cryptography 47.0.0: AESGCM.generate_key requires key size in bits rather than bytes, and AESGCM.encrypt concatenates the 16-byte authentication tag directly onto the ciphertext instead of returning a separate tag.

# Notes

Existing solution search returned sample sha256:b98c885c2365fa2de56dab1eea1087f3137ec69c260717f69d7ade5d27bee868 covering Rust extension compilation vs CFFI dynamic bindings on musl distributions.

This sample proves the API contract of the AEAD AESGCM primitive in the cryptography library. Callers frequently expect AESGCM.generate_key to accept key lengths in bytes (such as 32 for AES-256) and expect AESGCM.encrypt to return the ciphertext separate from the authentication tag. Instead, AESGCM.generate_key requires bit length (128, 192, or 256), and AESGCM.encrypt appends the 16-byte authentication tag directly to the ciphertext.

Passing byte lengths like 32 to AESGCM.generate_key fails loudly with ValueError: bit_length must be 128, 192, or 256, while passing detached ciphertext without the 16-byte tag to AESGCM.decrypt fails loudly with InvalidTag.

{"case":{"believed":"AESGCM.generate_key takes key length in bytes and AESGCM.encrypt returns ciphertext separately from the 16-byte authentication tag.","caseId":"case:sha256:c98b7721963d16ccb78a8a29dcea0eb02f467517c25120dbaea4c6c2a7a6782e","contract":["AESGCM.encrypt appends the 16-byte authentication tag to ciphertext producing len(plaintext) + 16 bytes, and AESGCM.generate_key rejects byte lengths with ValueError","AESGCM.decrypt accepts combined ciphertext and tag and fails with InvalidTag when passed detached ciphertext or mismatched associated data","AESGCM accepts None for associated_data during encryption and decrypts successfully with b''"],"goal":"AESGCM.generate_key requires key size in bits rather than bytes, and AESGCM.encrypt concatenates the 16-byte authentication tag directly onto the ciphertext instead of returning a separate tag.","kind":"HOW","packages":["pkg:pypi/cryptography@47.0.0"],"schemaVersion":1,"symbols":["cryptography.hazmat.primitives.ciphers.aead.AESGCM","cryptography.hazmat.primitives.ciphers.aead.AESGCM.generate_key","cryptography.hazmat.primitives.ciphers.aead.AESGCM.encrypt","cryptography.hazmat.primitives.ciphers.aead.AESGCM.decrypt","cryptography.exceptions.InvalidTag"]},"contractCommand":["python","test/contract.py"],"environment":{"arch":"x64","ecosystem":"pypi","executionContext":"python","language":"python","os":"linux","packageManager":"pip","runtime":"python","schemaVersion":1},"license":"MIT-0","packages":["pkg:pypi/cryptography@47.0.0"],"schemaVersion":1,"symbols":["cryptography.hazmat.primitives.ciphers.aead.AESGCM","cryptography.hazmat.primitives.ciphers.aead.AESGCM.generate_key","cryptography.hazmat.primitives.ciphers.aead.AESGCM.encrypt","cryptography.hazmat.primitives.ciphers.aead.AESGCM.decrypt","cryptography.exceptions.InvalidTag"],"verifierAdapter":"python@1"}

cffi==2.0.0
cryptography==47.0.0
pycparser==3.0

cffi==2.0.0
cryptography==47.0.0
pycparser==3.0

import os
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.exceptions import InvalidTag

# 1. AESGCM.generate_key takes bit_length in bits (128, 192, 256), NOT byte count
try:
    AESGCM.generate_key(32)
    raise AssertionError("AESGCM.generate_key(32) should fail when passed byte length")
except ValueError as e:
    assert str(e) == "bit_length must be 128, 192, or 256"

key = AESGCM.generate_key(bit_length=256)
assert len(key) == 32
aesgcm = AESGCM(key)

# 2. AESGCM.encrypt concatenates 16-byte authentication tag directly to ciphertext
nonce = os.urandom(12)
plaintext = b"authenticated payload data"
aad = b"header_data"

ciphertext_and_tag = aesgcm.encrypt(nonce, plaintext, aad)
assert len(ciphertext_and_tag) == len(plaintext) + 16

# 3. AESGCM.decrypt expects the combined ciphertext + tag payload
decrypted = aesgcm.decrypt(nonce, ciphertext_and_tag, aad)
assert decrypted == plaintext

# 4. Decrypting detached ciphertext without tag fails with InvalidTag
detached_ciphertext = ciphertext_and_tag[:-16]
try:
    aesgcm.decrypt(nonce, detached_ciphertext, aad)
    raise AssertionError("Decrypting detached ciphertext without tag must raise InvalidTag")
except InvalidTag:
    pass

# 5. Tampered ciphertext or mismatched associated data fails with InvalidTag
try:
    aesgcm.decrypt(nonce, ciphertext_and_tag, b"corrupted_header")
    raise AssertionError("Mismatched associated_data must raise InvalidTag")
except InvalidTag:
    pass

# 6. associated_data=None is valid and normalizes to empty bytes b""
ct_none_aad = aesgcm.encrypt(nonce, plaintext, None)
dec_empty_aad = aesgcm.decrypt(nonce, ct_none_aad, b"")
assert dec_empty_aad == plaintext