XorKeystreamScheme

A fast, dependency-free CommutativeScheme test double for driving the deal session / CRDT reveal logic WITHOUT the cost of real 2048-bit SRA modular exponentiation.

Both encrypt and strip XOR the message with a per-key keystream. XOR is commutative (m ^ ks_a ^ ks_b == m ^ ks_b ^ ks_a) and self-inverse (m ^ ks ^ ks == m), so this satisfies the commutative-encryption laws the deal protocol relies on — round-trip recovery, layer commutativity, and strip-order independence — while running in microseconds on every platform, including Apple/Kotlin-Native and wasmJs where SraScheme falls back to the ~40× slower pure-Kotlin big-integer path. It is verified against CommutativeSchemeConformanceSuite exactly like SraScheme.

The keystream depends only on the key and the byte index — never on message content — so layering commutes and strips in any order. Output length equals input length, so the marker + card domain of encodePlaintext round-trips.

This is a TEST DOUBLE — it provides NO cryptographic secrecy (the keystream is a fast non-cryptographic PRNG, not a CSPRNG). Real-crypto coverage stays in SraSchemeConformanceTest; use SraScheme for anything security-bearing.

A generated pair reuses the same secret for SchemeKeyPair.encryptKey and SchemeKeyPair.stripKey because XOR is its own inverse; distinct pairs draw independent random secrets, so distinct keys produce distinct ciphertexts.

Pure and stateless apart from the injected random (used solely by generateKey), so it is correct under a multi-threaded dispatcher.