-chat/v1: UTF-8 message — doan ↔ visitor".as_bytes();
@@ -41,7 +40,6 @@ const TEXT: &[u8] = "stack-chat/v1: UTF-8 message — doan ↔ visitor".as_bytes
 #[doc = "Exercises v6 PQ generation, protected-key import, signing and two-recipient encryption."]
 #[doc = "# Errors"]
 #[doc = "Returns a diagnostic if a required operation or integrity check fails."]
-#[wasm_bindgen]
 pub fn compatibility_probe() -> std::result::Result<String, String> {
     probe().map_err(|error| format!("{error:#}"))
 }
@@ -165,6 +163,11 @@ fn decrypt(ciphertext: &[u8], recipient: &Cert, sender: &Cert, password: &str) -
 }
 
 fn probe() -> Result<String> {
+    let backend = pgp::crypto::backend();
+    ensure!(
+        backend.starts_with("OpenSSL "),
+        "Expected OpenSSL backend, got {backend}"
+    );
     let sender = identity()?;
     let visitor = identity()?;
     ensure!(
@@ -205,7 +208,9 @@ fn probe() -> Result<String> {
         decrypt(&altered, &visitor, &sender, PASSWORD).is_err(),
         "Tampered ciphertext accepted"
     );
-    Ok("PASS: RFC 9980 ML-KEM-1024+X448, ML-DSA-87+Ed448, v6 keys, protected key import, both recipients, wrong password, wrong signer, tampering".to_owned())
+    Ok(format!(
+        "PASS: backend={backend}; RFC 9980 ML-KEM-1024+X448, ML-DSA-87+Ed448, v6 keys, protected key import, both recipients, wrong password, wrong signer, tampering"
+    ))
 }
 
 #[cfg(test)]
diff --git a/crates/chat-crypto/src/main.rs b/crates/chat-crypto/src/main.rs
new file mode 100644
index 0000000..b6749cf
--- /dev/null
+++ b/crates/chat-crypto/src/main.rs
@@ -0,0 +1,23 @@
+// Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as
+// published by the Free Software Foundation, either version 3 of the
+// License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+#![doc = "Command entry point for the isolated cryptographic compatibility probe."]
+
+use std::io::{self, Write};
+
+fn main() -> io::Result<()> {
+    let result = stack_chat_crypto::compatibility_probe().map_err(io::Error::other)?;
+    writeln!(io::stdout().lock(), "{result}")
+}