Documentation
¶
Overview ¶
Package e2e — shared end-to-end envelope primitives. ML-KEM-768 encapsulation, HKDF-SHA256 key derivation, ChaCha20-Poly1305 AEAD, and gzip, in the wire layout used by chutes. Each provider package owns its own discovery, attestation, transport, and stream handling; this package only translates plaintext <-> wire envelopes.
Index ¶
- Constants
- Variables
- func DeriveKey(shared, mlkemCT, info []byte) ([]byte, error)
- func Open(shared, mlkemCT, blob, info []byte, gunzip bool) ([]byte, error)
- func OpenFrame(key, blob []byte) ([]byte, error)
- func Seal(plaintext, recipientPub, info []byte, gzipFirst bool) (mlkemCT, blob []byte, err error)
- func SealFrame(key, plaintext []byte) ([]byte, error)
- type Error
Constants ¶
const ( MLKEMCTSize = 1088 // ML-KEM-768 ciphertext SaltSize = 16 // HKDF salt = mlkem_ct[:16] KeySize = 32 // ChaCha20-Poly1305 key / ML-KEM shared secret NonceSize = chacha20poly1305.NonceSize TagSize = chacha20poly1305.Overhead )
Pinned wire sizes (chutes WIRE.md sections 1-2).
Variables ¶
var ErrShortBlob = errors.New("blob shorter than nonce+tag")
ErrShortBlob is returned when an encrypted wire blob is too short to hold the required nonce and authentication tag. Exported for callers that branch on it via errors.Is.
Functions ¶
func DeriveKey ¶
DeriveKey computes the per-message AEAD key: HKDF-SHA256(ikm=shared, salt=mlkemCT[:16], info), 32 bytes. The salt is the first 16 bytes of THIS message's ML-KEM ciphertext, not a constant (chutes WIRE.md section 1).
func Open ¶
Open reverses Seal given the already-decapsulated shared secret, the mlkemCT used for the HKDF salt, and blob = nonce || ct || tag. It derives the direction key from info, AEAD-opens, and optionally gunzips.
func OpenFrame ¶
OpenFrame opens a single AEAD frame (blob = nonce || ct || tag) with an already-derived key. This is the stream path: the stream key is derived once from the e2e_init ciphertext and reused, and stream frames are never gzipped.
func Seal ¶
Seal encapsulates a fresh shared secret to the recipient's ML-KEM-768 encapsulation key, derives the direction key via info, optionally gzips the plaintext, then AEAD-seals it under a random nonce. It returns the ML-KEM ciphertext (1088 bytes) and blob = nonce(12) || ciphertext || tag(16). Callers prepend mlkemCT to blob for the request/response wire layout; stream frames omit it.
func SealFrame ¶
SealFrame is the inverse of OpenFrame: it AEAD-seals plaintext under an already-derived key and a fresh random nonce, returning nonce || ct || tag. No ML-KEM, no gzip — this is exactly the stream-chunk wire layout (chutes WIRE.md section 2). It exists so test/fixture code can produce real e2e frames; the production client never seals stream frames (the server does).
Source Files