# SiliconSignature Go

A pure Go implementation of SiliconSignature - a digital watermarking and image authentication system using Reed-Solomon error correction and LSB steganography.

## Features

- **Digital Watermarking**: Embed cryptographic signatures directly into images using LSB steganography
- **Reed-Solomon Error Correction**: Full RS codec over GF(2^8) with Berlekamp-Massey decoder
- **Proof-of-Work Authentication**: SHA-256 based nonce search for signature verification
- **CLI Tool**: Complete command-line interface for embedding and verifying watermarks
- **HTTP Server**: RESTful API for signing and verification
- **Pure Go**: No CGO required, produces static binaries
- **Cross-Platform**: Works on Linux, macOS, and Windows

## Installation

### Using go install

```bash
go install github.com/Agnuxo1/siliconsignature-go/cmd/siliconsignature@latest
```

### Building from source

```bash
git clone https://github.com/Agnuxo1/siliconsignature-go.git
cd siliconsignature-go
make build
```

### Docker

```bash
docker build -t siliconsignature .
docker run --rm siliconsignature hash -input /path/to/image.png
```

## Usage

### CLI Commands

#### Embed a watermark

```bash
# Software signing mode (default)
siliconsignature embed -input image.png -output signed.png -creator "user123"

# With custom output path
siliconsignature embed -input photo.jpg -output /tmp/signed_photo.jpg
```

#### Verify a watermarked image

```bash
# Text output
siliconsignature verify -input signed.png

# JSON output
siliconsignature verify -input signed.png -json
```

#### Compute image hash

```bash
siliconsignature hash -input image.png
```

#### Run HTTP server

```bash
# Default port (8080)
siliconsignature server

# Custom port
siliconsignature server -port 3000
```

### API Documentation

#### POST /api/v1/sign

Signs an image and embeds a cryptographic watermark.

**Request**: `multipart/form-data`
- `image` (required): Image file to sign
- `creator_id` (optional): Creator identifier

**Response**: JSON with signature details

```json
{
  "success": true,
  "message": "Image signed successfully",
  "signature": {
    "hash": "65501a37b306f5ac183848bab643350219c18111bfa97c706856b668d3bd5996",
    "nonce": "f16823b5",
    "ntime": "6964c85e",
    "version": "20000000",
    "status": "AUTHENTICATED_BY_SOFTWARE",
    "creator_id": "user123",
    "timestamp": 1715432000
  },
  "hash": "65501a37..."
}
```

#### POST /api/v1/verify

Verifies a watermarked image.

**Request**: `multipart/form-data`
- `image` (required): Image file to verify

**Response**: JSON with verification results

```json
{
  "success": true,
  "verified": true,
  "integrity": "FULL",
  "confidence": 1.0,
  "signature": {
    "hash": "65501a37...",
    "nonce": "f16823b5",
    "ntime": "6964c85e",
    "version": "20000000",
    "status": "AUTHENTICATED_BY_SOFTWARE"
  },
  "message": "Watermark verification complete"
}
```

#### GET /health

Health check endpoint.

```json
{
  "status": "ok",
  "name": "siliconsignature"
}
```

### Library Usage

```go
package main

import (
    "fmt"
    "image"
    _ "image/png"
    "os"

    siliconsignature "github.com/Agnuxo1/siliconsignature-go"
)

func main() {
    // Load image
    f, _ := os.Open("image.png")
    img, _, _ := image.Decode(f)
    f.Close()

    // Sign the image
    payload, err := siliconsignature.SoftwareSign(img, "creator123")
    if err != nil {
        panic(err)
    }

    // Embed watermark
    signedImg, err := siliconsignature.EmbedWatermark(img, payload)
    if err != nil {
        panic(err)
    }

    // Save signed image
    out, _ := os.Create("signed.png")
    defer out.Close()
    // encode and save...

    // Extract watermark
    extracted, err := siliconsignature.ExtractWatermark(signedImg)
    if err != nil {
        panic(err)
    }

    fmt.Printf("Hash: %s\n", extracted.Hash)
}
```

## Docker Usage

### Build

```bash
make docker
```

### Run

```bash
# Embed watermark
docker run --rm -v $(pwd):/data siliconsignature embed -input /data/image.png -output /data/signed.png

# Verify
docker run --rm -v $(pwd):/data siliconsignature verify -input /data/signed.png

# Server
docker run -p 8080:8080 siliconsignature server -port 8080
```

## Technical Details

### Reed-Solomon Parameters
- **Field**: GF(2^8) with primitive polynomial 0x11d
- **Error correction symbols**: 32 (nsym)
- **Primitive element**: 2 (alpha = 0x02)
- **Generator**: Product of (x - alpha^i) for i = 0..31

### LSB Embedding
- **Channels**: All RGB channels (flattened R0,G0,B0,R1,G1,B1,...)
- **Bit position**: LSB (bit 0)
- **Operation**: pixel = (pixel & 0xFE) | bit
- **Redundancy**: 5x repetition for robustness

### Binary Encoding Pipeline
```
JSON payload -> UTF-8 bytes -> Reed-Solomon encode(nsym=32) ->
length header (4 BE bytes) -> 5x repeat -> bit stream ->
LSB embed in all RGB channels
```

### Extraction Pipeline
```
LSB extract from all RGB channels -> split by 5 repetitions ->
for each: RS decode -> JSON parse -> return first valid
```

## Benchmarks

Performance on AMD Ryzen 9 5900X:

| Operation | Time |
|-----------|------|
| SHA-256 hash (1080p) | ~5ms |
| Nonce search | ~50-500ms |
| RS encode (1KB) | ~0.1ms |
| RS decode (1KB) | ~0.5ms |
| Embed watermark (1080p) | ~15ms |
| Extract watermark (1080p) | ~10ms |

## Makefile Targets

```bash
make build    # Build the binary
make test     # Run all tests
make docker   # Build Docker image
```

## License

MIT License - see LICENSE file for details.