Documentation
¶
Index ¶
- Constants
- func DeobfuscateModeDNSQuery(in []byte, expectedSequenceNumber uint64) ([]byte, []byte, []byte, error)
- func DeobfuscateModeDTLSHandshake(in []byte, expectedSequenceNumber uint64) ([]byte, []byte, []byte, error)
- func DeobfuscateModeGenericUDP(in []byte, expectedSequenceNumber uint64) ([]byte, []byte, []byte, error)
- func DeobfuscateModeNTPRequest(in []byte, expectedSequenceNumber uint64) ([]byte, []byte, []byte, error)
- func DeriveAESKey(psk []byte, sequenceNumber uint64, cumulativeHash []byte) ([]byte, error)
- func DeriveHMACKey(psk []byte, cumulativeHash []byte) ([]byte, error)
- func DeriveInitialCumulativeHash(psk []byte) ([]byte, error)
- func DeriveKey(psk []byte, salt string, additionalContext []byte, keyLen int) ([]byte, error)
- func GenerateRandomBytes(length int) ([]byte, error)
- func GenerateStateToken(psk []byte, sequenceNumber uint64, cumulativeHash []byte, ...) ([]byte, error)
- func ObfuscateModeDNSQuery(randSrc *mrand.Rand, stateToken, nonce, encryptedPayload []byte, ...) int
- func ObfuscateModeDTLSHandshake(randSrc *mrand.Rand, stateToken, nonce, encryptedPayload []byte, ...) int
- func ObfuscateModeGenericUDP(randSrc *mrand.Rand, stateToken, nonce, encryptedPayload []byte, ...) int
- func ObfuscateModeNTPRequest(randSrc *mrand.Rand, stateToken, nonce, encryptedPayload []byte, ...) int
- func UpdateCumulativeHash(psk []byte, oldHash []byte, sequenceNumber uint64, data []byte) ([]byte, error)
- func VerifyStateToken(psk []byte, expectedSequenceNumber uint64, expectedCumulativeHash []byte, ...) (bool, error)
- type HypernovaObfuscator
- type Obfuscator
Constants ¶
const ( MinPSKLen = 64 // Increased PSK length for more robust key derivation (e.g., for multiple HMACs/AES keys) NonceLen = 12 // AES-GCM nonce length TagLen = 16 // AES-GCM authentication tag length AESKeyLen = 32 // AES-256 key length HMACKeyLen = 32 // HMAC-SHA256 key length HMACSize = 32 // SHA256 output size (32 bytes) SequenceNumLen = 8 // Sequence number length (uint64) CumulativeHashLen = 32 // Length of cumulative hash (SHA256) StateTokenLen = SequenceNumLen + CumulativeHashLen + HMACSize // Sequence Num + Cumulative Hash + HMAC for integrity // General dynamic padding limits MaxDynamicPadding = 256 // Max random padding bytes for various sections MinDynamicPadding = 64 // Min random padding bytes )
Global constants for Hypernova protocol
const ( ModeDTLSHandshake = 0 // Mimics DTLS ClientHello ModeDNSQuery = 1 // Mimics DNS A record query ModeNTPRequest = 2 // Mimics NTP Request ModeGenericUDP = 3 // Generic UDP packet with random padding NumDisguiseModes = 4 // Total number of disguise modes )
Disguise mode identifiers
Variables ¶
This section is empty.
Functions ¶
func DeobfuscateModeDNSQuery ¶
func DeobfuscateModeDNSQuery(in []byte, expectedSequenceNumber uint64) ([]byte, []byte, []byte, error)
DeobfuscateModeDNSQuery parses a packet mimicking a DNS A record query.
func DeobfuscateModeDTLSHandshake ¶ added in v0.3.2
func DeobfuscateModeDTLSHandshake(in []byte, expectedSequenceNumber uint64) ([]byte, []byte, []byte, error)
DeobfuscateModeDTLSHandshake extracts embedded data from a packet mimicking a DTLS ClientHello.
func DeobfuscateModeGenericUDP ¶ added in v0.3.2
func DeobfuscateModeGenericUDP(in []byte, expectedSequenceNumber uint64) ([]byte, []byte, []byte, error)
DeobfuscateModeGenericUDP extracts embedded data from a generic UDP packet.
func DeobfuscateModeNTPRequest ¶ added in v0.3.2
func DeobfuscateModeNTPRequest(in []byte, expectedSequenceNumber uint64) ([]byte, []byte, []byte, error)
DeobfuscateModeNTPRequest extracts embedded data from a packet mimicking an NTP request.
func DeriveAESKey ¶
DeriveAESKey derives the AES key for payload encryption. It incorporates the current sequence number and cumulative state hash into the key derivation.
func DeriveHMACKey ¶
DeriveHMACKey derives the HMAC key for state token. It uses the cumulative state hash as additional context to make the HMAC key change over time.
func DeriveInitialCumulativeHash ¶
DeriveInitialCumulativeHash computes the initial cumulative hash from the PSK. This ensures both client and server start with the same synchronized state.
func DeriveKey ¶
DeriveKey derives a fixed-size key from the PSK, a context-specific salt, and an additional context. The additional context allows for key diversity based on current state.
func GenerateRandomBytes ¶
GenerateRandomBytes generates a slice of cryptographically secure random bytes of the given length.
func GenerateStateToken ¶
func GenerateStateToken(psk []byte, sequenceNumber uint64, cumulativeHash []byte, encryptedPayloadWithTag []byte) ([]byte, error)
GenerateStateToken generates the state token which includes sequence number, cumulative hash, and an HMAC. The HMAC covers the sequence number, the *current* cumulative hash, and the encrypted payload.
func ObfuscateModeDNSQuery ¶
func ObfuscateModeDNSQuery(randSrc *mrand.Rand, stateToken, nonce, encryptedPayload []byte, sequenceNumber uint64, out []byte) int
ObfuscateModeDNSQuery crafts a packet that mimics a DNS A record query. It embeds stateToken, nonce, and encryptedPayload.
func ObfuscateModeDTLSHandshake ¶ added in v0.3.2
func ObfuscateModeDTLSHandshake(randSrc *mrand.Rand, stateToken, nonce, encryptedPayload []byte, sequenceNumber uint64, out []byte) int
ObfuscateModeDTLSHandshake crafts a packet that mimics a DTLS ClientHello. It embeds stateToken, nonce, and encryptedPayload within the DTLS structure.
func ObfuscateModeGenericUDP ¶ added in v0.3.2
func ObfuscateModeGenericUDP(randSrc *mrand.Rand, stateToken, nonce, encryptedPayload []byte, sequenceNumber uint64, out []byte) int
ObfuscateModeGenericUDP creates a generic UDP packet with embedded data and random padding. It's a fallback or a simple, high-entropy mode.
func ObfuscateModeNTPRequest ¶ added in v0.3.2
func ObfuscateModeNTPRequest(randSrc *mrand.Rand, stateToken, nonce, encryptedPayload []byte, sequenceNumber uint64, out []byte) int
ObfuscateModeNTPRequest crafts a packet that mimics an NTP request. It embeds stateToken, nonce, and encryptedPayload.
func UpdateCumulativeHash ¶
func UpdateCumulativeHash(psk []byte, oldHash []byte, sequenceNumber uint64, data []byte) ([]byte, error)
UpdateCumulativeHash updates the cumulative state hash based on the previous hash, sequence number, and data. This is critical for the history-dependent state machine.
Types ¶
type HypernovaObfuscator ¶
type HypernovaObfuscator struct {
PSK []byte // Pre-shared key for all key derivations
// contains filtered or unexported fields
}
HypernovaObfuscator implements a highly complex, stateful obfuscation protocol. It uses multi-layered polymorphism, a history-dependent state machine, and dynamic traffic shaping elements.
func (*HypernovaObfuscator) Deobfuscate ¶
func (o *HypernovaObfuscator) Deobfuscate(in, out []byte) int
Deobfuscate reconstructs and decrypts the payload from a Hypernova packet, advancing the state machine upon successful decryption and validation. Returns the length of the decrypted data, or 0 if an error occurs.
func (*HypernovaObfuscator) Obfuscate ¶
func (o *HypernovaObfuscator) Obfuscate(in, out []byte) int
Obfuscate encrypts the input 'in' and embeds it into a state-dependent packet format. Returns the total length of the obfuscated packet, or 0 if an error occurs or 'out' is too small.
type Obfuscator ¶
Obfuscator is the interface that wraps the Obfuscate and Deobfuscate methods. Both methods return the number of bytes written to out. If a packet is not valid, the methods should return 0.
func NewHypernovaObfuscator ¶
func NewHypernovaObfuscator(psk []byte) (Obfuscator, error)
NewHypernovaObfuscator creates a new HypernovaObfuscator instance. psk: The pre-shared key. Must be at least MinPSKLen bytes long.
Source Files