refactor: share stream config and size math

BodyMaterial arrived after the range API was written, so it duplicated
logic the envelope path already had. Two copies mattered, because both
underpin the claim that the envelope path and the cached-material path
accept the same inputs and fail the same way:

- the aesstream.Config literal, built field by field in openStream and
  again in spanRangeReader, now bodyParams.streamConfig
- the plaintext-size derivation, in both BodyMaterial.PlaintextSize and
  plaintextSizeFor, now plaintextSizeFrom

bodyParams stays a separate type. Merging it into BodyMaterial would
hand the whole-object path a material with no header length to put in
it: cose.DecodeReader does not report how many bytes the envelope
consumed, and Decrypt has no use for the number. Its doc comment now
records what BodyMaterial adds and why the two shapes differ.

Validate stays off the envelope paths. validateBody checks that the iv
header is present but not that it is BaseNonceSize bytes, so a short iv
keeps failing in the body cipher rather than as ErrIncompleteMaterial.

Internal only: the exported surface is unchanged.

Signed-off-by: Miroslav Bajtoš <oss@bajtos.net>
Assisted-by: Claude:claude-opus-5

Author: bajtos

fee.go

@@ -534,12 +534,7 @@ func openStream(env *cose.Envelope, ciphertext io.Reader, cek []byte) (io.Reader
 	if err != nil {
 		return nil, err
 	}
-	r, err := aesstream.NewReader(ciphertext, aesstream.Config{
-		Key:       cek,
-		BaseNonce: body.baseNonce,
-		AAD:       body.aad,
-		ChunkSize: body.chunkSize,
-	})
+	r, err := aesstream.NewReader(ciphertext, body.streamConfig(cek))
 	if err != nil {
 		return nil, fmt.Errorf("fee: initializing body cipher: %w", err)
 	}
@@ -549,12 +544,32 @@ func openStream(env *cose.Envelope, ciphertext io.Reader, cek []byte) (io.Reader
 // bodyParams is the validated STREAM configuration a FEE envelope's body header
 // carries: everything fee/aesstream needs to decrypt the detached ciphertext
 // apart from the content-encryption key.
+//
+// [BodyMaterial] is the same parameters plus the envelope's encoded length —
+// where the ciphertext starts within a stored blob. That is what a caller caches
+// and what a range read needs; a whole-object read has neither the number (the
+// streaming decoder does not report it) nor a use for it, so the two shapes stay
+// distinct and [BodyMaterial.body] converts one way.
 type bodyParams struct {
 	baseNonce []byte
 	chunkSize int
 	aad       []byte
 }
 
+// streamConfig returns the fee/aesstream configuration for decrypting a body
+// with these parameters under cek. It is the only place FEE body parameters
+// become a stream configuration, so the whole-object reader ([openStream]) and
+// the range reader ([spanRangeReader]) cannot drift apart in how they configure
+// the cipher.
+func (b bodyParams) streamConfig(cek []byte) aesstream.Config {
+	return aesstream.Config{
+		Key:       cek,
+		BaseNonce: b.baseNonce,
+		AAD:       b.aad,
+		ChunkSize: b.chunkSize,
+	}
+}
+
 // validateBody checks a decoded envelope's FEE body headers — the algorithm is
 // the chunked AES-256-GCM-STREAM cipher, the base nonce (iv) is present, and the
 // self-describing chunk size is in range — and rebuilds the Enc_structure AAD

material.go

@@ -96,18 +96,36 @@ func (m BodyMaterial) PlaintextSize(blobSize int64) (int64, error) {
 	if err := m.Validate(); err != nil {
 		return 0, err
 	}
-	ciphertextSize := blobSize - m.HeaderLen
+	return plaintextSizeFrom(blobSize, m.HeaderLen, m.ChunkSize)
+}
+
+// plaintextSizeFrom derives the total plaintext size of a blobSize-byte blob
+// whose envelope occupies headerLen bytes and whose STREAM chunks carry chunkSize
+// plaintext bytes each.
+//
+// It is shared by [BodyMaterial.PlaintextSize] and the envelope-backed paths (via
+// plaintextSizeFor), so a blob size that cannot describe a FEE body is reported
+// the same way whether the parameters came from a cache or from the envelope.
+func plaintextSizeFrom(blobSize, headerLen int64, chunkSize int) (int64, error) {
+	ciphertextSize := blobSize - headerLen
 	if ciphertextSize < 0 {
 		return 0, fmt.Errorf("fee: blob size %d is shorter than its %d-byte envelope: %w",
-			blobSize, m.HeaderLen, aesstream.ErrCiphertextSize)
+			blobSize, headerLen, aesstream.ErrCiphertextSize)
 	}
-	n, err := aesstream.DecryptedSize(ciphertextSize, m.ChunkSize)
+	n, err := aesstream.DecryptedSize(ciphertextSize, chunkSize)
 	if err != nil {
 		return 0, fmt.Errorf("fee: blob of %d ciphertext bytes: %w", ciphertextSize, err)
 	}
 	return n, nil
 }
 
+// body returns the envelope body parameters m describes, for the range wiring it
+// shares with the envelope-backed paths. HeaderLen is not among them: it says
+// where the ciphertext starts, not how to decrypt it.
+func (m BodyMaterial) body() bodyParams {
+	return bodyParams{baseNonce: m.BaseNonce, chunkSize: m.ChunkSize, aad: m.AAD}
+}
+
 // clone returns a deep copy, so a BodyMaterial handed to a caller shares no
 // backing array with the envelope it came from (and one handed back to us cannot
 // be mutated underneath a live reader).

range.go

@@ -202,8 +202,7 @@ func DecryptRangeWithMaterial(blob io.ReaderAt, blobSize int64, m BodyMaterial,
 	if err != nil {
 		return nil, err
 	}
-	body := bodyParams{baseNonce: m.BaseNonce, chunkSize: m.ChunkSize, aad: m.AAD}
-	return spanRangeReader(blob, blobSize, m.HeaderLen, body, plainSize, cek, off, length)
+	return spanRangeReader(blob, blobSize, m.HeaderLen, m.body(), plainSize, cek, off, length)
 }
 
 // PlaintextSize reports the total decrypted size of a FEE blob from its envelope
@@ -222,7 +221,7 @@ func PlaintextSize(blob io.ReaderAt, blobSize int64) (int64, error) {
 	if err != nil {
 		return 0, err
 	}
-	return plaintextSizeFor(env, blobSize-headerLen, body.chunkSize)
+	return plaintextSizeFor(env, blobSize, headerLen, body.chunkSize)
 }
 
 // newRangeReader is the shared core of DecryptRange and DecryptRangeWithCEK:
@@ -240,7 +239,7 @@ func newRangeReader(env *cose.Envelope, blob io.ReaderAt, blobSize, headerLen in
 		return nil, err
 	}
 
-	plainSize, err := plaintextSizeFor(env, blobSize-headerLen, body.chunkSize)
+	plainSize, err := plaintextSizeFor(env, blobSize, headerLen, body.chunkSize)
 	if err != nil {
 		return nil, err
 	}
@@ -268,12 +267,7 @@ func spanRangeReader(blob io.ReaderAt, blobSize, headerLen int64, body bodyParam
 	// aesstream exactly the bytes it will ask for and nothing else.
 	sr, err := aesstream.NewSpanReader(
 		io.NewSectionReader(blob, headerLen+start, n),
-		aesstream.Config{
-			Key:       cek,
-			BaseNonce: body.baseNonce,
-			AAD:       body.aad,
-			ChunkSize: body.chunkSize,
-		},
+		body.streamConfig(cek),
 		ciphertextSize, off, length)
 	if err != nil {
 		return nil, fmt.Errorf("fee: initializing body cipher: %w", err)
@@ -282,14 +276,14 @@ func spanRangeReader(blob io.ReaderAt, blobSize, headerLen int64, body bodyParam
 	return &RangeReader{sr: sr, size: plainSize, spanOff: headerLen + start, spanLen: n}, nil
 }
 
-// plaintextSizeFor derives the object's total plaintext size from its ciphertext
-// length and chunk size, and cross-checks the envelope's declared chunk count
-// against it when one is present — catching a blob size that describes a
-// different object than the envelope does.
-func plaintextSizeFor(env *cose.Envelope, ciphertextSize int64, chunkSize int) (int64, error) {
-	plainSize, err := aesstream.DecryptedSize(ciphertextSize, chunkSize)
+// plaintextSizeFor is [plaintextSizeFrom] for a blob whose parameters came from
+// its envelope rather than from a caller's cache: it adds the cross-check of the
+// envelope's declared chunk count against the derived size, when one is present,
+// catching a blob size that describes a different object than the envelope does.
+func plaintextSizeFor(env *cose.Envelope, blobSize, headerLen int64, chunkSize int) (int64, error) {
+	plainSize, err := plaintextSizeFrom(blobSize, headerLen, chunkSize)
 	if err != nil {
-		return 0, fmt.Errorf("fee: blob of %d ciphertext bytes: %w", ciphertextSize, err)
+		return 0, err
 	}
 	if !env.Headers.Unprotected.Has(labelChunkCount) {
 		return plainSize, nil