ChaCha20-Poly1305 mock in Python

from hashlib import sha256
import struct

def chacha20_block(key, counter, nonce):
    """Mock ChaCha20 block: deterministic pseudo-random keystream from key+counter+nonce."""
    state_input = key + struct.pack("<I", counter) + nonce + b"ChaCha20"
    return sha256(state_input).digest()[:64]  # 64-byte keystream block

def chacha20_encrypt(key, nonce, plaintext):
    """Encrypt plaintext by XORing with keystream blocks (mock ChaCha20)."""
    ciphertext = b""
    counter = 0
    for i in range(0, len(plaintext), 64):
        keystream = chacha20_block(key, counter + i // 64, nonce)
        chunk = plaintext[i:i+64]
        ciphertext += bytes(a ^ b for a, b in zip(chunk, keystream))
    return ciphertext

def poly1305_tag(key, message):
    """Mock Poly1305: deterministic 16-byte tag using HMAC-style hashing."""
    auth_key = sha256(key + b"poly1305").digest()
    return sha256(auth_key + message).digest()[:16]

def aead_encrypt(key, nonce, plaintext, aad):
    """ChaCha20-Poly1305 mock: encrypt then authenticate ciphertext and AAD."""
    ciphertext = chacha20_encrypt(key, nonce, plaintext)
    tag = poly1305_tag(key, aad + ciphertext)
    return ciphertext, tag

if __name__ == "__main__":
    key = b"0123456789abcdef"  # 16-byte key
    nonce = b"abcdefghijkl"    # 12-byte nonce
    plaintext = b"hello world"
    aad = b"metadata header"

    ct, tag = aead_encrypt(key, nonce, plaintext, aad)
    print("ciphertext:", ct.hex())
    print("tag:", tag.hex())