Add ipcrypt-pfx

Author: jedisct1

dnscrypt-proxy/example-dnscrypt-proxy.toml

@@ -964,6 +964,7 @@ skip_incompatible = false
 ## - "ipcrypt-deterministic": Deterministic encryption (same IP always encrypts to same value) - requires 16-byte key
 ## - "ipcrypt-nd": Non-deterministic encryption with 8-byte tweak - requires 16-byte key
 ## - "ipcrypt-ndx": Non-deterministic encryption with 16-byte tweak (extended) - requires 32-byte key
+## - "ipcrypt-pfx": Prefix-preserving encryption (preserves network prefix relationships) - requires 32-byte key
 
 algorithm = "none"
 

dnscrypt-proxy/ipcrypt.go

@@ -67,8 +67,14 @@ func NewIPCryptConfig(keyHex string, algorithm string) (*IPCryptConfig, error) {
 		}
 		config.Tweak = make([]byte, 16)
 
+	case "ipcrypt-pfx":
+		// Prefix-preserving encryption
+		if len(key) != 32 {
+			return nil, fmt.Errorf("ipcrypt-pfx requires a 32-byte (64 hex chars) key, got %d bytes", len(key))
+		}
+
 	default:
-		return nil, fmt.Errorf("unsupported IP encryption algorithm: %s (must be 'ipcrypt-deterministic', 'ipcrypt-nd', 'ipcrypt-ndx', or 'none')", algorithm)
+		return nil, fmt.Errorf("unsupported IP encryption algorithm: %s (must be 'ipcrypt-deterministic', 'ipcrypt-nd', 'ipcrypt-ndx', 'ipcrypt-pfx', or 'none')", algorithm)
 	}
 
 	return config, nil
@@ -113,6 +119,14 @@ func (config *IPCryptConfig) EncryptIP(ip net.IP) (string, error) {
 		// Return as hex string for non-deterministic modes
 		return hex.EncodeToString(encrypted), nil
 
+	case "ipcrypt-pfx":
+		// Prefix-preserving encryption
+		encrypted, err := ipcrypt.EncryptIPPfx(ip, config.Key)
+		if err != nil {
+			return "", fmt.Errorf("failed to encrypt IP (pfx): %w", err)
+		}
+		return encrypted.String(), nil
+
 	default:
 		return "", fmt.Errorf("unsupported algorithm: %s", config.Algorithm)
 	}
@@ -182,6 +196,18 @@ func (config *IPCryptConfig) DecryptIP(encryptedStr string) (string, error) {
 		}
 		return decrypted, nil
 
+	case "ipcrypt-pfx":
+		// Decrypt prefix-preserving encrypted IP
+		ip := net.ParseIP(encryptedStr)
+		if ip == nil {
+			return "", fmt.Errorf("invalid encrypted IP address: %s", encryptedStr)
+		}
+		decrypted, err := ipcrypt.DecryptIPPfx(ip, config.Key)
+		if err != nil {
+			return "", fmt.Errorf("failed to decrypt IP (pfx): %w", err)
+		}
+		return decrypted.String(), nil
+
 	default:
 		return "", fmt.Errorf("unsupported algorithm: %s", config.Algorithm)
 	}