Documentation
¶
Index ¶
- Constants
- Variables
- func DefaultSuites() []aead.Suite
- func MakeAAD(direction Direction, epoch uint8, route, seq int32) []byte
- type Client
- type Direction
- type Pending
- type Server
- type Session
- func (s *Session) Epoch() uint8
- func (s *Session) Open(sealed, aad []byte) ([]byte, error)
- func (s *Session) OpenMessage(dst, sealed []byte, direction Direction, route, seq int32) ([]byte, error)
- func (s *Session) Overhead() int
- func (s *Session) Seal(plaintext, aad []byte) ([]byte, error)
- func (s *Session) SealMessage(dst, plaintext []byte, direction Direction, route, seq int32) ([]byte, error)
- func (s *Session) Suite() aead.Suite
Constants ¶
const ( // Version is the handshake protocol version. Version uint8 = 1 )
Variables ¶
var ( // ErrReplayMessage is returned when a sealed payload is replayed or is older than the // replay window. ErrReplayMessage = errors.New("replayed message") // ErrKeyExhausted is returned when the nonce counter of a session is exhausted. ErrKeyExhausted = errors.New("session key exhausted") )
Functions ¶
func DefaultSuites ¶
DefaultSuites returns the AEAD suites offered when none is configured, ordered by local preference.
func MakeAAD ¶
MakeAAD builds the additional authenticated data bound to the message header.
The encoding is canonical and independent of the packet configuration: version (1 byte), direction (1 byte), epoch (1 byte), route (4 bytes, big endian) and seq (4 bytes, big endian). Both peers must build it from the same values, so a modified header fails authentication and the epoch cannot be rewritten to downgrade the session.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client performs the client side of the handshake for a single connection.
The client only needs the public key of the server, and it verifies the ServerHello signature with it. A new client must be created for every connection because the handshake state is connection-scoped.
func NewClient ¶
NewClient returns a client side handshake bound to a single connection.
verifier verifies the signature of the server, and it is usually built from the pinned server public key.
func (*Client) Handle ¶
Handle consumes the ServerHello frame and returns the established session together with the Finished frame to send back to the server.
The server signature and the server Finished MAC are verified before the session is returned, so a failure means the peer is not the expected server or the handshake was tampered with.
type Pending ¶
type Pending struct {
// contains filtered or unexported fields
}
Pending is a derived but unconfirmed session.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server performs the server side of the handshake. It is stateless and safe for concurrent use; the per-connection state lives in Pending.
func NewServer ¶
NewServer returns a server side handshake.
signer signs the ServerHello so that the client can verify it with the pinned server public key.
type Session ¶
type Session struct {
// contains filtered or unexported fields
}
Session is the AEAD session established by the handshake.
The sealed payload layout is epoch(1) | counter(8) | ciphertext | tag. The nonce is the 4-byte session salt followed by the 8-byte counter, so it is never reused as long as the counter does not wrap. The epoch byte allows a future key rotation to keep both keys alive.
func (*Session) Open ¶
Open authenticates and decrypts a sealed payload.
The replay window is advanced only after the payload is authenticated, so forged packets cannot consume window slots.
func (*Session) OpenMessage ¶
func (s *Session) OpenMessage(dst, sealed []byte, direction Direction, route, seq int32) ([]byte, error)
OpenMessage authenticates a message and appends its plaintext to dst, binding its metadata using MakeAAD's encoding. dst must not overlap sealed, except that sealed[9:9] may be used for in-place decryption. On error no plaintext is returned and dst's backing memory may be modified. Replay state advances only after authentication succeeds, as in Open.
func (*Session) SealMessage ¶
func (s *Session) SealMessage(dst, plaintext []byte, direction Direction, route, seq int32) ([]byte, error)
SealMessage appends an encrypted message to dst, binding its direction, route and sequence number using MakeAAD's encoding. dst must not overlap plaintext. The caller owns the output.
Source Files