keyexchange

Overview ¶

Command keyexchange is a runnable demonstration of the ICX control plane: two peers establish a forward-secret, mutually-authenticated QUIC/mTLS session over loopback, derive PSP master keys from the TLS exporter, and negotiate per-direction Security Associations whose AES-GCM keys feed the Geneve/AF_XDP data plane.

It runs both peers in one process and self-verifies the result, so it doubles as living documentation and a smoke test. Build under GODEBUG=fips140=on to confirm the whole exchange uses only FIPS-approved primitives:

GODEBUG=fips140=on go run ./_examples/keyexchange

This example tracks the control-plane API as it evolves; keep it building.