keys.c

Go to the documentation of this file.

 
#include <ascii-chat/crypto/keys.h>
#include <ascii-chat/crypto/key_types.h>
#include <ascii-chat/crypto/ssh/ssh_keys.h>
#include <ascii-chat/crypto/gpg/gpg_keys.h>
#include <ascii-chat/crypto/gpg/openpgp.h>
#include <ascii-chat/crypto/https_keys.h>
#include <ascii-chat/common.h>
#include <ascii-chat/asciichat_errno.h>
#include <ascii-chat/util/path.h>
#include <ascii-chat/util/url.h>            // For url_is_valid(), url_parse()
#include <ascii-chat/platform/util.h>       // For platform_strtok_r
#include <ascii-chat/crypto/gpg/export.h>   // For gpg_get_public_key()
#include <ascii-chat/network/http_client.h> // For https_get()
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <ctype.h>
 
// =============================================================================
// High-Level Key Parsing Functions
// =============================================================================
 
asciichat_error_t parse_public_key(const char *input, public_key_t *key_out) {
  if (!input || !key_out) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid parameters for public key parsing");
  }
 
  // Clear output structure
  memset(key_out, 0, sizeof(public_key_t));
 
  // Try SSH key parsing first (full format with prefix)
  if (strncmp(input, "ssh-ed25519", 11) == 0) {
    key_out->type = KEY_TYPE_ED25519;
    asciichat_error_t result = parse_ssh_ed25519_line(input, key_out->key);
    if (result == ASCIICHAT_OK) {
      platform_strncpy(key_out->comment, sizeof(key_out->comment), "ssh-ed25519", sizeof(key_out->comment) - 1);
    }
    return result;
  }
 
  // Try raw base64 SSH public key (without "ssh-ed25519" prefix)
  // SSH Ed25519 public keys in base64 are typically ~68 characters
  size_t input_len = strlen(input);
  if (input_len >= 50 && input_len <= 80) {
    // Check if it looks like base64 (only contains valid base64 chars)
    bool looks_like_base64 = true;
    for (size_t i = 0; i < input_len; i++) {
      char c = input[i];
      if (!((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '+' || c == '/' ||
            c == '=')) {
        looks_like_base64 = false;
        break;
      }
    }
 
    if (looks_like_base64) {
      // Try to decode as SSH public key blob
      uint8_t *blob = SAFE_MALLOC(input_len, uint8_t *);
      size_t blob_len = 0;
 
      const char *end = NULL;
      int decode_result = sodium_base642bin(blob, input_len, input, input_len,
                                            NULL, // ignore chars
                                            &blob_len, &end, sodium_base64_VARIANT_ORIGINAL);
 
      if (decode_result == 0 && blob_len >= 47) { // Minimum size: 4+11+4+32 = 51 bytes
        // Validate SSH key blob structure
        // Format: [4 bytes: length][11 bytes: "ssh-ed25519"][4 bytes: length][32 bytes: key]
        if (blob_len >= 4) {
          uint32_t key_type_len =
              ((uint32_t)blob[0] << 24) | ((uint32_t)blob[1] << 16) | ((uint32_t)blob[2] << 8) | blob[3];
          if (key_type_len == 11 && blob_len >= 15 && memcmp(blob + 4, "ssh-ed25519", 11) == 0) {
            // Valid ssh-ed25519 blob, extract the 32-byte public key
            if (blob_len >= 19) {
              uint32_t pubkey_len =
                  ((uint32_t)blob[15] << 24) | ((uint32_t)blob[16] << 16) | ((uint32_t)blob[17] << 8) | blob[18];
              if (pubkey_len == 32 && blob_len >= 51) {
                // Extract Ed25519 public key
                key_out->type = KEY_TYPE_ED25519;
                memcpy(key_out->key, blob + 19, 32);
                platform_strncpy(key_out->comment, sizeof(key_out->comment), "raw-base64",
                                 sizeof(key_out->comment) - 1);
                SAFE_FREE(blob);
                return ASCIICHAT_OK;
              }
            }
          }
        }
      }
      SAFE_FREE(blob);
    }
  }
 
  // Try GPG key parsing
  if (strncmp(input, "gpg:", 4) == 0) {
    return parse_gpg_key(input + 4, key_out);
  }
 
  // Try HTTPS URLs (validated via production-grade URL regex)
  if (url_is_valid(input)) {
    // Parse HTTPS URL to extract hostname and path
    url_parts_t url_parts = {0};
    asciichat_error_t parse_result = url_parse(input, &url_parts);
    if (parse_result != ASCIICHAT_OK) {
      return SET_ERRNO(ERROR_CRYPTO_KEY, "Failed to parse HTTPS URL: %s", input);
    }
 
    // Fetch the key via HTTPS
    char *response = https_get(url_parts.host, url_parts.path);
    url_parts_destroy(&url_parts);
 
    if (!response) {
      return SET_ERRNO(ERROR_CRYPTO_KEY, "Failed to fetch key from HTTPS URL: %s", input);
    }
 
    // Parse the fetched content as a public key
    asciichat_error_t result = parse_public_key(response, key_out);
    SAFE_FREE(response);
    return result;
  }
 
  // Try HTTPS key fetching (GitHub/GitLab) - delegate to parse_public_keys and return first
  if (strncmp(input, "github:", 7) == 0 || strncmp(input, "gitlab:", 7) == 0) {
    public_key_t keys[1];
    size_t num_keys = 0;
    asciichat_error_t result = parse_public_keys(input, keys, &num_keys, 1);
    if (result == ASCIICHAT_OK && num_keys > 0) {
      *key_out = keys[0];
    }
    return result;
  }
 
  // Try raw hex key (64 hex chars = 32 bytes)
  if (strlen(input) == 64) {
    // Check if it's valid hex
    bool is_valid_hex = true;
    for (int i = 0; i < 64; i++) {
      if (!((input[i] >= '0' && input[i] <= '9') || (input[i] >= 'a' && input[i] <= 'f') ||
            (input[i] >= 'A' && input[i] <= 'F'))) {
        is_valid_hex = false;
        break;
      }
    }
 
    if (is_valid_hex) {
      // Assume it's a raw X25519 public key in hex (default for raw hex)
      key_out->type = KEY_TYPE_X25519;
      // Use hex_decode utility to safely decode hex string to binary
      if (hex_decode(input, key_out->key, 32) != ASCIICHAT_OK) {
        return SET_ERRNO(ERROR_CRYPTO_KEY, "Failed to decode hex key");
      }
      platform_strncpy(key_out->comment, sizeof(key_out->comment), "raw-hex", sizeof(key_out->comment) - 1);
      return ASCIICHAT_OK;
    }
  }
 
  // Try PGP armored format (-----BEGIN PGP PUBLIC KEY BLOCK-----)
  if (strstr(input, "-----BEGIN PGP PUBLIC KEY BLOCK-----") != NULL) {
    return parse_gpg_key_binary((const uint8_t *)input, strlen(input), key_out);
  }
 
  if (path_looks_like_path(input)) {
    char *normalized_path = NULL;
    asciichat_error_t path_result = path_validate_user_path(input, PATH_ROLE_KEY_PUBLIC, &normalized_path);
    if (path_result != ASCIICHAT_OK) {
      SAFE_FREE(normalized_path);
      return path_result;
    }
 
    FILE *f = platform_fopen(normalized_path, "r");
    if (f) {
      char line[BUFFER_SIZE_LARGE];
      if (fgets(line, sizeof(line), f)) {
        (void)fclose(f);
        SAFE_FREE(normalized_path);
        // Remove newline
        line[strcspn(line, "\r\n")] = 0;
        return parse_public_key(line, key_out);
      }
      (void)fclose(f);
    }
    SAFE_FREE(normalized_path);
  }
 
  return SET_ERRNO(ERROR_CRYPTO_KEY, "Unsupported key format: %s", input);
}
 
asciichat_error_t parse_private_key(const char *key_path, private_key_t *key_out) {
  if (!key_path || !key_out) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid parameters for private key parsing");
  }
 
  // Clear output structure
  memset(key_out, 0, sizeof(private_key_t));
 
  // Check for GPG key format: "gpg:KEYID" where KEYID is 8, 16, or 40 hex chars
  // - 8 chars: short key ID (last 8 chars of fingerprint)
  // - 16 chars: long key ID (last 16 chars of fingerprint)
  // - 40 chars: full fingerprint
  if (strncmp(key_path, "gpg:", 4) == 0) {
    const char *key_id = key_path + 4; // Skip "gpg:" prefix
 
    // Validate key ID format (must be 8, 16, or 40 hex characters)
    size_t key_id_len = strlen(key_id);
    if (key_id_len != 8 && key_id_len != 16 && key_id_len != 40) {
      return SET_ERRNO(ERROR_CRYPTO_KEY, "Invalid GPG key ID length: %zu (expected 8, 16, or 40 hex chars)",
                       key_id_len);
    }
 
    // Validate hex characters
    for (size_t i = 0; i < key_id_len; i++) {
      char c = key_id[i];
      if (!((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F'))) {
        return SET_ERRNO(ERROR_CRYPTO_KEY, "Invalid GPG key ID: contains non-hex character '%c'", c);
      }
    }
 
    // Get public key and keygrip from GPG keyring
    uint8_t public_key[32];
    char keygrip[64];
    if (gpg_get_public_key(key_id, public_key, keygrip) != 0) {
      return SET_ERRNO(ERROR_CRYPTO_KEY, "Failed to get public key from GPG for key ID: %s", key_id);
    }
 
    // Populate private_key_t structure for GPG agent use
    key_out->type = KEY_TYPE_ED25519;
    key_out->use_gpg_agent = true;
    key_out->use_ssh_agent = false;
 
    // Store public key (for handshake and verification)
    memcpy(key_out->public_key, public_key, 32);
 
    // Store keygrip (for GPG agent signing operations)
    platform_strncpy(key_out->gpg_keygrip, sizeof(key_out->gpg_keygrip), keygrip, sizeof(key_out->gpg_keygrip) - 1);
 
    // Store comment for display
    safe_snprintf(key_out->key_comment, sizeof(key_out->key_comment), "GPG key %s", key_id);
 
    // Clear the key.ed25519 field (we don't have the private key in memory)
    // The private key stays protected in GPG agent
    memset(key_out->key.ed25519, 0, 64);
 
    // Set the public key in the second half of ed25519 key (standard Ed25519 format)
    // This is for compatibility with code that expects the public key at offset 32
    memcpy(key_out->key.ed25519 + 32, public_key, 32);
 
    log_debug("Loaded GPG key %s (keygrip: %.40s) for agent signing", key_id, keygrip);
    return ASCIICHAT_OK;
  }
 
  // Try to load file and detect format
  char *normalized_path = NULL;
  asciichat_error_t path_result = path_validate_user_path(key_path, PATH_ROLE_KEY_PRIVATE, &normalized_path);
  if (path_result != ASCIICHAT_OK) {
    SAFE_FREE(normalized_path);
    return path_result;
  }
 
  // Read file content to detect format
  FILE *f = platform_fopen(normalized_path, "r");
  if (!f) {
    SAFE_FREE(normalized_path);
    return SET_ERRNO(ERROR_CRYPTO_KEY, "Failed to open private key file: %s", key_path);
  }
 
  // Read first 50 bytes to detect format
  char header[50];
  size_t bytes_read = fread(header, 1, sizeof(header) - 1, f);
  header[bytes_read] = '\0';
  fclose(f);
 
  log_debug("parse_private_key: Read %zu bytes from %s, header: %.50s", bytes_read, key_path, header);
 
  // Check for PGP armored secret key format
  if (strstr(header, "-----BEGIN PGP PRIVATE KEY") != NULL || strstr(header, "-----BEGIN PGP SECRET KEY") != NULL) {
    log_debug("Detected PGP armored secret key format in %s", key_path);
    // Load entire file for OpenPGP parsing
    f = platform_fopen(normalized_path, "r");
    if (!f) {
      SAFE_FREE(normalized_path);
      return SET_ERRNO(ERROR_CRYPTO_KEY, "Failed to open GPG key file: %s", key_path);
    }
 
    // Get file size
    fseek(f, 0, SEEK_END);
    long file_size = ftell(f);
    fseek(f, 0, SEEK_SET);
 
    if (file_size <= 0 || file_size > 1024 * 1024) { // Sanity check: max 1MB
      fclose(f);
      SAFE_FREE(normalized_path);
      return SET_ERRNO(ERROR_CRYPTO_KEY, "Invalid GPG key file size: %ld bytes", file_size);
    }
 
    char *file_content = SAFE_MALLOC((size_t)file_size + 1, char *);
    size_t content_read = fread(file_content, 1, (size_t)file_size, f);
    file_content[content_read] = '\0';
    fclose(f);
 
    // Parse OpenPGP armored secret key
    uint8_t ed25519_pk[32];
    uint8_t ed25519_sk[32];
    asciichat_error_t openpgp_result = openpgp_parse_armored_seckey(file_content, ed25519_pk, ed25519_sk);
    SAFE_FREE(file_content);
    SAFE_FREE(normalized_path);
 
    if (openpgp_result != ASCIICHAT_OK) {
      return openpgp_result;
    }
 
    // Populate private_key_t structure
    key_out->type = KEY_TYPE_ED25519;
    key_out->use_gpg_agent = false;
    key_out->use_ssh_agent = false;
 
    // Store keypair in Ed25519 format (64 bytes: 32-byte seed + 32-byte public key)
    // libsodium expects the seed in first 32 bytes and public key in second 32 bytes
    memcpy(key_out->key.ed25519, ed25519_sk, 32);      // Secret key (seed)
    memcpy(key_out->key.ed25519 + 32, ed25519_pk, 32); // Public key
    memcpy(key_out->public_key, ed25519_pk, 32);       // Also store in public_key field
 
    // Store comment
    safe_snprintf(key_out->key_comment, sizeof(key_out->key_comment), "GPG Ed25519 key from %s", key_path);
 
    log_debug("Loaded unencrypted GPG Ed25519 key from %s", key_path);
    return ASCIICHAT_OK;
  }
 
  // Fall back to SSH private key parsing
  asciichat_error_t result = parse_ssh_private_key(normalized_path, key_out);
  SAFE_FREE(normalized_path);
  return result;
}
 
// =============================================================================
// Multi-Key Public Key Parsing
// =============================================================================
 
asciichat_error_t parse_public_keys(const char *input, public_key_t *keys_out, size_t *num_keys, size_t max_keys) {
  if (!input || !keys_out || !num_keys || max_keys == 0) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid parameters for multi-key parsing");
  }
 
  *num_keys = 0;
 
  // Handle comma-separated key specifiers
  if (strchr(input, ',') != NULL) {
    size_t input_len = strlen(input);
    char *input_copy = SAFE_MALLOC(input_len + 1, char *);
    memcpy(input_copy, input, input_len + 1);
 
    char *saveptr = NULL;
    char *specifier = platform_strtok_r(input_copy, ",", &saveptr);
 
    while (specifier != NULL && *num_keys < max_keys) {
      // Trim leading/trailing whitespace
      while (*specifier && isspace((unsigned char)*specifier)) {
        specifier++;
      }
      char *end = specifier + strlen(specifier) - 1;
      while (end > specifier && isspace((unsigned char)*end)) {
        *end-- = '\0';
      }
 
      // Skip empty specifiers
      if (strlen(specifier) > 0) {
        // Recursively parse this single specifier (will not re-enter comma handling)
        size_t current_num = 0;
        asciichat_error_t result =
            parse_public_keys(specifier, &keys_out[*num_keys], &current_num, max_keys - *num_keys);
        if (result == ASCIICHAT_OK && current_num > 0) {
          *num_keys += current_num;
        } else {
          log_warn("Failed to parse key specifier: %s", specifier);
          // Continue parsing remaining specifiers even if one fails
        }
      }
 
      specifier = platform_strtok_r(NULL, ",", &saveptr);
    }
 
    SAFE_FREE(input_copy);
 
    if (*num_keys == 0) {
      return SET_ERRNO(ERROR_CRYPTO_KEY, "No valid keys found in comma-separated list: %s", input);
    }
    return ASCIICHAT_OK;
  }
 
  // Check for direct SSH Ed25519 key format BEFORE checking for file paths
  // (SSH keys can contain '/' in base64, which would match path_looks_like_path)
  if (strncmp(input, "ssh-ed25519", 11) == 0) {
    asciichat_error_t result = parse_public_key(input, &keys_out[0]);
    if (result == ASCIICHAT_OK) {
      *num_keys = 1;
    }
    return result;
  }
 
  // Check if this is a GitHub/GitLab reference - these support multiple keys
  if (strncmp(input, "github:", 7) == 0 || strncmp(input, "gitlab:", 7) == 0) {
    const char *username = input + 7; // Skip "github:" or "gitlab:"
    bool is_github = (strncmp(input, "github:", 7) == 0);
    bool is_gpg = (strstr(username, ".gpg") != NULL);
 
    char **keys = NULL;
    size_t num_fetched_keys = 0;
    asciichat_error_t result;
 
    if (is_github) {
      if (is_gpg) {
        result = fetch_github_gpg_keys(username, &keys, &num_fetched_keys);
      } else {
        result = fetch_github_ssh_keys(username, &keys, &num_fetched_keys);
      }
    } else {
      if (is_gpg) {
        result = fetch_gitlab_gpg_keys(username, &keys, &num_fetched_keys);
      } else {
        result = fetch_gitlab_ssh_keys(username, &keys, &num_fetched_keys);
      }
    }
 
    if (result != ASCIICHAT_OK || num_fetched_keys == 0) {
      return SET_ERRNO(ERROR_CRYPTO_KEY, "Failed to fetch keys from %s for user: %s", is_github ? "GitHub" : "GitLab",
                       username);
    }
 
    // Parse each fetched key (only Ed25519 keys will succeed)
    for (size_t i = 0; i < num_fetched_keys && *num_keys < max_keys; i++) {
      if (parse_public_key(keys[i], &keys_out[*num_keys]) == ASCIICHAT_OK) {
        (*num_keys)++;
      }
      // Non-Ed25519 keys are silently skipped
    }
 
    // Free the keys array
    for (size_t i = 0; i < num_fetched_keys; i++) {
      SAFE_FREE(keys[i]);
    }
    SAFE_FREE(keys);
 
    if (*num_keys == 0) {
      return SET_ERRNO(ERROR_CRYPTO_KEY, "No valid Ed25519 keys found for %s user: %s", is_github ? "GitHub" : "GitLab",
                       username);
    }
 
    log_debug("Parsed %zu Ed25519 key(s) from %s user: %s", *num_keys, is_github ? "GitHub" : "GitLab", username);
    return ASCIICHAT_OK;
  }
 
  // For file paths, delegate to parse_keys_from_file
  if (path_looks_like_path(input)) {
    return parse_keys_from_file(input, keys_out, num_keys, max_keys);
  }
 
  // For all other formats, use single-key parsing
  asciichat_error_t result = parse_public_key(input, &keys_out[0]);
  if (result == ASCIICHAT_OK) {
    *num_keys = 1;
  }
  return result;
}
 
// =============================================================================
// Key Conversion Functions
// =============================================================================
 
asciichat_error_t public_key_to_x25519(const public_key_t *key, uint8_t x25519_pk[32]) {
  if (!key || !x25519_pk) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid parameters for public_key_to_x25519");
  }
 
  if (key->type == KEY_TYPE_X25519) {
    // Passthrough for X25519 keys
    memcpy(x25519_pk, key->key, 32);
    return ASCIICHAT_OK;
  }
 
  if (key->type == KEY_TYPE_ED25519) {
    // Convert Ed25519 to X25519
    return ed25519_to_x25519_public(key->key, x25519_pk);
  }
 
  return SET_ERRNO(ERROR_CRYPTO_KEY, "Unsupported key type for X25519 conversion: %d", key->type);
}
 
asciichat_error_t private_key_to_x25519(const private_key_t *key, uint8_t x25519_sk[32]) {
  if (!key || !x25519_sk) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid parameters for private_key_to_x25519");
  }
 
  if (key->type == KEY_TYPE_X25519) {
    // Passthrough for X25519 keys
    memcpy(x25519_sk, key->key.x25519, 32);
    return ASCIICHAT_OK;
  }
 
  if (key->type == KEY_TYPE_ED25519) {
    // Convert Ed25519 to X25519 (Ed25519 private key is 64 bytes: seed + public)
    return ed25519_to_x25519_private(key->key.ed25519, x25519_sk);
  }
 
  return SET_ERRNO(ERROR_CRYPTO_KEY, "Unsupported key type for X25519 conversion: %d", key->type);
}
 
// =============================================================================
// HTTPS Key Fetching Wrapper Functions
// =============================================================================
 
asciichat_error_t fetch_github_keys(const char *username, char ***keys_out, size_t *num_keys, bool use_gpg) {
  if (!username || !keys_out || !num_keys) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid parameters for fetch_github_keys");
  }
 
  if (use_gpg) {
    return fetch_github_gpg_keys(username, keys_out, num_keys);
  } else {
    return fetch_github_ssh_keys(username, keys_out, num_keys);
  }
}
 
asciichat_error_t fetch_gitlab_keys(const char *username, char ***keys_out, size_t *num_keys, bool use_gpg) {
  if (!username || !keys_out || !num_keys) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid parameters for fetch_gitlab_keys");
  }
 
  if (use_gpg) {
    return fetch_gitlab_gpg_keys(username, keys_out, num_keys);
  } else {
    return fetch_gitlab_ssh_keys(username, keys_out, num_keys);
  }
}
 
// =============================================================================
// Key Formatting Functions
// =============================================================================
 
asciichat_error_t parse_keys_from_file(const char *path, public_key_t *keys, size_t *num_keys, size_t max_keys) {
  if (!path || !keys || !num_keys) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid parameters for key file parsing");
  }
 
  *num_keys = 0;
 
  if (!path_looks_like_path(path)) {
    return SET_ERRNO(ERROR_CRYPTO_KEY, "Invalid keys file path: %s", path);
  }
 
  char *normalized_path = NULL;
  asciichat_error_t path_result = path_validate_user_path(path, PATH_ROLE_CLIENT_KEYS, &normalized_path);
  if (path_result != ASCIICHAT_OK) {
    SAFE_FREE(normalized_path);
    return path_result;
  }
 
  FILE *f = platform_fopen(normalized_path, "r");
  if (!f) {
    SAFE_FREE(normalized_path);
    return SET_ERRNO(ERROR_CRYPTO_KEY, "Failed to open keys file: %s", path);
  }
 
  char line[BUFFER_SIZE_LARGE];
  while (fgets(line, sizeof(line), f) && *num_keys < max_keys) {
    // Remove newline
    line[strcspn(line, "\r\n")] = 0;
 
    // Skip empty lines and comments
    if (strlen(line) == 0 || line[0] == '#') {
      continue;
    }
 
    if (parse_public_key(line, &keys[*num_keys]) == ASCIICHAT_OK) {
      (*num_keys)++;
    }
  }
 
  (void)fclose(f);
  SAFE_FREE(normalized_path);
  return ASCIICHAT_OK;
}
 
void format_public_key(const public_key_t *key, char *output, size_t output_size) {
  if (!key || !output || output_size == 0) {
    return;
  }
 
  if (key->type == KEY_TYPE_ED25519) {
    // Format as SSH Ed25519 public key
    // Simple base64 encoding for 32 bytes = 43 chars + padding
    // For now, just use hex encoding
    char hex_key[65];
    for (size_t i = 0; i < 32; i++) {
      char hex_byte[3];
      safe_snprintf(hex_byte, sizeof(hex_byte), "%02x", key->key[i]);
      hex_key[i * 2] = hex_byte[0];
      hex_key[i * 2 + 1] = hex_byte[1];
    }
    hex_key[64] = '\0';
    safe_snprintf(output, output_size, "ssh-ed25519 %s %s", hex_key, key->comment);
  } else if (key->type == KEY_TYPE_X25519) {
    // Format as hex X25519 key
    char hex_key[65];
    for (size_t i = 0; i < 32; i++) {
      char hex_byte[3];
      safe_snprintf(hex_byte, sizeof(hex_byte), "%02x", key->key[i]);
      hex_key[i * 2] = hex_byte[0];
      hex_key[i * 2 + 1] = hex_byte[1];
    }
    hex_key[64] = '\0';
    safe_snprintf(output, output_size, "x25519 %s", hex_key);
  } else {
    safe_snprintf(output, output_size, "unknown key type: %d", key->type);
  }
}
 
// =============================================================================
// Hex Encoding/Decoding Utilities
// =============================================================================
 
asciichat_error_t hex_decode(const char *hex, uint8_t *output, size_t output_len) {
  if (!hex || !output) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid parameters for hex_decode");
  }
 
  size_t hex_len = strlen(hex);
  size_t expected_hex_len = output_len * 2;
 
  if (hex_len != expected_hex_len) {
    return SET_ERRNO(ERROR_INVALID_PARAM,
                     "Hex string length (%zu) doesn't match expected output length (%zu * 2 = %zu)", hex_len,
                     output_len, expected_hex_len);
  }
 
  // Decode hex string to binary
  for (size_t i = 0; i < output_len; i++) {
    char hex_byte[3] = {hex[i * 2], hex[i * 2 + 1], '\0'};
    char *endptr;
    unsigned long byte = strtoul(hex_byte, &endptr, 16);
 
    // Validate hex character
    if (*endptr != '\0' || byte > 255) {
      return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid hex character at position %zu: '%c%c'", i * 2, hex[i * 2],
                       hex[i * 2 + 1]);
    }
 
    output[i] = (uint8_t)byte;
  }
 
  return ASCIICHAT_OK;
}