chore: Add Prabhpreet to the list of whitepper authors

.dockerignore

@@ -1,7 +0,0 @@
-examples/
-target/
-flake.*
-.ci
-.direnv
-.git
-.github

.github/workflows/qc.yaml

@@ -25,34 +25,6 @@ jobs:
       - name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master
 
-  rustfmt:
-    name: Rust Format
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Run Rust Formatting Script
-        run: bash format_rust_code.sh --mode check
-
-  cargo-bench:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/cache@v3
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-      - name: Install libsodium
-        run: sudo apt-get install -y libsodium-dev
-        # liboqs requires quite a lot of stack memory, thus we adjust
-        # the default stack size picked for new threads (which is used
-        # by `cargo test`) to be _big enough_. Setting it to 8 MiB
-      - run: RUST_MIN_STACK=8388608 cargo bench --no-run --workspace
-
   cargo-audit:
     runs-on: ubuntu-latest
     steps:
@@ -121,7 +93,7 @@ jobs:
         # liboqs requires quite a lot of stack memory, thus we adjust
         # the default stack size picked for new threads (which is used
         # by `cargo test`) to be _big enough_. Setting it to 8 MiB
-      - run: RUST_MIN_STACK=8388608 cargo test --workspace
+      - run: RUST_MIN_STACK=8388608 cargo test
 
   cargo-test-nix-devshell-x86_64-linux:
     runs-on:
@@ -144,7 +116,7 @@ jobs:
         with:
           name: rosenpass
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - run: nix develop --command cargo test --workspace
+      - run: nix develop --command cargo test
 
   cargo-fuzz:
     runs-on: ubuntu-latest
@@ -169,10 +141,8 @@ jobs:
         run: cargo install cargo-fuzz
       - name: Run fuzzing
         run: |
-          cargo fuzz run fuzz_aead_enc_into -- -max_total_time=5
-          cargo fuzz run fuzz_blake2b -- -max_total_time=5
-          cargo fuzz run fuzz_handle_msg -- -max_total_time=5
-          ulimit -s 8192000 && RUST_MIN_STACK=33554432000 && cargo fuzz run fuzz_kyber_encaps -- -max_total_time=5
-          cargo fuzz run fuzz_mceliece_encaps -- -max_total_time=5
-          cargo fuzz run fuzz_box_secret_alloc -- -max_total_time=5
-          cargo fuzz run fuzz_vec_secret_alloc -- -max_total_time=5
+          cargo fuzz run fuzz_aead_enc_into -- -max_total_time=60
+          cargo fuzz run fuzz_blake2b -- -max_total_time=60
+          cargo fuzz run fuzz_handle_msg -- -max_total_time=60
+          cargo fuzz run fuzz_kyber_encaps -- -max_total_time=60
+          cargo fuzz run fuzz_mceliece_encaps -- -max_total_time=60

Cargo.toml

@@ -3,21 +3,16 @@ resolver = "2"
 
 members = [
     "rosenpass",
-    "cipher-traits",
     "ciphers",
     "util",
     "constant-time",
-    "oqs",
+    "sodium",
     "to",
     "fuzz",
-    "secret-memory",
-    "lenses",
-    "wireguard-broker",
 ]
 
 default-members = [
-    "rosenpass",
-    "wireguard-broker"
+    "rosenpass"
 ]
 
 [workspace.metadata.release]
@@ -28,41 +23,28 @@ tag-prefix = ""
 rosenpass = { path = "rosenpass" }
 rosenpass-util = { path = "util" }
 rosenpass-constant-time = { path = "constant-time" }
-rosenpass-cipher-traits = { path = "cipher-traits" }
+rosenpass-sodium = { path = "sodium" }
 rosenpass-ciphers = { path = "ciphers" }
 rosenpass-to = { path = "to" }
-rosenpass-secret-memory = { path = "secret-memory" }
-rosenpass-oqs = { path = "oqs" }
-rosenpass-lenses = { path = "lenses" }
-rosenpass-wireguard-broker = { path = "wireguard-broker" }
 criterion = "0.4.0"
 test_bin = "0.4.0"
 libfuzzer-sys = "0.4"
 stacker = "0.1.15"
 doc-comment = "0.3.3"
-base64 = "0.21.5"
+base64 = "0.21.1"
 zeroize = "1.7.0"
 memoffset = "0.9.0"
-thiserror = "1.0.50"
-paste = "1.0.14"
-env_logger = "0.10.1"
-toml = "0.7.8"
+lazy_static = "1.4.0"
+thiserror = "1.0.40"
+paste = "1.0.12"
+env_logger = "0.10.0"
+toml = "0.7.4"
 static_assertions = "1.1.0"
-allocator-api2 = "0.2.14"
-allocator-api2-tests = "0.2.14"
-memsec = "0.6.3"
-rand = "0.8.5"
-wireguard-uapi = "3.0.0"
-command-fds = "0.2.3"
-rustix = { version = "0.38.27", features = ["net"] }
-tokio = { version = "1.34.0", features = ["sync", "full", "mio"] }
-typenum = "1.17.0"
-log = { version = "0.4.20" }
-clap = { version = "4.4.10", features = ["derive"] }
-serde = { version = "1.0.193", features = ["derive"] }
+log = { version = "0.4.17" }
+clap = { version = "4.3.0", features = ["derive"] }
+serde = { version = "1.0.163", features = ["derive"] }
 arbitrary = { version = "1.3.2", features = ["derive"] }
-anyhow = { version = "1.0.75", features = ["backtrace", "std"] }
-mio = { version = "0.8.9", features = ["net", "os-poll"] }
-oqs-sys = { version = "0.8", default-features = false, features = ['classic_mceliece', 'kyber']  }
-blake2 = "0.10.6"
-chacha20poly1305 = { version = "0.10.1", default-features = false, features = [ "std", "heapless" ] }
+anyhow = { version = "1.0.71", features = ["backtrace"] }
+mio = { version = "0.8.6", features = ["net", "os-poll"] }
+libsodium-sys-stable= { version = "1.19.28", features = ["use-pkg-config"] }
+oqs-sys = { version = "0.8", default-features = false, features = ['classic_mceliece', 'kyber']  }

analysis/03_identity_hiding.entry.mpv

@@ -1,121 +0,0 @@
-/*
-  This identity hiding process tests whether the rosenpass protocol is able to protect the identity of an initiator or responder.
-  The participants in the test are trusted initiators, trusted responders and compromised initiators and responders.
-  The test consists of two phases. In the first phase all of the participants can communicate with each other using the rosenpass protocol.
-  An attacker observes the first phase and is able to intercept and modify messages and choose participants to communicate with each other
-
-  In the second phase if the anonymity of an initiator is being tested then one of two trusted initiators is chosen.
-  The chosen initiator communicates directly with a trusted responder.
-  If an attacker can determine which initiator was chosen then the anonymity of the initiator has been compromised.
-  Otherwise the protocol has successfully protected the initiators’ identity.
-
-  If the anonymity of a responder is being tested then one of two trusted responders is chosen instead.
-  Then an initiator communicates directly with the chosen responder.
-  If an attacker can determine which responder was chosen then the anonymity of the responder is compromised.
-  Otherwise the protocol successfully protects the identity of a responder.
-
-  The Proverif code treats the public key as synonymous with identity.
-  In the above test when a responder or initiator is chosen what is actually chosen is the public/private key pair to use for communication.
-  Traditionally when a responder or initiator is chosen they would be chosen randomly.
-  The way Proverif makes a "choice" is by simulating multiple processes, one process per choice
-  Then the processes are compared and if an association between a public key and a process can be made the test fails.
-  As the choice is at least as bad as choosing the worst possible option the credibility of the test is maintained.
-  The drawback is that Proverif is only able to tell if the identity can be brute forced but misses any probabilistic associations.
-  As usual Proverif also assumes perfect encryption and in particular assumes encryption cannot be linked to identity.
-
-  One of the tradeoffs made here is that the choice function in Proverif is slow but this is in favour of being able to write more precise tests.
-  Another issue is the choice function does not work with queries so a test needs to be run for each set of assumptions.
-  In this case the test uses secure rng and a fresh secure biscuit key.
-*/
-
-
-#include "config.mpv"
-
-#define CHAINING_KEY_EVENTS 1
-#define MESSAGE_TRANSMISSION_EVENTS 1
-#define SESSION_START_EVENTS 0
-#define RANDOMIZED_CALL_IDS 0
-#undef FULL_MODEL
-#undef SIMPLE_MODEL
-#define SIMPLE_MODEL 1
-
-#include "prelude/basic.mpv"
-#include "crypto/key.mpv"
-#include "rosenpass/oracles.mpv"
-#include "crypto/kem.mpv"
-
-#define INITIATOR_TEST
-#define NEW_TRUSTED_SEED(name)            \
-  new MCAT(name, _secret_seed):seed_prec; \
-  name <- make_trusted_seed(MCAT(name, _secret_seed)); \
-
-free D:channel [private].
-free secure_biscuit_no:Atom [private].
-free secure_sidi,secure_sidr:SessionId [private].
-free secure_psk:key [private].
-free initiator1, initiator2:kem_sk_prec.
-free responder1, responder2:kem_sk_prec.
-
-let secure_init_hello(initiator: kem_sk_tmpl, sidi : SessionId, psk: key_tmpl, responder: kem_sk_tmpl) =
-  NEW_TRUSTED_SEED(seski_trusted_seed)
-  NEW_TRUSTED_SEED(ssptr_trusted_seed)
-  Oinitiator_inner(sidi, initiator, psk, responder, seski_trusted_seed, ssptr_trusted_seed, D).
-
-let secure_resp_hello(initiator: kem_sk_tmpl, responder: kem_sk_tmpl, sidr:SessionId, sidi:SessionId, biscuit_no:Atom, psk:key_tmpl) =
-  in(D, Envelope(k, IH2b(InitHello(=sidi, epki, sctr, pidiC, auth))));
-  ih <- InitHello(sidi, epki, sctr, pidiC, auth);
-  NEW_TRUSTED_SEED(septi_trusted_seed)
-  NEW_TRUSTED_SEED(sspti_trusted_seed)
-  Oinit_hello_inner(sidr, biscuit_no, responder, psk, initiator, septi_trusted_seed, sspti_trusted_seed, ih, D).
-
-let secure_init_conf(initiator: kem_sk_tmpl, responder: kem_sk_tmpl, psk:key_tmpl, sidi:SessionId, sidr:SessionId) =
-  in(D, Envelope(k3, IC2b(InitConf(=sidi, =sidr, biscuit, auth3))));
-  ic <- InitConf(sidi,sidr,biscuit, auth3);
-  NEW_TRUSTED_SEED(seski_trusted_seed)
-  NEW_TRUSTED_SEED(ssptr_trusted_seed)
-  Oinit_conf_inner(initiator, psk, responder, ic).
-
-let secure_communication(initiator: kem_sk_tmpl, responder:kem_sk_tmpl) =
-  secure_key <- prepare_key(secure_psk);
-  (!secure_init_hello(initiator, secure_sidi, secure_key, responder))
-  | !secure_resp_hello(initiator, responder, secure_sidr, secure_sidi, secure_biscuit_no, secure_key)
-  | !(secure_init_conf(initiator, responder, secure_key, secure_sidi, secure_sidr)).
-
-let pipeChannel(D:channel, C:channel) =
-  in(D, b:bits);
-  out(C, b).
-
-fun kem_private(kem_pk): kem_sk
-  reduc forall sk_tmpl:kem_sk;
-    kem_private(kem_pub(sk_tmpl)) = sk_tmpl[private].
-
-let secretCommunication() =
-#ifdef INITIATOR_TEST
-  initiator_pk <- choice[setup_kem_pk(make_trusted_kem_sk(initiator1)), setup_kem_pk(make_trusted_kem_sk(initiator2))];
-  initiator_seed <- prepare_kem_sk(kem_private(initiator_pk)); 
-#else
-  initiator_seed <- prepare_kem_sk(trusted_kem_sk(initiator1));
-#endif
-#ifdef RESPONDER_TEST
-  responder_pk <- choice[setup_kem_pk(make_trusted_kem_sk(responder1)), setup_kem_pk(make_trusted_kem_sk(responder2))];
-  responder_seed <- prepare_kem_sk(kem_private(responder_pk));
-#else
-  responder_seed <- prepare_kem_sk(trusted_kem_sk(responder1));
-#endif
-  secure_communication(initiator_seed, responder_seed) | !pipeChannel(D, C).
-
-let reveal_pks() =
-  out(C, setup_kem_pk(make_trusted_kem_sk(responder1)));
-  out(C, setup_kem_pk(make_trusted_kem_sk(responder2)));
-  out(C, setup_kem_pk(make_trusted_kem_sk(initiator1)));
-  out(C, setup_kem_pk(make_trusted_kem_sk(initiator2))).
-
-let rosenpass_main2() = 
-  REP(INITIATOR_BOUND, Oinitiator)
-  | REP(RESPONDER_BOUND, Oinit_hello)
-  | REP(RESPONDER_BOUND, Oinit_conf).
-
-let identity_hiding_main() = 
-  0 | reveal_pks() |  rosenpass_main2() | phase 1; secretCommunication().
-
-let main = identity_hiding_main.

analysis/rosenpass/oracles.mpv

@@ -47,16 +47,14 @@ CK_EV(  event OskOinit_conf(key, key). )
 MTX_EV( event ICRjct(InitConf_t, key, kem_sk, kem_pk). )
 SES_EV( event ResponderSession(InitConf_t, key). )
 event ConsumeBiscuit(Atom, kem_sk, kem_pk, Atom).
-
-let Oinit_conf_inner(Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:InitConf_t) =
+let Oinit_conf() = 
+  in(C, Cinit_conf(Ssskm, Spsk, Sspkt, ic));
 #if RANDOMIZED_CALL_IDS
   new call:Atom;
 #else
   call <- Cinit_conf(Ssskm, Spsk, Sspkt, ic);
 #endif
-
   SETUP_HANDSHAKE_STATE()
-
   eski <- kem_sk0;
   epki <- kem_pk0;
   let try_ = (
@@ -74,10 +72,6 @@ let Oinit_conf_inner(Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:Ini
     0
 #endif
   ).
-  
-let Oinit_conf() = 
-  in(C, Cinit_conf(Ssskm, Spsk, Sspkt, ic));
-  Oinit_conf_inner(Ssskm, Spsk, Sspkt, ic).
 
 restriction biscuit_no:Atom, sskm:kem_sk, spkr:kem_pk, ad1:Atom, ad2:Atom;
   event(ConsumeBiscuit(biscuit_no, sskm, spkr, ad1)) && event(ConsumeBiscuit(biscuit_no, sskm, spkr, ad2))
@@ -91,8 +85,8 @@ CK_EV(  event OskOresp_hello(key, key, key). )
 MTX_EV( event RHRjct(RespHello_t, key, kem_sk, kem_pk). )
 MTX_EV( event ICSent(RespHello_t, InitConf_t, key, kem_sk, kem_pk). )
 SES_EV( event InitiatorSession(RespHello_t, key). )
-let Oresp_hello(HS_DECL_ARGS, C_in:channel) =
-  in(C_in, Cresp_hello(RespHello(sidr, =sidi, ecti, scti, biscuit, auth)));
+let Oresp_hello(HS_DECL_ARGS) =
+  in(C, Cresp_hello(RespHello(sidr, =sidi, ecti, scti, biscuit, auth)));
   rh <- RespHello(sidr, sidi, ecti, scti, biscuit, auth);
   /* try */ let ic = (
     ck_ini <- ck;
@@ -104,7 +98,7 @@ let Oresp_hello(HS_DECL_ARGS, C_in:channel) =
     SES_EV( event InitiatorSession(rh, osk); )
     ic
   /* success */ ) in (
-    out(C_in, Envelope(create_mac(spkt, IC2b(ic)), IC2b(ic)))
+    out(C, ic)
   /* fail */ ) else (
 #if MESSAGE_TRANSMISSION_EVENTS
     event RHRjct(rh, psk, sski, spkr)
@@ -122,8 +116,8 @@ MTX_EV( event IHRjct(InitHello_t, key, kem_sk, kem_pk). )
 MTX_EV( event RHSent(InitHello_t, RespHello_t, key, kem_sk, kem_pk). )
 event ConsumeSidr(SessionId, Atom).
 event ConsumeBn(Atom, kem_sk, kem_pk, Atom).
-
-let Oinit_hello_inner(sidm:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt: kem_sk_tmpl, Septi: seed_tmpl, Sspti: seed_tmpl, ih: InitHello_t, C_out:channel) = 
+let Oinit_hello() = 
+  in(C, Cinit_hello(sidr, biscuit_no, Ssskm, Spsk, Sspkt, Septi, Sspti, ih));
 #if RANDOMIZED_CALL_IDS
   new call:Atom;
 #else
@@ -131,19 +125,14 @@ let Oinit_hello_inner(sidm:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:k
 #endif
   // TODO: This is ugly
   let InitHello(sidi, epki, sctr, pidiC, auth) = ih in
-
   SETUP_HANDSHAKE_STATE()
-
   eski <- kem_sk0;
-
-  event ConsumeBn(biscuit_no, sskm, spkt, call);
-  event ConsumeSidr(sidr, call);
-
   epti <- rng_key(setup_seed(Septi)); // RHR4
   spti <- rng_key(setup_seed(Sspti)); // RHR5
+  event ConsumeBn(biscuit_no, sskm, spkt, call);
+  event ConsumeSidr(sidr, call);
   event ConsumeSeed(Epti, setup_seed(Septi), call);
   event ConsumeSeed(Spti, setup_seed(Sspti), call);
-
   let rh = (
     INITHELLO_CONSUME()
     ck_ini <- ck;
@@ -152,8 +141,7 @@ let Oinit_hello_inner(sidm:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:k
     MTX_EV( event RHSent(ih, rh, psk, sskr, spki); )
     rh
   /* success */ ) in (
-    out(C_out, Envelope(create_mac(spkt, RH2b(rh)), RH2b(rh)))
-
+    out(C, rh)
   /* fail */ ) else (
 #if MESSAGE_TRANSMISSION_EVENTS
     event IHRjct(ih, psk, sskr, spki)
@@ -162,10 +150,6 @@ let Oinit_hello_inner(sidm:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:k
 #endif
   ).
 
-let Oinit_hello() = 
-  in(C, Cinit_hello(sidr, biscuit_no, Ssskm, Spsk, Sspkt, Septi, Sspti, ih));
-  Oinit_hello_inner(sidr, biscuit_no, Ssskm, Spsk, Sspkt, Septi, Sspti, ih, C).
-
 restriction sid:SessionId, ad1:Atom, ad2:Atom;
   event(ConsumeSidr(sid, ad1)) && event(ConsumeSidr(sid, ad2))
     ==> ad1 = ad2.
@@ -183,34 +167,26 @@ CK_EV( event OskOinitiator_ck(key). )
 CK_EV( event OskOinitiator(key, key, kem_sk, kem_pk, key). )
 MTX_EV( event IHSent(InitHello_t, key, kem_sk, kem_pk). )
 event ConsumeSidi(SessionId, Atom).
-
-let Oinitiator_inner(sidi: SessionId, Ssskm: kem_sk_tmpl, Spsk: key_tmpl, Sspkt: kem_sk_tmpl, Seski: seed_tmpl, Ssptr: seed_tmpl, C_out:channel) =
-  #if RANDOMIZED_CALL_IDS
-    new call:Atom;
-  #else
-    call <- Cinitiator(sidi, Ssskm, Spsk, Sspkt, Seski, Ssptr);
-  #endif
-
-    SETUP_HANDSHAKE_STATE()
-
-    sidr <- sid0;
-
-    RNG_KEM_PAIR(eski, epki, Seski) // IHI3
-    sptr <- rng_key(setup_seed(Ssptr)); // IHI5
-    event ConsumeSidi(sidi, call);
-    event ConsumeSeed(Sptr, setup_seed(Ssptr), call);
-    event ConsumeSeed(Eski, setup_seed(Seski), call);
-
-    INITHELLO_PRODUCE()
-    CK_EV( event OskOinitiator_ck(ck); ) 
-    CK_EV( event OskOinitiator(ck, psk, sski, spkr, sptr); )
-    MTX_EV( event IHSent(ih, psk, sski, spkr); )
-    out(C_out, Envelope(create_mac(spkt, IH2b(ih)), IH2b(ih)));
-    Oresp_hello(HS_PASS_ARGS, C_out).
-
 let Oinitiator() =
   in(C, Cinitiator(sidi, Ssskm, Spsk, Sspkt, Seski, Ssptr));
-  Oinitiator_inner(sidi, Ssskm, Spsk, Sspkt, Seski, Ssptr, C).
+#if RANDOMIZED_CALL_IDS
+  new call:Atom;
+#else
+  call <- Cinitiator(sidi, Ssskm, Spsk, Sspkt, Seski, Ssptr);
+#endif
+  SETUP_HANDSHAKE_STATE()
+  RNG_KEM_PAIR(eski, epki, Seski) // IHI3
+  sidr <- sid0;
+  sptr <- rng_key(setup_seed(Ssptr)); // IHI5
+  event ConsumeSidi(sidi, call);
+  event ConsumeSeed(Sptr, setup_seed(Ssptr), call);
+  event ConsumeSeed(Eski, setup_seed(Seski), call);
+  INITHELLO_PRODUCE()
+  CK_EV( event OskOinitiator_ck(ck); ) 
+  CK_EV( event OskOinitiator(ck, psk, sski, spkr, sptr); )
+  MTX_EV( event IHSent(ih, psk, sski, spkr); )
+  out(C, ih);
+  Oresp_hello(HS_PASS_ARGS).
 
 restriction sid:SessionId, ad1:Atom, ad2:Atom;
   event(ConsumeSidi(sid, ad1)) && event(ConsumeSidi(sid, ad2))

analysis/rosenpass/protocol.mpv

@@ -2,12 +2,6 @@
 #include "crypto/kem.mpv"
 #include "rosenpass/handshake_state.mpv"
 
-fun Envelope(
-  key,
-  bits
-): bits [data].
-letfun create_mac(pk:kem_pk, payload:bits) = lprf2(MAC, kem_pk2b(pk), payload).
-
 type InitHello_t.
 fun InitHello(
   SessionId, // sidi
@@ -17,8 +11,6 @@ fun InitHello(
   bits       // auth
 ) : InitHello_t [data].
 
-fun IH2b(InitHello_t) : bitstring [typeConverter].
-
 #define INITHELLO_PRODUCE()       \
   ck <- lprf1(CK_INIT, kem_pk2b(spkr)); /* IHI1 */ \
   /* not handled here */                /* IHI2 */ \
@@ -49,9 +41,7 @@ fun RespHello(
     bits       // auth
 ) : RespHello_t [data].
 
-fun RH2b(RespHello_t) : bitstring [typeConverter].
-
-#define RESPHELLO_PRODUCE()  \
+#define RESPHELLO_PRODUCE()                   \
   /* not handled here */           /* RHR1 */ \
   MIX2(sid2b(sidr), sid2b(sidi))   /* RHR3 */ \
   ENCAPS_AND_MIX(ecti, epki, epti) /* RHR4 */ \
@@ -77,8 +67,6 @@ fun InitConf(
     bits       // auth
 ) : InitConf_t [data].
 
-fun IC2b(InitConf_t) : bitstring [typeConverter].
-
 #define INITCONF_PRODUCE()                  \
   MIX2(sid2b(sidi), sid2b(sidr)) /* ICI3 */ \
   ENCRYPT_AND_MIX(auth, empty)   /* ICI4 */ \

cipher-traits/Cargo.toml

@@ -1,12 +0,0 @@
-[package]
-name = "rosenpass-cipher-traits"
-authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
-version = "0.1.0"
-edition = "2021"
-license = "MIT OR Apache-2.0"
-description = "Rosenpass internal traits for cryptographic primitives"
-homepage = "https://rosenpass.eu/"
-repository = "https://github.com/rosenpass/rosenpass"
-readme = "readme.md"
-
-[dependencies]

cipher-traits/src/kem.rs

@@ -1,47 +0,0 @@
-//! Traits and implementations for Key Encapsulation Mechanisms (KEMs)
-//!
-//! KEMs are the interface provided by almost all post-quantum
-//! secure key exchange mechanisms.
-//!
-//! Conceptually KEMs are akin to public-key encryption, but instead of encrypting
-//! arbitrary data, KEMs are limited to the transmission of keys, randomly chosen during
-//!
-//! encapsulation.
-//! The [KEM] Trait describes the basic API offered by a Key Encapsulation
-//! Mechanism. Two implementations for it are provided, [StaticKEM] and [EphemeralKEM].
-
-use std::result::Result;
-
-/// Key Encapsulation Mechanism
-///
-/// The KEM interface defines three operations: Key generation, key encapsulation and key
-/// decapsulation.
-pub trait Kem {
-    type Error;
-
-    /// Secrete Key length
-    const SK_LEN: usize;
-    /// Public Key length
-    const PK_LEN: usize;
-    /// Ciphertext length
-    const CT_LEN: usize;
-    /// Shared Secret length
-    const SHK_LEN: usize;
-
-    /// Generate a keypair consisting of secret key (`sk`) and public key (`pk`)
-    ///
-    /// `keygen() -> sk, pk`
-    fn keygen(sk: &mut [u8], pk: &mut [u8]) -> Result<(), Self::Error>;
-
-    /// From a public key (`pk`), generate a shared key (`shk`, for local use)
-    /// and a cipher text (`ct`, to be sent to the owner of the `pk`).
-    ///
-    /// `encaps(pk) -> shk, ct`
-    fn encaps(shk: &mut [u8], ct: &mut [u8], pk: &[u8]) -> Result<(), Self::Error>;
-
-    /// From a secret key (`sk`) and a cipher text (`ct`) derive a shared key
-    /// (`shk`)
-    ///
-    /// `decaps(sk, ct) -> shk`
-    fn decaps(shk: &mut [u8], sk: &[u8], ct: &[u8]) -> Result<(), Self::Error>;
-}

cipher-traits/src/lib.rs

@@ -1,2 +0,0 @@
-mod kem;
-pub use kem::Kem;

ciphers/Cargo.toml

@@ -11,12 +11,8 @@ readme = "readme.md"
 
 [dependencies]
 anyhow = { workspace = true }
+rosenpass-sodium = { workspace = true }
 rosenpass-to = { workspace = true }
 rosenpass-constant-time = { workspace = true }
-rosenpass-secret-memory = { workspace = true }
-rosenpass-oqs = { workspace = true }
-rosenpass-util = { workspace = true }
 static_assertions = { workspace = true }
 zeroize = { workspace = true }
-chacha20poly1305 = { workspace = true }
-blake2 = { workspace = true }

ciphers/src/hash_domain.rs

@@ -1,109 +0,0 @@
-use anyhow::Result;
-use rosenpass_secret_memory::Secret;
-use rosenpass_to::To;
-
-use crate::subtle::incorrect_hmac_blake2b as hash;
-
-pub use hash::KEY_LEN;
-
-// TODO Use a proper Dec interface
-#[derive(Clone, Debug)]
-pub struct HashDomain([u8; KEY_LEN]);
-#[derive(Clone, Debug)]
-pub struct HashDomainNamespace([u8; KEY_LEN]);
-#[derive(Clone, Debug)]
-pub struct SecretHashDomain(Secret<KEY_LEN>);
-#[derive(Clone, Debug)]
-pub struct SecretHashDomainNamespace(Secret<KEY_LEN>);
-
-impl HashDomain {
-    pub fn zero() -> Self {
-        Self([0u8; KEY_LEN])
-    }
-
-    pub fn dup(self) -> HashDomainNamespace {
-        HashDomainNamespace(self.0)
-    }
-
-    pub fn turn_secret(self) -> SecretHashDomain {
-        SecretHashDomain(Secret::from_slice(&self.0))
-    }
-
-    // TODO: Protocol! Use domain separation to ensure that
-    pub fn mix(self, v: &[u8]) -> Result<Self> {
-        Ok(Self(hash::hash(&self.0, v).collect::<[u8; KEY_LEN]>()?))
-    }
-
-    pub fn mix_secret<const N: usize>(self, v: Secret<N>) -> Result<SecretHashDomain> {
-        SecretHashDomain::invoke_primitive(&self.0, v.secret())
-    }
-
-    pub fn into_value(self) -> [u8; KEY_LEN] {
-        self.0
-    }
-}
-
-impl HashDomainNamespace {
-    pub fn mix(&self, v: &[u8]) -> Result<HashDomain> {
-        Ok(HashDomain(
-            hash::hash(&self.0, v).collect::<[u8; KEY_LEN]>()?,
-        ))
-    }
-
-    pub fn mix_secret<const N: usize>(&self, v: Secret<N>) -> Result<SecretHashDomain> {
-        SecretHashDomain::invoke_primitive(&self.0, v.secret())
-    }
-}
-
-impl SecretHashDomain {
-    pub fn invoke_primitive(k: &[u8], d: &[u8]) -> Result<SecretHashDomain> {
-        let mut r = SecretHashDomain(Secret::zero());
-        hash::hash(k, d).to(r.0.secret_mut())?;
-        Ok(r)
-    }
-
-    pub fn zero() -> Self {
-        Self(Secret::zero())
-    }
-
-    pub fn dup(self) -> SecretHashDomainNamespace {
-        SecretHashDomainNamespace(self.0)
-    }
-
-    pub fn danger_from_secret(k: Secret<KEY_LEN>) -> Self {
-        Self(k)
-    }
-
-    pub fn mix(self, v: &[u8]) -> Result<SecretHashDomain> {
-        Self::invoke_primitive(self.0.secret(), v)
-    }
-
-    pub fn mix_secret<const N: usize>(self, v: Secret<N>) -> Result<SecretHashDomain> {
-        Self::invoke_primitive(self.0.secret(), v.secret())
-    }
-
-    pub fn into_secret(self) -> Secret<KEY_LEN> {
-        self.0
-    }
-
-    pub fn into_secret_slice(mut self, v: &[u8], dst: &[u8]) -> Result<()> {
-        hash::hash(v, dst).to(self.0.secret_mut())
-    }
-}
-
-impl SecretHashDomainNamespace {
-    pub fn mix(&self, v: &[u8]) -> Result<SecretHashDomain> {
-        SecretHashDomain::invoke_primitive(self.0.secret(), v)
-    }
-
-    pub fn mix_secret<const N: usize>(&self, v: Secret<N>) -> Result<SecretHashDomain> {
-        SecretHashDomain::invoke_primitive(self.0.secret(), v.secret())
-    }
-
-    // TODO: This entire API is not very nice; we need this for biscuits, but
-    // it might be better to extract a special "biscuit"
-    // labeled subkey and reinitialize the chain with this
-    pub fn danger_into_secret(self) -> Secret<KEY_LEN> {
-        self.0
-    }
-}

ciphers/src/lib.rs

@@ -5,23 +5,24 @@ pub mod subtle;
 pub const KEY_LEN: usize = 32;
 const_assert!(KEY_LEN == aead::KEY_LEN);
 const_assert!(KEY_LEN == xaead::KEY_LEN);
-const_assert!(KEY_LEN == hash_domain::KEY_LEN);
+const_assert!(KEY_LEN == hash::KEY_LEN);
 
 /// Authenticated encryption with associated data
 pub mod aead {
-    pub use crate::subtle::chacha20poly1305_ietf::{decrypt, encrypt, KEY_LEN, NONCE_LEN, TAG_LEN};
-}
-
-/// Authenticated encryption with associated data with a constant nonce
-pub mod xaead {
-    pub use crate::subtle::xchacha20poly1305_ietf::{
+    pub use rosenpass_sodium::aead::chacha20poly1305_ietf::{
         decrypt, encrypt, KEY_LEN, NONCE_LEN, TAG_LEN,
     };
 }
 
-pub mod hash_domain;
-
-pub mod kem {
-    pub use rosenpass_oqs::ClassicMceliece460896 as StaticKem;
-    pub use rosenpass_oqs::Kyber512 as EphemeralKem;
+/// Authenticated encryption with associated data with a constant nonce
+pub mod xaead {
+    pub use rosenpass_sodium::aead::xchacha20poly1305_ietf::{
+        decrypt, encrypt, KEY_LEN, NONCE_LEN, TAG_LEN,
+    };
+}
+
+pub mod hash {
+    pub use crate::subtle::incorrect_hmac_blake2b::{
+        hash, KEY_LEN, KEY_MAX, KEY_MIN, OUT_MAX, OUT_MIN,
+    };
 }

ciphers/src/subtle/blake2b.rs

@@ -1,42 +0,0 @@
-use zeroize::Zeroizing;
-
-use blake2::digest::crypto_common::generic_array::GenericArray;
-use blake2::digest::crypto_common::typenum::U32;
-use blake2::digest::crypto_common::KeySizeUser;
-use blake2::digest::{FixedOutput, Mac, OutputSizeUser};
-use blake2::Blake2bMac;
-
-use rosenpass_to::{ops::copy_slice, with_destination, To};
-use rosenpass_util::typenum2const;
-
-type Impl = Blake2bMac<U32>;
-
-type KeyLen = <Impl as KeySizeUser>::KeySize;
-type OutLen = <Impl as OutputSizeUser>::OutputSize;
-
-const KEY_LEN: usize = typenum2const! { KeyLen };
-const OUT_LEN: usize = typenum2const! { OutLen };
-
-pub const KEY_MIN: usize = KEY_LEN;
-pub const KEY_MAX: usize = KEY_LEN;
-pub const OUT_MIN: usize = OUT_LEN;
-pub const OUT_MAX: usize = OUT_LEN;
-
-#[inline]
-pub fn hash<'a>(key: &'a [u8], data: &'a [u8]) -> impl To<[u8], anyhow::Result<()>> + 'a {
-    with_destination(|out: &mut [u8]| {
-        let mut h = Impl::new_from_slice(key)?;
-        h.update(data);
-
-        // Jesus christ, blake2 crate, your usage of GenericArray might be nice and fancy
-        // but it introduces a ton of complexity. This cost me half an hour just to figure
-        // out the right way to use the imports while allowing for zeroization.
-        // An API based on slices might actually be simpler.
-        let mut tmp = Zeroizing::new([0u8; OUT_LEN]);
-        let mut tmp = GenericArray::from_mut_slice(tmp.as_mut());
-        h.finalize_into(&mut tmp);
-        copy_slice(tmp.as_ref()).to(out);
-
-        Ok(())
-    })
-}

ciphers/src/subtle/chacha20poly1305_ietf.rs

@@ -1,43 +0,0 @@
-use rosenpass_to::ops::copy_slice;
-use rosenpass_to::To;
-use rosenpass_util::typenum2const;
-
-use chacha20poly1305::aead::generic_array::GenericArray;
-use chacha20poly1305::ChaCha20Poly1305 as AeadImpl;
-use chacha20poly1305::{AeadCore, AeadInPlace, KeyInit, KeySizeUser};
-
-pub const KEY_LEN: usize = typenum2const! { <AeadImpl as KeySizeUser>::KeySize };
-pub const TAG_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::TagSize };
-pub const NONCE_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::NonceSize };
-
-#[inline]
-pub fn encrypt(
-    ciphertext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    plaintext: &[u8],
-) -> anyhow::Result<()> {
-    let nonce = GenericArray::from_slice(nonce);
-    let (ct, mac) = ciphertext.split_at_mut(ciphertext.len() - TAG_LEN);
-    copy_slice(plaintext).to(ct);
-    let mac_value = AeadImpl::new_from_slice(key)?.encrypt_in_place_detached(&nonce, ad, ct)?;
-    copy_slice(&mac_value[..]).to(mac);
-    Ok(())
-}
-
-#[inline]
-pub fn decrypt(
-    plaintext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    ciphertext: &[u8],
-) -> anyhow::Result<()> {
-    let nonce = GenericArray::from_slice(nonce);
-    let (ct, mac) = ciphertext.split_at(ciphertext.len() - TAG_LEN);
-    let tag = GenericArray::from_slice(mac);
-    copy_slice(ct).to(plaintext);
-    AeadImpl::new_from_slice(key)?.decrypt_in_place_detached(&nonce, ad, plaintext, tag)?;
-    Ok(())
-}

ciphers/src/subtle/incorrect_hmac_blake2b.rs

@@ -1,10 +1,8 @@
 use anyhow::ensure;
-use zeroize::Zeroizing;
-
 use rosenpass_constant_time::xor;
+use rosenpass_sodium::hash::blake2b;
 use rosenpass_to::{ops::copy_slice, with_destination, To};
-
-use crate::subtle::blake2b;
+use zeroize::Zeroizing;
 
 pub const KEY_LEN: usize = 32;
 pub const KEY_MIN: usize = KEY_LEN;

ciphers/src/subtle/mod.rs

@@ -1,4 +1 @@
-pub mod blake2b;
-pub mod chacha20poly1305_ietf;
 pub mod incorrect_hmac_blake2b;
-pub mod xchacha20poly1305_ietf;

ciphers/src/subtle/xchacha20poly1305_ietf.rs

@@ -1,45 +0,0 @@
-use rosenpass_to::ops::copy_slice;
-use rosenpass_to::To;
-use rosenpass_util::typenum2const;
-
-use chacha20poly1305::aead::generic_array::GenericArray;
-use chacha20poly1305::XChaCha20Poly1305 as AeadImpl;
-use chacha20poly1305::{AeadCore, AeadInPlace, KeyInit, KeySizeUser};
-
-pub const KEY_LEN: usize = typenum2const! { <AeadImpl as KeySizeUser>::KeySize };
-pub const TAG_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::TagSize };
-pub const NONCE_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::NonceSize };
-
-#[inline]
-pub fn encrypt(
-    ciphertext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    plaintext: &[u8],
-) -> anyhow::Result<()> {
-    let nonce = GenericArray::from_slice(nonce);
-    let (n, ct_mac) = ciphertext.split_at_mut(NONCE_LEN);
-    let (ct, mac) = ct_mac.split_at_mut(ct_mac.len() - TAG_LEN);
-    copy_slice(nonce).to(n);
-    copy_slice(plaintext).to(ct);
-    let mac_value = AeadImpl::new_from_slice(key)?.encrypt_in_place_detached(&nonce, ad, ct)?;
-    copy_slice(&mac_value[..]).to(mac);
-    Ok(())
-}
-
-#[inline]
-pub fn decrypt(
-    plaintext: &mut [u8],
-    key: &[u8],
-    ad: &[u8],
-    ciphertext: &[u8],
-) -> anyhow::Result<()> {
-    let (n, ct_mac) = ciphertext.split_at(NONCE_LEN);
-    let (ct, mac) = ct_mac.split_at(ct_mac.len() - TAG_LEN);
-    let nonce = GenericArray::from_slice(n);
-    let tag = GenericArray::from_slice(mac);
-    copy_slice(ct).to(plaintext);
-    AeadImpl::new_from_slice(key)?.decrypt_in_place_detached(&nonce, ad, plaintext, tag)?;
-    Ok(())
-}

constant-time/Cargo.toml

@@ -13,4 +13,3 @@ readme = "readme.md"
 
 [dependencies]
 rosenpass-to = { workspace = true }
-memsec = { workspace = true }

constant-time/src/lib.rs

@@ -1,5 +1,3 @@
-use core::hint::black_box;
-
 use rosenpass_to::{with_destination, To};
 
 /// Xors the source into the destination
@@ -18,62 +16,11 @@ use rosenpass_to::{with_destination, To};
 ///
 /// If source and destination are of different sizes.
 #[inline]
-pub fn xor(src: &[u8]) -> impl To<[u8], ()> + '_ {
+pub fn xor<'a>(src: &'a [u8]) -> impl To<[u8], ()> + 'a {
     with_destination(|dst: &mut [u8]| {
-        assert!(black_box(src.len()) == black_box(dst.len()));
+        assert!(src.len() == dst.len());
         for (dv, sv) in dst.iter_mut().zip(src.iter()) {
-            *black_box(dv) ^= black_box(*sv);
+            *dv ^= *sv;
         }
     })
 }
-
-#[inline]
-pub fn memcmp(a: &[u8], b: &[u8]) -> bool {
-    a.len() == b.len()
-        && unsafe { memsec::memeq(a.as_ptr() as *const u8, b.as_ptr() as *const u8, a.len()) }
-}
-
-#[inline]
-pub fn compare(a: &[u8], b: &[u8]) -> i32 {
-    assert!(a.len() == b.len());
-    unsafe { memsec::memcmp(a.as_ptr(), b.as_ptr(), a.len()) }
-}
-
-/// Interpret the given slice as a little-endian unsigned integer
-/// and increment that integer.
-///
-/// # Examples
-///
-/// ```
-/// use rosenpass_constant_time::increment as inc;
-/// use rosenpass_to::To;
-///
-/// fn testcase(v: &[u8], correct: &[u8]) {
-///   let mut v = v.to_owned();
-///   inc(&mut v);
-///   assert_eq!(&v, correct);
-/// }
-///
-/// testcase(b"", b"");
-/// testcase(b"\x00", b"\x01");
-/// testcase(b"\x01", b"\x02");
-/// testcase(b"\xfe", b"\xff");
-/// testcase(b"\xff", b"\x00");
-/// testcase(b"\x00\x00", b"\x01\x00");
-/// testcase(b"\x01\x00", b"\x02\x00");
-/// testcase(b"\xfe\x00", b"\xff\x00");
-/// testcase(b"\xff\x00", b"\x00\x01");
-/// testcase(b"\x00\x00\x00\x00\x00\x00", b"\x01\x00\x00\x00\x00\x00");
-/// testcase(b"\x00\xa3\x00\x77\x00\x00", b"\x01\xa3\x00\x77\x00\x00");
-/// testcase(b"\xff\xa3\x00\x77\x00\x00", b"\x00\xa4\x00\x77\x00\x00");
-/// testcase(b"\xff\xff\xff\x77\x00\x00", b"\x00\x00\x00\x78\x00\x00");
-/// ```
-#[inline]
-pub fn increment(v: &mut [u8]) {
-    let mut carry = 1u8;
-    for val in v.iter_mut() {
-        let (v, c) = black_box(*val).overflowing_add(black_box(carry));
-        *black_box(val) = v;
-        *black_box(&mut carry) = black_box(black_box(c) as u8);
-    }
-}

doc/rosenpass.1

@@ -23,7 +23,7 @@ If you are not specifically tasked with developing post-quantum secure systems,
 you probably do not need this tool.
 .Ss COMMANDS
 .Bl -tag -width Ds
-.It Ar gen-keys --secret-key <file-path> --public-key <file-path>
+.It Ar keygen private-key <file-path> public-key <file-path>
 Generate a keypair to use in the exchange command later.
 Send the public-key file to your communication partner and keep the private-key
 file secret!

doc/setup/multi_device_isolation.md

@@ -1,109 +0,0 @@
-# Multi Device Isolation
-
-On supported systems (just Linux, state Feb. 2024), Rosenpass uses a so-called broker architecture where multiple operating system processes work together to negotiate a key using post quantum cryptography and then send it to WireGuard to run an actual VPN. This is similar to the sandboxes used by web browsers to prevent websites accessing the rest of the computer.
-
-These processes communicate using what is called a "unix socket"; a special file that can be used by to processes to send data back and forth. There are tools to forward data from a unix socket one one host to a unix socket on another host. By using one of these tools, you can run most of Rosenpass' processes on one host while running just the process that forwards keys from Rosenpass to WireGuard on the device that establishes the WireGuard tunnel.
-
-This type of setup can provide a very high degree of isolation. When set up correctly, a critical bug in the Rosenpass code can not affect the host running WireGuard and vice versa. Keep in mind though that for this goal to be reached, the method to connect both hosts must be sufficiently secured: If the WireGuard host is allowed to perform arbitrary commands on the Rosenpass host, then an attacker with access to the WireGuard device can also take over the Rosenpass device.
-
-You can use the instructions from [Unix Domain Socket Forwarding with OpenSSH](https://www.skreutz.com/posts/unix-domain-socket-forwarding-with-openssh/) to harden the connection between the two devices after following the instructions from this tutorial.
-
-## Instructions
-
-In this manual, we are dealing with three hosts:
-
-- The **local peer**: The local host running WireGuard 
-- The **remote peer**: The remote host we are connecting to.
-- The **the rosenpass device**: The dedicated host running rosenpass. It connects with *local peer* to supply WireGuard with keys and it connects with remote peer to perform key exchanges.
-
-Lets assume, that you are starting from a working Rosenpass setup on *local peer* and *remote peer*, running rosenpass and WireGuard on each host. Both setups use configuration files. We will move the rosenpass instance running on *local peer* to the *rosenpass device* in this tutorial.
-
-### Step 0: Setup Rosenpass
-
-If you do not have a functioning rosenpass deployment on the local and remote peer at this point, you can create one by using the configuration files from the configuration-examples directory.
-
-You will need to set up the WireGuard device manually using instructions for your linux distribution. You can use the tutorial on the [arch wiki](https://wiki.archlinux.org/title/WireGuard) for reference.
-
-Make sure to set a random pre-shared key during creation of the WireGuard setup on both hosts at startup. Random pre-shared keys can be generated by using `wg genpks` on each host.
-
-For the broker based setup to work, you might have to assign the broker process the CAP_NET_ADMIN linux capability:
-
-```bash
-sudo setcap CAP_NET_ADMIN=+eip ./target/debug/rosenpass-wireguard-broker-privileged
-```
-
-Make sure the broker binaries are in your system path when starting rosenpass:
-
-```bash
-PATH="$PWD/target/debug:$PATH" ./target/debug/rosenpass exchange-config ./path/to/config/file.toml
-```
-
-You will also need to setup rosenpass on the rosenpass device.
-
-### Step 1: Verify that your rosenpass setup is working
-
-Start rosenpass on both peers using the following command.
-
-```bash
-PATH="$PWD/target/debug:$PATH" rosenpass exchange-config ./path/to/config/file.toml
-```
-
-Now you can verify that rosenpass inserted a pre-shared key on both hosts:
-
-```bash
-wg show wgRpTest preshared-keys
-```
-
-The shell output will look similar to this:
-
-```
-tdnV/wa/0Uf8Nrm3cZkKXOm4atrOEPzv1+dvaG7p7y0=    5235LJ/ONgrO8XuxECtLPzGOyWSvuzHcexzcgoHubfs=
-```
-
-The first value is the peer's public key, the second in the pre-shared key. The pre-shared keys should match.
-
-### Step 2: Manually start the broker
-
-Rosenpass starts the psk-broker internally by default. We are looking to manually start it instead.
-
-On the *local peer*, first start the broker manually:
-
-```bash
-rm -fv broker.sock; PATH="target/debug" ./target/debug/rosenpass-wireguard-broker-socket-handler --listen-path broker.sock
-```
-
-Now you should call rosenpass while make use of the created socket. Use the `psk_broker` configuration key. Your configuration will now look something like this:
-
-```bash
-PATH="$PWD/target/debug:$PATH" rosenpass --psk-broker broker.sock exchange-config ./path/to/config/file.toml
-```
-
-### Step 2: Forward the unix socket to the rosenpass device
-
-OpenSSH socket forwarding can be used; on the local peer you can execute something like the following command:
-
-```bash
-ssh -vgMR path/to/rosenpass/broker.sock:./broker.sock -L user@rosenpass_device
-```
-
-### Step 3: Start rosenpass on the rosenpass device
-
-You may need to copy your configuration files to the rosenpass device:
-
-```bash
-scp ./path/to/config/file.toml ./path/to/peer/pk ./path/to/pk ./path/to/sk user@rosenpass_device:path/to/rosenpass/
-```
-
-Now you can start rosenpass on the rosenpass device:
-
-```bash
-PATH="$PWD/target/debug:$PATH" ./target/debug/rosenpass exchange-config ./path/to/config.toml
-```
-
-### Step 4: Harden the setup
-
-This tutorial is in a very rough state; it currently provides enough hints to advanced users to convey how the setup is supposed work. For a real production setup it needs to be adapted.
-
-In particular, you can use the guide from  from [Unix Domain Socket Forwarding with OpenSSH](https://www.skreutz.com/posts/unix-domain-socket-forwarding-with-openssh/) to make sure neither the *local peer* nor the *rosenpass device* can execute arbitrary commands on each other. The socat tutorial used in this setup can be used to achieve a diversity of setups, such as forwarding the unix socket via a plain TCP socket without encryption to the rosenpass device, if a trusted network setup is used to connect the two. Other setups such as securing the connection using TLS or forwarding the connection via a serial connection can be achieved.
-
-You should also make sure that the rosenpass secret key is at no point in time stored in the *local peer*, so if you followed this tutorial you might want to regenerate the keypair on the *rosenpass device* itself.

examples/broker-in-podman-container/config/config.toml

@@ -1,9 +0,0 @@
-public_key = "./pk1"
-secret_key = "./sk1"
-listen = ["[::]:9999"]
-verbosity = "Verbose"
-
-[[peers]]
-public_key = "./pk2"
-device = "YOUR WIREGUARD DEVICE"
-peer = "YOUR PEER PK"

examples/broker-in-podman-container/rosenpass-exchange-asuser/podman-compose.yml

@@ -1,26 +0,0 @@
-version: "3.8"
-services:
-  rosenpass:
-    build: ../rosenpass/
-    command: rosenpass
-    ports:
-      - name: rosenpass-ipv4
-        target: 9999
-        host_ip: 127.0.0.1
-        published: 9999
-        protocol: udp
-        mode: host    
-      - name: rosenpass-ipv4
-        target: 9999
-        host_ip: '[::1]'
-        published: 9999
-        protocol: udp
-        mode: host    
-    environment:
-      RUST_LOG: info
-      #DEBUG_ENTRYPOINT: 1
-    cap_add:
-      - NET_ADMIN
-    volumes:
-      - ../socket:/socket:ro
-      - ../config:/config:ro

examples/broker-in-podman-container/rosenpass-psk-broker-asroot/podman-compose.yml

@@ -1,14 +0,0 @@
-version: "3.8"
-services:
-  rosenpass:
-    build: ../rosenpass
-    command: psk_broker
-    environment:
-      RUST_LOG: info
-      USER_GAINS_CAP_NET_ADMIN: 1
-      #DEBUG_ENTRYPOINT: 1
-    cap_add:
-      - NET_ADMIN
-    volumes:
-      - ../socket:/socket:rw
-    network_mode: host

examples/broker-in-podman-container/rosenpass/Dockerfile

@@ -1,35 +0,0 @@
-FROM rust:slim as build
-
-RUN apt-get update && apt-get install -y \
-  build-essential \
-  cmake \
-  libclang-dev \
-  libcap2-bin \
-  git \
-  inotify-tools
-
-RUN adduser --system --uid 768 --group rosenpass --home /var/lib/rosenpass
-
-USER rosenpass:rosenpass
-RUN cd ~rosenpass \
-  && git clone --depth 1 "https://github.com/rosenpass/rosenpass" -b dev/broker-architecture rosenpass-source \
-  && cd rosenpass-source \
-  && mkdir -p ~rosenpass/usr \
-  && cargo install --path rosenpass --root ~rosenpass/usr --bins \
-  && cargo install --path wireguard-broker --root ~rosenpass/usr --bins \
-  && cd ~rosenpass \
-  && rm -R rosenpass-source
-USER root:root
-
-# TODO: Is this proper handling of ambient capabilities?
-RUN setcap CAP_NET_ADMIN=+ep ~rosenpass/usr/bin/rosenpass-wireguard-broker-privileged
-
-VOLUME /config
-COPY ./entrypoint.sh /usr/local/sbin/docker_entrypoint
-COPY ./fd_passing.pl /usr/local/sbin/fd_passing
-RUN chmod a+x /usr/local/sbin/docker_entrypoint /usr/local/sbin/fd_passing
-ENTRYPOINT ["/usr/local/sbin/docker_entrypoint"]
-
-VOLUME /socket
-
-CMD rosenpass config.toml

examples/broker-in-podman-container/rosenpass/entrypoint.sh

@@ -1,187 +0,0 @@
-#! /bin/bash
-
-set -e # Needed by bail()
-
-log() {
-  local lvl; lvl="${1}"; shift || bail "log()" "USAGE: log LEVEL CONTEXT MSG..."
-  local ctx; ctx="${1}"; shift || bail "log()" "USAGE: log LEVEL CONTEXT MSG..."
-  echo >&2 "[entrypoint.sh/${ctx} ${lvl}]:" "$@"
-}
-
-log_debug() {
-  if [[ -n "${DEBUG_ENTRYPOINT}" ]]; then
-    log "DEBUG" "$@"
-  fi
-}
-
-log_info() {
-  log "INFO" "$@"
-}
-
-log_err() {
-  log "ERROR" "$@"
-}
-
-exc() {
-  local ctx; ctx="${1}"; shift || bail "exc()" "USAGE: exc CONTEXT CMD..."
-  log_debug '$' "$@"
-  "$@"
-}
-
-bail() {
-  local ctx; ctx="${1}"; shift || bail "bail()" "USAGE: bail CONTEXT MSG..."
-  (( "$#" != 0 )) || bail "${ctx}" $'USAGE: bail CONTEXT MSG... # Bail called without parameters! Please use error messages dear developer.'
-  log_err "${ctx}" "$@"
-  return 1
-}
-
-join() {
-  local delim; delim="$1"; shift || bail "join()" "USAGE: join DELIM ELMS..."
-  local tmp fst
-  fst="true"
-  for tmp in "$@"; do
-    if [[ "${fst}" = "true" ]]; then
-      printf "%s" "${tmp}"
-      fst=""
-    else
-      printf "%s%s" "${delim}" "${tmp}"
-    fi
-  done
-}
-
-# Shred files after they where red (recursively)
-# USAGE: $ burn_after_reading DIR
-burn_after_reading() {
-  local dir; dir="$1"; shift || bail "join()" "USAGE: burn_after_reading DIR"
-
-  log_info burn_after_reading "Started for ${dir}"
-
-  # Load the list of configuration files
-  local -a files_arr # Array
-  readarray -td $'\0' files_arr < <(find "${dir}" -type f -print0)
-
-  # Convert configuration file list to associative array
-  local file
-  local -A files_todo # Associative array
-  for file in "${files_arr[@]}"; do
-    files_todo["${file}"]="1"
-  done
-
-  # Watch for closed files
-  local file
-  # The --exclude '/$' excludes directories
-  inotifywait --quiet --monitor --event close_nowrite --exclude '/$' --recursive . --no-newline --format "%w%f%0" \
-    | while read -d $'\0' -r file; do
-
-        # Check if the file is in the todo list, if yes, erase it
-        if [[ "${files_todo["${file}"]+1}" = "1" ]]; then
-          log_info burn_after_reading "File loaded from configuration; removing now: ${file}";
-          shred "${file}"
-          # Clear from the todo list; What in the devils name is this quoting style bash
-          unset 'files_todo["${file}"]'
-        fi
-
-        # We're done if the todo list is empty
-        if (( "${#files_todo[@]}" == 0 )); then
-          return
-        fi
-      done
-}
-
-
-as_user() {
-  local -a cmd_prefix
-  if [[ "$1" = "--exec" ]]; then
-    cmd_prefix=("exec")
-    shift
-  fi
-
-  local user; user="$1"; shift || bail "as_user()" "USAGE: as_user USER CMD..."
-  (( "$#" > 0 )) || bail "as_user()" "USAGE: as_user USER CMD..."
-
-  if [[ -n "${USER_GAINS_CAP_NET_ADMIN}" ]]; then # TODO: Dirty to do this here; use --cap-net-admin or something?
-    exc "as_user()" "${cmd_prefix[@]}" \
-      capsh --caps="cap_net_admin+eip cap_setuid,cap_setgid+ep" --keep=1 \
-        --user="${user}" --addamb=cap_net_admin -- -c 'exec "$@"' -- "$@"
-  elif [[ "${user}" = "$(whoami)" ]]; then
-    exc "as_user()" "${cmd_prefix[@]}" "$@"
-  else
-    exc "as_user()" "${cmd_prefix[@]}" runuser -u "${user}" -- "$@"
-  fi
-}
-
-usage() {
-  bail "USAGE: ${SCRIPT} rosenpass|psk_broker"
-}
-
-cmd_internal() {
-  "$@"
-}
-
-cmd_run_command() {
-  exc "run_command()" as_user --exec "${SWITCH_USER}" "$@"
-}
-
-cmd_psk_broker() {
-  exc "psk_broker()" exec \
-    fd_passing --listen /socket/psk_broker.sock \
-      "$SCRIPT" internal as_user --exec "${SWITCH_USER}" \
-        rosenpass-wireguard-broker-socket-handler --listen-fd
-}
-
-rosenpass_start_with_socket_fd() {
-  local fd; fd="$1"; shift || bail "rosenpass_start_with_socket_fd()" "USAGE: rosenpass_start_with_socket_fd PSK_BROKER_FD"
-  exc "rosenpass_start_with_socket_fd()" exec \
-    rosenpass --psk-broker-fd "$fd" exchange-config /config/config.toml
-}
-
-cmd_rosenpass() {
-  test -z "${USER_GAINS_CAP_NET_ADMIN}" || bail "rosenpass()" "USER_GAINS_CAP_NET_ADMIN should be unset. The rosenpass instance doing key exchanges should not have network admin privileges!"
-  exc "psk_broker()" exec \
-    fd_passing --connect /socket/psk_broker.sock \
-      "$SCRIPT" internal as_user --exec "${SWITCH_USER}" \
-        "$SCRIPT" internal rosenpass_start_with_socket_fd
-}
-
-main() {
-  local command; command="$1"; shift || usage
-  case "${command}" in 
-    internal) cmd_internal "$@" ;;
-    run_command) ;;
-    psk_broker) ;;
-    rosenpass) ;;
-    *) usage;;
-  esac
-
-  exc "main()" umask u=rw,og=
-  exc "main()" cp -R "${CONFIG_MOUNT}" "${CONFIG_TMP}"
-  exc "main()" chmod -R u+X "${CONFIG_TMP}"
-  exc "main()" chown -R rosenpass:rosenpass "${CONFIG_TMP}"
-  # TODO: How can we do this? We should probably use a dedicated config broker.
-  #exc "main()" umount "${CONFIG_MOUNT}"
-  exc "main()" cd "${CONFIG_TMP}"
-
-  if [[ -n "${BURN_AFTER_READING}" ]]; then
-    ( burn_after_reading /dev/shm/rosenpass-config )&
-  fi
-
-  local -a path_cpy extra_path_cpy
-  mapfile -td ':' path_cpy < <(echo -n "$PATH")
-  mapfile -td ':' extra_path_cpy < <(echo -n "$EXTRA_PATH")
-  PATH="$(join ":" "${extra_path_cpy[@]}" "${path_cpy[@]}")"
-  export PATH
-
-  exc "main()" "cmd_${command}" "$@"
-}
-
-SCRIPT="$0"
-
-# Config
-CONFIG_MOUNT="${CONFIG_MOUNT:-/config}"
-CONFIG_TMP="${CONFIG_TMP:-/dev/shm/rosenpass-config}"
-BURN_AFTER_READING="${BURN_AFTER_READING:-true}"
-SWITCH_USER="${SWITCH_USER:-rosenpass}"
-#USER_GAINS_CAP_NET_ADMIN="${USER_GAINS_CAP_NET_ADMIN}"
-EXTRA_PATH="${EXTRA_PATH:-"$(eval echo ~rosenpass)/usr/bin"}"
-
-main "$@"

examples/broker-in-podman-container/rosenpass/fd_passing.pl

@@ -1,38 +0,0 @@
-#! /usr/bin/perl
-
-use Fcntl;
-use IO::Socket::UNIX;
-
-my $usage = "[$0] Usage: $0 SOCKETPATH [--connect|--listen] CMD...";
-
-my $mode = shift or die($usage);
-my $sopath = shift or die($usage);
-
-
-my $listen;
-if ($mode eq "--listen") {
-  $listen = 1;
-} elsif ($mode eq "--connect") {
-  $listen = 0;
-} else {
-  die($usage);
-}
-
-my $socket;
-if ($listen == 1) {
-  $socket = IO::Socket::UNIX->new(
-      Type => SOCK_STREAM(),
-      Local => $sopath,
-      Listen => 1,
-  ) or die "[$0] Error listening on socket socket: $!";
-} else {
-  $socket = IO::Socket::UNIX->new(
-      Type => SOCK_STREAM(),
-      Peer => $sopath,
-  ) or die "[$0] Error listening on socket socket: $!";
-}
-
-my $fd_flags = $socket->fcntl(F_GETFD, 0) or die "[$0] fcntl F_GETFD: $!";
-$socket->fcntl(F_SETFD, $fd_flags & ~FD_CLOEXEC) or die "[$0] fcntl F_SETFD: $!";
-
-exec(@ARGV, $socket->fileno);  # pass it on the command line

flake.nix

@@ -291,6 +291,7 @@
               ];
               buildPhase = ''
                 export HOME=$(mktemp -d)
+                export OSFONTDIR="$(kpsewhich --var-value TEXMF)/fonts/{opentype/public/nunito,truetype/google/noto}"
                 latexmk -r tex/CI.rc
               '';
               installPhase = ''

format_rust_code.sh

@@ -1,115 +0,0 @@
-#!/usr/bin/env bash
-
-# Parse command line options
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        --mode)
-            mode="$2"
-            shift 2
-            ;;
-        *)
-            echo "Unknown option: $1"
-            exit 1
-            ;;
-    esac
-done
-
-# Check if mode is specified
-if [ -z "$mode" ]; then
-    echo "Please specify the mode using --mode option. Valid modes are 'check' and 'fix'."
-    exit 1
-fi
-
-# Find all Markdown files in the current directory and its subdirectories
-mapfile -t md_files < <(find . -type f -name "*.md")
-
-count=0
-# Iterate through each Markdown file
-for file in "${md_files[@]}"; do
-    # Use awk to extract Rust code blocks enclosed within triple backticks
-    rust_code_blocks=$(awk '/```rust/{flag=1; next}/```/{flag=0} flag' "$file")
-
-    # Count the number of Rust code blocks
-    num_fences=$(awk '/```rust/{f=1} f{if(/```/){f=0; count++}} END{print count}' "$file")
-
-    if [ -n "$rust_code_blocks" ]; then
-        echo "Processing Rust code in $file"
-        # Iterate through each Rust code block
-        for ((i=1; i <= num_fences ; i++)); do
-            # Extract individual Rust code block using awk
-            current_rust_block=$(awk -v i="$i" '/```rust/{f=1; if (++count == i) next} f&&/```/{f=0;next} f' "$file")
-            # Variable to check if we have added the main function
-            add_main=0  
-            # Check if the Rust code block is already inside a function
-            if ! echo "$current_rust_block" | grep -q "fn main()"; then
-                # If not, wrap it in a main function
-                current_rust_block=$'fn main() {\n'"$current_rust_block"$'\n}'
-                add_main=1
-            fi
-            if [ "$mode" == "check" ]; then
-                # Apply changes to the Rust code block
-                formatted_rust_code=$(echo "$current_rust_block" | rustfmt)
-                # Use rustfmt to format the Rust code block, remove first and last lines, and remove the first 4 spaces if added  main function
-                if [ "$add_main" == 1 ]; then
-                    formatted_rust_code=$(echo "$formatted_rust_code" | sed '1d;$d' | sed 's/^    //')
-                    current_rust_block=$(echo "$current_rust_block" | sed '1d;')
-                    current_rust_block=$(echo "$current_rust_block" | sed '$d')
-                fi
-                if [ "$formatted_rust_code" == "$current_rust_block" ]; then
-                    echo "No changes needed in Rust code block $i in $file"
-                else
-                    echo -e "\nChanges needed in Rust code block $i in $file:\n"
-                    echo "$formatted_rust_code"
-                    count=+1
-                fi
-
-            elif [ "$mode" == "fix" ]; then
-                # Replace current_rust_block with formatted_rust_code in the file
-                formatted_rust_code=$(echo "$current_rust_block" | rustfmt)
-                # Use rustfmt to format the Rust code block, remove first and last lines, and remove the first 4 spaces if added  main function
-                if [ "$add_main" == 1 ]; then
-                    formatted_rust_code=$(echo "$formatted_rust_code" | sed '1d;$d' | sed 's/^    //')
-                    current_rust_block=$(echo "$current_rust_block" | sed '1d;')
-                    current_rust_block=$(echo "$current_rust_block" | sed '$d')
-                fi
-                # Check if the formatted code is the same as the current Rust code block
-                if [ "$formatted_rust_code" == "$current_rust_block" ]; then
-                    echo "No changes needed in Rust code block $i in $file"
-                else
-                    echo "Formatting Rust code block $i in $file"
-                    # Replace current_rust_block with formatted_rust_code in the file
-                    # Use awk to find the line number of the pattern
-
-                    start_line=$(grep -n "^\`\`\`rust" "$file" | sed -n "${i}p" | cut -d: -f1)
-                    end_line=$(grep -n "^\`\`\`" "$file" | awk -F: -v start_line="$start_line" '$1 > start_line {print $1; exit;}')
-
-                    if [ -n "$start_line" ] && [ -n "$end_line" ]; then
-                        # Print lines before the Rust code block
-                        head -n "$((start_line - 1))" "$file"
-
-                        # Print the formatted Rust code block
-                        echo "\`\`\`rust"
-                        echo "$formatted_rust_code"
-                        echo "\`\`\`"
-
-                        # Print lines after the Rust code block
-                        tail -n +"$((end_line + 1))" "$file"
-                    else
-                        # Rust code block not found or end line not found
-                        cat "$file"
-                    fi > tmpfile && mv tmpfile "$file"
-
-                fi
-            else  
-                echo "Unknown mode: $mode. Valid modes are 'check' and 'fix'."
-                exit 1
-            fi
-        done
-    fi
-done
-
-# CI failure if changes are needed
-if [ $count -gt 0 ]; then
-    echo "CI failed: Changes needed in Rust code blocks."
-    exit 1
-fi

fuzz/Cargo.toml

@@ -11,9 +11,8 @@ cargo-fuzz = true
 arbitrary = { workspace = true }
 libfuzzer-sys = { workspace = true }
 stacker = { workspace = true }
-rosenpass-secret-memory = { workspace = true }
+rosenpass-sodium = { workspace = true }
 rosenpass-ciphers = { workspace = true }
-rosenpass-cipher-traits = { workspace = true }
 rosenpass-to = { workspace = true }
 rosenpass = { workspace = true }
 
@@ -46,15 +45,3 @@ name = "fuzz_kyber_encaps"
 path = "fuzz_targets/kyber_encaps.rs"
 test = false
 doc = false
-
-[[bin]]
-name = "fuzz_box_secret_alloc"
-path = "fuzz_targets/box_secret_alloc.rs"
-test = false
-doc = false
-
-[[bin]]
-name = "fuzz_vec_secret_alloc"
-path = "fuzz_targets/vec_secret_alloc.rs"
-test = false
-doc = false

fuzz/fuzz_targets/aead_enc_into.rs

@@ -5,6 +5,7 @@ extern crate rosenpass;
 use libfuzzer_sys::fuzz_target;
 
 use rosenpass_ciphers::aead;
+use rosenpass_sodium::init as sodium_init;
 
 #[derive(arbitrary::Arbitrary, Debug)]
 pub struct Input {
@@ -15,6 +16,8 @@ pub struct Input {
 }
 
 fuzz_target!(|input: Input| {
+    sodium_init().unwrap();
+
     let mut ciphertext: Vec<u8> = Vec::with_capacity(input.plaintext.len() + 16);
     ciphertext.resize(input.plaintext.len() + 16, 0);
 

fuzz/fuzz_targets/blake2b.rs

@@ -4,7 +4,7 @@ extern crate rosenpass;
 
 use libfuzzer_sys::fuzz_target;
 
-use rosenpass_ciphers::subtle::blake2b;
+use rosenpass_sodium::{hash::blake2b, init as sodium_init};
 use rosenpass_to::To;
 
 #[derive(arbitrary::Arbitrary, Debug)]
@@ -14,6 +14,8 @@ pub struct Blake2b {
 }
 
 fuzz_target!(|input: Blake2b| {
+    sodium_init().unwrap();
+
     let mut out = [0u8; 32];
 
     blake2b::hash(&input.key, &input.data).to(&mut out).unwrap();

fuzz/fuzz_targets/box_secret_alloc.rs

@@ -1,8 +0,0 @@
-#![no_main]
-
-use libfuzzer_sys::fuzz_target;
-use rosenpass_secret_memory::alloc::secret_box;
-
-fuzz_target!(|data: &[u8]| {
-    let _ = secret_box(data);
-});

fuzz/fuzz_targets/handle_msg.rs

@@ -3,10 +3,13 @@ extern crate rosenpass;
 
 use libfuzzer_sys::fuzz_target;
 
+use rosenpass::coloring::Secret;
 use rosenpass::protocol::CryptoServer;
-use rosenpass_secret_memory::Secret;
+use rosenpass_sodium::init as sodium_init;
 
 fuzz_target!(|rx_buf: &[u8]| {
+    sodium_init().unwrap();
+
     let sk = Secret::from_slice(&[0; 13568]);
     let pk = Secret::from_slice(&[0; 524160]);
 

fuzz/fuzz_targets/kyber_encaps.rs

@@ -4,8 +4,7 @@ extern crate rosenpass;
 
 use libfuzzer_sys::fuzz_target;
 
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::EphemeralKem;
+use rosenpass::pqkem::{EphemeralKEM, KEM};
 
 #[derive(arbitrary::Arbitrary, Debug)]
 pub struct Input {
@@ -16,5 +15,5 @@ fuzz_target!(|input: Input| {
     let mut ciphertext = [0u8; 768];
     let mut shared_secret = [0u8; 32];
 
-    EphemeralKem::encaps(&mut shared_secret, &mut ciphertext, &input.pk).unwrap();
+    EphemeralKEM::encaps(&mut shared_secret, &mut ciphertext, &input.pk).unwrap();
 });

fuzz/fuzz_targets/mceliece_encaps.rs

@@ -3,13 +3,12 @@ extern crate rosenpass;
 
 use libfuzzer_sys::fuzz_target;
 
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::StaticKem;
+use rosenpass::pqkem::{StaticKEM, KEM};
 
-fuzz_target!(|input: [u8; StaticKem::PK_LEN]| {
+fuzz_target!(|input: &[u8]| {
     let mut ciphertext = [0u8; 188];
     let mut shared_secret = [0u8; 32];
 
     // We expect errors while fuzzing therefore we do not check the result.
-    let _ = StaticKem::encaps(&mut shared_secret, &mut ciphertext, &input);
+    let _ = StaticKEM::encaps(&mut shared_secret, &mut ciphertext, input);
 });

fuzz/fuzz_targets/vec_secret_alloc.rs

@@ -1,9 +0,0 @@
-#![no_main]
-
-use libfuzzer_sys::fuzz_target;
-use rosenpass_secret_memory::alloc::secret_vec;
-
-fuzz_target!(|data: &[u8]| {
-    let mut vec = secret_vec();
-    vec.extend_from_slice(data);
-});

lenses/Cargo.toml

@@ -1,16 +0,0 @@
-[package]
-name = "rosenpass-lenses"
-version = "0.1.0"
-authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
-edition = "2021"
-license = "MIT OR Apache-2.0"
-description = "Rosenpass internal library for parsing binary data securely"
-homepage = "https://rosenpass.eu/"
-repository = "https://github.com/rosenpass/rosenpass"
-readme = "readme.md"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[dependencies]
-paste = { workspace = true }
-thiserror = { workspace = true }

lenses/readme.md

@@ -1,3 +0,0 @@
-# Rosenpass internal binary parsing library
-
-This is an internal library; no guarantee is made about its API at this point in time.

lenses/src/lib.rs

@@ -1,206 +0,0 @@
-use std::result::Result;
-
-/// Common trait shared by all Lenses
-pub trait LenseView {
-    const LEN: usize;
-}
-
-/// Error during lense creation
-#[derive(thiserror::Error, Debug, Eq, PartialEq, Clone)]
-pub enum LenseError {
-    #[error("buffer size mismatch")]
-    BufferSizeMismatch,
-}
-
-pub type LenseResult<T> = Result<T, LenseError>;
-
-impl LenseError {
-    pub fn ensure_exact_buffer_size(len: usize, required: usize) -> LenseResult<()> {
-        (len == required)
-            .then_some(())
-            .ok_or(LenseError::BufferSizeMismatch)
-    }
-
-    pub fn ensure_sufficient_buffer_size(len: usize, required: usize) -> LenseResult<()> {
-        (len >= required)
-            .then_some(())
-            .ok_or(LenseError::BufferSizeMismatch)
-    }
-}
-
-/// A macro to create data lenses.
-#[macro_export]
-macro_rules! lense(
-    // prefix          @ offset       ; optional meta    ; field name   : field length, ...
-    (token_muncher_ref @ $offset:expr ; $( $attr:meta )* ; $field:ident : $len:expr $(, $( $tail:tt )+ )?) =>  {
-        ::paste::paste!{
-
-        #[allow(rustdoc::broken_intra_doc_links)]
-        $( #[ $attr ] )*
-        ///
-        #[doc = lense!(maybe_docstring_link $len)]
-        /// bytes long
-        pub fn $field(&self) -> &__ContainerType::Output {
-            &self.0[$offset .. $offset + $len]
-        }
-
-        /// The bytes until the
-        #[doc = lense!(maybe_docstring_link Self::$field)]
-        /// field
-        pub fn [< until_ $field >](&self) -> &__ContainerType::Output {
-            &self.0[0 .. $offset]
-        }
-
-        // if the tail exits, consume it as well
-        $(
-        lense!{token_muncher_ref @ $offset + $len ; $( $tail )+ }
-        )?
-        }
-    };
-
-    // prefix          @ offset       ; optional meta    ; field name   : field length, ...
-    (token_muncher_mut @ $offset:expr ; $( $attr:meta )* ; $field:ident : $len:expr $(, $( $tail:tt )+ )?) =>  {
-        ::paste::paste!{
-
-        #[allow(rustdoc::broken_intra_doc_links)]
-        $( #[ $attr ] )*
-        ///
-        #[doc = lense!(maybe_docstring_link $len)]
-        /// bytes long
-        pub fn [< $field _mut >](&mut self) -> &mut __ContainerType::Output {
-            &mut self.0[$offset .. $offset + $len]
-        }
-
-        // if the tail exits, consume it as well
-        $(
-        lense!{token_muncher_mut @ $offset + $len ; $( $tail )+ }
-        )?
-        }
-    };
-
-    // switch that yields literals unchanged, but creates docstring links to
-    // constants
-    // TODO the doc string link doesn't work if $x is taken from a generic,
-    (maybe_docstring_link $x:literal) => (stringify!($x));
-    (maybe_docstring_link $x:expr) => (stringify!([$x]));
-
-    // struct name  < optional generics     >    := optional doc string      field name   : field length, ...
-($type:ident $( < $( $generic:ident ),+ > )? := $( $( #[ $attr:meta ] )* $field:ident : $len:expr ),+) => (::paste::paste!{
-
-        #[allow(rustdoc::broken_intra_doc_links)]
-        /// A data lense to manipulate byte slices.
-        ///
-        //// # Fields
-        ///
-        $(
-        /// - `
-        #[doc = stringify!($field)]
-        /// `:
-        #[doc = lense!(maybe_docstring_link $len)]
-        /// bytes
-        )+
-        pub struct $type<__ContainerType $(, $( $generic ),+ )? > (
-            __ContainerType,
-            // The phantom data is required, since all generics declared on a
-            // type need to be used on the type.
-            // https://doc.rust-lang.org/stable/error_codes/E0392.html
-            $( $( ::core::marker::PhantomData<$generic> ),+ )?
-        );
-
-        impl<__ContainerType $(, $( $generic: LenseView ),+ )? > $type<__ContainerType $(, $( $generic ),+ )? >{
-            $(
-            /// Size in bytes of the field `
-            #[doc = !($field)]
-            /// `
-            pub const fn [< $field _len >]() -> usize{
-                $len
-            }
-            )+
-
-            /// Verify that `len` exactly holds [Self]
-            pub fn check_size(len: usize) -> ::rosenpass_lenses::LenseResult<()> {
-                ::rosenpass_lenses::LenseError::ensure_exact_buffer_size(len, $( $len + )+ 0)
-            }
-        }
-
-        // read-only accessor functions
-        impl<'a, __ContainerType $(, $( $generic: LenseView ),+ )?> $type<&'a __ContainerType $(, $( $generic ),+ )?>
-        where
-            __ContainerType: std::ops::Index<std::ops::Range<usize>> + ?Sized,
-        {
-            lense!{token_muncher_ref @ 0 ; $( $( $attr )* ; $field : $len ),+ }
-
-            /// View into all bytes belonging to this Lense
-            pub fn all_bytes(&self) -> &__ContainerType::Output {
-                &self.0[0..Self::LEN]
-            }
-        }
-
-        // mutable accessor functions
-        impl<'a, __ContainerType $(, $( $generic: LenseView ),+ )?> $type<&'a mut __ContainerType $(, $( $generic ),+ )?>
-        where
-            __ContainerType: std::ops::IndexMut<std::ops::Range<usize>> + ?Sized,
-        {
-            lense!{token_muncher_ref @ 0 ; $( $( $attr )* ; $field : $len ),+ }
-            lense!{token_muncher_mut @ 0 ; $( $( $attr )* ; $field : $len ),+ }
-
-            /// View into all bytes belonging to this Lense
-            pub fn all_bytes(&self) -> &__ContainerType::Output {
-                &self.0[0..Self::LEN]
-            }
-
-            /// View into all bytes belonging to this Lense
-            pub fn all_bytes_mut(&mut self) -> &mut __ContainerType::Output {
-                &mut self.0[0..Self::LEN]
-            }
-        }
-
-        // lense trait, allowing us to know the implementing lenses size
-        impl<__ContainerType $(, $( $generic: LenseView ),+ )? > LenseView for $type<__ContainerType $(, $( $generic ),+ )? >{
-            /// Number of bytes required to store this type in binary format
-            const LEN: usize = $( $len + )+ 0;
-        }
-
-        /// Extension trait to allow checked creation of a lense over
-        /// some byte slice that contains a
-        #[doc = lense!(maybe_docstring_link $type)]
-        pub trait [< $type Ext >] {
-            type __ContainerType;
-
-            /// Create a lense to the byte slice
-            fn [< $type:snake >] $(< $($generic : LenseView),* >)? (self) -> ::rosenpass_lenses::LenseResult< $type<Self::__ContainerType, $( $($generic),+ )? >>;
-
-            /// Create a lense to the byte slice, automatically truncating oversized buffers
-            fn [< $type:snake _ truncating >] $(< $($generic : LenseView),* >)? (self) -> ::rosenpass_lenses::LenseResult< $type<Self::__ContainerType, $( $($generic),+ )? >>;
-        }
-
-        impl<'a> [< $type Ext >] for &'a [u8] {
-            type __ContainerType = &'a [u8];
-
-            fn [< $type:snake >] $(< $($generic : LenseView),* >)? (self) -> ::rosenpass_lenses::LenseResult< $type<Self::__ContainerType, $( $($generic),+ )? >> {
-                $type::<Self::__ContainerType, $( $($generic),+ )? >::check_size(self.len())?;
-                Ok($type ( self, $( $( ::core::marker::PhantomData::<$generic>  ),+ )? ))
-            }
-
-            fn [< $type:snake _ truncating >] $(< $($generic : LenseView),* >)? (self) -> ::rosenpass_lenses::LenseResult< $type<Self::__ContainerType, $( $($generic),+ )? >> {
-                let required_size = $( $len + )+ 0;
-                ::rosenpass_lenses::LenseError::ensure_sufficient_buffer_size(self.len(), required_size)?;
-                [< $type Ext >]::[< $type:snake >](&self[..required_size])
-            }
-        }
-
-        impl<'a> [< $type Ext >] for &'a mut [u8] {
-            type __ContainerType = &'a mut [u8];
-            fn [< $type:snake >] $(< $($generic : LenseView),* >)? (self) -> ::rosenpass_lenses::LenseResult< $type<Self::__ContainerType, $( $($generic),+ )? >> {
-                $type::<Self::__ContainerType, $( $($generic),+ )? >::check_size(self.len())?;
-                Ok($type ( self, $( $( ::core::marker::PhantomData::<$generic>  ),+ )? ))
-            }
-
-            fn [< $type:snake _ truncating >] $(< $($generic : LenseView),* >)? (self) -> ::rosenpass_lenses::LenseResult< $type<Self::__ContainerType, $( $($generic),+ )? >> {
-                let required_size = $( $len + )+ 0;
-                ::rosenpass_lenses::LenseError::ensure_sufficient_buffer_size(self.len(), required_size)?;
-                [< $type Ext >]::[< $type:snake >](&mut self[..required_size])
-            }
-        }
-    });
-);

oqs/readme.md

@@ -1,5 +0,0 @@
-# Rosenpass internal liboqs bindings
-
-Rosenpass internal library providing bindings to liboqs.
-
-This is an internal library; not guarantee is made about its API at this point in time.

oqs/src/kem_macro.rs

@@ -1,80 +0,0 @@
-macro_rules! oqs_kem {
-    ($name:ident) => { ::paste::paste!{
-        mod [< $name:snake >] {
-            use rosenpass_cipher_traits::Kem;
-            use rosenpass_util::result::Guaranteed;
-
-            pub enum [< $name:camel >]  {}
-
-            /// # Panic & Safety
-            ///
-            /// This Trait impl calls unsafe [oqs_sys] functions, that write to byte
-            /// slices only identified using raw pointers. It must be ensured that the raw
-            /// pointers point into byte slices of sufficient length, to avoid UB through
-            /// overwriting of arbitrary data. This is ensured through assertions in the
-            /// implementation.
-            ///
-            /// __Note__: This requirement is stricter than necessary, it would suffice
-            /// to only check that the buffers are big enough, allowing them to be even
-            /// bigger. However, from a correctness point of view it does not make sense to
-            /// allow bigger buffers.
-            impl Kem for [< $name:camel >] {
-                type Error = ::std::convert::Infallible;
-
-                const SK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_secret_key >] as usize;
-                const PK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_public_key >] as usize;
-                const CT_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_ciphertext >] as usize;
-                const SHK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_shared_secret >] as usize;
-
-                fn keygen(sk: &mut [u8], pk: &mut [u8]) -> Guaranteed<()> {
-                    assert_eq!(sk.len(), Self::SK_LEN);
-                    assert_eq!(pk.len(), Self::PK_LEN);
-                    unsafe {
-                        oqs_call!(
-                            ::oqs_sys::kem::[< OQS_KEM _ $name:snake _ keypair >],
-                            pk.as_mut_ptr(),
-                            sk.as_mut_ptr()
-                        );
-                    }
-
-                    Ok(())
-                }
-
-                fn encaps(shk: &mut [u8], ct: &mut [u8], pk: &[u8]) -> Guaranteed<()> {
-                    assert_eq!(shk.len(), Self::SHK_LEN);
-                    assert_eq!(ct.len(), Self::CT_LEN);
-                    assert_eq!(pk.len(), Self::PK_LEN);
-                    unsafe {
-                        oqs_call!(
-                            ::oqs_sys::kem::[< OQS_KEM _ $name:snake _ encaps >],
-                            ct.as_mut_ptr(),
-                            shk.as_mut_ptr(),
-                            pk.as_ptr()
-                        );
-                    }
-
-                    Ok(())
-                }
-
-                fn decaps(shk: &mut [u8], sk: &[u8], ct: &[u8]) -> Guaranteed<()> {
-                    assert_eq!(shk.len(), Self::SHK_LEN);
-                    assert_eq!(sk.len(), Self::SK_LEN);
-                    assert_eq!(ct.len(), Self::CT_LEN);
-                    unsafe {
-                        oqs_call!(
-                            ::oqs_sys::kem::[< OQS_KEM _ $name:snake _ decaps >],
-                            shk.as_mut_ptr(),
-                            ct.as_ptr(),
-                            sk.as_ptr()
-                        );
-                    }
-
-                    Ok(())
-                }
-            }
-
-        }
-
-        pub use [< $name:snake >] :: [< $name:camel >];
-    }}
-}

oqs/src/lib.rs

@@ -1,21 +0,0 @@
-macro_rules! oqs_call {
-    ($name:path, $($args:expr),*) => {{
-        use oqs_sys::common::OQS_STATUS::*;
-
-        match $name($($args),*) {
-            OQS_SUCCESS => {}, // nop
-            OQS_EXTERNAL_LIB_ERROR_OPENSSL => {
-                panic!("OpenSSL error in liboqs' {}.", stringify!($name));
-            },
-            OQS_ERROR => {
-                panic!("Unknown error in liboqs' {}.", stringify!($name));
-            }
-        }
-    }};
-    ($name:ident) => { oqs_call!($name, ) };
-}
-
-#[macro_use]
-mod kem_macro;
-oqs_kem!(kyber_512);
-oqs_kem!(classic_mceliece_460896);

papers/tex/template-rosenpass.tex

@@ -177,11 +177,7 @@ version={4.0},
 		\titlehead{\centerline{\includegraphics[width=4cm]{RosenPass-Logo}}}
 		\title{\inserttitle}
 	}
-	\ifx\csname insertauthor\endcsname\relax
-	\author{}
-	\else
-	\author{\parbox{\linewidth}{\centering\insertauthor}}
-	\fi
+	\author{\csname insertauthor\endcsname}
 	\subject{\csname insertsubject\endcsname}
 	\date{\vspace{-1cm}}
 }

papers/whitepaper.md

@@ -6,6 +6,7 @@ author:
 - Benjamin Lipp = Max Planck Institute for Security and Privacy (MPI-SP)
 - Wanja Zaeske
 - Lisa Schmidt = {Scientific Illustrator – \\url{mullana.de}}
+- Prabhpreet Dua
 abstract: |
        Rosenpass is used to create post-quantum-secure VPNs. Rosenpass computes a shared key, WireGuard (WG) [@wg] uses the shared key to establish a secure connection. Rosenpass can also be used without WireGuard, deriving post-quantum-secure symmetric keys for another application. The Rosenpass protocol builds on “Post-quantum WireGuard” (PQWG) [@pqwg] and improves it by using a cookie mechanism to provide security against state disruption attacks.
 
@@ -428,12 +429,89 @@ The responder code handling InitConf needs to deal with the biscuits and package
 
 ICR5 and ICR6 perform biscuit replay protection using the biscuit number. This is not handled in `load_biscuit()` itself because there is the case that `biscuit_no = biscuit_used` which needs to be dealt with for retransmission handling.
 
+### Denial of Service Mitigation and Cookies
+
+Rosenpass derives its cookie-based DoS mitigation technique for a responder from Wireguard [@wg]. 
+
+When the responder is under load, it may choose to not process further handshake messages, but instead to respond with a cookie reply message (see Figure \ref{img:MessageTypes}). 
+
+The sender of the exchange then uses this cookie in order to resend the message and have it accepted the following time by the reciever. 
+
+For an initiator, Rosenpass ignores the message when under load.
+
+#### Cookie Reply Message
+
+The cookie reply message consists of the `sid` of the client under load, a random 24-byte bitstring `nonce` and encrypting `cookie_tau` into a `cookie` reply field which consists of the following (from the perspective of the cookie reply sender):
+
+```
+cookie_tau = lhash("cookie-tau",r_m, a_m)[0..16]
+cookie = XAEAD(lhash("cookie-key", spkm), nonce, cookie_tau , mac_peer)
+```
+
+where `r_m` is a secret variable that changes every two minutes to a random value. `a_m` is a concatenation of the source IP address and UDP source port of the client's peer. `cookie_tau` will result in a truncated 16 byte value from the above hash operation. `mac_peer` is the `mac` field of the peer's handshake message to which message is the reply.  
+
+#### Envelope `mac` Field
+
+Similar to `mac.1` in Wireguard handshake messages, the `mac` field of a Rosenpass envelope from a handshake packet sender's point of view consists of the following:
+
+```
+mac = lhash("mac", spkt, MAC_WIRE_DATA)[0..16]
+```
+
+where `MAC_WIRE_DATA` represents all bytes of msg prior to `mac` field in the envelope.
+
+If a client receives an invalid `mac` value for any message, it will discard the message.
+
+#### Envelope cookie field
+
+The `cookie_tau` value encrypted as part of `cookie` field in the cookie reply message is decrypted by its receiver and stored as the `last_recvd_cookie` for a limited time (120 seconds). This value is then used by the sender to append a `cookie` field to the sender's message envelope to retransmit the handshake message.  This is the equivalent of Wireguard's `mac.2` field and is determined as follows:
+
+```
+
+if (is_zero_length_bitstring(last_recvd_cookie)  ||  last_cookie_time_ellapsed >= 120) {
+    cookie = 0^16; //zeroed out 16 bytes bitstring
+}
+else {
+    cookie = lhash("cookie",last_recvd_cookie,COOKIE_WIRE_DATA)
+}
+```
+
+Here, `last_recvd_cookie` is the last received decrypted data of the `cookie` field from a cookie reply message by a hanshake message sender, `last_cookie_time_ellapsed` is the amount of time in seconds ellapsed since last cookie was received, and `COOKIE_WIRE_DATA` are the message contents of all bytes of the retransmitted message prior to the `cookie` field.
+
+The sender can use an invalid value for the `cookie` value, when the receiver is not under load, and the receiver must ignore this value.
+However, when the receiver is under load, it may reject messages with the invalid `cookie` value, and issue a cookie reply message. 
+
+### Conditions to trigger DoS Mechanism
+
+Rosenpass implementations are expected to detect conditions in which they are under computational load to trigger the cookie based DoS mitigation mechanism by replying with a cookie reply message.
+
+For the reference implemenation, Rosenpass has derived inspiration from the linux implementation of Wireguard.
+
+This implementation suggests that the reciever keep track of the number of messages it is processing at a given time. 
+
+On receiving an incoming message, if the length of the message queue to be processed exceeds a threshold `MAX_QUEUED_INCOMING_HANDSHAKES_THRESHOLD`, the client is considered under load and its state is stored as under load. In addition, the timestamp of this instant when the client was last under load is stored. When recieving subsequent messages, if the client is still in an under load state, the client will check if the time ellpased since the client was last under load has exceeded `LAST_UNDER_LOAD_WINDOW` seconds. If this is the case, the client will update its state to normal operation, and process the message in a normal fashion.
+
+Currently, the following constants are derived from the Linux kernel implementation of Wireguard:
+
+```
+MAX_QUEUED_INCOMING_HANDSHAKES_THRESHOLD = 4096
+LAST_UNDER_LOAD_WINDOW = 1 //seconds
+```
+
 ## Dealing with Packet Loss
 
 The initiator deals with packet loss by storing the messages it sends to the responder and retransmitting them in randomized, exponentially increasing intervals until they get a response. Receiving RespHello terminates retransmission of InitHello. A Data or EmptyData message serves as acknowledgement of receiving InitConf and terminates its retransmission.
 
 The responder does not need to do anything special to handle RespHello retransmission – if the RespHello package is lost, the initiator retransmits InitHello and the responder can generate another RespHello package from that. InitConf retransmission needs to be handled specifically in the responder code because accepting an InitConf retransmission would reset the live session including the nonce counter, which would cause nonce reuse. Implementations must detect the case that `biscuit_no = biscuit_used` in ICR5, skip execution of ICR6 and ICR7, and just transmit another EmptyData package to confirm that the initiator can stop transmitting InitConf.
 
+### Interaction with cookie reply system
+
+The cookie reply system does not interfere with the retransmission logic discussed above. 
+
+When the initator is under load, it will ignore processing any incoming messages.
+
+When a responder is under load, a handshake message will be discarded and a cookie reply message is sent. The initiator, then on the reciept of the cookie reply message, will store a decrypted `cookie_tau` value to use when appending a `cookie` to subsequently sent messages. As per the retransmission mechanism above, the initiator will send a retransmitted InitHello or InitConf message with a valid `cookie` value appended. On receiving the retransmitted handshake message, the responder will validate the `cookie` value and resume with the handshake process. 
+
 \printbibliography
 
 \setupimage{landscape,fullpage,label=img:HandlingCode}

rosenpass/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
 name = "rosenpass"
-description = "Build post-quantum-secure VPNs with WireGuard!"
 version = "0.2.1"
 authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
 edition = "2021"
 license = "MIT OR Apache-2.0"
+description = "Build post-quantum-secure VPNs with WireGuard!"
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
@@ -16,15 +16,15 @@ harness = false
 [dependencies]
 rosenpass-util = { workspace = true }
 rosenpass-constant-time = { workspace = true }
+rosenpass-sodium = { workspace = true }
 rosenpass-ciphers = { workspace = true }
-rosenpass-cipher-traits = { workspace = true }
 rosenpass-to = { workspace = true }
-rosenpass-secret-memory = { workspace = true }
-rosenpass-lenses = { workspace = true }
-rosenpass-wireguard-broker = { workspace = true }
 anyhow = { workspace = true }
 static_assertions = { workspace = true }
 memoffset = { workspace = true }
+libsodium-sys-stable = { workspace = true }
+oqs-sys = { workspace = true }
+lazy_static = { workspace = true }
 thiserror = { workspace = true }
 paste = { workspace = true }
 log = { workspace = true }
@@ -33,9 +33,6 @@ serde = { workspace = true }
 toml = { workspace = true }
 clap = { workspace = true }
 mio = { workspace = true }
-rand = { workspace = true }
-command-fds = { workspace = true }
-rustix = { workspace = true }
 
 [build-dependencies]
 anyhow = { workspace = true }

rosenpass/benches/handshake.rs

@@ -1,8 +1,9 @@
 use anyhow::Result;
-use rosenpass::protocol::{CryptoServer, HandleMsgResult, MsgBuf, PeerPtr, SPk, SSk, SymKey};
-
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::StaticKem;
+use rosenpass::pqkem::KEM;
+use rosenpass::{
+    pqkem::StaticKEM,
+    protocol::{CryptoServer, HandleMsgResult, MsgBuf, PeerPtr, SPk, SSk, SymKey},
+};
 
 use criterion::{black_box, criterion_group, criterion_main, Criterion};
 
@@ -39,7 +40,7 @@ fn hs(ini: &mut CryptoServer, res: &mut CryptoServer) -> Result<()> {
 
 fn keygen() -> Result<(SSk, SPk)> {
     let (mut sk, mut pk) = (SSk::zero(), SPk::zero());
-    StaticKem::keygen(sk.secret_mut(), pk.secret_mut())?;
+    StaticKEM::keygen(sk.secret_mut(), pk.secret_mut())?;
     Ok((sk, pk))
 }
 
@@ -56,6 +57,7 @@ fn make_server_pair() -> Result<(CryptoServer, CryptoServer)> {
 }
 
 fn criterion_benchmark(c: &mut Criterion) {
+    rosenpass_sodium::init().unwrap();
     let (mut a, mut b) = make_server_pair().unwrap();
     c.bench_function("cca_secret_alloc", |bench| {
         bench.iter(|| {

rosenpass/src/app_server.rs

@@ -1,26 +1,44 @@
-use std::cell::{Cell, RefCell};
-use std::io::{ErrorKind, Write};
-use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV4, SocketAddrV6, ToSocketAddrs};
-use std::os::unix::net::UnixStream;
+use anyhow::bail;
+
+use anyhow::Result;
+use log::{debug, error, info, warn};
+use mio::Interest;
+use mio::Token;
+use rosenpass_util::file::fopen_w;
+
+use std::cell::Cell;
+use std::io::Write;
+
+use std::io::ErrorKind;
+use std::net::Ipv4Addr;
+use std::net::Ipv6Addr;
+use std::net::SocketAddr;
+use std::net::SocketAddrV4;
+use std::net::SocketAddrV6;
+use std::net::ToSocketAddrs;
 use std::path::PathBuf;
+use std::process::Command;
+use std::process::Stdio;
 use std::slice;
+use std::thread;
 use std::time::Duration;
+use std::time::Instant;
 
-use anyhow::{bail, Result};
-use log::{error, info, warn};
-use mio::{Interest, Token};
-
-use rosenpass_secret_memory::Public;
+use crate::{
+    config::Verbosity,
+    protocol::{CryptoServer, MsgBuf, PeerPtr, SPk, SSk, SymKey, Timing},
+};
+use rosenpass_util::attempt;
 use rosenpass_util::b64::{b64_writer, fmt_b64};
-use rosenpass_util::{attempt, file::fopen_w};
-use rosenpass_wireguard_broker::api::mio_client::MioBrokerClient as PskBroker;
-use rosenpass_wireguard_broker::WireGuardBroker;
-
-use crate::config::Verbosity;
-use crate::protocol::{CryptoServer, MsgBuf, PeerPtr, SPk, SSk, SymKey, Timing};
 
 const IPV4_ANY_ADDR: Ipv4Addr = Ipv4Addr::new(0, 0, 0, 0);
 const IPV6_ANY_ADDR: Ipv6Addr = Ipv6Addr::new(0, 0, 0, 0, 0, 0, 0, 0);
+
+// Using values from Linux Kernel implementation
+// TODO: Customize values for rosenpass
+const MAX_QUEUED_INCOMING_HANDSHAKES_THRESHOLD: usize = 4096;
+const LAST_UNDER_LOAD_WINDOW: Duration = Duration::from_secs(1);
+
 fn ipv4_any_binding() -> SocketAddr {
     // addr, port
     SocketAddr::V4(SocketAddrV4::new(IPV4_ANY_ADDR, 0))
@@ -31,19 +49,6 @@ fn ipv6_any_binding() -> SocketAddr {
     SocketAddr::V6(SocketAddrV6::new(IPV6_ANY_ADDR, 0, 0, 0))
 }
 
-#[derive(Default)]
-struct MioTokenDispenser {
-    counter: usize,
-}
-
-impl MioTokenDispenser {
-    fn get_token(&mut self) -> Token {
-        let r = self.counter;
-        self.counter += 1;
-        Token(r)
-    }
-}
-
 #[derive(Default, Debug)]
 pub struct AppPeer {
     pub outfile: Option<PathBuf>,
@@ -60,22 +65,18 @@ impl AppPeer {
     }
 }
 
-#[derive(Debug)]
+#[derive(Default, Debug)]
 pub struct WireguardOut {
     // impl KeyOutput
     pub dev: String,
-    pub pk: Public<32>,
+    pub pk: String,
     pub extra_params: Vec<String>,
 }
 
-impl Default for WireguardOut {
-    fn default() -> Self {
-        Self {
-            dev: Default::default(),
-            pk: Public::zero(),
-            extra_params: Default::default(),
-        }
-    }
+#[derive(Debug)]
+pub enum DoSOperation {
+    UnderLoad { last_under_load: Instant },
+    Normal,
 }
 
 /// Holds the state of the application, namely the external IO
@@ -88,10 +89,10 @@ pub struct AppServer {
     pub sockets: Vec<mio::net::UdpSocket>,
     pub events: mio::Events,
     pub mio_poll: mio::Poll,
-    pub psk_broker: RefCell<PskBroker>,
     pub peers: Vec<AppPeer>,
     pub verbosity: Verbosity,
     pub all_sockets_drained: bool,
+    pub under_load: DoSOperation,
 }
 
 /// A socket pointer is an index assigned to a socket;
@@ -353,24 +354,11 @@ impl AppServer {
         sk: SSk,
         pk: SPk,
         addrs: Vec<SocketAddr>,
-        psk_broker_socket: UnixStream,
         verbosity: Verbosity,
     ) -> anyhow::Result<Self> {
         // setup mio
         let mio_poll = mio::Poll::new()?;
         let events = mio::Events::with_capacity(8);
-        let mut dispenser = MioTokenDispenser::default();
-
-        // Create the Wireguard broker connection
-        let psk_broker = {
-            let mut sock = mio::net::UnixStream::from_std(psk_broker_socket);
-            mio_poll.registry().register(
-                &mut sock,
-                dispenser.get_token(),
-                Interest::READABLE | Interest::WRITABLE,
-            )?;
-            PskBroker::new(sock)
-        };
 
         // bind each SocketAddr to a socket
         let maybe_sockets: Result<Vec<_>, _> =
@@ -455,12 +443,12 @@ impl AppServer {
         Ok(Self {
             crypt: CryptoServer::new(sk, pk),
             peers: Vec::new(),
-            psk_broker: RefCell::new(psk_broker),
             verbosity,
             sockets,
             events,
             mio_poll,
             all_sockets_drained: false,
+            under_load: DoSOperation::Normal,
         })
     }
 
@@ -575,7 +563,37 @@ impl AppServer {
                 }
 
                 ReceivedMessage(len, endpoint) => {
-                    match self.crypt.handle_msg(&rx[..len], &mut *tx) {
+                    let msg_result = match self.under_load {
+                        DoSOperation::UnderLoad { last_under_load: _ } => {
+                            //TODO: Lookup peer through addresses (hash)
+                            let index = self
+                                .peers
+                                .iter()
+                                .enumerate()
+                                .find(|(_num, p)| {
+                                    if let Some(ep) = p.endpoint() {
+                                        ep.addresses() == endpoint.addresses()
+                                    } else {
+                                        false
+                                    }
+                                })
+                                .ok_or(anyhow::anyhow!("Received message from unknown endpoint"))?
+                                .0;
+                            let socket_addr = endpoint
+                                .addresses()
+                                .first()
+                                .copied()
+                                .ok_or(anyhow::anyhow!("No socket address for endpoint"))?;
+                            self.crypt.handle_msg_under_load(
+                                &rx[..len],
+                                &mut *tx,
+                                PeerPtr(index),
+                                socket_addr,
+                            )
+                        }
+                        DoSOperation::Normal => self.crypt.handle_msg(&rx[..len], &mut *tx),
+                    };
+                    match msg_result {
                         Err(ref e) => {
                             self.verbose().then(|| {
                                 info!(
@@ -650,9 +668,31 @@ impl AppServer {
         }
 
         if let Some(owg) = ap.outwg.as_ref() {
-            self.psk_broker
-                .borrow_mut()
-                .set_psk(&owg.dev, owg.pk.value, *key.secret())?;
+            let mut child = Command::new("wg")
+                .arg("set")
+                .arg(&owg.dev)
+                .arg("peer")
+                .arg(&owg.pk)
+                .arg("preshared-key")
+                .arg("/dev/stdin")
+                .stdin(Stdio::piped())
+                .args(&owg.extra_params)
+                .spawn()?;
+            b64_writer(child.stdin.take().unwrap()).write_all(key.secret())?;
+
+            thread::spawn(move || {
+                let status = child.wait();
+
+                if let Ok(status) = status {
+                    if status.success() {
+                        debug!("successfully passed psk to wg")
+                    } else {
+                        error!("could not pass psk to wg {:?}", status)
+                    }
+                } else {
+                    error!("wait failed: {:?}", status)
+                }
+            });
         }
 
         Ok(())
@@ -708,18 +748,29 @@ impl AppServer {
         // desired on a non-dual-stack OS), thus just checking every socket after any
         // readiness event seems to be good enough™ for now.
 
+        println!("All sockets drained: {}", self.all_sockets_drained);
         // only poll if we drained all sockets before
         if self.all_sockets_drained {
-            self.mio_poll
-                .poll(&mut self.events, Some(timeout))
-                .or_else(|e| match e.kind() {
-                    ErrorKind::Interrupted | ErrorKind::WouldBlock => Ok(()),
-                    _ => Err(e),
-                })?;
+            self.mio_poll.poll(&mut self.events, Some(timeout))?;
+
+            let queue_length = self.events.iter().peekable().count();
+
+            println!("queue length: {}", queue_length);
+
+            if queue_length > MAX_QUEUED_INCOMING_HANDSHAKES_THRESHOLD {
+                self.under_load = DoSOperation::UnderLoad {
+                    last_under_load: Instant::now(),
+                }
+            }
         }
 
-        self.psk_broker.get_mut().poll()?;
+        if let DoSOperation::UnderLoad { last_under_load } = self.under_load {
+            if last_under_load.elapsed() > LAST_UNDER_LOAD_WINDOW {
+                self.under_load = DoSOperation::Normal;
+            }
+        }
 
+        // drain all sockets
         let mut would_block_count = 0;
         for (sock_no, socket) in self.sockets.iter_mut().enumerate() {
             match socket.recv_from(buf) {

rosenpass/src/cli.rs

@@ -1,54 +1,22 @@
-use std::io::{BufReader, Read};
-use std::os::unix::net::UnixStream;
-use std::path::PathBuf;
-use std::process::Command;
-use std::thread;
-
-use anyhow::{bail, ensure, Context};
-use clap::{ArgGroup, Parser, Subcommand};
-use command_fds::{CommandFdExt, FdMapping};
-use log::{error, info};
-use rustix::fd::AsRawFd;
-use rustix::net::{socketpair, AddressFamily, SocketFlags, SocketType};
-
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::StaticKem;
-use rosenpass_secret_memory::file::StoreSecret;
-use rosenpass_secret_memory::Public;
-use rosenpass_util::b64::b64_reader;
-use rosenpass_util::fd::claim_fd;
+use anyhow::{bail, ensure};
+use clap::Parser;
 use rosenpass_util::file::{LoadValue, LoadValueB64};
+use std::path::{Path, PathBuf};
 
 use crate::app_server;
 use crate::app_server::AppServer;
-use crate::protocol::{SPk, SSk, SymKey};
+use crate::{
+    // app_server::{AppServer, LoadValue, LoadValueB64},
+    coloring::Secret,
+    pqkem::{StaticKEM, KEM},
+    protocol::{SPk, SSk, SymKey},
+};
 
 use super::config;
 
 #[derive(Parser, Debug)]
-#[command(author, version, about)]
-#[clap(group(
-    ArgGroup::new("psk_broker_specs")
-    .args(&["psk_broker", "psk_broker_fd"]),
-))]
-pub struct Cli {
-    // Path of the wireguard_psk broker socket to connect to
-    #[arg(long)]
-    psk_broker: Option<PathBuf>,
-
-    /// When this command is called from another process, the other process can open and bind the
-    /// unix socket for the psk broker connectionto use themselves, passing it to this process. In Rust this can be achieved
-    /// using the [command-fds](https://docs.rs/command-fds/latest/command_fds/) crate.
-    #[arg(long)]
-    psk_broker_fd: Option<i32>,
-
-    #[command(subcommand)]
-    pub command: CliCommand,
-}
-
-#[derive(Subcommand, Debug)]
 #[command(author, version, about, long_about)]
-pub enum CliCommand {
+pub enum Cli {
     /// Start Rosenpass in server mode and carry on with the key exchange
     ///
     /// This will parse the configuration file and perform the key exchange
@@ -96,7 +64,6 @@ pub enum CliCommand {
         config_file: PathBuf,
 
         /// Forcefully overwrite existing config file
-        /// - [ ] Janepie
         #[clap(short, long)]
         force: bool,
     },
@@ -122,15 +89,6 @@ pub enum CliCommand {
         force: bool,
     },
 
-    /// Deprecated - use gen-keys instead
-    #[allow(rustdoc::broken_intra_doc_links)]
-    #[allow(rustdoc::invalid_html_tags)]
-    Keygen {
-        // NOTE yes, the legacy keygen argument initially really accepted "privet-key", not "secret-key"!
-        /// public-key <PATH> private-key <PATH>
-        args: Vec<String>,
-    },
-
     /// Validate a configuration
     Validate { config_files: Vec<PathBuf> },
 
@@ -143,9 +101,9 @@ impl Cli {
     pub fn run() -> anyhow::Result<()> {
         let cli = Self::parse();
 
-        use CliCommand::*;
+        use Cli::*;
         match cli {
-            Cli { command: Man, .. } => {
+            Man => {
                 let man_cmd = std::process::Command::new("man")
                     .args(["1", "rosenpass"])
                     .status();
@@ -154,10 +112,7 @@ impl Cli {
                     println!(include_str!(env!("ROSENPASS_MAN")));
                 }
             }
-            Cli {
-                command: GenConfig { config_file, force },
-                ..
-            } => {
+            GenConfig { config_file, force } => {
                 ensure!(
                     force || !config_file.exists(),
                     "config file {config_file:?} already exists"
@@ -166,52 +121,11 @@ impl Cli {
                 config::Rosenpass::example_config().store(config_file)?;
             }
 
-            // Deprecated - use gen-keys instead
-            Cli {
-                command: Keygen { args },
-                ..
-            } => {
-                log::warn!("The 'keygen' command is deprecated. Please use the 'gen-keys' command instead.");
-
-                let mut public_key: Option<PathBuf> = None;
-                let mut secret_key: Option<PathBuf> = None;
-
-                // Manual arg parsing, since clap wants to prefix flags with "--"
-                let mut args = args.into_iter();
-                loop {
-                    match (args.next().as_deref(), args.next()) {
-                        (Some("private-key"), Some(opt)) | (Some("secret-key"), Some(opt)) => {
-                            secret_key = Some(opt.into());
-                        }
-                        (Some("public-key"), Some(opt)) => {
-                            public_key = Some(opt.into());
-                        }
-                        (Some(flag), _) => {
-                            bail!("Unknown option `{}`", flag);
-                        }
-                        (_, _) => break,
-                    };
-                }
-
-                if secret_key.is_none() {
-                    bail!("private-key is required");
-                }
-                if public_key.is_none() {
-                    bail!("public-key is required");
-                }
-
-                generate_and_save_keypair(secret_key.unwrap(), public_key.unwrap())?;
-            }
-
-            Cli {
-                command:
-                    GenKeys {
-                        config_file,
-                        public_key,
-                        secret_key,
-                        force,
-                    },
-                ..
+            GenKeys {
+                config_file,
+                public_key,
+                secret_key,
+                force,
             } => {
                 // figure out where the key file is specified, in the config file or directly as flag?
                 let (pkf, skf) = match (config_file, public_key, secret_key) {
@@ -248,13 +162,15 @@ impl Cli {
                 }
 
                 // generate the keys and store them in files
-                generate_and_save_keypair(skf, pkf)?;
+                let mut ssk = crate::protocol::SSk::random();
+                let mut spk = crate::protocol::SPk::random();
+                StaticKEM::keygen(ssk.secret_mut(), spk.secret_mut())?;
+
+                ssk.store_secret(skf)?;
+                spk.store_secret(pkf)?;
             }
 
-            ref cli @ Cli {
-                command: ExchangeConfig { ref config_file },
-                ..
-            } => {
+            ExchangeConfig { config_file } => {
                 ensure!(
                     config_file.exists(),
                     "config file '{config_file:?}' does not exist"
@@ -262,41 +178,33 @@ impl Cli {
 
                 let config = config::Rosenpass::load(config_file)?;
                 config.validate()?;
-                Self::event_loop(&cli, &config)?;
+                Self::event_loop(config)?;
             }
 
-            ref cli @ Cli {
-                command:
-                    Exchange {
-                        ref first_arg,
-                        ref rest_of_args,
-                        ref config_file,
-                    },
-                ..
+            Exchange {
+                first_arg,
+                mut rest_of_args,
+                config_file,
             } => {
-                let mut args = Vec::new();
-                args.push(first_arg.clone());
-                args.extend_from_slice(&rest_of_args[..]);
+                rest_of_args.insert(0, first_arg);
+                let args = rest_of_args;
                 let mut config = config::Rosenpass::parse_args(args)?;
 
-                if let Some(p) = &config_file {
+                if let Some(p) = config_file {
                     config.store(&p)?;
-                    config.config_file_path = p.clone();
+                    config.config_file_path = p;
                 }
                 config.validate()?;
-                Self::event_loop(&cli, &config)?;
+                Self::event_loop(config)?;
             }
 
-            Cli {
-                command: Validate { config_files },
-                ..
-            } => {
+            Validate { config_files } => {
                 for file in config_files {
                     match config::Rosenpass::load(&file) {
                         Ok(config) => {
                             eprintln!("{file:?} is valid TOML and conforms to the expected schema");
                             match config.validate() {
-                                Ok(_) => eprintln!("{file:?} has passed all logical checks"),
+                                Ok(_) => eprintln!("{file:?} is passed all logical checks"),
                                 Err(_) => eprintln!("{file:?} contains logical errors"),
                             }
                         }
@@ -309,99 +217,30 @@ impl Cli {
         Ok(())
     }
 
-    fn event_loop(cli: &Cli, config: &config::Rosenpass) -> anyhow::Result<()> {
+    fn event_loop(config: config::Rosenpass) -> anyhow::Result<()> {
         // load own keys
         let sk = SSk::load(&config.secret_key)?;
         let pk = SPk::load(&config.public_key)?;
 
-        // Connect to the psk broker unix socket if one was specified
-        // OR OTHERWISE pawn the psk broker and use socketpair(2) to connect with them
-        let psk_broker_socket = if let Some(ref broker_path) = cli.psk_broker {
-            let sock = UnixStream::connect(broker_path)?;
-            sock.set_nonblocking(true)?;
-            sock
-        } else if let Some(broker_fd) = cli.psk_broker_fd {
-            let sock = UnixStream::from(claim_fd(broker_fd)?);
-            sock.set_nonblocking(true)?;
-            sock
-        } else {
-            let (ours, theirs) = socketpair(
-                AddressFamily::UNIX,
-                SocketType::STREAM,
-                SocketFlags::empty(),
-                None,
-            )?;
-
-            // Setup our end of the socketpair
-            let ours = UnixStream::from(ours);
-            ours.set_nonblocking(true)?;
-
-            // Start the PSK broker
-            let mut child = Command::new("rosenpass-wireguard-broker-socket-handler")
-                .args(&["--stream-fd", "3"])
-                .fd_mappings(vec![FdMapping {
-                    parent_fd: theirs.as_raw_fd(),
-                    child_fd: 3,
-                }])?
-                .spawn()?;
-
-            // Handle the PSK broker crashing
-            thread::spawn(move || {
-                let status = child.wait();
-
-                if let Ok(status) = status {
-                    if status.success() {
-                        // Maybe they are doing double forking?
-                        info!("PSK broker exited.");
-                    } else {
-                        error!("PSK broker exited with an error ({status:?})");
-                    }
-                } else {
-                    error!("Wait on PSK broker process failed ({status:?})");
-                }
-            });
-
-            ours
-        };
-
         // start an application server
         let mut srv = std::boxed::Box::<AppServer>::new(AppServer::new(
             sk,
             pk,
-            config.listen.clone(),
-            psk_broker_socket,
-            config.verbosity.clone(),
+            config.listen,
+            config.verbosity,
         )?);
 
-        for cfg_peer in config.peers.iter().by_ref() {
+        for cfg_peer in config.peers {
             srv.add_peer(
                 // psk, pk, outfile, outwg, tx_addr
-                cfg_peer
-                    .pre_shared_key
-                    .as_ref()
-                    .map(SymKey::load_b64)
-                    .transpose()?,
+                cfg_peer.pre_shared_key.map(SymKey::load_b64).transpose()?,
                 SPk::load(&cfg_peer.public_key)?,
-                cfg_peer.key_out.clone(),
-                cfg_peer
-                    .wg
-                    .as_ref()
-                    .map(|cfg| -> anyhow::Result<_> {
-                        let b64pk = &cfg.peer;
-                        let mut pk = Public::zero();
-                        b64_reader(BufReader::new(b64pk.as_bytes()))
-                            .read_exact(&mut pk.value)
-                            .with_context(|| {
-                                format!("Could not decode base64 public key: '{b64pk}'")
-                            })?;
-
-                        Ok(app_server::WireguardOut {
-                            pk,
-                            dev: cfg.device.clone(),
-                            extra_params: cfg.extra_params.clone(),
-                        })
-                    })
-                    .transpose()?,
+                cfg_peer.key_out,
+                cfg_peer.wg.map(|cfg| app_server::WireguardOut {
+                    dev: cfg.device,
+                    pk: cfg.peer,
+                    extra_params: cfg.extra_params,
+                }),
                 cfg_peer.endpoint.clone(),
             )?;
         }
@@ -410,11 +249,13 @@ impl Cli {
     }
 }
 
-/// generate secret and public keys, store in files according to the paths passed as arguments
-fn generate_and_save_keypair(secret_key: PathBuf, public_key: PathBuf) -> anyhow::Result<()> {
-    let mut ssk = crate::protocol::SSk::random();
-    let mut spk = crate::protocol::SPk::random();
-    StaticKem::keygen(ssk.secret_mut(), spk.secret_mut())?;
-    ssk.store_secret(secret_key)?;
-    spk.store_secret(public_key)
+trait StoreSecret {
+    fn store_secret<P: AsRef<Path>>(&self, path: P) -> anyhow::Result<()>;
+}
+
+impl<const N: usize> StoreSecret for Secret<N> {
+    fn store_secret<P: AsRef<Path>>(&self, path: P) -> anyhow::Result<()> {
+        std::fs::write(path, self.secret())?;
+        Ok(())
+    }
 }

rosenpass/src/coloring.rs

@@ -0,0 +1,443 @@
+//! Types types for dealing with (secret-) values
+//!
+//! These types use type level coloring to make accidential leackage of secrets extra hard. Both [Secret] and [Public] own their data, but the memory backing
+//! [Secret] is special:
+//! - as it is heap allocated, we can actively zeroize the memory before freeing it.
+//! - guard pages before and after each allocation trap accidential sequential reads that creep towards our secrets
+//! - the memory is mlocked, e.g. it is never swapped
+
+use anyhow::Context;
+use lazy_static::lazy_static;
+use libsodium_sys as libsodium;
+use rosenpass_util::{
+    b64::b64_reader,
+    file::{fopen_r, LoadValue, LoadValueB64, ReadExactToEnd, StoreValue},
+    functional::mutating,
+    mem::cpy,
+};
+use std::result::Result;
+use std::{
+    collections::HashMap,
+    convert::TryInto,
+    fmt,
+    ops::{Deref, DerefMut},
+    os::raw::c_void,
+    path::Path,
+    ptr::null_mut,
+    sync::Mutex,
+};
+
+// This might become a problem in library usage; it's effectively a memory
+// leak which probably isn't a problem right now because most memory will
+// be reused…
+lazy_static! {
+    static ref SECRET_CACHE: Mutex<SecretMemoryPool> = Mutex::new(SecretMemoryPool::new());
+}
+
+/// Pool that stores secret memory allocations
+///
+/// Allocation of secret memory is expensive. Thus, this struct provides a
+/// pool of secret memory, readily available to yield protected, slices of
+/// memory.
+///
+/// Further information about the protection in place can be found in in the
+/// [libsodium documentation](https://libsodium.gitbook.io/doc/memory_management#guarded-heap-allocations)
+#[derive(Debug)] // TODO check on Debug derive, is that clever
+pub struct SecretMemoryPool {
+    pool: HashMap<usize, Vec<*mut c_void>>,
+}
+
+impl SecretMemoryPool {
+    /// Create a new [SecretMemoryPool]
+    #[allow(clippy::new_without_default)]
+    pub fn new() -> Self {
+        let pool = HashMap::new();
+
+        Self { pool }
+    }
+
+    /// Return secrete back to the pool for future re-use
+    ///
+    /// This consumes the [Secret], but its memory is re-used.
+    pub fn release<const N: usize>(&mut self, mut s: Secret<N>) {
+        unsafe {
+            self.release_by_ref(&mut s);
+        }
+        std::mem::forget(s);
+    }
+
+    /// Return secret back to the pool for future re-use, by slice
+    ///
+    /// # Safety
+    ///
+    /// After calling this function on a [Secret], the secret must never be
+    /// used again for anything.
+    unsafe fn release_by_ref<const N: usize>(&mut self, s: &mut Secret<N>) {
+        s.zeroize();
+        let Secret { ptr: secret } = s;
+        // don't call Secret::drop, that could cause a double free
+        self.pool.entry(N).or_default().push(*secret);
+    }
+
+    /// Take protected memory from the pool, allocating new one if no suitable
+    /// chunk is found in the inventory.
+    ///
+    /// The secret is guaranteed to be full of nullbytes
+    ///
+    /// # Safety
+    ///
+    /// This function contains an unsafe call to [libsodium::sodium_malloc].
+    /// This call has no known safety invariants, thus nothing can go wrong™.
+    /// However, just like normal `malloc()` this can return a null ptr. Thus
+    /// the returned pointer is checked for null; causing the program to panic
+    /// if it is null.
+    pub fn take<const N: usize>(&mut self) -> Secret<N> {
+        let entry = self.pool.entry(N).or_default();
+        let secret = entry.pop().unwrap_or_else(|| {
+            let ptr = unsafe { libsodium::sodium_malloc(N) };
+            assert!(
+                !ptr.is_null(),
+                "libsodium::sodium_mallloc() returned a null ptr"
+            );
+            ptr
+        });
+
+        let mut s = Secret { ptr: secret };
+        s.zeroize();
+        s
+    }
+}
+
+impl Drop for SecretMemoryPool {
+    /// # Safety
+    ///
+    /// The drop implementation frees the contained elements using
+    /// [libsodium::sodium_free]. This is safe as long as every `*mut c_void`
+    /// contained was initialized with a call to [libsodium::sodium_malloc]
+    fn drop(&mut self) {
+        for ptr in self.pool.drain().flat_map(|(_, x)| x.into_iter()) {
+            unsafe {
+                libsodium::sodium_free(ptr);
+            }
+        }
+    }
+}
+
+/// # Safety
+///
+/// No safety implications are known, since the `*mut c_void` in
+/// is essentially used like a `&mut u8` [SecretMemoryPool].
+unsafe impl Send for SecretMemoryPool {}
+
+/// Store for a secret
+///
+/// Uses memory allocated with [libsodium::sodium_malloc],
+/// esentially can do the same things as `[u8; N].as_mut_ptr()`.
+pub struct Secret<const N: usize> {
+    ptr: *mut c_void,
+}
+
+impl<const N: usize> Clone for Secret<N> {
+    fn clone(&self) -> Self {
+        let mut new = Self::zero();
+        new.secret_mut().clone_from_slice(self.secret());
+        new
+    }
+}
+
+impl<const N: usize> Drop for Secret<N> {
+    fn drop(&mut self) {
+        self.zeroize();
+        // the invariant that the [Secret] is not used after the
+        // `release_by_ref` call is guaranteed, since this is a drop implementation
+        unsafe { SECRET_CACHE.lock().unwrap().release_by_ref(self) };
+        self.ptr = null_mut();
+    }
+}
+
+impl<const N: usize> Secret<N> {
+    pub fn from_slice(slice: &[u8]) -> Self {
+        let mut new_self = Self::zero();
+        new_self.secret_mut().copy_from_slice(slice);
+        new_self
+    }
+
+    /// Returns a new [Secret] that is zero initialized
+    pub fn zero() -> Self {
+        // Using [SecretMemoryPool] here because this operation is expensive,
+        // yet it is used in hot loops
+        let s = SECRET_CACHE.lock().unwrap().take();
+        assert_eq!(s.secret(), &[0u8; N]);
+        s
+    }
+
+    /// Returns a new [Secret] that is randomized
+    pub fn random() -> Self {
+        mutating(Self::zero(), |r| r.randomize())
+    }
+
+    /// Sets all data of an existing secret to null bytes
+    pub fn zeroize(&mut self) {
+        rosenpass_sodium::helpers::memzero(self.secret_mut());
+    }
+
+    /// Sets all data an existing secret to random bytes
+    pub fn randomize(&mut self) {
+        rosenpass_sodium::helpers::randombytes_buf(self.secret_mut());
+    }
+
+    /// Borrows the data
+    pub fn secret(&self) -> &[u8; N] {
+        // - calling `from_raw_parts` is safe, because `ptr` is initalized with
+        //   as `N` byte allocation from the creation of `Secret` onwards. `ptr`
+        //   stays valid over the full lifetime of `Secret`
+        //
+        // - calling uwnrap is safe, because we can guarantee that the slice has
+        //   exactly the required size `N` to create an array of `N` elements.
+        let ptr = self.ptr as *const u8;
+        let slice = unsafe { std::slice::from_raw_parts(ptr, N) };
+        slice.try_into().unwrap()
+    }
+
+    /// Borrows the data mutably
+    pub fn secret_mut(&mut self) -> &mut [u8; N] {
+        // the same safety argument as for `secret()` holds
+        let ptr = self.ptr as *mut u8;
+        let slice = unsafe { std::slice::from_raw_parts_mut(ptr, N) };
+        slice.try_into().unwrap()
+    }
+}
+
+/// The Debug implementation of [Secret] does not reveal the secret data,
+/// instead a placeholder `<SECRET>` is used
+impl<const N: usize> fmt::Debug for Secret<N> {
+    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
+        fmt.write_str("<SECRET>")
+    }
+}
+
+/// Contains information in the form of a byte array that may be known to the
+/// public
+// TODO: We should get rid of the Public type; just use a normal value
+#[derive(Copy, Clone, Hash, PartialEq, Eq, PartialOrd, Ord)]
+#[repr(transparent)]
+pub struct Public<const N: usize> {
+    pub value: [u8; N],
+}
+
+impl<const N: usize> Public<N> {
+    /// Create a new [Public] from a byte slice
+    pub fn from_slice(value: &[u8]) -> Self {
+        mutating(Self::zero(), |r| cpy(value, &mut r.value))
+    }
+
+    /// Create a new [Public] from a byte array
+    pub fn new(value: [u8; N]) -> Self {
+        Self { value }
+    }
+
+    /// Create a zero initialized [Public]
+    pub fn zero() -> Self {
+        Self { value: [0u8; N] }
+    }
+
+    /// Create a random initialized [Public]
+    pub fn random() -> Self {
+        mutating(Self::zero(), |r| r.randomize())
+    }
+
+    /// Randomize all bytes in an existing [Public]
+    pub fn randomize(&mut self) {
+        rosenpass_sodium::helpers::randombytes_buf(&mut self.value);
+    }
+}
+
+/// Writes the contents of an `&[u8]` as hexadecimal symbols to a [std::fmt::Formatter]
+pub fn debug_crypto_array(v: &[u8], fmt: &mut fmt::Formatter) -> fmt::Result {
+    fmt.write_str("[{}]=")?;
+    if v.len() > 64 {
+        for byte in &v[..32] {
+            std::fmt::LowerHex::fmt(byte, fmt)?;
+        }
+        fmt.write_str("…")?;
+        for byte in &v[v.len() - 32..] {
+            std::fmt::LowerHex::fmt(byte, fmt)?;
+        }
+    } else {
+        for byte in v {
+            std::fmt::LowerHex::fmt(byte, fmt)?;
+        }
+    }
+    Ok(())
+}
+
+impl<const N: usize> fmt::Debug for Public<N> {
+    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
+        debug_crypto_array(&self.value, fmt)
+    }
+}
+
+impl<const N: usize> Deref for Public<N> {
+    type Target = [u8; N];
+
+    fn deref(&self) -> &[u8; N] {
+        &self.value
+    }
+}
+
+impl<const N: usize> DerefMut for Public<N> {
+    fn deref_mut(&mut self) -> &mut [u8; N] {
+        &mut self.value
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+
+    /// https://libsodium.gitbook.io/doc/memory_management#guarded-heap-allocations
+    /// promises us that allocated memory is initialized with this magic byte
+    const SODIUM_MAGIC_BYTE: u8 = 0xdb;
+
+    /// must be called before any interaction with libsodium
+    fn init() {
+        unsafe { libsodium_sys::sodium_init() };
+    }
+
+    /// checks that whe can malloc with libsodium
+    #[test]
+    fn sodium_malloc() {
+        init();
+        const N: usize = 8;
+        let ptr = unsafe { libsodium_sys::sodium_malloc(N) };
+        let mem = unsafe { std::slice::from_raw_parts(ptr as *mut u8, N) };
+        assert_eq!(mem, &[SODIUM_MAGIC_BYTE; N])
+    }
+
+    /// checks that whe can free with libsodium
+    #[test]
+    fn sodium_free() {
+        init();
+        const N: usize = 8;
+        let ptr = unsafe { libsodium_sys::sodium_malloc(N) };
+        unsafe { libsodium_sys::sodium_free(ptr) }
+    }
+
+    /// check that we can alloc using the magic pool
+    #[test]
+    fn secret_memory_pool_take() {
+        init();
+        const N: usize = 0x100;
+        let mut pool = SecretMemoryPool::new();
+        let secret: Secret<N> = pool.take();
+        assert_eq!(secret.secret(), &[0; N]);
+    }
+
+    /// check that a secrete lives, even if its [SecretMemoryPool] is deleted
+    #[test]
+    fn secret_memory_pool_drop() {
+        init();
+        const N: usize = 0x100;
+        let mut pool = SecretMemoryPool::new();
+        let secret: Secret<N> = pool.take();
+        std::mem::drop(pool);
+        assert_eq!(secret.secret(), &[0; N]);
+    }
+
+    /// check that a secrete can be reborn, freshly initialized with zero
+    #[test]
+    fn secret_memory_pool_release() {
+        init();
+        const N: usize = 1;
+        let mut pool = SecretMemoryPool::new();
+        let mut secret: Secret<N> = pool.take();
+        let old_secret_ptr = secret.ptr;
+
+        secret.secret_mut()[0] = 0x13;
+        pool.release(secret);
+
+        // now check that we get the same ptr
+        let new_secret: Secret<N> = pool.take();
+        assert_eq!(old_secret_ptr, new_secret.ptr);
+
+        // and that the secret was zeroized
+        assert_eq!(new_secret.secret(), &[0; N]);
+    }
+}
+
+trait StoreSecret {
+    type Error;
+
+    fn store_secret<P: AsRef<Path>>(&self, path: P) -> Result<(), Self::Error>;
+}
+
+impl<T: StoreValue> StoreSecret for T {
+    type Error = <T as StoreValue>::Error;
+
+    fn store_secret<P: AsRef<Path>>(&self, path: P) -> Result<(), Self::Error> {
+        self.store(path)
+    }
+}
+
+impl<const N: usize> LoadValue for Secret<N> {
+    type Error = anyhow::Error;
+
+    fn load<P: AsRef<Path>>(path: P) -> anyhow::Result<Self> {
+        let mut v = Self::random();
+        let p = path.as_ref();
+        fopen_r(p)?
+            .read_exact_to_end(v.secret_mut())
+            .with_context(|| format!("Could not load file {p:?}"))?;
+        Ok(v)
+    }
+}
+
+impl<const N: usize> LoadValueB64 for Secret<N> {
+    type Error = anyhow::Error;
+
+    fn load_b64<P: AsRef<Path>>(path: P) -> anyhow::Result<Self> {
+        use std::io::Read;
+
+        let mut v = Self::random();
+        let p = path.as_ref();
+        // This might leave some fragments of the secret on the stack;
+        // in practice this is likely not a problem because the stack likely
+        // will be overwritten by something else soon but this is not exactly
+        // guaranteed. It would be possible to remedy this, but since the secret
+        // data will linger in the Linux page cache anyways with the current
+        // implementation, going to great length to erase the secret here is
+        // not worth it right now.
+        b64_reader(&mut fopen_r(p)?)
+            .read_exact(v.secret_mut())
+            .with_context(|| format!("Could not load base64 file {p:?}"))?;
+        Ok(v)
+    }
+}
+
+impl<const N: usize> StoreSecret for Secret<N> {
+    type Error = anyhow::Error;
+
+    fn store_secret<P: AsRef<Path>>(&self, path: P) -> anyhow::Result<()> {
+        std::fs::write(path, self.secret())?;
+        Ok(())
+    }
+}
+
+impl<const N: usize> LoadValue for Public<N> {
+    type Error = anyhow::Error;
+
+    fn load<P: AsRef<Path>>(path: P) -> anyhow::Result<Self> {
+        let mut v = Self::random();
+        fopen_r(path)?.read_exact_to_end(&mut *v)?;
+        Ok(v)
+    }
+}
+
+impl<const N: usize> StoreValue for Public<N> {
+    type Error = anyhow::Error;
+
+    fn store<P: AsRef<Path>>(&self, path: P) -> anyhow::Result<()> {
+        std::fs::write(path, **self)?;
+        Ok(())
+    }
+}

rosenpass/src/config.rs

@@ -26,7 +26,7 @@ pub struct Rosenpass {
     pub config_file_path: PathBuf,
 }
 
-#[derive(Debug, PartialEq, Eq, Serialize, Deserialize, Clone)]
+#[derive(Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub enum Verbosity {
     Quiet,
     Verbose,
@@ -41,6 +41,10 @@ pub struct RosenpassPeer {
     #[serde(default)]
     pub key_out: Option<PathBuf>,
 
+    // TODO make sure failure does not crash but is logged
+    #[serde(default)]
+    pub exchange_command: Vec<String>,
+
     // TODO make this field only available on binary builds, not on library builds
     #[serde(flatten)]
     pub wg: Option<WireGuard>,
@@ -341,20 +345,28 @@ impl Rosenpass {
     /// Generate an example configuration
     pub fn example_config() -> Self {
         let peer = RosenpassPeer {
-            public_key: "/path/to/rp-peer-public-key".into(),
+            public_key: "rp-peer-public-key".into(),
             endpoint: Some("my-peer.test:9999".into()),
-            key_out: Some("/path/to/rp-key-out.txt".into()),
-            pre_shared_key: Some("additional pre shared key".into()),
-            wg: Some(WireGuard {
-                device: "wirgeguard device e.g. wg0".into(),
-                peer: "wireguard public key".into(),
-                extra_params: vec!["passed to".into(), "wg set".into()],
-            }),
+            exchange_command: [
+                "wg",
+                "set",
+                "wg0",
+                "peer",
+                "<PEER_ID>",
+                "preshared-key",
+                "/dev/stdin",
+            ]
+            .into_iter()
+            .map(|x| x.to_string())
+            .collect(),
+            key_out: Some("rp-key-out".into()),
+            pre_shared_key: None,
+            wg: None,
         };
 
         Self {
-            public_key: "/path/to/rp-public-key".into(),
-            secret_key: "/path/to/rp-secret-key".into(),
+            public_key: "rp-public-key".into(),
+            secret_key: "rp-secret-key".into(),
             peers: vec![peer],
             ..Self::new("", "")
         }
@@ -374,7 +386,7 @@ mod test {
     use super::*;
 
     fn split_str(s: &str) -> Vec<String> {
-        s.split(' ').map(|s| s.to_string()).collect()
+        s.split(" ").map(|s| s.to_string()).collect()
     }
 
     #[test]

rosenpass/src/hash_domains.rs

@@ -1,46 +0,0 @@
-//! Pseudo Random Functions (PRFs) with a tree-like label scheme which
-//! ensures their uniqueness
-
-use anyhow::Result;
-use rosenpass_ciphers::{hash_domain::HashDomain, KEY_LEN};
-
-// TODO Use labels that can serve as identifiers
-macro_rules! hash_domain_ns {
-    ($base:ident, $name:ident, $($lbl:expr),* ) => {
-        pub fn $name() -> Result<HashDomain> {
-            let t = $base()?;
-            $( let t = t.mix($lbl.as_bytes())?; )*
-            Ok(t)
-        }
-    }
-}
-
-macro_rules! hash_domain {
-    ($base:ident, $name:ident, $($lbl:expr),* ) => {
-        pub fn $name() -> Result<[u8; KEY_LEN]> {
-            let t = $base()?;
-            $( let t = t.mix($lbl.as_bytes())?; )*
-            Ok(t.into_value())
-        }
-    }
-}
-
-pub fn protocol() -> Result<HashDomain> {
-    HashDomain::zero().mix("Rosenpass v1 mceliece460896 Kyber512 ChaChaPoly1305 BLAKE2s".as_bytes())
-}
-
-hash_domain_ns!(protocol, mac, "mac");
-hash_domain_ns!(protocol, cookie, "cookie");
-hash_domain_ns!(protocol, peerid, "peer id");
-hash_domain_ns!(protocol, biscuit_ad, "biscuit additional data");
-hash_domain_ns!(protocol, ckinit, "chaining key init");
-hash_domain_ns!(protocol, _ckextract, "chaining key extract");
-
-hash_domain!(_ckextract, mix, "mix");
-hash_domain!(_ckextract, hs_enc, "handshake encryption");
-hash_domain!(_ckextract, ini_enc, "initiator handshake encryption");
-hash_domain!(_ckextract, res_enc, "responder handshake encryption");
-
-hash_domain_ns!(_ckextract, _user, "user");
-hash_domain_ns!(_user, _rp, "rosenpass.eu");
-hash_domain!(_rp, osk, "wireguard psk");

rosenpass/src/labeled_prf.rs

@@ -0,0 +1,50 @@
+//! Pseudo Random Functions (PRFs) with a tree-like label scheme which
+//! ensures their uniqueness
+
+
+use crate::prftree::PrfTree;
+use anyhow::Result;
+use rosenpass_ciphers::KEY_LEN;
+
+pub fn protocol() -> Result<PrfTree> {
+    PrfTree::zero().mix("Rosenpass v1 mceliece460896 Kyber512 ChaChaPoly1305 BLAKE2s".as_bytes())
+}
+
+// TODO Use labels that can serve as identifiers
+macro_rules! prflabel {
+    ($base:ident, $name:ident, $($lbl:expr),* ) => {
+        pub fn $name() -> Result<PrfTree> {
+            let t = $base()?;
+            $( let t = t.mix($lbl.as_bytes())?; )*
+            Ok(t)
+        }
+    }
+}
+
+prflabel!(protocol, mac, "mac");
+prflabel!(protocol, cookie, "cookie");
+prflabel!(protocol, cookie_tau, "cookie-tau");
+prflabel!(protocol, cookie_key, "cookie-key");
+prflabel!(protocol, peerid, "peer id");
+prflabel!(protocol, biscuit_ad, "biscuit additional data");
+prflabel!(protocol, ckinit, "chaining key init");
+prflabel!(protocol, _ckextract, "chaining key extract");
+
+macro_rules! prflabel_leaf {
+    ($base:ident, $name:ident, $($lbl:expr),* ) => {
+        pub fn $name() -> Result<[u8; KEY_LEN]> {
+            let t = $base()?;
+            $( let t = t.mix($lbl.as_bytes())?; )*
+            Ok(t.into_value())
+        }
+    }
+}
+
+prflabel_leaf!(_ckextract, mix, "mix");
+prflabel_leaf!(_ckextract, hs_enc, "handshake encryption");
+prflabel_leaf!(_ckextract, ini_enc, "initiator handshake encryption");
+prflabel_leaf!(_ckextract, res_enc, "responder handshake encryption");
+
+prflabel!(_ckextract, _user, "user");
+prflabel!(_user, _rp, "rosenpass.eu");
+prflabel_leaf!(_rp, osk, "wireguard psk");

rosenpass/src/lib.rs

@@ -1,24 +1,56 @@
-use rosenpass_lenses::LenseError;
-
+pub mod coloring;
+#[rustfmt::skip]
+pub mod labeled_prf;
 pub mod app_server;
 pub mod cli;
 pub mod config;
-pub mod hash_domains;
 pub mod msgs;
+pub mod pqkem;
+pub mod prftree;
 pub mod protocol;
 
 #[derive(thiserror::Error, Debug)]
 pub enum RosenpassError {
-    #[error("buffer size mismatch")]
-    BufferSizeMismatch,
+    #[error("error in OQS")]
+    Oqs,
+    #[error("error from external library while calling OQS")]
+    OqsExternalLib,
+    #[error("buffer size mismatch, required {required_size} but found {actual_size}")]
+    BufferSizeMismatch {
+        required_size: usize,
+        actual_size: usize,
+    },
     #[error("invalid message type")]
     InvalidMessageType(u8),
 }
 
-impl From<LenseError> for RosenpassError {
-    fn from(value: LenseError) -> Self {
-        match value {
-            LenseError::BufferSizeMismatch => RosenpassError::BufferSizeMismatch,
+impl RosenpassError {
+    /// Helper function to check a buffer size
+    fn check_buffer_size(required_size: usize, actual_size: usize) -> Result<(), Self> {
+        if required_size != actual_size {
+            Err(Self::BufferSizeMismatch {
+                required_size,
+                actual_size,
+            })
+        } else {
+            Ok(())
+        }
+    }
+}
+
+/// Extension trait to attach function calls to foreign types.
+trait RosenpassMaybeError {
+    /// Checks whether something is an error or not
+    fn to_rg_error(&self) -> Result<(), RosenpassError>;
+}
+
+impl RosenpassMaybeError for oqs_sys::common::OQS_STATUS {
+    fn to_rg_error(&self) -> Result<(), RosenpassError> {
+        use oqs_sys::common::OQS_STATUS;
+        match self {
+            OQS_STATUS::OQS_SUCCESS => Ok(()),
+            OQS_STATUS::OQS_ERROR => Err(RosenpassError::Oqs),
+            OQS_STATUS::OQS_EXTERNAL_LIB_ERROR_OPENSSL => Err(RosenpassError::OqsExternalLib),
         }
     }
 }

rosenpass/src/main.rs

@@ -1,16 +1,21 @@
 use log::error;
 use rosenpass::cli::Cli;
+use rosenpass_util::attempt;
 use std::process::exit;
 
 /// Catches errors, prints them through the logger, then exits
 pub fn main() {
-    // default to displaying warning and error log messages only
-    env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("warn")).init();
+    env_logger::init();
 
-    match Cli::run() {
+    let res = attempt!({
+        rosenpass_sodium::init()?;
+        Cli::run()
+    });
+
+    match res {
         Ok(_) => {}
         Err(e) => {
-            error!("{e:?}");
+            error!("{e}");
             exit(1);
         }
     }

rosenpass/src/msgs.rs

@@ -9,15 +9,14 @@
 //!
 //! # Example
 //!
-//! The following example uses the [`lense` macro](rosenpass_lenses::lense) to create a lense that
+//! The following example uses the [`data_lense` macro](crate::data_lense) to create a lense that
 //! might be useful when dealing with UDP headers.
 //!
 //! ```
-//! use rosenpass_lenses::{lense, LenseView};
-//! use rosenpass::RosenpassError;
+//! use rosenpass::{data_lense, RosenpassError, msgs::LenseView};
 //! # fn main() -> Result<(), RosenpassError> {
 //!
-//! lense! {UdpDatagramHeader :=
+//! data_lense! {UdpDatagramHeader :=
 //!     source_port: 2,
 //!     dest_port: 2,
 //!     length: 2,
@@ -45,14 +44,222 @@
 //! ```
 
 use super::RosenpassError;
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::{EphemeralKem, StaticKem};
-use rosenpass_ciphers::{aead, xaead, KEY_LEN};
-use rosenpass_lenses::{lense, LenseView};
+use crate::pqkem::*;
+use rosenpass_ciphers::{aead, xaead};
+
+pub const MAC_SIZE: usize = 16;
+pub const COOKIE_SIZE: usize = 16;
 
 // Macro magic ////////////////////////////////////////////////////////////////
 
-lense! { Envelope<M> :=
+/// A macro to create data lenses. Refer to the [`msgs` mod](crate::msgs) for
+/// an example and further elaboration
+// TODO implement TryFrom<[u8]> and From<[u8; Self::len()]>
+#[macro_export]
+macro_rules! data_lense(
+    // prefix          @ offset       ; optional meta    ; field name   : field length, ...
+    (token_muncher_ref @ $offset:expr ; $( $attr:meta )* ; $field:ident : $len:expr $(, $( $tail:tt )+ )?) =>  {
+        ::paste::paste!{
+
+        #[allow(rustdoc::broken_intra_doc_links)]
+        $( #[ $attr ] )*
+        ///
+        #[doc = data_lense!(maybe_docstring_link $len)]
+        /// bytes long
+        pub fn $field(&self) -> &__ContainerType::Output {
+            &self.0[$offset .. $offset + $len]
+        }
+
+        /// The bytes until the
+        #[doc = data_lense!(maybe_docstring_link Self::$field)]
+        /// field
+        pub fn [< until_ $field >](&self) -> &__ContainerType::Output {
+            &self.0[0 .. $offset]
+        }
+
+        // if the tail exits, consume it as well
+        $(
+        data_lense!{token_muncher_ref @ $offset + $len ; $( $tail )+ }
+        )?
+        }
+    };
+
+    // prefix          @ offset       ; optional meta    ; field name   : field length, ...
+    (token_muncher_mut @ $offset:expr ; $( $attr:meta )* ; $field:ident : $len:expr $(, $( $tail:tt )+ )?) =>  {
+        ::paste::paste!{
+
+        #[allow(rustdoc::broken_intra_doc_links)]
+        $( #[ $attr ] )*
+        ///
+        #[doc = data_lense!(maybe_docstring_link $len)]
+        /// bytes long
+        pub fn [< $field _mut >](&mut self) -> &mut __ContainerType::Output {
+            &mut self.0[$offset .. $offset + $len]
+        }
+
+        // if the tail exits, consume it as well
+        $(
+        data_lense!{token_muncher_mut @ $offset + $len ; $( $tail )+ }
+        )?
+        }
+    };
+
+    // switch that yields literals unchanged, but creates docstring links to
+    // constants
+    // TODO the doc string link doesn't work if $x is taken from a generic,
+    (maybe_docstring_link $x:literal) => (stringify!($x));
+    (maybe_docstring_link $x:expr) => (stringify!([$x]));
+
+    // struct name  < optional generics     >    := optional doc string      field name   : field length, ...
+    ($type:ident $( < $( $generic:ident ),+ > )? := $( $( #[ $attr:meta ] )* $field:ident : $len:expr ),+) => (::paste::paste!{
+
+        #[allow(rustdoc::broken_intra_doc_links)]
+        /// A data lense to manipulate byte slices.
+        ///
+        //// # Fields
+        ///
+        $(
+        /// - `
+        #[doc = stringify!($field)]
+        /// `:
+        #[doc = data_lense!(maybe_docstring_link $len)]
+        /// bytes
+        )+
+        pub struct $type<__ContainerType $(, $( $generic ),+ )? > (
+            __ContainerType,
+            // The phantom data is required, since all generics declared on a
+            // type need to be used on the type.
+            // https://doc.rust-lang.org/stable/error_codes/E0392.html
+            $( $( ::core::marker::PhantomData<$generic> ),+ )?
+        );
+
+        impl<__ContainerType $(, $( $generic: LenseView ),+ )? > $type<__ContainerType $(, $( $generic ),+ )? >{
+            $(
+            /// Size in bytes of the field `
+            #[doc = !($field)]
+            /// `
+            pub const fn [< $field _len >]() -> usize{
+                $len
+            }
+            )+
+
+            /// Verify that `len` is sufficiently long to hold [Self]
+            pub fn check_size(len: usize) -> Result<(), RosenpassError>{
+                let required_size = $( $len + )+ 0;
+                let actual_size = len;
+                if required_size != actual_size {
+                    Err(RosenpassError::BufferSizeMismatch {
+                        required_size,
+                        actual_size,
+                    })
+                }else{
+                    Ok(())
+                }
+            }
+        }
+
+        // read-only accessor functions
+        impl<'a, __ContainerType $(, $( $generic: LenseView ),+ )?> $type<&'a __ContainerType $(, $( $generic ),+ )?>
+        where
+            __ContainerType: std::ops::Index<std::ops::Range<usize>> + ?Sized,
+        {
+            data_lense!{token_muncher_ref @ 0 ; $( $( $attr )* ; $field : $len ),+ }
+
+            /// View into all bytes belonging to this Lense
+            pub fn all_bytes(&self) -> &__ContainerType::Output {
+                &self.0[0..Self::LEN]
+            }
+        }
+
+        // mutable accessor functions
+        impl<'a, __ContainerType $(, $( $generic: LenseView ),+ )?> $type<&'a mut __ContainerType $(, $( $generic ),+ )?>
+        where
+            __ContainerType: std::ops::IndexMut<std::ops::Range<usize>> + ?Sized,
+        {
+            data_lense!{token_muncher_ref @ 0 ; $( $( $attr )* ; $field : $len ),+ }
+            data_lense!{token_muncher_mut @ 0 ; $( $( $attr )* ; $field : $len ),+ }
+
+            /// View into all bytes belonging to this Lense
+            pub fn all_bytes(&self) -> &__ContainerType::Output {
+                &self.0[0..Self::LEN]
+            }
+
+            /// View into all bytes belonging to this Lense
+            pub fn all_bytes_mut(&mut self) -> &mut __ContainerType::Output {
+                &mut self.0[0..Self::LEN]
+            }
+        }
+
+        // lense trait, allowing us to know the implementing lenses size
+        impl<__ContainerType $(, $( $generic: LenseView ),+ )? > LenseView for $type<__ContainerType $(, $( $generic ),+ )? >{
+            /// Number of bytes required to store this type in binary format
+            const LEN: usize = $( $len + )+ 0;
+        }
+
+        /// Extension trait to allow checked creation of a lense over
+        /// some byte slice that contains a
+        #[doc = data_lense!(maybe_docstring_link $type)]
+        pub trait [< $type Ext >] {
+            type __ContainerType;
+
+            /// Create a lense to the byte slice
+            fn [< $type:snake >] $(< $($generic : LenseView),* >)? (self) -> Result< $type<Self::__ContainerType, $( $($generic),+ )? >, RosenpassError>;
+
+            /// Create a lense to the byte slice, automatically truncating oversized buffers
+            fn [< $type:snake _ truncating >] $(< $($generic : LenseView),* >)? (self) -> Result< $type<Self::__ContainerType, $( $($generic),+ )? >, RosenpassError>;
+        }
+
+        impl<'a> [< $type Ext >] for &'a [u8] {
+            type __ContainerType = &'a [u8];
+
+            fn [< $type:snake >] $(< $($generic : LenseView),* >)? (self) -> Result< $type<Self::__ContainerType, $( $($generic),+ )? >, RosenpassError> {
+                $type::<Self::__ContainerType, $( $($generic),+ )? >::check_size(self.len())?;
+                Ok($type ( self, $( $( ::core::marker::PhantomData::<$generic>  ),+ )? ))
+            }
+
+            fn [< $type:snake _ truncating >] $(< $($generic : LenseView),* >)? (self) -> Result< $type<Self::__ContainerType, $( $($generic),+ )? >, RosenpassError> {
+                let required_size = $( $len + )+ 0;
+                let actual_size = self.len();
+                if actual_size < required_size {
+                    return Err(RosenpassError::BufferSizeMismatch {
+                        required_size,
+                        actual_size,
+                    });
+                }
+
+                [< $type Ext >]::[< $type:snake >](&self[..required_size])
+            }
+        }
+
+        impl<'a> [< $type Ext >] for &'a mut [u8] {
+            type __ContainerType = &'a mut [u8];
+            fn [< $type:snake >] $(< $($generic : LenseView),* >)? (self) -> Result< $type<Self::__ContainerType, $( $($generic),+ )? >, RosenpassError> {
+                $type::<Self::__ContainerType, $( $($generic),+ )? >::check_size(self.len())?;
+                Ok($type ( self, $( $( ::core::marker::PhantomData::<$generic>  ),+ )? ))
+            }
+
+            fn [< $type:snake _ truncating >] $(< $($generic : LenseView),* >)? (self) -> Result< $type<Self::__ContainerType, $( $($generic),+ )? >, RosenpassError> {
+                let required_size = $( $len + )+ 0;
+                let actual_size = self.len();
+                if actual_size < required_size {
+                    return Err(RosenpassError::BufferSizeMismatch {
+                        required_size,
+                        actual_size,
+                    });
+                }
+
+                [< $type Ext >]::[< $type:snake >](&mut self[..required_size])
+            }
+        }
+    });
+);
+
+/// Common trait shared by all Lenses
+pub trait LenseView {
+    const LEN: usize;
+}
+
+data_lense! { Envelope<M> :=
     /// [MsgType] of this message
     msg_type: 1,
     /// Reserved for future use
@@ -61,40 +268,40 @@ lense! { Envelope<M> :=
     payload: M::LEN,
     /// Message Authentication Code (mac) over all bytes until (exclusive)
     /// `mac` itself
-    mac: 16,
-    /// Currently unused, TODO: do something with this
-    cookie: 16
+    mac: MAC_SIZE,
+    /// Cookie value
+    cookie: COOKIE_SIZE
 }
 
-lense! { InitHello :=
+data_lense! { InitHello :=
     /// Randomly generated connection id
     sidi: 4,
     /// Kyber 512 Ephemeral Public Key
-    epki: EphemeralKem::PK_LEN,
+    epki: EphemeralKEM::PK_LEN,
     /// Classic McEliece Ciphertext
-    sctr: StaticKem::CT_LEN,
+    sctr: StaticKEM::CT_LEN,
     /// Encryped: 16 byte hash of McEliece initiator static key
     pidic: aead::TAG_LEN + 32,
     /// Encrypted TAI64N Time Stamp (against replay attacks)
     auth: aead::TAG_LEN
 }
 
-lense! { RespHello :=
+data_lense! { RespHello :=
     /// Randomly generated connection id
     sidr: 4,
     /// Copied from InitHello
     sidi: 4,
     /// Kyber 512 Ephemeral Ciphertext
-    ecti: EphemeralKem::CT_LEN,
+    ecti: EphemeralKEM::CT_LEN,
     /// Classic McEliece Ciphertext
-    scti: StaticKem::CT_LEN,
+    scti: StaticKEM::CT_LEN,
     /// Empty encrypted message (just an auth tag)
     auth: aead::TAG_LEN,
     /// Responders handshake state in encrypted form
     biscuit: BISCUIT_CT_LEN
 }
 
-lense! { InitConf :=
+data_lense! { InitConf :=
     /// Copied from InitHello
     sidi: 4,
     /// Copied from RespHello
@@ -105,7 +312,7 @@ lense! { InitConf :=
     auth: aead::TAG_LEN
 }
 
-lense! { EmptyData :=
+data_lense! { EmptyData :=
     /// Copied from RespHello
     sid: 4,
     /// Nonce
@@ -114,21 +321,23 @@ lense! { EmptyData :=
     auth: aead::TAG_LEN
 }
 
-lense! { Biscuit :=
+data_lense! { Biscuit :=
     /// H(spki) – Ident ifies the initiator
-    pidi: KEY_LEN,
+    pidi: aead::KEY_LEN,
     /// The biscuit number (replay protection)
     biscuit_no: 12,
     /// Chaining key
-    ck: KEY_LEN
+    ck: aead::KEY_LEN
 }
 
-lense! { DataMsg :=
+data_lense! { DataMsg :=
     dummy: 4
 }
 
-lense! { CookieReply :=
-    dummy: 4
+data_lense! { CookieReply :=
+    sid: 4,
+    nonce: xaead::NONCE_LEN,
+    cookie_encrypted: MAC_SIZE + xaead::TAG_LEN
 }
 
 // Traits /////////////////////////////////////////////////////////////////////

rosenpass/src/pqkem.rs

@@ -0,0 +1,168 @@
+//! Traits and implementations for Key Encapsulation Mechanisms (KEMs)
+//!
+//! KEMs are the interface provided by almost all post-quantum
+//! secure key exchange mechanisms.
+//!
+//! Conceptually KEMs are akin to public-key encryption, but instead of encrypting
+//! arbitrary data, KEMs are limited to the transmission of keys, randomly chosen during
+//!
+//! encapsulation.
+//! The [KEM] Trait describes the basic API offered by a Key Encapsulation
+//! Mechanism. Two implementations for it are provided, [StaticKEM] and [EphemeralKEM].
+
+use crate::{RosenpassError, RosenpassMaybeError};
+
+/// Key Encapsulation Mechanism
+///
+/// The KEM interface defines three operations: Key generation, key encapsulation and key
+/// decapsulation.
+pub trait KEM {
+    /// Secrete Key length
+    const SK_LEN: usize;
+    /// Public Key length
+    const PK_LEN: usize;
+    /// Ciphertext length
+    const CT_LEN: usize;
+    /// Shared Secret length
+    const SHK_LEN: usize;
+
+    /// Generate a keypair consisting of secret key (`sk`) and public key (`pk`)
+    ///
+    /// `keygen() -> sk, pk`
+    fn keygen(sk: &mut [u8], pk: &mut [u8]) -> Result<(), RosenpassError>;
+
+    /// From a public key (`pk`), generate a shared key (`shk`, for local use)
+    /// and a cipher text (`ct`, to be sent to the owner of the `pk`).
+    ///
+    /// `encaps(pk) -> shk, ct`
+    fn encaps(shk: &mut [u8], ct: &mut [u8], pk: &[u8]) -> Result<(), RosenpassError>;
+
+    /// From a secret key (`sk`) and a cipher text (`ct`) derive a shared key
+    /// (`shk`)
+    ///
+    /// `decaps(sk, ct) -> shk`
+    fn decaps(shk: &mut [u8], sk: &[u8], ct: &[u8]) -> Result<(), RosenpassError>;
+}
+
+/// A KEM that is secure against Chosen Ciphertext Attacks (CCA).
+/// In the context of rosenpass this is used for static keys.
+/// Uses [Classic McEliece](https://classic.mceliece.org/) 460896 from liboqs.
+///
+/// Classic McEliece is chosen because of its high security margin and its small
+/// ciphertexts. The public keys are humongous, but (being static keys) the are never transmitted over
+/// the wire so this is not a big problem.
+pub struct StaticKEM;
+
+/// # Safety
+///
+/// This Trait impl calls unsafe [oqs_sys] functions, that write to byte
+/// slices only identified using raw pointers. It must be ensured that the raw
+/// pointers point into byte slices of sufficient length, to avoid UB through
+/// overwriting of arbitrary data. This is checked in the following code before
+/// the unsafe calls, and an early return with an Err occurs if the byte slice
+/// size does not match the required size.
+///
+/// __Note__: This requirement is stricter than necessary, it would suffice
+/// to only check that the buffers are big enough, allowing them to be even
+/// bigger. However, from a correctness point of view it does not make sense to
+/// allow bigger buffers.
+impl KEM for StaticKEM {
+    const SK_LEN: usize = oqs_sys::kem::OQS_KEM_classic_mceliece_460896_length_secret_key as usize;
+    const PK_LEN: usize = oqs_sys::kem::OQS_KEM_classic_mceliece_460896_length_public_key as usize;
+    const CT_LEN: usize = oqs_sys::kem::OQS_KEM_classic_mceliece_460896_length_ciphertext as usize;
+    const SHK_LEN: usize =
+        oqs_sys::kem::OQS_KEM_classic_mceliece_460896_length_shared_secret as usize;
+
+    fn keygen(sk: &mut [u8], pk: &mut [u8]) -> Result<(), RosenpassError> {
+        RosenpassError::check_buffer_size(sk.len(), Self::SK_LEN)?;
+        RosenpassError::check_buffer_size(pk.len(), Self::PK_LEN)?;
+        unsafe {
+            oqs_sys::kem::OQS_KEM_classic_mceliece_460896_keypair(pk.as_mut_ptr(), sk.as_mut_ptr())
+                .to_rg_error()
+        }
+    }
+
+    fn encaps(shk: &mut [u8], ct: &mut [u8], pk: &[u8]) -> Result<(), RosenpassError> {
+        RosenpassError::check_buffer_size(shk.len(), Self::SHK_LEN)?;
+        RosenpassError::check_buffer_size(ct.len(), Self::CT_LEN)?;
+        RosenpassError::check_buffer_size(pk.len(), Self::PK_LEN)?;
+        unsafe {
+            oqs_sys::kem::OQS_KEM_classic_mceliece_460896_encaps(
+                ct.as_mut_ptr(),
+                shk.as_mut_ptr(),
+                pk.as_ptr(),
+            )
+            .to_rg_error()
+        }
+    }
+
+    fn decaps(shk: &mut [u8], sk: &[u8], ct: &[u8]) -> Result<(), RosenpassError> {
+        RosenpassError::check_buffer_size(shk.len(), Self::SHK_LEN)?;
+        RosenpassError::check_buffer_size(sk.len(), Self::SK_LEN)?;
+        RosenpassError::check_buffer_size(ct.len(), Self::CT_LEN)?;
+        unsafe {
+            oqs_sys::kem::OQS_KEM_classic_mceliece_460896_decaps(
+                shk.as_mut_ptr(),
+                ct.as_ptr(),
+                sk.as_ptr(),
+            )
+            .to_rg_error()
+        }
+    }
+}
+
+/// Implements a KEM that is secure against Chosen Plaintext Attacks (CPA).
+/// In the context of rosenpass this is used for ephemeral keys.
+/// Currently the implementation uses
+/// [Kyber 512](https://openquantumsafe.org/liboqs/algorithms/kem/kyber) from liboqs.
+///
+/// This is being used for ephemeral keys; since these are use-once the first post quantum
+/// wireguard paper claimed that CPA security would be sufficient. Nonetheless we choose kyber
+/// which provides CCA security since there are no publicly vetted KEMs out there which provide
+/// only CPA security.
+pub struct EphemeralKEM;
+
+/// # Safety
+///
+/// This Trait impl calls unsafe [oqs_sys] functions, that write to byte
+/// slices only identified using raw pointers. It must be ensured that the raw
+/// pointers point into byte slices of sufficient length, to avoid UB through
+/// overwriting of arbitrary data. This is checked in the following code before
+/// the unsafe calls, and an early return with an Err occurs if the byte slice
+/// size does not match the required size.
+///
+/// __Note__: This requirement is stricter than necessary, it would suffice
+/// to only check that the buffers are big enough, allowing them to be even
+/// bigger. However, from a correctness point of view it does not make sense to
+/// allow bigger buffers.
+impl KEM for EphemeralKEM {
+    const SK_LEN: usize = oqs_sys::kem::OQS_KEM_kyber_512_length_secret_key as usize;
+    const PK_LEN: usize = oqs_sys::kem::OQS_KEM_kyber_512_length_public_key as usize;
+    const CT_LEN: usize = oqs_sys::kem::OQS_KEM_kyber_512_length_ciphertext as usize;
+    const SHK_LEN: usize = oqs_sys::kem::OQS_KEM_kyber_512_length_shared_secret as usize;
+    fn keygen(sk: &mut [u8], pk: &mut [u8]) -> Result<(), RosenpassError> {
+        RosenpassError::check_buffer_size(sk.len(), Self::SK_LEN)?;
+        RosenpassError::check_buffer_size(pk.len(), Self::PK_LEN)?;
+        unsafe {
+            oqs_sys::kem::OQS_KEM_kyber_512_keypair(pk.as_mut_ptr(), sk.as_mut_ptr()).to_rg_error()
+        }
+    }
+    fn encaps(shk: &mut [u8], ct: &mut [u8], pk: &[u8]) -> Result<(), RosenpassError> {
+        RosenpassError::check_buffer_size(shk.len(), Self::SHK_LEN)?;
+        RosenpassError::check_buffer_size(ct.len(), Self::CT_LEN)?;
+        RosenpassError::check_buffer_size(pk.len(), Self::PK_LEN)?;
+        unsafe {
+            oqs_sys::kem::OQS_KEM_kyber_512_encaps(ct.as_mut_ptr(), shk.as_mut_ptr(), pk.as_ptr())
+                .to_rg_error()
+        }
+    }
+    fn decaps(shk: &mut [u8], sk: &[u8], ct: &[u8]) -> Result<(), RosenpassError> {
+        RosenpassError::check_buffer_size(shk.len(), Self::SHK_LEN)?;
+        RosenpassError::check_buffer_size(sk.len(), Self::SK_LEN)?;
+        RosenpassError::check_buffer_size(ct.len(), Self::CT_LEN)?;
+        unsafe {
+            oqs_sys::kem::OQS_KEM_kyber_512_decaps(shk.as_mut_ptr(), ct.as_ptr(), sk.as_ptr())
+                .to_rg_error()
+        }
+    }
+}

rosenpass/src/prftree.rs

@@ -0,0 +1,106 @@
+//! Implementation of the tree-like structure used for the label derivation in [labeled_prf](crate::labeled_prf)
+use crate::coloring::Secret;
+
+use anyhow::Result;
+use rosenpass_ciphers::{hash, KEY_LEN};
+use rosenpass_to::To;
+
+// TODO Use a proper Dec interface
+#[derive(Clone, Debug)]
+pub struct PrfTree([u8; KEY_LEN]);
+#[derive(Clone, Debug)]
+pub struct PrfTreeBranch([u8; KEY_LEN]);
+#[derive(Clone, Debug)]
+pub struct SecretPrfTree(Secret<KEY_LEN>);
+#[derive(Clone, Debug)]
+pub struct SecretPrfTreeBranch(Secret<KEY_LEN>);
+
+impl PrfTree {
+    pub fn zero() -> Self {
+        Self([0u8; KEY_LEN])
+    }
+
+    pub fn dup(self) -> PrfTreeBranch {
+        PrfTreeBranch(self.0)
+    }
+
+    pub fn into_secret_prf_tree(self) -> SecretPrfTree {
+        SecretPrfTree(Secret::from_slice(&self.0))
+    }
+
+    // TODO: Protocol! Use domain separation to ensure that
+    pub fn mix(self, v: &[u8]) -> Result<Self> {
+        Ok(Self(hash::hash(&self.0, v).collect::<[u8; KEY_LEN]>()?))
+    }
+
+    pub fn mix_secret<const N: usize>(self, v: Secret<N>) -> Result<SecretPrfTree> {
+        SecretPrfTree::prf_invoc(&self.0, v.secret())
+    }
+
+    pub fn into_value(self) -> [u8; KEY_LEN] {
+        self.0
+    }
+}
+
+impl PrfTreeBranch {
+    pub fn mix(&self, v: &[u8]) -> Result<PrfTree> {
+        Ok(PrfTree(hash::hash(&self.0, v).collect::<[u8; KEY_LEN]>()?))
+    }
+
+    pub fn mix_secret<const N: usize>(&self, v: Secret<N>) -> Result<SecretPrfTree> {
+        SecretPrfTree::prf_invoc(&self.0, v.secret())
+    }
+}
+
+impl SecretPrfTree {
+    pub fn prf_invoc(k: &[u8], d: &[u8]) -> Result<SecretPrfTree> {
+        let mut r = SecretPrfTree(Secret::zero());
+        hash::hash(k, d).to(r.0.secret_mut())?;
+        Ok(r)
+    }
+
+    pub fn zero() -> Self {
+        Self(Secret::zero())
+    }
+
+    pub fn dup(self) -> SecretPrfTreeBranch {
+        SecretPrfTreeBranch(self.0)
+    }
+
+    pub fn danger_from_secret(k: Secret<KEY_LEN>) -> Self {
+        Self(k)
+    }
+
+    pub fn mix(self, v: &[u8]) -> Result<SecretPrfTree> {
+        Self::prf_invoc(self.0.secret(), v)
+    }
+
+    pub fn mix_secret<const N: usize>(self, v: Secret<N>) -> Result<SecretPrfTree> {
+        Self::prf_invoc(self.0.secret(), v.secret())
+    }
+
+    pub fn into_secret(self) -> Secret<KEY_LEN> {
+        self.0
+    }
+
+    pub fn into_secret_slice(mut self, v: &[u8], dst: &[u8]) -> Result<()> {
+        hash::hash(v, dst).to(self.0.secret_mut())
+    }
+}
+
+impl SecretPrfTreeBranch {
+    pub fn mix(&self, v: &[u8]) -> Result<SecretPrfTree> {
+        SecretPrfTree::prf_invoc(self.0.secret(), v)
+    }
+
+    pub fn mix_secret<const N: usize>(&self, v: Secret<N>) -> Result<SecretPrfTree> {
+        SecretPrfTree::prf_invoc(self.0.secret(), v.secret())
+    }
+
+    // TODO: This entire API is not very nice; we need this for biscuits, but
+    // it might be better to extract a special "biscuit"
+    // labeled subkey and reinitialize the chain with this
+    pub fn danger_into_secret(self) -> Secret<KEY_LEN> {
+        self.0
+    }
+}

rosenpass/src/protocol.rs

@@ -19,20 +19,22 @@
 //! [CryptoServer].
 //!
 //! ```
-//! use rosenpass_cipher_traits::Kem;
-//! use rosenpass_ciphers::kem::StaticKem;
 //! use rosenpass::{
+//!     pqkem::{StaticKEM, KEM},
 //!     protocol::{SSk, SPk, MsgBuf, PeerPtr, CryptoServer, SymKey},
 //! };
 //! # fn main() -> anyhow::Result<()> {
 //!
+//! // always initialize libsodium before anything
+//! rosenpass_sodium::init()?;
+//!
 //! // initialize secret and public key for peer a ...
 //! let (mut peer_a_sk, mut peer_a_pk) = (SSk::zero(), SPk::zero());
-//! StaticKem::keygen(peer_a_sk.secret_mut(), peer_a_pk.secret_mut())?;
+//! StaticKEM::keygen(peer_a_sk.secret_mut(), peer_a_pk.secret_mut())?;
 //!
 //! // ... and for peer b
 //! let (mut peer_b_sk, mut peer_b_pk) = (SSk::zero(), SPk::zero());
-//! StaticKem::keygen(peer_b_sk.secret_mut(), peer_b_pk.secret_mut())?;
+//! StaticKEM::keygen(peer_b_sk.secret_mut(), peer_b_pk.secret_mut())?;
 //!
 //! // initialize server and a pre-shared key
 //! let psk = SymKey::random();
@@ -65,24 +67,21 @@
 //! # }
 //! ```
 
+use crate::{
+    coloring::*,
+    labeled_prf::{self as lprf},
+    msgs::*,
+    pqkem::*,
+    prftree::{SecretPrfTree, SecretPrfTreeBranch},
+};
+use anyhow::{bail, ensure, Context, Result};
+use rosenpass_ciphers::{aead, xaead, KEY_LEN};
+use rosenpass_util::{cat, mem::cpy_min, ord::max_usize, time::Timebase};
 use std::collections::hash_map::{
     Entry::{Occupied, Vacant},
     HashMap,
 };
-use std::convert::Infallible;
-
-use anyhow::{bail, ensure, Context, Result};
-
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::hash_domain::{SecretHashDomain, SecretHashDomainNamespace};
-use rosenpass_ciphers::kem::{EphemeralKem, StaticKem};
-use rosenpass_ciphers::{aead, xaead, KEY_LEN};
-use rosenpass_constant_time as constant_time;
-use rosenpass_lenses::LenseView;
-use rosenpass_secret_memory::{Public, Secret};
-use rosenpass_util::{cat, mem::cpy_min, ord::max_usize, time::Timebase};
-
-use crate::{hash_domains, msgs::*};
+use std::net::{IpAddr, SocketAddr};
 
 // CONSTANTS & SETTINGS //////////////////////////
 
@@ -111,6 +110,16 @@ pub const REKEY_AFTER_TIME_RESPONDER: Timing = 120.0;
 pub const REKEY_AFTER_TIME_INITIATOR: Timing = 130.0;
 pub const REJECT_AFTER_TIME: Timing = 180.0;
 
+// From the wireguard paper; "under no circumstances send an initiation message more than once every 5 seconds"
+pub const REKEY_TIMEOUT: Timing = 5.0;
+
+// Cookie Secret value Rm composing `cookie_tau` in the whitepaper
+pub const COOKIE_SECRET_LEN: usize = MAC_SIZE;
+pub const COOKIE_SECRET_EXP: Timing = 120.0;
+
+// Peer Cookie Tau expiration
+pub const PEER_COOKIE_TAU_EXP: Timing = 120.0;
+
 // Seconds until the biscuit key is changed; we issue biscuits
 // using one biscuit key for one epoch and store the biscuit for
 // decryption for a second epoch
@@ -141,10 +150,10 @@ pub fn has_happened(ev: Timing, now: Timing) -> bool {
 
 // DATA STRUCTURES & BASIC TRAITS & ACCESSORS ////
 
-pub type SPk = Secret<{ StaticKem::PK_LEN }>; // Just Secret<> instead of Public<> so it gets allocated on the heap
-pub type SSk = Secret<{ StaticKem::SK_LEN }>;
-pub type EPk = Public<{ EphemeralKem::PK_LEN }>;
-pub type ESk = Secret<{ EphemeralKem::SK_LEN }>;
+pub type SPk = Secret<{ StaticKEM::PK_LEN }>; // Just Secret<> instead of Public<> so it gets allocated on the heap
+pub type SSk = Secret<{ StaticKEM::SK_LEN }>;
+pub type EPk = Public<{ EphemeralKEM::PK_LEN }>;
+pub type ESk = Secret<{ EphemeralKEM::SK_LEN }>;
 
 pub type SymKey = Secret<KEY_LEN>;
 pub type SymHash = Public<KEY_LEN>;
@@ -186,6 +195,89 @@ pub struct CryptoServer {
 
     // Tick handling
     pub peer_poll_off: usize,
+
+    // Random state which changes every COOKIE_SECRET_EXP seconds
+    pub cookie_secret: CookieSecret,
+}
+
+#[derive(Debug)]
+pub enum CookieSecret {
+    Some {
+        value: [u8; COOKIE_SECRET_LEN],
+        last_updated: Timebase,
+    },
+    None,
+}
+
+impl CookieSecret {
+    pub fn new(value: [u8; COOKIE_SECRET_LEN]) -> Self {
+        Self::Some {
+            value,
+            last_updated: Timebase::default(),
+        }
+    }
+
+    // Get the cookie secret, does not update the value
+    pub fn get(&self, expiry: Timing) -> Option<&[u8]> {
+        if let CookieSecret::Some {
+            value: _value,
+            last_updated,
+        } = self
+        {
+            if last_updated.now() > expiry {
+                return None;
+            }
+        }
+
+        match self {
+            CookieSecret::Some { value, .. } => Some(value),
+            CookieSecret::None => None,
+        }
+    }
+
+    // Get the cookie secret or update the value if it has expired and return the updated value
+    pub fn get_or_update_ellapsed<F: Fn(&mut [u8])>(
+        &mut self,
+        expiry: Timing,
+        update_fn: F,
+    ) -> &[u8] {
+        if let CookieSecret::Some {
+            value,
+            last_updated,
+        } = self
+        {
+            if last_updated.now() > expiry {
+                update_fn(value);
+                *last_updated = Timebase::default();
+            }
+            value
+        } else {
+            *self = CookieSecret::Some {
+                value: [0; COOKIE_SECRET_LEN],
+                last_updated: Timebase::default(),
+            };
+            let value = match self {
+                CookieSecret::Some {
+                    value,
+                    last_updated: _,
+                } => value,
+                CookieSecret::None => unreachable!(),
+            };
+            update_fn(value);
+            value
+        }
+    }
+
+    pub fn is_some(&self) -> bool {
+        match self {
+            CookieSecret::Some { .. } => true,
+            CookieSecret::None => false,
+        }
+    }
+
+    pub fn is_none(&self) -> bool {
+        !self.is_some()
+    }
 }
 
 /// A Biscuit is like a fancy cookie. To avoid state disruption attacks,
@@ -213,6 +305,8 @@ pub struct Peer {
     pub session: Option<Session>,
     pub handshake: Option<InitiatorHandshake>,
     pub initiation_requested: bool,
+    pub cookie_tau: CookieSecret,
+    pub last_sent_mac: Option<Public<MAC_SIZE>>,
 }
 
 impl Peer {
@@ -224,6 +318,8 @@ impl Peer {
             session: None,
             initiation_requested: false,
             handshake: None,
+            cookie_tau: CookieSecret::None,
+            last_sent_mac: None,
         }
     }
 }
@@ -235,7 +331,7 @@ pub struct HandshakeState {
     /// Session ID of Responder
     pub sidr: SessionId,
     /// Chaining Key
-    pub ck: SecretHashDomainNamespace, // TODO: We should probably add an abstr
+    pub ck: SecretPrfTreeBranch,
 }
 
 #[derive(Hash, PartialEq, Eq, PartialOrd, Ord, Debug, Copy, Clone)]
@@ -287,7 +383,7 @@ pub struct Session {
     pub sidt: SessionId,
     pub handshake_role: HandshakeRole,
     // Crypto
-    pub ck: SecretHashDomainNamespace,
+    pub ck: SecretPrfTreeBranch,
     /// Key for Transmission ("transmission key mine")
     pub txkm: SymKey,
     /// Key for Reception ("transmission key theirs")
@@ -451,6 +547,7 @@ impl CryptoServer {
             peers: Vec::new(),
             index: HashMap::new(),
             peer_poll_off: 0,
+            cookie_secret: CookieSecret::None,
         }
     }
 
@@ -462,7 +559,7 @@ impl CryptoServer {
     #[rustfmt::skip]
     pub fn pidm(&self) -> Result<PeerId> {
         Ok(Public::new(
-            hash_domains::peerid()?
+            lprf::peerid()?
                 .mix(self.spkm.secret())?
                 .into_value()))
     }
@@ -484,6 +581,8 @@ impl CryptoServer {
             session: None,
             handshake: None,
             initiation_requested: false,
+            cookie_tau: CookieSecret::None,
+            last_sent_mac: None,
         };
         let peerid = peer.pidt()?;
         let peerno = self.peers.len();
@@ -586,13 +685,15 @@ impl Peer {
             session: None,
             handshake: None,
             initiation_requested: false,
+            cookie_tau: CookieSecret::None,
+            last_sent_mac: None,
         }
     }
 
     #[rustfmt::skip]
     pub fn pidt(&self) -> Result<PeerId> {
         Ok(Public::new(
-            hash_domains::peerid()?
+            lprf::peerid()?
                 .mix(self.spkt.secret())?
                 .into_value()))
     }
@@ -605,7 +706,7 @@ impl Session {
             sidm: SessionId::zero(),
             sidt: SessionId::zero(),
             handshake_role: HandshakeRole::Initiator,
-            ck: SecretHashDomain::zero().dup(),
+            ck: SecretPrfTree::zero().dup(),
             txkm: SymKey::zero(),
             txkt: SymKey::zero(),
             txnm: 0,
@@ -755,7 +856,122 @@ pub struct HandleMsgResult {
 }
 
 impl CryptoServer {
-    /// Respond to an incoming message
+    /// Process a message under load
+    /// This is one of the main entry point for the protocol.
+    /// Keeps track of messages processed, and qualifies messages using
+    /// cookie based DoS mitigation. Dispatches message for further processing
+    /// to `process_msg` handler if cookie is valid, otherwise sends a cookie reply
+    /// message for sender to process and verify for messages part of the handshake phase
+    /// (i.e. InitHello, InitConf messages only). Bails on messages sent by responder and
+    /// non-handshake messages.
+    pub fn handle_msg_under_load(
+        &mut self,
+        rx_buf: &[u8],
+        tx_buf: &mut [u8],
+        peer: PeerPtr,
+        socket_addr: SocketAddr,
+    ) -> Result<HandleMsgResult> {
+        //Check cookie value
+        let mut ip_addr_port = match socket_addr.ip() {
+            IpAddr::V4(ipv4) => ipv4.octets().to_vec(),
+            IpAddr::V6(ipv6) => ipv6.octets().to_vec(),
+        };
+
+        ip_addr_port.extend_from_slice(&socket_addr.port().to_be_bytes());
+
+        let (rx_bytes_til_cookie, rx_cookie, rx_mac, rx_sid) = match rx_buf[0].try_into() {
+            Ok(MsgType::InitHello) => {
+                let msg_in = rx_buf.envelope::<InitHello<&[u8]>>()?;
+                (
+                    msg_in.until_cookie().to_vec(),
+                    msg_in.cookie().to_vec(),
+                    msg_in.mac().to_vec(),
+                    msg_in.payload().init_hello()?.sidi().to_vec(),
+                )
+            }
+            Ok(MsgType::InitConf) => {
+                let msg_in = rx_buf.envelope::<InitConf<&[u8]>>()?;
+                (
+                    msg_in.until_cookie().to_vec(),
+                    msg_in.cookie().to_vec(),
+                    msg_in.mac().to_vec(),
+                    msg_in.payload().init_conf()?.sidi().to_vec(),
+                )
+            }
+            Ok(_) => {
+                bail!("Message did not contain cookie or could not be sent a cookie reply message (responder sent-message or non-handshake)")
+            }
+            Err(_) => {
+                bail!("Message type not supported")
+            }
+        };
+
+        let cookie_tau = lprf::cookie_tau()?
+            .mix(self.cookie_secret.get_or_update_ellapsed(
+                COOKIE_SECRET_EXP,
+                rosenpass_sodium::helpers::randombytes_buf,
+            ))?
+            .mix(&ip_addr_port)?
+            .into_value()[..16]
+            .to_vec();
+
+        let expected = lprf::cookie()?
+            .mix(&cookie_tau)?
+            .mix(&rx_bytes_til_cookie)?
+            .into_value()[..16]
+            .to_vec();
+
+        //If valid cookie is found, process message
+        if rosenpass_sodium::helpers::memcmp(&rx_cookie, &expected) {
+            let result = self.handle_msg(rx_buf, tx_buf)?;
+            Ok(result)
+        }
+        //Otherwise send cookie reply
+        else {
+            let mut msg_out = tx_buf.envelope_truncating::<CookieReply<&mut [u8]>>()?;
+            let cookie_key = lprf::cookie_key()?.mix(self.spkm.secret())?.into_value();
+
+            let mut cookie_reply_lens = msg_out.payload_mut().cookie_reply()?;
+            let nonce_val = XAEADNonce::random();
+
+            // Copy sender's session id to cookie reply message
+            {
+                let sid = cookie_reply_lens.sid_mut();
+                sid.copy_from_slice(&rx_sid[..]);
+            }
+
+            // Generate random nonce, copy it to message and nonce_val
+            {
+                let nonce = cookie_reply_lens.nonce_mut();
+                nonce.copy_from_slice(&nonce_val.value);
+            }
+
+            // Encrypt cookie
+            {
+                const COOKIE_LENS_SID_LEN: usize = 4;
+                let cookie_ciphertext =
+                    &mut cookie_reply_lens.all_bytes_mut()[COOKIE_LENS_SID_LEN..];
+                xaead::encrypt(
+                    cookie_ciphertext,
+                    &cookie_key,
+                    &nonce_val.value,
+                    &rx_mac,
+                    &cookie_tau,
+                )?;
+            }
+
+            // length of the response
+            let len = Some(self.seal_and_commit_msg(peer, MsgType::CookieReply, msg_out)?);
+
+            Ok(HandleMsgResult {
+                exchanged_with: None,
+                resp: len,
+            })
+        }
+    }
+
+    /// Handle an incoming message
+    /// This is one of the main entry point for the protocol.
     ///
     /// # Overview
     ///
@@ -839,7 +1055,14 @@ impl CryptoServer {
                 self.handle_resp_conf(msg_in.payload().empty_data()?)?
             }
             Ok(MsgType::DataMsg) => bail!("DataMsg handling not implemented!"),
-            Ok(MsgType::CookieReply) => bail!("CookieReply handling not implemented!"),
+            Ok(MsgType::CookieReply) => {
+                let msg_in = rx_buf.envelope::<CookieReply<&[u8]>>()?;
+                ensure!(msg_in.check_seal(self)?, seal_broken);
+
+                let peer = self.handle_cookie_reply(msg_in.payload().cookie_reply()?)?;
+                len = 0;
+                peer
+            }
             Err(_) => {
                 bail!("CookieReply handling not implemented!")
             }
@@ -852,7 +1075,8 @@ impl CryptoServer {
     }
 
     /// Serialize message to `tx_buf`, generating the `mac` in the process of
-    /// doing so
+    /// doing so. If `cookie_secret` is also present, a `cookie` value is also generated
+    /// and added to the message
     ///
     /// The message type is explicitly required here because it is very easy to
     /// forget setting that, which creates subtle but far ranging errors.
@@ -864,6 +1088,15 @@ impl CryptoServer {
     ) -> Result<usize> {
         msg.msg_type_mut()[0] = msg_type as u8;
         msg.seal(peer, self)?;
+        msg.seal_cookie(peer, self)?;
+
+        //Store sent mac value as last sent mac (for cookie reply)
+        let mut mac = [0u8; MAC_SIZE];
+        mac.copy_from_slice(msg.mac());
+
+        peer.get_mut(self)
+            .last_sent_mac
+            .replace(Public { value: mac });
         Ok(<Envelope<(), M> as LenseView>::LEN)
     }
 }
@@ -1133,12 +1366,22 @@ impl IniHsPtr {
     }
 
     pub fn apply_retransmission(&self, srv: &mut CryptoServer, tx_buf: &mut [u8]) -> Result<usize> {
-        let ih = self
-            .get_mut(srv)
-            .as_mut()
-            .with_context(|| format!("No current handshake for peer {:?}", self.peer()))?;
-        cpy_min(&ih.tx_buf[..ih.tx_len], tx_buf);
-        Ok(ih.tx_len)
+        let ih_tx_len: usize;
+
+        {
+            let ih = self
+                .get_mut(srv)
+                .as_mut()
+                .with_context(|| format!("No current handshake for peer {:?}", self.peer()))?;
+            cpy_min(&ih.tx_buf[..ih.tx_len], tx_buf);
+            ih_tx_len = ih.tx_len;
+        }
+
+        // Add cookie to retransmitted message
+        let mut envelope = tx_buf.envelope_truncating::<InitHello<&mut [u8]>>()?;
+        envelope.seal_cookie(self.peer(), srv)?;
+
+        Ok(ih_tx_len)
     }
 
     pub fn register_retransmission(&self, srv: &mut CryptoServer) -> Result<()> {
@@ -1156,7 +1399,7 @@ impl IniHsPtr {
                         .min(ih.tx_count as f64),
                 )
                 * RETRANSMIT_DELAY_JITTER
-                * (rand::random::<f64>() + 1.0); // TODO: Replace with the rand crate
+                * (rosenpass_sodium::helpers::rand_f64() + 1.0); // TODO: Replace with the rand crate
         ih.tx_count += 1;
         Ok(())
     }
@@ -1176,13 +1419,23 @@ where
 {
     /// Calculate the message authentication code (`mac`)
     pub fn seal(&mut self, peer: PeerPtr, srv: &CryptoServer) -> Result<()> {
-        let mac = hash_domains::mac()?
+        let mac = lprf::mac()?
             .mix(peer.get(srv).spkt.secret())?
             .mix(self.until_mac())?;
         self.mac_mut()
             .copy_from_slice(mac.into_value()[..16].as_ref());
         Ok(())
     }
+
+    /// Calculate and append the cookie value if `cookie_tau` exists (`cookie`)
+    pub fn seal_cookie(&mut self, peer: PeerPtr, srv: &CryptoServer) -> Result<()> {
+        if let Some(cookie_tau) = peer.get(srv).cookie_tau.get(PEER_COOKIE_TAU_EXP) {
+            let cookie = lprf::cookie()?.mix(cookie_tau)?.mix(self.until_cookie())?;
+            self.cookie_mut()
+                .copy_from_slice(cookie.into_value()[..16].as_ref());
+        }
+        Ok(())
+    }
 }
 
 impl<M> Envelope<&[u8], M>
@@ -1191,10 +1444,8 @@ where
 {
     /// Check the message authentication code
     pub fn check_seal(&self, srv: &CryptoServer) -> Result<bool> {
-        let expected = hash_domains::mac()?
-            .mix(srv.spkm.secret())?
-            .mix(self.until_mac())?;
-        Ok(constant_time::memcmp(
+        let expected = lprf::mac()?.mix(srv.spkm.secret())?.mix(self.until_mac())?;
+        Ok(rosenpass_sodium::helpers::memcmp(
             self.mac(),
             &expected.into_value()[..16],
         ))
@@ -1223,38 +1474,38 @@ impl HandshakeState {
         Self {
             sidi: SessionId::zero(),
             sidr: SessionId::zero(),
-            ck: SecretHashDomain::zero().dup(),
+            ck: SecretPrfTree::zero().dup(),
         }
     }
 
     pub fn erase(&mut self) {
-        self.ck = SecretHashDomain::zero().dup();
+        self.ck = SecretPrfTree::zero().dup();
     }
 
     pub fn init(&mut self, spkr: &[u8]) -> Result<&mut Self> {
-        self.ck = hash_domains::ckinit()?.turn_secret().mix(spkr)?.dup();
+        self.ck = lprf::ckinit()?.mix(spkr)?.into_secret_prf_tree().dup();
         Ok(self)
     }
 
     pub fn mix(&mut self, a: &[u8]) -> Result<&mut Self> {
-        self.ck = self.ck.mix(&hash_domains::mix()?)?.mix(a)?.dup();
+        self.ck = self.ck.mix(&lprf::mix()?)?.mix(a)?.dup();
         Ok(self)
     }
 
     pub fn encrypt_and_mix(&mut self, ct: &mut [u8], pt: &[u8]) -> Result<&mut Self> {
-        let k = self.ck.mix(&hash_domains::hs_enc()?)?.into_secret();
+        let k = self.ck.mix(&lprf::hs_enc()?)?.into_secret();
         aead::encrypt(ct, k.secret(), &[0u8; aead::NONCE_LEN], &[], pt)?;
         self.mix(ct)
     }
 
     pub fn decrypt_and_mix(&mut self, pt: &mut [u8], ct: &[u8]) -> Result<&mut Self> {
-        let k = self.ck.mix(&hash_domains::hs_enc()?)?.into_secret();
+        let k = self.ck.mix(&lprf::hs_enc()?)?.into_secret();
         aead::decrypt(pt, k.secret(), &[0u8; aead::NONCE_LEN], &[], ct)?;
         self.mix(ct)
     }
 
     // I loathe "error: constant expression depends on a generic parameter"
-    pub fn encaps_and_mix<T: Kem<Error = Infallible>, const SHK_LEN: usize>(
+    pub fn encaps_and_mix<T: KEM, const SHK_LEN: usize>(
         &mut self,
         ct: &mut [u8],
         pk: &[u8],
@@ -1264,7 +1515,7 @@ impl HandshakeState {
         self.mix(pk)?.mix(shk.secret())?.mix(ct)
     }
 
-    pub fn decaps_and_mix<T: Kem<Error = Infallible>, const SHK_LEN: usize>(
+    pub fn decaps_and_mix<T: KEM, const SHK_LEN: usize>(
         &mut self,
         sk: &[u8],
         pk: &[u8],
@@ -1294,14 +1545,14 @@ impl HandshakeState {
             .copy_from_slice(self.ck.clone().danger_into_secret().secret());
 
         // calculate ad contents
-        let ad = hash_domains::biscuit_ad()?
+        let ad = lprf::biscuit_ad()?
             .mix(srv.spkm.secret())?
             .mix(self.sidi.as_slice())?
             .mix(self.sidr.as_slice())?
             .into_value();
 
         // consume biscuit no
-        constant_time::increment(&mut *srv.biscuit_ctr);
+        rosenpass_sodium::helpers::increment(&mut *srv.biscuit_ctr);
 
         // The first bit of the nonce indicates which biscuit key was used
         // TODO: This is premature optimization. Remove!
@@ -1329,7 +1580,7 @@ impl HandshakeState {
         let bk = BiscuitKeyPtr(((biscuit_ct[0] & 0b1000_0000) >> 7) as usize);
 
         // Calculate additional data fields
-        let ad = hash_domains::biscuit_ad()?
+        let ad = lprf::biscuit_ad()?
             .mix(srv.spkm.secret())?
             .mix(sidi.as_slice())?
             .mix(sidr.as_slice())?
@@ -1347,7 +1598,7 @@ impl HandshakeState {
 
         // Reconstruct the biscuit fields
         let no = BiscuitId::from_slice(biscuit.biscuit_no());
-        let ck = SecretHashDomain::danger_from_secret(Secret::from_slice(biscuit.ck())).dup();
+        let ck = SecretPrfTree::danger_from_secret(Secret::from_slice(biscuit.ck())).dup();
         let pid = PeerId::from_slice(biscuit.pidi());
 
         // Reconstruct the handshake state
@@ -1364,7 +1615,8 @@ impl HandshakeState {
         // indicates retransmission
         // TODO: Handle retransmissions without involving the crypto code
         ensure!(
-            constant_time::compare(biscuit.biscuit_no(), &*peer.get(srv).biscuit_used) >= 0,
+            rosenpass_sodium::helpers::compare(biscuit.biscuit_no(), &*peer.get(srv).biscuit_used)
+                >= 0,
             "Rejecting biscuit: Outdated biscuit number"
         );
 
@@ -1373,8 +1625,8 @@ impl HandshakeState {
 
     pub fn enter_live(self, srv: &CryptoServer, role: HandshakeRole) -> Result<Session> {
         let HandshakeState { ck, sidi, sidr } = self;
-        let tki = ck.mix(&hash_domains::ini_enc()?)?.into_secret();
-        let tkr = ck.mix(&hash_domains::res_enc()?)?.into_secret();
+        let tki = ck.mix(&lprf::ini_enc()?)?.into_secret();
+        let tkr = ck.mix(&lprf::res_enc()?)?.into_secret();
         let created_at = srv.timebase.now();
         let (ntx, nrx) = (0, 0);
         let (mysid, peersid, ktx, krx) = match role {
@@ -1405,7 +1657,7 @@ impl CryptoServer {
             .get(self)
             .as_ref()
             .with_context(|| format!("No current session for peer {:?}", peer))?;
-        Ok(session.ck.mix(&hash_domains::osk()?)?.into_secret())
+        Ok(session.ck.mix(&lprf::osk()?)?.into_secret())
     }
 }
 
@@ -1427,7 +1679,7 @@ impl CryptoServer {
         ih.sidi_mut().copy_from_slice(&hs.core.sidi.value);
 
         // IHI3
-        EphemeralKem::keygen(hs.eski.secret_mut(), &mut *hs.epki)?;
+        EphemeralKEM::keygen(hs.eski.secret_mut(), &mut *hs.epki)?;
         ih.epki_mut().copy_from_slice(&hs.epki.value);
 
         // IHI4
@@ -1435,7 +1687,7 @@ impl CryptoServer {
 
         // IHI5
         hs.core
-            .encaps_and_mix::<StaticKem, { StaticKem::SHK_LEN }>(
+            .encaps_and_mix::<StaticKEM, { StaticKEM::SHK_LEN }>(
                 ih.sctr_mut(),
                 peer.get(self).spkt.secret(),
             )?;
@@ -1474,7 +1726,7 @@ impl CryptoServer {
         core.mix(ih.sidi())?.mix(ih.epki())?;
 
         // IHR5
-        core.decaps_and_mix::<StaticKem, { StaticKem::SHK_LEN }>(
+        core.decaps_and_mix::<StaticKEM, { StaticKEM::SHK_LEN }>(
             self.sskm.secret(),
             self.spkm.secret(),
             ih.sctr(),
@@ -1504,10 +1756,10 @@ impl CryptoServer {
         core.mix(rh.sidr())?.mix(rh.sidi())?;
 
         // RHR4
-        core.encaps_and_mix::<EphemeralKem, { EphemeralKem::SHK_LEN }>(rh.ecti_mut(), ih.epki())?;
+        core.encaps_and_mix::<EphemeralKEM, { EphemeralKEM::SHK_LEN }>(rh.ecti_mut(), ih.epki())?;
 
         // RHR5
-        core.encaps_and_mix::<StaticKem, { StaticKem::SHK_LEN }>(
+        core.encaps_and_mix::<StaticKEM, { StaticKEM::SHK_LEN }>(
             rh.scti_mut(),
             peer.get(self).spkt.secret(),
         )?;
@@ -1572,14 +1824,14 @@ impl CryptoServer {
         core.mix(rh.sidr())?.mix(rh.sidi())?;
 
         // RHI4
-        core.decaps_and_mix::<EphemeralKem, { EphemeralKem::SHK_LEN }>(
+        core.decaps_and_mix::<EphemeralKEM, { EphemeralKEM::SHK_LEN }>(
             hs!().eski.secret(),
             &*hs!().epki,
             rh.ecti(),
         )?;
 
         // RHI5
-        core.decaps_and_mix::<StaticKem, { StaticKem::SHK_LEN }>(
+        core.decaps_and_mix::<StaticKEM, { StaticKEM::SHK_LEN }>(
             self.sskm.secret(),
             self.spkm.secret(),
             rh.scti(),
@@ -1641,7 +1893,7 @@ impl CryptoServer {
         core.decrypt_and_mix(&mut [0u8; 0], ic.auth())?;
 
         // ICR5
-        if constant_time::compare(&*biscuit_no, &*peer.get(self).biscuit_used) > 0 {
+        if rosenpass_sodium::helpers::compare(&*biscuit_no, &*peer.get(self).biscuit_used) > 0 {
             // ICR6
             peer.get_mut(self).biscuit_used = biscuit_no;
 
@@ -1735,10 +1987,55 @@ impl CryptoServer {
 
         Ok(hs.peer())
     }
+
+    pub fn handle_cookie_reply(&mut self, cr: CookieReply<&[u8]>) -> Result<PeerPtr> {
+        let session_id = SessionId::from_slice(cr.sid());
+
+        let peer_ptr: Option<PeerPtr> = self
+            .lookup_session(session_id)
+            .map(|v| PeerPtr(v.0))
+            .or_else(|| self.lookup_handshake(session_id).map(|v| PeerPtr(v.0)));
+        if let Some(peer) = peer_ptr {
+            if let Some(mac) = peer.get(self).last_sent_mac {
+                let mut cookie_value = [0u8; COOKIE_SECRET_LEN];
+                let spkt = peer.get(self).spkt.secret();
+                let cookie_key = lprf::cookie_key()?.mix(spkt)?.into_value();
+
+                xaead::decrypt(
+                    &mut cookie_value,
+                    &cookie_key,
+                    &mac.value,
+                    &cr.all_bytes()[4..],
+                )?;
+
+                peer.get_mut(self).cookie_tau = CookieSecret::Some {
+                    value: cookie_value,
+                    last_updated: Timebase::default(),
+                };
+
+                Ok(peer)
+            } else {
+                bail!(
+                    "No last sent message for peer {pidr:?} to decrypt cookie reply.",
+                    pidr = cr.sid()
+                );
+            }
+        } else {
+            let sids: Vec<_> = self
+                .peers
+                .iter()
+                .map(|p| p.session.as_ref().map(|s| s.sidm))
+                .collect();
+            println!("SID: {:?}", sids);
+            bail!("No such peer {pidr:?}.", pidr = cr.sid());
+        }
+    }
 }
 
 #[cfg(test)]
 mod test {
+    use std::{net::SocketAddrV4, thread::sleep, time::Duration};
+
     use super::*;
 
     #[test]
@@ -1757,6 +2054,8 @@ mod test {
     /// Through all this, the handshake should still successfully terminate;
     /// i.e. an exchanged key must be produced in both servers.
     fn handles_incorrect_size_messages() {
+        rosenpass_sodium::init().unwrap();
+
         stacker::grow(8 * 1024 * 1024, || {
             const OVERSIZED_MESSAGE: usize = ((MAX_MESSAGE_LEN as f32) * 1.2) as usize;
             type MsgBufPlus = Public<OVERSIZED_MESSAGE>;
@@ -1768,10 +2067,14 @@ mod test {
 
             // Process the entire handshake
             let mut msglen = Some(me.initiate_handshake(PEER0, &mut *resbuf).unwrap());
-            while let Some(l) = msglen {
-                std::mem::swap(&mut me, &mut they);
-                std::mem::swap(&mut msgbuf, &mut resbuf);
-                msglen = test_incorrect_sizes_for_msg(&mut me, &*msgbuf, l, &mut *resbuf);
+            loop {
+                if let Some(l) = msglen {
+                    std::mem::swap(&mut me, &mut they);
+                    std::mem::swap(&mut msgbuf, &mut resbuf);
+                    msglen = test_incorrect_sizes_for_msg(&mut me, &*msgbuf, l, &mut *resbuf);
+                } else {
+                    break;
+                }
             }
 
             assert_eq!(
@@ -1798,8 +2101,8 @@ mod test {
             }
 
             let res = srv.handle_msg(&msgbuf[..l], resbuf);
-            assert!(res.is_err()); // handle_msg should raise an error
-            assert!(!resbuf.iter().any(|x| *x != 0)); // resbuf should not have been changed
+            assert!(matches!(res, Err(_))); // handle_msg should raise an error
+            assert!(!resbuf.iter().find(|x| **x != 0).is_some()); // resbuf should not have been changed
         }
 
         // Apply the proper handle_msg operation
@@ -1809,7 +2112,7 @@ mod test {
     fn keygen() -> Result<(SSk, SPk)> {
         // TODO: Copied from the benchmark; deduplicate
         let (mut sk, mut pk) = (SSk::zero(), SPk::zero());
-        StaticKem::keygen(sk.secret_mut(), pk.secret_mut())?;
+        StaticKEM::keygen(sk.secret_mut(), pk.secret_mut())?;
         Ok((sk, pk))
     }
 
@@ -1825,4 +2128,129 @@ mod test {
         b.add_peer(Some(psk), pka)?;
         Ok((a, b))
     }
+
+    #[test]
+    fn cookie_reply_mechanism_responder_under_load() {
+        stacker::grow(8 * 1024 * 1024, || {
+            type MsgBufPlus = Public<MAX_MESSAGE_LEN>;
+            let (mut a, mut b) = make_server_pair().unwrap();
+
+            let mut a_to_b_buf = MsgBufPlus::zero();
+            let mut b_to_a_buf = MsgBufPlus::zero();
+
+            let ip_a: SocketAddrV4 = "127.0.0.1:8080".parse().unwrap();
+            let mut ip_addr_port_a = ip_a.ip().octets().to_vec();
+            ip_addr_port_a.extend_from_slice(&ip_a.port().to_be_bytes());
+
+            let _ip_b: SocketAddrV4 = "127.0.0.1:8081".parse().unwrap();
+
+            let init_hello_len = a.initiate_handshake(PeerPtr(0), &mut *a_to_b_buf).unwrap();
+
+            //B handles handshake under load, should send cookie reply message with invalid cookie
+            let HandleMsgResult { resp, .. } = b
+                .handle_msg_under_load(
+                    &a_to_b_buf.as_slice()[..init_hello_len],
+                    &mut *b_to_a_buf,
+                    PeerPtr(0),
+                    SocketAddr::V4(ip_a),
+                )
+                .unwrap();
+
+            let cookie_reply_len = resp.unwrap();
+
+            //A handles cookie reply message
+            a.handle_msg(&b_to_a_buf[..cookie_reply_len], &mut *a_to_b_buf)
+                .unwrap();
+
+            assert!(a.peers[0].cookie_tau.is_some());
+
+            let expected_cookie_tau = lprf::cookie_tau()
+                .unwrap()
+                .mix(b.cookie_secret.get(COOKIE_SECRET_EXP).unwrap())
+                .unwrap()
+                .mix(&ip_addr_port_a)
+                .unwrap()
+                .into_value()[..16]
+                .to_vec();
+            assert_eq!(
+                a.peers[0].cookie_tau.get(PEER_COOKIE_TAU_EXP),
+                Some(&expected_cookie_tau[..])
+            );
+
+            let retx_init_hello_len = loop {
+                match a.poll().unwrap() {
+                    PollResult::SendRetransmission(peer) => {
+                        break (a.retransmit_handshake(peer, &mut *a_to_b_buf).unwrap());
+                    }
+                    PollResult::Sleep(time) => {
+                        sleep(Duration::from_secs_f64(time));
+                    }
+                    _ => {}
+                }
+            };
+
+            let retx_msg_type: MsgType = a_to_b_buf.value[0].try_into().unwrap();
+            assert_eq!(retx_msg_type, MsgType::InitHello);
+
+            //B handles retransmitted message
+            let HandleMsgResult { resp, .. } = b
+                .handle_msg_under_load(
+                    &a_to_b_buf.as_slice()[..retx_init_hello_len],
+                    &mut *b_to_a_buf,
+                    PeerPtr(0),
+                    SocketAddr::V4(ip_a),
+                )
+                .unwrap();
+
+            let _resp_hello_len = resp.unwrap();
+
+            let resp_msg_type: MsgType = b_to_a_buf.value[0].try_into().unwrap();
+            assert_eq!(resp_msg_type, MsgType::RespHello);
+        });
+    }
+
+    #[test]
+    fn cookie_reply_mechanism_initiator_bails_on_message_under_load() {
+        stacker::grow(8 * 1024 * 1024, || {
+            type MsgBufPlus = Public<MAX_MESSAGE_LEN>;
+            let (mut a, mut b) = make_server_pair().unwrap();
+
+            let mut a_to_b_buf = MsgBufPlus::zero();
+            let mut b_to_a_buf = MsgBufPlus::zero();
+
+            let ip_a: SocketAddrV4 = "127.0.0.1:8080".parse().unwrap();
+            let mut ip_addr_port_a = ip_a.ip().octets().to_vec();
+            ip_addr_port_a.extend_from_slice(&ip_a.port().to_be_bytes());
+            let ip_b: SocketAddrV4 = "127.0.0.1:8081".parse().unwrap();
+
+            //A initiates handshake
+            let init_hello_len = a.initiate_handshake(PeerPtr(0), &mut *a_to_b_buf).unwrap();
+
+            //B handles InitHello message, should respond with RespHello
+            let HandleMsgResult { resp, .. } = b
+                .handle_msg(&a_to_b_buf.as_slice()[..init_hello_len], &mut *b_to_a_buf)
+                .unwrap();
+
+            let resp_hello_len = resp.unwrap();
+            let resp_msg_type: MsgType = b_to_a_buf.value[0].try_into().unwrap();
+            assert_eq!(resp_msg_type, MsgType::RespHello);
+
+            let sids: Vec<_> = b
+                .peers
+                .iter()
+                .map(|p| p.session.as_ref().map(|s| s.sidt))
+                .collect();
+            println!("Peer SIDs: {:?}", sids);
+
+            //A handles RespHello message under load, should send cookie reply
+            assert!(a
+                .handle_msg_under_load(
+                    &b_to_a_buf[..resp_hello_len],
+                    &mut *a_to_b_buf,
+                    PeerPtr(0),
+                    SocketAddr::V4(ip_b),
+                )
+                .is_err());
+        });
+    }
 }

rosenpass/tests/integration_test.rs

@@ -30,8 +30,11 @@ fn generate_keys() {
 
 fn find_udp_socket() -> u16 {
     for port in 1025..=u16::MAX {
-        if UdpSocket::bind(("127.0.0.1", port)).is_ok() {
-            return port;
+        match UdpSocket::bind(("127.0.0.1", port)) {
+            Ok(_) => {
+                return port;
+            }
+            _ => {}
         }
     }
     panic!("no free UDP port found");
@@ -51,9 +54,9 @@ fn check_exchange() {
     for (secret_key_path, pub_key_path) in secret_key_paths.iter().zip(public_key_paths.iter()) {
         let output = test_bin::get_test_bin(BIN)
             .args(["gen-keys", "--secret-key"])
-            .arg(secret_key_path)
+            .arg(&secret_key_path)
             .arg("--public-key")
-            .arg(pub_key_path)
+            .arg(&pub_key_path)
             .output()
             .expect("Failed to start {BIN}");
 

secret-memory/Cargo.toml

@@ -1,23 +0,0 @@
-[package]
-name = "rosenpass-secret-memory"
-version = "0.1.0"
-authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
-edition = "2021"
-license = "MIT OR Apache-2.0"
-description = "Rosenpass internal utilities for storing secrets in memory"
-homepage = "https://rosenpass.eu/"
-repository = "https://github.com/rosenpass/rosenpass"
-readme = "readme.md"
-
-[dependencies]
-anyhow = { workspace = true }
-rosenpass-to = { workspace = true }
-rosenpass-util = { workspace = true }
-zeroize = { workspace = true }
-rand = { workspace = true }
-memsec = { workspace = true }
-allocator-api2 = { workspace = true }
-log = { workspace = true }
-
-[dev-dependencies]
-allocator-api2-tests = { workspace = true }

secret-memory/readme.md

@@ -1,5 +0,0 @@
-# Rosenpass secure memory library
-
-Rosenpass internal library providing utilities for securely storing secret data in memory.
-
-This is an internal library; not guarantee is made about its API at this point in time.

secret-memory/src/alloc/memsec.rs

@@ -1,108 +0,0 @@
-use std::fmt;
-use std::ptr::NonNull;
-
-use allocator_api2::alloc::{AllocError, Allocator, Layout};
-
-#[derive(Copy, Clone, Default)]
-struct MemsecAllocatorContents;
-
-/// Memory allocation using using the memsec crate
-#[derive(Copy, Clone, Default)]
-pub struct MemsecAllocator {
-    _dummy_private_data: MemsecAllocatorContents,
-}
-
-/// A box backed by the memsec allocator
-pub type MemsecBox<T> = allocator_api2::boxed::Box<T, MemsecAllocator>;
-
-/// A vector backed by the memsec allocator
-pub type MemsecVec<T> = allocator_api2::vec::Vec<T, MemsecAllocator>;
-
-pub fn memsec_box<T>(x: T) -> MemsecBox<T> {
-    MemsecBox::<T>::new_in(x, MemsecAllocator::new())
-}
-
-pub fn memsec_vec<T>() -> MemsecVec<T> {
-    MemsecVec::<T>::new_in(MemsecAllocator::new())
-}
-
-impl MemsecAllocator {
-    pub fn new() -> Self {
-        Self {
-            _dummy_private_data: MemsecAllocatorContents,
-        }
-    }
-}
-
-unsafe impl Allocator for MemsecAllocator {
-    fn allocate(&self, layout: Layout) -> Result<NonNull<[u8]>, AllocError> {
-        // Call memsec allocator
-        let mem: Option<NonNull<[u8]>> = unsafe { memsec::malloc_sized(layout.size()) };
-
-        // Unwrap the option
-        let Some(mem) = mem else {
-            log::error!("Allocation {layout:?} was requested but memsec returned a null pointer");
-            return Err(AllocError);
-        };
-
-        // Ensure the right alignment is used
-        let off = (mem.as_ptr() as *const u8).align_offset(layout.align());
-        if off != 0 {
-            log::error!("Allocation {layout:?} was requested but memsec returned allocation \
-                with offset {off} from the requested alignment. Memsec always allocates values \
-                at the end of a memory page for security reasons, custom alignments are not supported. \
-                You could try allocating an oversized value.");
-            unsafe { memsec::free(mem) };
-            return Err(AllocError);
-        };
-
-        Ok(mem)
-    }
-
-    unsafe fn deallocate(&self, ptr: NonNull<u8>, _layout: Layout) {
-        unsafe {
-            memsec::free(ptr);
-        }
-    }
-}
-
-impl fmt::Debug for MemsecAllocator {
-    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
-        fmt.write_str("<memsec based Rust allocator>")
-    }
-}
-
-#[cfg(test)]
-mod test {
-    use allocator_api2_tests::make_test;
-
-    use super::*;
-
-    make_test! { test_sizes(MemsecAllocator::new()) }
-    make_test! { test_vec(MemsecAllocator::new()) }
-    make_test! { test_many_boxes(MemsecAllocator::new()) }
-
-    #[test]
-    fn memsec_allocation() {
-        let alloc = MemsecAllocator::new();
-        memsec_allocation_impl::<0>(&alloc);
-        memsec_allocation_impl::<7>(&alloc);
-        memsec_allocation_impl::<8>(&alloc);
-        memsec_allocation_impl::<64>(&alloc);
-        memsec_allocation_impl::<999>(&alloc);
-    }
-
-    fn memsec_allocation_impl<const N: usize>(alloc: &MemsecAllocator) {
-        let layout = Layout::new::<[u8; N]>();
-        let mem = alloc.allocate(layout).unwrap();
-
-        // https://libsodium.gitbook.io/doc/memory_management#guarded-heap-allocations
-        // promises us that allocated memory is initialized with the magic byte 0xDB
-        // and memsec promises to provide a reimplementation of the libsodium mechanism;
-        // it uses the magic value 0xD0 though
-        assert_eq!(unsafe { mem.as_ref() }, &[0xD0u8; N]);
-
-        let mem = NonNull::new(mem.as_ptr() as *mut u8).unwrap();
-        unsafe { alloc.deallocate(mem, layout) };
-    }
-}

secret-memory/src/alloc/mod.rs

@@ -1,6 +0,0 @@
-pub mod memsec;
-
-pub use crate::alloc::memsec::{
-    memsec_box as secret_box, memsec_vec as secret_vec, MemsecAllocator as SecretAllocator,
-    MemsecBox as SecretBox, MemsecVec as SecretVec,
-};

secret-memory/src/debug.rs

@@ -1,20 +0,0 @@
-use std::fmt;
-
-/// Writes the contents of an `&[u8]` as hexadecimal symbols to a [std::fmt::Formatter]
-pub fn debug_crypto_array(v: &[u8], fmt: &mut fmt::Formatter) -> fmt::Result {
-    fmt.write_str("[{}]=")?;
-    if v.len() > 64 {
-        for byte in &v[..32] {
-            std::fmt::LowerHex::fmt(byte, fmt)?;
-        }
-        fmt.write_str("…")?;
-        for byte in &v[v.len() - 32..] {
-            std::fmt::LowerHex::fmt(byte, fmt)?;
-        }
-    } else {
-        for byte in v {
-            std::fmt::LowerHex::fmt(byte, fmt)?;
-        }
-    }
-    Ok(())
-}

secret-memory/src/file.rs

@@ -1,7 +0,0 @@
-use std::path::Path;
-
-pub trait StoreSecret {
-    type Error;
-
-    fn store_secret<P: AsRef<Path>>(&self, path: P) -> Result<(), Self::Error>;
-}

secret-memory/src/lib.rs

@@ -1,11 +0,0 @@
-pub mod debug;
-pub mod file;
-pub mod rand;
-
-pub mod alloc;
-
-mod public;
-pub use crate::public::Public;
-
-mod secret;
-pub use crate::secret::Secret;

secret-memory/src/public.rs

@@ -1,112 +0,0 @@
-use crate::debug::debug_crypto_array;
-use rand::{Fill as Randomize, Rng};
-use rosenpass_to::{ops::copy_slice, To};
-use rosenpass_util::file::{fopen_r, LoadValue, ReadExactToEnd, StoreValue};
-use rosenpass_util::functional::mutating;
-use std::borrow::{Borrow, BorrowMut};
-use std::fmt;
-use std::ops::{Deref, DerefMut};
-use std::path::Path;
-
-/// Contains information in the form of a byte array that may be known to the
-/// public
-// TODO: We should get rid of the Public type; just use a normal value
-#[derive(Copy, Clone, Hash, PartialEq, Eq, PartialOrd, Ord)]
-#[repr(transparent)]
-pub struct Public<const N: usize> {
-    pub value: [u8; N],
-}
-
-impl<const N: usize> Public<N> {
-    /// Create a new [Public] from a byte slice
-    pub fn from_slice(value: &[u8]) -> Self {
-        copy_slice(value).to_this(Self::zero)
-    }
-
-    /// Create a new [Public] from a byte array
-    pub fn new(value: [u8; N]) -> Self {
-        Self { value }
-    }
-
-    /// Create a zero initialized [Public]
-    pub fn zero() -> Self {
-        Self { value: [0u8; N] }
-    }
-
-    /// Create a random initialized [Public]
-    pub fn random() -> Self {
-        mutating(Self::zero(), |r| r.randomize())
-    }
-
-    /// Randomize all bytes in an existing [Public]
-    pub fn randomize(&mut self) {
-        self.try_fill(&mut crate::rand::rng()).unwrap()
-    }
-}
-
-impl<const N: usize> Randomize for Public<N> {
-    fn try_fill<R: Rng + ?Sized>(&mut self, rng: &mut R) -> Result<(), rand::Error> {
-        self.value.try_fill(rng)
-    }
-}
-
-impl<const N: usize> fmt::Debug for Public<N> {
-    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
-        debug_crypto_array(&self.value, fmt)
-    }
-}
-
-impl<const N: usize> Deref for Public<N> {
-    type Target = [u8; N];
-
-    fn deref(&self) -> &[u8; N] {
-        &self.value
-    }
-}
-
-impl<const N: usize> DerefMut for Public<N> {
-    fn deref_mut(&mut self) -> &mut [u8; N] {
-        &mut self.value
-    }
-}
-
-impl<const N: usize> Borrow<[u8; N]> for Public<N> {
-    fn borrow(&self) -> &[u8; N] {
-        &self.value
-    }
-}
-impl<const N: usize> BorrowMut<[u8; N]> for Public<N> {
-    fn borrow_mut(&mut self) -> &mut [u8; N] {
-        &mut self.value
-    }
-}
-
-impl<const N: usize> Borrow<[u8]> for Public<N> {
-    fn borrow(&self) -> &[u8] {
-        &self.value
-    }
-}
-impl<const N: usize> BorrowMut<[u8]> for Public<N> {
-    fn borrow_mut(&mut self) -> &mut [u8] {
-        &mut self.value
-    }
-}
-
-impl<const N: usize> LoadValue for Public<N> {
-    type Error = anyhow::Error;
-
-    fn load<P: AsRef<Path>>(path: P) -> anyhow::Result<Self> {
-        let mut v = Self::random();
-        fopen_r(path)?.read_exact_to_end(&mut *v)?;
-        Ok(v)
-    }
-}
-
-impl<const N: usize> StoreValue for Public<N> {
-    type Error = anyhow::Error;
-
-    fn store<P: AsRef<Path>>(&self, path: P) -> anyhow::Result<()> {
-        std::fs::write(path, **self)?;
-        Ok(())
-    }
-}

secret-memory/src/rand.rs

@@ -1,5 +0,0 @@
-pub type Rng = rand::rngs::ThreadRng;
-
-pub fn rng() -> Rng {
-    rand::thread_rng()
-}

secret-memory/src/secret.rs

@@ -1,321 +0,0 @@
-use std::cell::RefCell;
-use std::collections::HashMap;
-use std::convert::TryInto;
-use std::fmt;
-use std::ops::{Deref, DerefMut};
-use std::path::Path;
-
-use anyhow::Context;
-use rand::{Fill as Randomize, Rng};
-use zeroize::{Zeroize, ZeroizeOnDrop};
-
-use rosenpass_util::b64::b64_reader;
-use rosenpass_util::file::{fopen_r, LoadValue, LoadValueB64, ReadExactToEnd};
-use rosenpass_util::functional::mutating;
-
-use crate::alloc::{secret_box, SecretBox, SecretVec};
-use crate::file::StoreSecret;
-
-// This might become a problem in library usage; it's effectively a memory
-// leak which probably isn't a problem right now because most memory will
-// be reused…
-thread_local! {
-    static SECRET_CACHE: RefCell<SecretMemoryPool> = RefCell::new(SecretMemoryPool::new());
-}
-
-fn with_secret_memory_pool<Fn, R>(mut f: Fn) -> R
-where
-    Fn: FnMut(Option<&mut SecretMemoryPool>) -> R,
-{
-    // This acquires the SECRET_CACHE
-    SECRET_CACHE
-        .try_with(|cell| {
-            // And acquires the inner reference
-            cell.try_borrow_mut()
-                .as_deref_mut()
-                // To call the given function
-                .map(|pool| f(Some(pool)))
-                .ok()
-        })
-        .ok()
-        .flatten()
-        // Failing that, the given function is called with None
-        .unwrap_or_else(|| f(None))
-}
-
-// Wrapper around SecretBox that applies automatic zeroization
-#[derive(Debug)]
-struct ZeroizingSecretBox<T: Zeroize + ?Sized>(Option<SecretBox<T>>);
-
-impl<T: Zeroize> ZeroizingSecretBox<T> {
-    fn new(boxed: T) -> Self {
-        ZeroizingSecretBox(Some(secret_box(boxed)))
-    }
-}
-
-impl<T: Zeroize + ?Sized> ZeroizingSecretBox<T> {
-    fn from_secret_box(inner: SecretBox<T>) -> Self {
-        Self(Some(inner))
-    }
-
-    fn take(mut self) -> SecretBox<T> {
-        self.0.take().unwrap()
-    }
-}
-
-impl<T: Zeroize + ?Sized> ZeroizeOnDrop for ZeroizingSecretBox<T> {}
-impl<T: Zeroize + ?Sized> Zeroize for ZeroizingSecretBox<T> {
-    fn zeroize(&mut self) {
-        if let Some(inner) = &mut self.0 {
-            let inner: &mut SecretBox<T> = inner; // type annotation
-            inner.zeroize()
-        }
-    }
-}
-
-impl<T: Zeroize + ?Sized> Drop for ZeroizingSecretBox<T> {
-    fn drop(&mut self) {
-        self.zeroize()
-    }
-}
-
-impl<T: Zeroize + ?Sized> Deref for ZeroizingSecretBox<T> {
-    type Target = T;
-
-    fn deref(&self) -> &T {
-        self.0.as_ref().unwrap()
-    }
-}
-
-impl<T: Zeroize + ?Sized> DerefMut for ZeroizingSecretBox<T> {
-    fn deref_mut(&mut self) -> &mut T {
-        self.0.as_mut().unwrap()
-    }
-}
-
-/// Pool that stores secret memory allocations
-///
-/// Allocation of secret memory is expensive. Thus, this struct provides a
-/// pool of secret memory, readily available to yield protected, slices of
-/// memory.
-#[derive(Debug)] // TODO check on Debug derive, is that clever
-struct SecretMemoryPool {
-    pool: HashMap<usize, Vec<ZeroizingSecretBox<[u8]>>>,
-}
-
-impl SecretMemoryPool {
-    /// Create a new [SecretMemoryPool]
-    #[allow(clippy::new_without_default)]
-    pub fn new() -> Self {
-        Self {
-            pool: HashMap::new(),
-        }
-    }
-
-    /// Return secret back to the pool for future re-use
-    pub fn release<const N: usize>(&mut self, mut sec: ZeroizingSecretBox<[u8; N]>) {
-        sec.zeroize();
-
-        // This conversion sequence is weird but at least it guarantees
-        // that the heap allocation is preserved according to the docs
-        let sec: SecretVec<u8> = sec.take().into();
-        let sec: SecretBox<[u8]> = sec.into();
-
-        self.pool
-            .entry(N)
-            .or_default()
-            .push(ZeroizingSecretBox::from_secret_box(sec));
-    }
-
-    /// Take protected memory from the pool, allocating new one if no suitable
-    /// chunk is found in the inventory.
-    ///
-    /// The secret is guaranteed to be full of nullbytes
-    pub fn take<const N: usize>(&mut self) -> ZeroizingSecretBox<[u8; N]> {
-        let entry = self.pool.entry(N).or_default();
-        let inner = match entry.pop() {
-            None => secret_box([0u8; N]),
-            Some(sec) => sec.take().try_into().unwrap(),
-        };
-        ZeroizingSecretBox::from_secret_box(inner)
-    }
-}
-
-/// Storage for secret data
-pub struct Secret<const N: usize> {
-    storage: Option<ZeroizingSecretBox<[u8; N]>>,
-}
-
-impl<const N: usize> Secret<N> {
-    pub fn from_slice(slice: &[u8]) -> Self {
-        let mut new_self = Self::zero();
-        new_self.secret_mut().copy_from_slice(slice);
-        new_self
-    }
-
-    /// Returns a new [Secret] that is zero initialized
-    pub fn zero() -> Self {
-        // Using [SecretMemoryPool] here because this operation is expensive,
-        // yet it is used in hot loops
-        let buf = with_secret_memory_pool(|pool| {
-            pool.map(|p| p.take())
-                .unwrap_or_else(|| ZeroizingSecretBox::new([0u8; N]))
-        });
-
-        Self { storage: Some(buf) }
-    }
-
-    /// Returns a new [Secret] that is randomized
-    pub fn random() -> Self {
-        mutating(Self::zero(), |r| r.randomize())
-    }
-
-    /// Sets all data an existing secret to random bytes
-    pub fn randomize(&mut self) {
-        self.try_fill(&mut crate::rand::rng()).unwrap()
-    }
-
-    /// Borrows the data
-    pub fn secret(&self) -> &[u8; N] {
-        self.storage.as_ref().unwrap()
-    }
-
-    /// Borrows the data mutably
-    pub fn secret_mut(&mut self) -> &mut [u8; N] {
-        self.storage.as_mut().unwrap()
-    }
-}
-
-impl<const N: usize> Randomize for Secret<N> {
-    fn try_fill<R: Rng + ?Sized>(&mut self, rng: &mut R) -> Result<(), rand::Error> {
-        // Zeroize self first just to make sure the barriers from the zeroize create take
-        // effect to prevent the compiler from optimizing this away.
-        // We should at some point replace this with our own barriers.
-        self.zeroize();
-        self.secret_mut().try_fill(rng)
-    }
-}
-
-impl<const N: usize> ZeroizeOnDrop for Secret<N> {}
-impl<const N: usize> Zeroize for Secret<N> {
-    fn zeroize(&mut self) {
-        if let Some(inner) = &mut self.storage {
-            inner.zeroize()
-        }
-    }
-}
-
-impl<const N: usize> Drop for Secret<N> {
-    fn drop(&mut self) {
-        with_secret_memory_pool(|pool| {
-            if let Some((pool, secret)) = pool.zip(self.storage.take()) {
-                pool.release(secret);
-            }
-        });
-
-        // This should be unnecessary: The pool has one item – the inner secret – which
-        // zeroizes itself on drop. Calling it should not do any harm though…
-        self.zeroize()
-    }
-}
-
-impl<const N: usize> Clone for Secret<N> {
-    fn clone(&self) -> Self {
-        Self::from_slice(self.secret())
-    }
-}
-
-/// The Debug implementation of [Secret] does not reveal the secret data,
-/// instead a placeholder `<SECRET>` is used
-impl<const N: usize> fmt::Debug for Secret<N> {
-    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
-        fmt.write_str("<SECRET>")
-    }
-}
-
-impl<const N: usize> LoadValue for Secret<N> {
-    type Error = anyhow::Error;
-
-    fn load<P: AsRef<Path>>(path: P) -> anyhow::Result<Self> {
-        let mut v = Self::random();
-        let p = path.as_ref();
-        fopen_r(p)?
-            .read_exact_to_end(v.secret_mut())
-            .with_context(|| format!("Could not load file {p:?}"))?;
-        Ok(v)
-    }
-}
-
-impl<const N: usize> LoadValueB64 for Secret<N> {
-    type Error = anyhow::Error;
-
-    fn load_b64<P: AsRef<Path>>(path: P) -> anyhow::Result<Self> {
-        use std::io::Read;
-
-        let mut v = Self::random();
-        let p = path.as_ref();
-        // This might leave some fragments of the secret on the stack;
-        // in practice this is likely not a problem because the stack likely
-        // will be overwritten by something else soon but this is not exactly
-        // guaranteed. It would be possible to remedy this, but since the secret
-        // data will linger in the Linux page cache anyways with the current
-        // implementation, going to great length to erase the secret here is
-        // not worth it right now.
-        b64_reader(&mut fopen_r(p)?)
-            .read_exact(v.secret_mut())
-            .with_context(|| format!("Could not load base64 file {p:?}"))?;
-        Ok(v)
-    }
-}
-
-impl<const N: usize> StoreSecret for Secret<N> {
-    type Error = anyhow::Error;
-
-    fn store_secret<P: AsRef<Path>>(&self, path: P) -> anyhow::Result<()> {
-        std::fs::write(path, self.secret())?;
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod test {
-    use super::*;
-
-    /// check that we can alloc using the magic pool
-    #[test]
-    fn secret_memory_pool_take() {
-        const N: usize = 0x100;
-        let mut pool = SecretMemoryPool::new();
-        let secret: ZeroizingSecretBox<[u8; N]> = pool.take();
-        assert_eq!(secret.as_ref(), &[0; N]);
-    }
-
-    /// check that a secrete lives, even if its [SecretMemoryPool] is deleted
-    #[test]
-    fn secret_memory_pool_drop() {
-        const N: usize = 0x100;
-        let mut pool = SecretMemoryPool::new();
-        let secret: ZeroizingSecretBox<[u8; N]> = pool.take();
-        std::mem::drop(pool);
-        assert_eq!(secret.as_ref(), &[0; N]);
-    }
-
-    /// check that a secrete can be reborn, freshly initialized with zero
-    #[test]
-    fn secret_memory_pool_release() {
-        const N: usize = 1;
-        let mut pool = SecretMemoryPool::new();
-        let mut secret: ZeroizingSecretBox<[u8; N]> = pool.take();
-        let old_secret_ptr = secret.as_ref().as_ptr();
-
-        secret.as_mut()[0] = 0x13;
-        pool.release(secret);
-
-        // now check that we get the same ptr
-        let new_secret: ZeroizingSecretBox<[u8; N]> = pool.take();
-        assert_eq!(old_secret_ptr, new_secret.as_ref().as_ptr());
-
-        // and that the secret was zeroized
-        assert_eq!(new_secret.as_ref(), &[0; N]);
-    }
-}

sodium/Cargo.toml

@@ -1,16 +1,17 @@
 [package]
-name = "rosenpass-oqs"
+name = "rosenpass-sodium"
 authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
 version = "0.1.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
-description = "Rosenpass internal bindings to liboqs"
+description = "Rosenpass internal bindings to libsodium"
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
 
 [dependencies]
-rosenpass-cipher-traits = { workspace = true }
 rosenpass-util = { workspace = true }
-oqs-sys = { workspace = true }
-paste = { workspace = true }
+rosenpass-to = { workspace = true }
+anyhow = { workspace = true }
+libsodium-sys-stable = { workspace = true }
+log = { workspace = true }

sodium/readme.md

@@ -1,5 +1,5 @@
 # Rosenpass internal libsodium bindings
 
-Rosenpass internal library providing traits for cryptographic primitives.
+Rosenpass internal library providing bindings to libsodium.
 
 This is an internal library; not guarantee is made about its API at this point in time.

sodium/src/aead/chacha20poly1305_ietf.rs

@@ -0,0 +1,63 @@
+use libsodium_sys as libsodium;
+use std::ffi::c_ulonglong;
+use std::ptr::{null, null_mut};
+
+pub const KEY_LEN: usize = libsodium::crypto_aead_chacha20poly1305_IETF_KEYBYTES as usize;
+pub const TAG_LEN: usize = libsodium::crypto_aead_chacha20poly1305_IETF_ABYTES as usize;
+pub const NONCE_LEN: usize = libsodium::crypto_aead_chacha20poly1305_IETF_NPUBBYTES as usize;
+
+#[inline]
+pub fn encrypt(
+    ciphertext: &mut [u8],
+    key: &[u8],
+    nonce: &[u8],
+    ad: &[u8],
+    plaintext: &[u8],
+) -> anyhow::Result<()> {
+    assert!(ciphertext.len() == plaintext.len() + TAG_LEN);
+    assert!(key.len() == KEY_LEN);
+    assert!(nonce.len() == NONCE_LEN);
+    let mut clen: u64 = 0;
+    sodium_call!(
+        crypto_aead_chacha20poly1305_ietf_encrypt,
+        ciphertext.as_mut_ptr(),
+        &mut clen,
+        plaintext.as_ptr(),
+        plaintext.len() as c_ulonglong,
+        ad.as_ptr(),
+        ad.len() as c_ulonglong,
+        null(), // nsec is not used
+        nonce.as_ptr(),
+        key.as_ptr()
+    )?;
+    assert!(clen as usize == ciphertext.len());
+    Ok(())
+}
+
+#[inline]
+pub fn decrypt(
+    plaintext: &mut [u8],
+    key: &[u8],
+    nonce: &[u8],
+    ad: &[u8],
+    ciphertext: &[u8],
+) -> anyhow::Result<()> {
+    assert!(ciphertext.len() == plaintext.len() + TAG_LEN);
+    assert!(key.len() == KEY_LEN);
+    assert!(nonce.len() == NONCE_LEN);
+    let mut mlen: u64 = 0;
+    sodium_call!(
+        crypto_aead_chacha20poly1305_ietf_decrypt,
+        plaintext.as_mut_ptr(),
+        &mut mlen as *mut c_ulonglong,
+        null_mut(), // nsec is not used
+        ciphertext.as_ptr(),
+        ciphertext.len() as c_ulonglong,
+        ad.as_ptr(),
+        ad.len() as c_ulonglong,
+        nonce.as_ptr(),
+        key.as_ptr()
+    )?;
+    assert!(mlen as usize == plaintext.len());
+    Ok(())
+}

sodium/src/aead/mod.rs

@@ -0,0 +1,2 @@
+pub mod chacha20poly1305_ietf;
+pub mod xchacha20poly1305_ietf;

sodium/src/aead/xchacha20poly1305_ietf.rs

@@ -0,0 +1,63 @@
+use libsodium_sys as libsodium;
+use std::ffi::c_ulonglong;
+use std::ptr::{null, null_mut};
+
+pub const KEY_LEN: usize = libsodium::crypto_aead_xchacha20poly1305_IETF_KEYBYTES as usize;
+pub const TAG_LEN: usize = libsodium::crypto_aead_xchacha20poly1305_ietf_ABYTES as usize;
+pub const NONCE_LEN: usize = libsodium::crypto_aead_xchacha20poly1305_IETF_NPUBBYTES as usize;
+
+#[inline]
+pub fn encrypt(
+    ciphertext: &mut [u8],
+    key: &[u8],
+    nonce: &[u8],
+    ad: &[u8],
+    plaintext: &[u8],
+) -> anyhow::Result<()> {
+    assert!(ciphertext.len() == plaintext.len() + NONCE_LEN + TAG_LEN);
+    assert!(key.len() == libsodium::crypto_aead_xchacha20poly1305_IETF_KEYBYTES as usize);
+    let (n, ct) = ciphertext.split_at_mut(NONCE_LEN);
+    n.copy_from_slice(nonce);
+    let mut clen: u64 = 0;
+    sodium_call!(
+        crypto_aead_xchacha20poly1305_ietf_encrypt,
+        ct.as_mut_ptr(),
+        &mut clen,
+        plaintext.as_ptr(),
+        plaintext.len() as c_ulonglong,
+        ad.as_ptr(),
+        ad.len() as c_ulonglong,
+        null(), // nsec is not used
+        nonce.as_ptr(),
+        key.as_ptr()
+    )?;
+    assert!(clen as usize == ct.len());
+    Ok(())
+}
+
+#[inline]
+pub fn decrypt(
+    plaintext: &mut [u8],
+    key: &[u8],
+    ad: &[u8],
+    ciphertext: &[u8],
+) -> anyhow::Result<()> {
+    assert!(ciphertext.len() == plaintext.len() + NONCE_LEN + TAG_LEN);
+    assert!(key.len() == KEY_LEN);
+    let (n, ct) = ciphertext.split_at(NONCE_LEN);
+    let mut mlen: u64 = 0;
+    sodium_call!(
+        crypto_aead_xchacha20poly1305_ietf_decrypt,
+        plaintext.as_mut_ptr(),
+        &mut mlen as *mut c_ulonglong,
+        null_mut(), // nsec is not used
+        ct.as_ptr(),
+        ct.len() as c_ulonglong,
+        ad.as_ptr(),
+        ad.len() as c_ulonglong,
+        n.as_ptr(),
+        key.as_ptr()
+    )?;
+    assert!(mlen as usize == plaintext.len());
+    Ok(())
+}

sodium/src/hash/blake2b.rs

@@ -0,0 +1,31 @@
+use libsodium_sys as libsodium;
+use rosenpass_to::{with_destination, To};
+use std::ffi::c_ulonglong;
+use std::ptr::null;
+
+pub const KEY_MIN: usize = libsodium::crypto_generichash_blake2b_KEYBYTES_MIN as usize;
+pub const KEY_MAX: usize = libsodium::crypto_generichash_blake2b_KEYBYTES_MAX as usize;
+pub const OUT_MIN: usize = libsodium::crypto_generichash_blake2b_BYTES_MIN as usize;
+pub const OUT_MAX: usize = libsodium::crypto_generichash_blake2b_BYTES_MAX as usize;
+
+#[inline]
+pub fn hash<'a>(key: &'a [u8], data: &'a [u8]) -> impl To<[u8], anyhow::Result<()>> + 'a {
+    with_destination(|out: &mut [u8]| {
+        assert!(key.is_empty() || (KEY_MIN <= key.len() && key.len() <= KEY_MAX));
+        assert!(OUT_MIN <= out.len() && out.len() <= OUT_MAX);
+        let kptr = match key.len() {
+            // NULL key
+            0 => null(),
+            _ => key.as_ptr(),
+        };
+        sodium_call!(
+            crypto_generichash_blake2b,
+            out.as_mut_ptr(),
+            out.len(),
+            data.as_ptr(),
+            data.len() as c_ulonglong,
+            kptr,
+            key.len()
+        )
+    })
+}

sodium/src/hash/mod.rs

@@ -0,0 +1 @@
+pub mod blake2b;

sodium/src/helpers.rs

@@ -0,0 +1,52 @@
+use libsodium_sys as libsodium;
+use std::os::raw::c_void;
+
+#[inline]
+pub fn memcmp(a: &[u8], b: &[u8]) -> bool {
+    a.len() == b.len()
+        && unsafe {
+            let r = libsodium::sodium_memcmp(
+                a.as_ptr() as *const c_void,
+                b.as_ptr() as *const c_void,
+                a.len(),
+            );
+            r == 0
+        }
+}
+
+#[inline]
+pub fn compare(a: &[u8], b: &[u8]) -> i32 {
+    assert!(a.len() == b.len());
+    unsafe { libsodium::sodium_compare(a.as_ptr(), b.as_ptr(), a.len()) }
+}
+
+#[inline]
+pub fn increment(v: &mut [u8]) {
+    unsafe {
+        libsodium::sodium_increment(v.as_mut_ptr(), v.len());
+    }
+}
+
+#[inline]
+pub fn randombytes_buf(buf: &mut [u8]) {
+    unsafe { libsodium::randombytes_buf(buf.as_mut_ptr() as *mut c_void, buf.len()) };
+}
+
+#[inline]
+pub fn memzero(buf: &mut [u8]) {
+    unsafe { libsodium::sodium_memzero(buf.as_mut_ptr() as *mut c_void, buf.len()) };
+}
+
+// Choose a fully random u64
+// TODO: Replace with ::rand::random
+pub fn rand_u64() -> u64 {
+    let mut buf = [0u8; 8];
+    randombytes_buf(&mut buf);
+    u64::from_le_bytes(buf)
+}
+
+// Choose a random f64 in [0; 1] inclusive; quick and dirty
+// TODO: Replace with ::rand::random
+pub fn rand_f64() -> f64 {
+    (rand_u64() as f64) / (u64::MAX as f64)
+}

sodium/src/lib.rs

@@ -0,0 +1,20 @@
+use libsodium_sys as libsodium;
+
+macro_rules! sodium_call {
+    ($name:ident, $($args:expr),*) => { ::rosenpass_util::attempt!({
+        anyhow::ensure!(unsafe{libsodium::$name($($args),*)} > -1,
+            "Error in libsodium's {}.", stringify!($name));
+        Ok(())
+    })};
+    ($name:ident) => { sodium_call!($name, ) };
+}
+
+#[inline]
+pub fn init() -> anyhow::Result<()> {
+    log::trace!("initializing libsodium");
+    sodium_call!(sodium_init)
+}
+
+pub mod aead;
+pub mod hash;
+pub mod helpers;

to/README.md

@@ -12,17 +12,15 @@ The crate provides chained functions to simplify allocating the destination para
 For now this crate is experimental; patch releases are guaranteed not to contain any breaking changes, but minor releases may.
 
 ```rust
-use rosenpass_to::ops::copy_array;
-use rosenpass_to::{to, with_destination, To};
 use std::ops::BitXorAssign;
+use rosenpass_to::{To, to, with_destination};
+use rosenpass_to::ops::copy_array;
 
 // Destination functions return some value that implements the To trait.
 // Unfortunately dealing with lifetimes is a bit more finicky than it would#
 // be without destination parameters
-fn xor_slice<'a, T>(src: &'a [T]) -> impl To<[T], ()> + 'a
-where
-    T: BitXorAssign + Clone,
-{
+fn xor_slice<'a, T>(src: &'a[T]) -> impl To<[T], ()> + 'a
+        where T: BitXorAssign + Clone {
     // Custom implementations of the to trait can be created, but the easiest
     with_destination(move |dst: &mut [T]| {
         assert!(src.len() == dst.len());
@@ -67,7 +65,7 @@ assert_eq!(&dst[..], &flip01[..]);
 // The builtin function copy_array supports to_value() since its
 // destination parameter is a fixed size array, which can be allocated
 // using default()
-let dst: [u8; 4] = copy_array(flip01).to_value();
+let dst : [u8; 4] = copy_array(flip01).to_value();
 assert_eq!(&dst, flip01);
 ```
 
@@ -86,9 +84,7 @@ Functions declared like this are more cumbersome to use when the destination par
 use std::ops::BitXorAssign;
 
 fn xor_slice<T>(dst: &mut [T], src: &[T])
-where
-    T: BitXorAssign + Clone,
-{
+        where T: BitXorAssign + Clone {
     assert!(src.len() == dst.len());
     for (d, s) in dst.iter_mut().zip(src.iter()) {
         *d ^= s.clone();
@@ -118,8 +114,8 @@ assert_eq!(&dst[..], &flip01[..]);
 There are a couple of ways to use a function with destination:
 
 ```rust
-use rosenpass_to::ops::{copy_array, copy_slice_least};
 use rosenpass_to::{to, To};
+use rosenpass_to::ops::{copy_array, copy_slice_least};
 
 let mut dst = b"           ".to_vec();
 
@@ -133,8 +129,7 @@ copy_slice_least(b"This is fin").to(&mut dst[..]);
 assert_eq!(&dst[..], b"This is fin");
 
 // You can allocate the destination variable on the fly using `.to_this(...)`
-let tmp =
-    copy_slice_least(b"This is new---").to_this(|| b"This will be overwritten".to_owned());
+let tmp = copy_slice_least(b"This is new---").to_this(|| b"This will be overwritten".to_owned());
 assert_eq!(&tmp[..], b"This is new---verwritten");
 
 // You can allocate the destination variable on the fly `.collect(..)` if it implements default
@@ -152,11 +147,8 @@ assert_eq!(&tmp[..], b"Fixed");
 The to crate provides basic functions with destination for copying data between slices and arrays.
 
 ```rust
-use rosenpass_to::ops::{
-    copy_array, copy_slice, copy_slice_least, copy_slice_least_src, try_copy_slice,
-    try_copy_slice_least_src,
-};
 use rosenpass_to::{to, To};
+use rosenpass_to::ops::{copy_array, copy_slice, copy_slice_least, copy_slice_least_src, try_copy_slice, try_copy_slice_least_src};
 
 let mut dst = b"           ".to_vec();
 
@@ -169,33 +161,18 @@ to(&mut dst[4..], copy_slice_least_src(b"!!!"));
 assert_eq!(&dst[..], b"Hell!!!orld");
 
 // Copy a slice, copying as many bytes as possible
-to(
-    &mut dst[6..],
-    copy_slice_least(b"xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"),
-);
+to(&mut dst[6..], copy_slice_least(b"xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"));
 assert_eq!(&dst[..], b"Hell!!xxxxx");
 
 // Copy a slice, will return None and abort if the sizes do not much
 assert_eq!(Some(()), to(&mut dst[..], try_copy_slice(b"Hello World")));
 assert_eq!(None, to(&mut dst[..], try_copy_slice(b"---")));
-assert_eq!(
-    None,
-    to(&mut dst[..], try_copy_slice(b"---------------------"))
-);
+assert_eq!(None, to(&mut dst[..], try_copy_slice(b"---------------------")));
 assert_eq!(&dst[..], b"Hello World");
 
 // Copy a slice, will return None and abort if source is longer than destination
-assert_eq!(
-    Some(()),
-    to(&mut dst[4..], try_copy_slice_least_src(b"!!!"))
-);
-assert_eq!(
-    None,
-    to(
-        &mut dst[4..],
-        try_copy_slice_least_src(b"-------------------------")
-    )
-);
+assert_eq!(Some(()), to(&mut dst[4..], try_copy_slice_least_src(b"!!!")));
+assert_eq!(None, to(&mut dst[4..], try_copy_slice_least_src(b"-------------------------")));
 assert_eq!(&dst[..], b"Hell!!!orld");
 
 // Copy fixed size arrays all at once
@@ -209,14 +186,12 @@ assert_eq!(&dst, b"Hello");
 The easiest way to declare a function with destination is to use the with_destination function.
 
 ```rust
+use rosenpass_to::{To, to, with_destination};
 use rosenpass_to::ops::copy_array;
-use rosenpass_to::{to, with_destination, To};
 
 /// Copy the given slice to the start of a vector, reusing its memory if possible
 fn copy_to_vec<'a, T>(src: &'a [T]) -> impl To<Vec<T>, ()> + 'a
-where
-    T: Clone,
-{
+        where T: Clone {
     with_destination(move |dst: &mut Vec<T>| {
         dst.clear();
         dst.extend_from_slice(src);
@@ -242,9 +217,7 @@ The same pattern can be implemented without `to`, at the cost of being slightly
 ```rust
 /// Copy the given slice to the start of a vector, reusing its memory if possible
 fn copy_to_vec<T>(dst: &mut Vec<T>, src: &[T])
-where
-    T: Clone,
-{
+        where T: Clone {
     dst.clear();
     dst.extend_from_slice(src);
 }
@@ -267,11 +240,11 @@ Alternative functions are returned, that return a `to::Beside` value, containing
 destination variable and the return value.
 
 ```rust
-use rosenpass_to::{to, with_destination, Beside, To};
-use std::cmp::{max, min};
+use std::cmp::{min, max};
+use rosenpass_to::{To, to, with_destination, Beside};
 
 /// Copy an array of floats and calculate the average
-pub fn copy_and_average<'a>(src: &'a [f64]) -> impl To<[f64], f64> + 'a {
+pub fn copy_and_average<'a>(src: &'a[f64]) -> impl To<[f64], f64> + 'a {
     with_destination(move |dst: &mut [f64]| {
         assert!(src.len() == dst.len());
         let mut sum = 0f64;
@@ -327,8 +300,8 @@ assert_eq!(tmp, Beside([42f64; 3], 42f64));
 When Beside values contain a `()`, `Option<()>`, or `Result<(), Error>` return value, they expose a special method called `.condense()`; this method consumes the Beside value and condenses destination and return value into one value.
 
 ```rust
-use rosenpass_to::Beside;
 use std::result::Result;
+use rosenpass_to::{Beside};
 
 assert_eq!((), Beside((), ()).condense());
 
@@ -345,8 +318,8 @@ assert_eq!(Err(()), Beside(42, err_unit).condense());
 When condense is implemented for a type, `.to_this(|| ...)`, `.to_value()`, and `.collect::<...>()` on the `To` trait can be used even with a return value:
 
 ```rust
-use rosenpass_to::ops::try_copy_slice;
 use rosenpass_to::To;
+use rosenpass_to::ops::try_copy_slice;;
 
 let tmp = try_copy_slice(b"Hello World").collect::<[u8; 11]>();
 assert_eq!(tmp, Some(*b"Hello World"));
@@ -364,8 +337,8 @@ assert_eq!(tmp, None);
 The same naturally also works for Results, but the example is a bit harder to motivate:
 
 ```rust
-use rosenpass_to::{to, with_destination, To};
 use std::result::Result;
+use rosenpass_to::{to, To, with_destination};
 
 #[derive(PartialEq, Eq, Debug, Default)]
 struct InvalidFloat;
@@ -407,8 +380,8 @@ Condensation is implemented through a trait called CondenseBeside ([local](Conde
 If you can not implement this trait because its for an external type (see [orphan rule](https://doc.rust-lang.org/book/ch10-02-traits.html#implementing-a-trait-on-a-type)), this crate welcomes contributions of new Condensation rules.
 
 ```rust
+use rosenpass_to::{To, with_destination, Beside, CondenseBeside};
 use rosenpass_to::ops::copy_slice;
-use rosenpass_to::{with_destination, Beside, CondenseBeside, To};
 
 #[derive(PartialEq, Eq, Debug, Default)]
 struct MyTuple<Left, Right>(Left, Right);
@@ -423,10 +396,7 @@ impl<Val, Right> CondenseBeside<Val> for MyTuple<(), Right> {
 }
 
 fn copy_slice_and_return_something<'a, T, U>(src: &'a [T], something: U) -> impl To<[T], U> + 'a
-where
-    T: Copy,
-    U: 'a,
-{
+        where T: Copy, U: 'a {
     with_destination(move |dst: &mut [T]| {
         copy_slice(src).to(dst);
         something
@@ -447,7 +417,7 @@ Using `with_destination(...)` is convenient, but since it uses closures it resul
 Implementing the ToTrait manual is the right choice for library use cases.
 
 ```rust
-use rosenpass_to::{to, with_destination, To};
+use rosenpass_to::{to, To, with_destination};
 
 struct TryCopySliceSource<'a, T: Copy> {
     src: &'a [T],
@@ -455,20 +425,17 @@ struct TryCopySliceSource<'a, T: Copy> {
 
 impl<'a, T: Copy> To<[T], Option<()>> for TryCopySliceSource<'a, T> {
     fn to(self, dst: &mut [T]) -> Option<()> {
-        (self.src.len() == dst.len()).then(|| dst.copy_from_slice(self.src))
+        (self.src.len() == dst.len())
+            .then(|| dst.copy_from_slice(self.src))
     }
 }
 
 fn try_copy_slice<'a, T>(src: &'a [T]) -> TryCopySliceSource<'a, T>
-where
-    T: Copy,
-{
+        where T: Copy {
     TryCopySliceSource { src }
 }
 
-let mut dst = try_copy_slice(b"Hello World")
-    .collect::<[u8; 11]>()
-    .unwrap();
+let mut dst = try_copy_slice(b"Hello World").collect::<[u8; 11]>().unwrap();
 assert_eq!(&dst[..], b"Hello World");
 assert_eq!(None, to(&mut dst[..], try_copy_slice(b"---")));
 ```
@@ -478,8 +445,8 @@ assert_eq!(None, to(&mut dst[..], try_copy_slice(b"---")));
 Destinations can also be used with methods. This example demonstrates using destinations in an extension trait for everything that implements `Borrow<[T]>` for any `T` and a concrete `To` trait implementation.
 
 ```rust
-use rosenpass_to::{to, with_destination, To};
 use std::borrow::Borrow;
+use rosenpass_to::{to, To, with_destination};
 
 struct TryCopySliceSource<'a, T: Copy> {
     src: &'a [T],
@@ -487,24 +454,24 @@ struct TryCopySliceSource<'a, T: Copy> {
 
 impl<'a, T: Copy> To<[T], Option<()>> for TryCopySliceSource<'a, T> {
     fn to(self, dst: &mut [T]) -> Option<()> {
-        (self.src.len() == dst.len()).then(|| dst.copy_from_slice(self.src))
+        (self.src.len() == dst.len())
+            .then(|| dst.copy_from_slice(self.src))
     }
 }
 
 trait TryCopySliceExt<'a, T: Copy> {
-    fn try_copy_slice(&'a self) -> TryCopySliceSource<'a, T>;
+    fn try_copy_slice(&'a self)  -> TryCopySliceSource<'a, T>;
 }
 
 impl<'a, T: 'a + Copy, Ref: 'a + Borrow<[T]>> TryCopySliceExt<'a, T> for Ref {
-    fn try_copy_slice(&'a self) -> TryCopySliceSource<'a, T> {
-        TryCopySliceSource { src: self.borrow() }
+    fn try_copy_slice(&'a self)  -> TryCopySliceSource<'a, T> {
+        TryCopySliceSource {
+            src: self.borrow()
+        }
     }
 }
 
-let mut dst = b"Hello World"
-    .try_copy_slice()
-    .collect::<[u8; 11]>()
-    .unwrap();
+let mut dst = b"Hello World".try_copy_slice().collect::<[u8; 11]>().unwrap();
 assert_eq!(&dst[..], b"Hello World");
 assert_eq!(None, to(&mut dst[..], b"---".try_copy_slice()));
 ```

to/src/ops.rs

@@ -8,7 +8,7 @@ use crate::{with_destination, To};
 /// # Panics
 ///
 /// This function will panic if the two slices have different lengths.
-pub fn copy_slice<T>(origin: &[T]) -> impl To<[T], ()> + '_
+pub fn copy_slice<'a, T>(origin: &'a [T]) -> impl To<[T], ()> + 'a
 where
     T: Copy,
 {
@@ -23,7 +23,7 @@ where
 /// # Panics
 ///
 /// This function will panic if destination is shorter than origin.
-pub fn copy_slice_least_src<T>(origin: &[T]) -> impl To<[T], ()> + '_
+pub fn copy_slice_least_src<'a, T>(origin: &'a [T]) -> impl To<[T], ()> + 'a
 where
     T: Copy,
 {
@@ -34,7 +34,7 @@ where
 /// destination.
 ///
 /// Copies as much data as is present in the shorter slice.
-pub fn copy_slice_least<T>(origin: &[T]) -> impl To<[T], ()> + '_
+pub fn copy_slice_least<'a, T>(origin: &'a [T]) -> impl To<[T], ()> + 'a
 where
     T: Copy,
 {
@@ -47,7 +47,7 @@ where
 /// Function with destination that attempts to copy data from origin into the destination.
 ///
 /// Will return None if the slices are of different lengths.
-pub fn try_copy_slice<T>(origin: &[T]) -> impl To<[T], Option<()>> + '_
+pub fn try_copy_slice<'a, T>(origin: &'a [T]) -> impl To<[T], Option<()>> + 'a
 where
     T: Copy,
 {
@@ -62,7 +62,7 @@ where
 /// Destination may be longer than origin.
 ///
 /// Will return None if the destination is shorter than origin.
-pub fn try_copy_slice_least_src<T>(origin: &[T]) -> impl To<[T], Option<()>> + '_
+pub fn try_copy_slice_least_src<'a, T>(origin: &'a [T]) -> impl To<[T], Option<()>> + 'a
 where
     T: Copy,
 {
@@ -72,7 +72,7 @@ where
 }
 
 /// Function with destination that copies all data between two array references.
-pub fn copy_array<T, const N: usize>(origin: &[T; N]) -> impl To<[T; N], ()> + '_
+pub fn copy_array<'a, T, const N: usize>(origin: &'a [T; N]) -> impl To<[T; N], ()> + 'a
 where
     T: Copy,
 {

util/Cargo.toml

@@ -14,6 +14,3 @@ readme = "readme.md"
 [dependencies]
 base64 = { workspace = true }
 anyhow = { workspace = true }
-rustix = { workspace = true }
-typenum = { workspace = true }
-static_assertions = { workspace = true }

util/src/fd.rs

@@ -1,12 +0,0 @@
-use std::os::fd::{OwnedFd, RawFd};
-
-/// Clone some file descriptor
-///
-/// If the file descriptor is invalid, an error will be raised.
-pub fn claim_fd(fd: RawFd) -> anyhow::Result<OwnedFd> {
-    use rustix::{fd::BorrowedFd, io::dup};
-
-    // This is safe since [dup] will simply raise
-    let fd = unsafe { dup(BorrowedFd::borrow_raw(fd))? };
-    Ok(fd)
-}

util/src/file.rs

@@ -6,21 +6,21 @@ use std::{fs::OpenOptions, path::Path};
 
 /// Open a file writable
 pub fn fopen_w<P: AsRef<Path>>(path: P) -> std::io::Result<File> {
-    OpenOptions::new()
+    Ok(OpenOptions::new()
         .read(false)
         .write(true)
         .create(true)
         .truncate(true)
-        .open(path)
+        .open(path)?)
 }
 /// Open a file readable
 pub fn fopen_r<P: AsRef<Path>>(path: P) -> std::io::Result<File> {
-    OpenOptions::new()
+    Ok(OpenOptions::new()
         .read(true)
         .write(false)
         .create(false)
         .truncate(false)
-        .open(path)
+        .open(path)?)
 }
 
 pub trait ReadExactToEnd {

util/src/lib.rs

@@ -1,11 +1,7 @@
-#![recursion_limit = "256"]
-
 pub mod b64;
-pub mod fd;
 pub mod file;
 pub mod functional;
 pub mod mem;
 pub mod ord;
 pub mod result;
 pub mod time;
-pub mod typenum;

util/src/result.rs

@@ -1,6 +1,3 @@
-use std::convert::Infallible;
-use std::result::Result;
-
 /// Try block basically…returns a result and allows the use of the question mark operator inside
 #[macro_export]
 macro_rules! attempt {
@@ -8,92 +5,3 @@ macro_rules! attempt {
         (|| -> ::anyhow::Result<_> { $block })()
     };
 }
-
-/// Trait for container types that guarantee successful unwrapping.
-///
-/// The `.guaranteed()` function can be used over unwrap to show that
-/// the function will not panic.
-///
-/// Implementations must not panic.
-pub trait GuaranteedValue {
-    type Value;
-
-    /// Extract the contained value while being panic-safe, like .unwrap()
-    ///
-    /// # Panic Safety
-    ///
-    /// Implementations of guaranteed() must not panic.
-    fn guaranteed(self) -> Self::Value;
-}
-
-/// A result type that never contains an error.
-///
-/// This is mostly useful in generic contexts.
-///
-/// # Examples
-///
-/// ```
-/// use std::num::Wrapping;
-/// use std::result::Result;
-/// use std::convert::Infallible;
-/// use std::ops::Add;
-///
-/// use rosenpass_util::result::{Guaranteed, GuaranteedValue};
-///
-/// trait FailableAddition: Sized {
-///   type Error;
-///   fn failable_addition(&self, other: &Self) -> Result<Self, Self::Error>;
-/// }
-///
-/// #[derive(Copy, Clone, Debug, Eq, PartialEq)]
-/// struct OverflowError;
-///
-/// impl<T> FailableAddition for Wrapping<T>
-///   where for <'a> &'a Wrapping<T>: Add<Output = Wrapping<T>> {
-///   type Error = Infallible;
-///   fn failable_addition(&self, other: &Self) -> Guaranteed<Self> {
-///     Ok(self + other)
-///   }
-/// }
-///
-/// impl FailableAddition for u32 {
-///   type Error = OverflowError;
-///   fn failable_addition(&self, other: &Self) -> Result<Self, Self::Error> {
-///     match self.checked_add(*other) {
-///         Some(v) => Ok(v),
-///         None => Err(OverflowError),
-///     }
-///   }
-/// }
-///
-/// fn failable_multiply<T>(a: &T, b: u32)
-///         -> Result<T, T::Error>
-///     where
-///         T: FailableAddition {
-///     assert!(b >= 2); // Acceptable only because this is for demonstration purposes
-///     let mut accu = a.failable_addition(a)?;
-///     for _ in 2..b {
-///         accu = accu.failable_addition(a)?;
-///     }
-///     Ok(accu)
-/// }
-///
-/// // We can use .guaranteed() with Wrapping<u32>, since the operation uses
-/// // the Infallible error type.
-/// // We can also use unwrap which just happens to not raise an error.
-/// assert_eq!(failable_multiply(&Wrapping(42u32), 3).guaranteed(), Wrapping(126));
-/// assert_eq!(failable_multiply(&Wrapping(42u32), 3).unwrap(), Wrapping(126));
-///
-/// // We can not use .guaranteed() with u32, since there can be an error.
-/// // We can however use unwrap(), which may panic
-/// //assert_eq!(failable_multiply(&42u32, 3).guaranteed(), 126); // COMPILER ERROR
-/// assert_eq!(failable_multiply(&42u32, 3).unwrap(), 126);
-/// ```
-pub type Guaranteed<T> = Result<T, Infallible>;
-
-impl<T> GuaranteedValue for Guaranteed<T> {
-    type Value = T;
-    fn guaranteed(self) -> Self::Value {
-        self.unwrap()
-    }
-}

util/src/typenum.rs

@@ -1,341 +0,0 @@
-use typenum::bit::{B0, B1};
-use typenum::int::{NInt, PInt, Z0};
-use typenum::marker_traits as markers;
-use typenum::uint::{UInt, UTerm};
-
-/// Convenience macro to convert type numbers to constant integers
-#[macro_export]
-macro_rules! typenum2const {
-    ($val:ty) => {
-        typenum2const!($val as _)
-    };
-    ($val:ty as $type:ty) => {
-        <$val as $crate::typenum::IntoConst<$type>>::VALUE
-    };
-}
-
-/// Trait implemented by constant integers to facilitate conversion to constant integers
-pub trait IntoConst<T> {
-    const VALUE: T;
-}
-
-struct ConstApplyNegSign<T: AssociatedUnsigned, Param: IntoConst<<T as AssociatedUnsigned>::Type>>(
-    *const T,
-    *const Param,
-);
-struct ConstApplyPosSign<T: AssociatedUnsigned, Param: IntoConst<<T as AssociatedUnsigned>::Type>>(
-    *const T,
-    *const Param,
-);
-struct ConstLshift<T, Param: IntoConst<T>, const SHIFT: i32>(*const T, *const Param); // impl IntoConst<T>
-struct ConstAdd<T, Lhs: IntoConst<T>, Rhs: IntoConst<T>>(*const T, *const Lhs, *const Rhs); // impl IntoConst<T>
-
-/// Assigns an unsigned type to a signed type
-trait AssociatedUnsigned {
-    type Type;
-}
-
-macro_rules! impl_into_const {
-    ( $from:ty as $to:ty := $impl:expr) => {
-        impl IntoConst<$to> for $from {
-            const VALUE: $to = $impl;
-        }
-    };
-}
-
-macro_rules! impl_numeric_into_const_common {
-    ($type:ty) => {
-        impl_into_const! { Z0 as $type := 0 }
-        impl_into_const! { B0 as $type := 0 }
-        impl_into_const! { B1 as $type := 1 }
-        impl_into_const! { UTerm as $type := 0 }
-
-        impl<Param: IntoConst<$type>, const SHIFT: i32> IntoConst<$type>
-            for ConstLshift<$type, Param, SHIFT>
-        {
-            const VALUE: $type = Param::VALUE << SHIFT;
-        }
-
-        impl<Lhs: IntoConst<$type>, Rhs: IntoConst<$type>> IntoConst<$type>
-            for ConstAdd<$type, Lhs, Rhs>
-        {
-            const VALUE: $type =
-                <Lhs as IntoConst<$type>>::VALUE + <Rhs as IntoConst<$type>>::VALUE;
-        }
-    };
-}
-
-macro_rules! impl_numeric_into_const_unsigned {
-    ($($to_list:ty),*) =>  {
-        $( impl_numeric_into_const_unsigned! { @impl $to_list } )*
-    };
-
-    (@impl $type:ty) =>  {
-        impl_numeric_into_const_common!{ $type }
-
-        impl AssociatedUnsigned for $type {
-            type Type = $type;
-        }
-
-        impl<Param: IntoConst<$type>> IntoConst<$type> for ConstApplyPosSign<$type, Param> {
-            const VALUE : $type = Param::VALUE;
-        }
-    };
-}
-
-macro_rules! impl_numeric_into_const_signed {
-    ($($to_list:ty : $unsigned_list:ty),*) =>  {
-        $( impl_numeric_into_const_signed! { @impl $to_list : $unsigned_list} )*
-    };
-
-    (@impl $type:ty : $unsigned:ty) =>  {
-        impl_numeric_into_const_common!{ $type }
-
-        impl AssociatedUnsigned for $type {
-            type Type = $unsigned;
-        }
-
-        impl<Param: IntoConst<$unsigned>> IntoConst<$type> for ConstApplyPosSign<$type, Param> {
-            const VALUE : $type = Param::VALUE as $type;
-        }
-
-        impl<Param: IntoConst<$unsigned>> IntoConst<$type> for ConstApplyNegSign<$type, Param> {
-            const VALUE : $type =
-                if Param::VALUE == (1 as $unsigned).rotate_right(1) {
-                    // Handle the negative value without an associated positive value (e.g. -128
-                    // for i8)
-                    < $type >::MIN
-                } else {
-                    -(Param::VALUE as $type)
-                };
-        }
-    };
-}
-
-impl_into_const! { B0 as bool := false }
-impl_into_const! { B1 as bool := true }
-impl_numeric_into_const_unsigned! { usize, u8, u16, u32, u64, u128 }
-impl_numeric_into_const_signed! { isize : usize, i8 : u8, i16 : u16, i32 : u32, i64 : u64, i128 : u128 }
-
-// Unsigned type numbers to const integers
-impl<Ret, Rest, Bit> IntoConst<Ret> for UInt<Rest, Bit>
-where
-    Rest: IntoConst<Ret>,
-    Bit: IntoConst<Ret>,
-    ConstLshift<Ret, Rest, 1>: IntoConst<Ret>,
-    ConstAdd<Ret, ConstLshift<Ret, Rest, 1>, Bit>: IntoConst<Ret>,
-{
-    const VALUE: Ret = <ConstAdd<Ret, ConstLshift<Ret, Rest, 1>, Bit> as IntoConst<Ret>>::VALUE;
-}
-
-// Signed type numbers with positive sign to const integers
-impl<Ret, Unsigned> IntoConst<Ret> for PInt<Unsigned>
-where
-    Ret: AssociatedUnsigned,
-    Unsigned: markers::Unsigned + markers::NonZero + IntoConst<<Ret as AssociatedUnsigned>::Type>,
-    ConstApplyPosSign<Ret, Unsigned>: IntoConst<Ret>,
-{
-    const VALUE: Ret = <ConstApplyPosSign<Ret, Unsigned> as IntoConst<Ret>>::VALUE;
-}
-
-// Signed type numbers with negative sign to const integers
-impl<Ret, Unsigned> IntoConst<Ret> for NInt<Unsigned>
-where
-    Ret: AssociatedUnsigned,
-    Unsigned: markers::Unsigned + markers::NonZero + IntoConst<<Ret as AssociatedUnsigned>::Type>,
-    ConstApplyNegSign<Ret, Unsigned>: IntoConst<Ret>,
-{
-    const VALUE: Ret = <ConstApplyNegSign<Ret, Unsigned> as IntoConst<Ret>>::VALUE;
-}
-
-mod test {
-    use static_assertions::const_assert_eq;
-    use typenum::consts::*;
-    use typenum::op;
-
-    macro_rules! test_const_conversion {
-        // Type groups
-
-        (($($typenum:ty),*) >= u7 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (u8, u16, u32, u64, u128) = $const } )*
-            $( test_const_conversion! { ($typenum) as (i8, i16, i32, i64, i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= u8 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (u8, u16, u32, u64, u128) = $const } )*
-            $( test_const_conversion! { ($typenum) as (    i16, i32, i64, i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= u15 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (    u16, u32, u64, u128) = $const } )*
-            $( test_const_conversion! { ($typenum) as (    i16, i32, i64, i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= u16 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (    u16, u32, u64, u128) = $const } )*
-            $( test_const_conversion! { ($typenum) as (         i32, i64, i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= u31 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (         u32, u64, u128) = $const } )*
-            $( test_const_conversion! { ($typenum) as (         i32, i64, i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= u32 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (         u32, u64, u128) = $const } )*
-            $( test_const_conversion! { ($typenum) as (              i64, i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= u63 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (              u64, u128) = $const } )*
-            $( test_const_conversion! { ($typenum) as (              i64, i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= u64 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (              u64, u128) = $const } )*
-            $( test_const_conversion! { ($typenum) as (                   i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= u127 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (                   u128) = $const } )*
-            $( test_const_conversion! { ($typenum) as (                   i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= u128 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (                   u128) = $const } )*
-            $( test_const_conversion! { ($typenum) as (                       ) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= i8 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (i8, i16, i32, i64, i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= i16 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (    i16, i32, i64, i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= i32 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (         i32, i64, i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= i64 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (              i64, i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) >= i128 = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { ($typenum) as (                   i128) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        // Basic operation
-
-        () => {};
-
-        (($($typenum:ty),*) as () = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) as ($type:ty) = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { @impl ($typenum) as ($type) = $const } )*
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (($($typenum:ty),*) as ($type_head:ty, $($type_tail:ty),*) = $const:expr $(; $($rest:tt)*)?) => {
-            $( test_const_conversion! { @impl ($typenum) as ($type_head) = $const } )*
-            test_const_conversion! { ($($typenum),*) as ($($type_tail),*) = $const }
-            $( test_const_conversion! { $($rest)* } )?
-        };
-
-        (@impl ($typenum:ty) as ($type:ty) = $const:expr $(; $($rest:tt)*)?) => {
-            const_assert_eq!(typenum2const!($typenum as $type), $const);
-            $( test_const_conversion!($($rest)*); )?
-        };
-    }
-
-    test_const_conversion! {
-        (B0, False) as (bool, bool) = false;
-
-        (B0, U0, Z0) >= u7 = 0;
-        (B1, U1, P1) >= u7 = 1;
-
-        (U2, P2) >= u7 = 2;
-        (B1, True) as (bool) = true;
-        (U3, P3) >= u7 = 3;
-        (U8, P8) >= u7 = 8;
-        (U127, P127) >= u7 = 127;
-        (U220, P220) >= u8 = 220;
-        (U255, P255) >= u8 = 255;
-        (U1000, P1000) >= u15 = 1000;
-        (U10000, P10000) >= u15 = 10000;
-        (U16384, P16384) >= u15 = 16384;
-        (U32768, P32768) >= u16 = 32768;
-        (U65536, P65536) >= u31 = 65536;
-        (U100000, P100000) >= u31 = 100000;
-        (U1000000000, P1000000000) >= u31 = 1000000000;
-        (U2147483648, P2147483648) >= u32 = 2147483648;
-        (U1000000000000000000, P1000000000000000000) >= u63 = 1000000000000000000;
-        (U1000000000000000000, P1000000000000000000) >= u63 = 1000000000000000000;
-
-        (U9223372036854775808) >= u64 = 9223372036854775808;
-        (U10000000000000000000) >= u64 = 10000000000000000000;
-
-        (N10000) >= i16 = -10000;
-        (N1000000) >= i32 = -1000000;
-        (N1000000000) >= i32 = -1000000000;
-        (N1000000000000) >= i64 = -1000000000000;
-    }
-
-    const_assert_eq!(127, (!(1u8.rotate_right(1)) - 0) as _);
-    const_assert_eq!(126, (!(1u8.rotate_right(1)) - 1) as _);
-    const_assert_eq!(255, (!(0u8.rotate_right(1)) - 0) as _);
-    const_assert_eq!(254, (!(0u8.rotate_right(1)) - 1) as _);
-
-    test_const_conversion! {
-        (op!(pow(U2, U7) - U1))   >= u7   = (!(1u8.rotate_right(1)) - 0) as _;
-        (op!(pow(U2, U7) - U2))   >= u7   = (!(1u8.rotate_right(1)) - 1) as _;
-        (op!(pow(U2, U15) - U1))  >= u15  = (!(1u16.rotate_right(1)) - 0) as _;
-        (op!(pow(U2, U15) - U2))  >= u15  = (!(1u16.rotate_right(1)) - 1) as _;
-        (op!(pow(U2, U31) - U1))  >= u31  = (!(1u32.rotate_right(1)) - 0) as _;
-        (op!(pow(U2, U31) - U2))  >= u31  = (!(1u32.rotate_right(1)) - 1) as _;
-        (op!(pow(U2, U63) - U1))  >= u63  = (!(1u64.rotate_right(1)) - 0) as _;
-        (op!(pow(U2, U63) - U2))  >= u63  = (!(1u64.rotate_right(1)) - 1) as _;
-        (op!(pow(U2, U127) - U1)) >= u127 = (!(1u128.rotate_right(1)) - 0) as _;
-        (op!(pow(U2, U127) - U2)) >= u127 = (!(1u128.rotate_right(1)) - 1) as _;
-
-        (op!(pow(U2, U8) - U1))   >= u8   = (u8::MAX - 0) as _;
-        (op!(pow(U2, U8) - U2))   >= u8   = (u8::MAX - 1) as _;
-        (op!(pow(U2, U16) - U1))  >= u16  = (u16::MAX - 0) as _;
-        (op!(pow(U2, U16) - U2))  >= u16  = (u16::MAX - 1) as _;
-        (op!(pow(U2, U32) - U1))  >= u32  = (u32::MAX - 0) as _;
-        (op!(pow(U2, U32) - U2))  >= u32  = (u32::MAX - 1) as _;
-        (op!(pow(U2, U64) - U1))  >= u64  = (u64::MAX - 0) as _;
-        (op!(pow(U2, U64) - U2))  >= u64  = (u64::MAX - 1) as _;
-        (op!(pow(U2, U128) - U1)) >= u128 = (u128::MAX - 0) as _;
-        (op!(pow(U2, U128) - U2)) >= u128 = (u128::MAX - 1) as _;
-
-        (op!(Z0 - pow(P2, P7) + Z0)) >= i8 = (i8::MIN + 0) as _;
-        (op!(Z0 - pow(P2, P7) + P1)) >= i8 = (i8::MIN + 1) as _;
-        (op!(Z0 - pow(P2, P15) + Z0)) >= i16 = (i16::MIN + 0) as _;
-        (op!(Z0 - pow(P2, P15) + P1)) >= i16 = (i16::MIN + 1) as _;
-        (op!(Z0 - pow(P2, P31) + Z0)) >= i32 = (i32::MIN + 0) as _;
-        (op!(Z0 - pow(P2, P31) + P1)) >= i32 = (i32::MIN + 1) as _;
-        (op!(Z0 - pow(P2, P63) + Z0)) >= i64 = (i64::MIN + 0) as _;
-        (op!(Z0 - pow(P2, P63) + P1)) >= i64 = (i64::MIN + 1) as _;
-        (op!(Z0 - pow(P2, P127) + Z0)) >= i128 = (i128::MIN + 0) as _;
-        (op!(Z0 - pow(P2, P127) + P1)) >= i128 = (i128::MIN + 1) as _;
-    }
-}

wireguard-broker/Cargo.toml

@@ -1,42 +0,0 @@
-[package]
-name = "rosenpass-wireguard-broker"
-authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
-version = "0.1.0"
-edition = "2021"
-license = "MIT OR Apache-2.0"
-description = "Rosenpass internal broker that runs as root and supplies exchanged keys to the kernel."
-homepage = "https://rosenpass.eu/"
-repository = "https://github.com/rosenpass/rosenpass"
-readme = "readme.md"
-
-[dependencies]
-thiserror = { workspace = true }
-rosenpass-lenses = { workspace = true }
-paste = { workspace = true } # TODO: Using lenses should not necessitate importing paste
-
-# Privileged only
-wireguard-uapi = { workspace = true }
-
-# Socket handler only
-rosenpass-to = { workspace = true }
-tokio = { workspace = true }
-anyhow = { workspace = true }
-clap = { workspace = true }
-env_logger = { workspace = true }
-log = { workspace = true }
-
-# Mio broker client
-mio = { workspace = true }
-rosenpass-util = { workspace = true }
-
-[[bin]]
-name = "rosenpass-wireguard-broker-privileged"
-path = "src/bin/priviledged.rs"
-test = false
-doc = false
-
-[[bin]]
-name = "rosenpass-wireguard-broker-socket-handler"
-test = false
-path = "src/bin/socket_handler.rs"
-doc = false

wireguard-broker/readme.md

@@ -1,5 +0,0 @@
-# Rosenpass internal broker supplying WireGuard with keys.
-
-This crate contains a small application purpose-built to supply WireGuard in the linux kernel with pre-shared keys.
-
-This is an internal library; not guarantee is made about its API at this point in time.

wireguard-broker/src/api/client.rs

@@ -1,152 +0,0 @@
-use std::{borrow::BorrowMut, marker::PhantomData};
-
-use rosenpass_lenses::LenseView;
-
-use crate::{
-    api::msgs::{self, EnvelopeExt, SetPskRequestExt, SetPskResponseExt},
-    WireGuardBroker,
-};
-
-#[derive(thiserror::Error, Debug, Clone, Eq, PartialEq)]
-pub enum BrokerClientPollResponseError<RecvError> {
-    #[error(transparent)]
-    IoError(RecvError),
-    #[error("Invalid message.")]
-    InvalidMessage,
-}
-
-impl<RecvError> From<msgs::InvalidMessageTypeError> for BrokerClientPollResponseError<RecvError> {
-    fn from(value: msgs::InvalidMessageTypeError) -> Self {
-        let msgs::InvalidMessageTypeError = value; // Assert that this is a unit type
-        BrokerClientPollResponseError::<RecvError>::InvalidMessage
-    }
-}
-
-fn io_pollerr<RecvError>(e: RecvError) -> BrokerClientPollResponseError<RecvError> {
-    BrokerClientPollResponseError::<RecvError>::IoError(e)
-}
-
-fn invalid_msg_pollerr<RecvError>() -> BrokerClientPollResponseError<RecvError> {
-    BrokerClientPollResponseError::<RecvError>::InvalidMessage
-}
-
-#[derive(thiserror::Error, Debug, Clone, Eq, PartialEq)]
-pub enum BrokerClientSetPskError<SendError> {
-    #[error(transparent)]
-    IoError(SendError),
-    #[error("Interface name out of bounds")]
-    IfaceOutOfBounds,
-}
-
-pub trait BrokerClientIo {
-    type SendError;
-    type RecvError;
-
-    fn send_msg(&mut self, buf: &[u8]) -> Result<(), Self::SendError>;
-    fn recv_msg(&mut self) -> Result<Option<&[u8]>, Self::RecvError>;
-}
-
-#[derive(Debug)]
-pub struct BrokerClient<'a, Io, IoRef>
-where
-    Io: BrokerClientIo,
-    IoRef: 'a + BorrowMut<Io>,
-{
-    io: IoRef,
-    _phantom_io: PhantomData<&'a mut Io>,
-}
-
-impl<'a, Io, IoRef> BrokerClient<'a, Io, IoRef>
-where
-    Io: BrokerClientIo,
-    IoRef: 'a + BorrowMut<Io>,
-{
-    pub fn new(io: IoRef) -> Self {
-        Self {
-            io,
-            _phantom_io: PhantomData,
-        }
-    }
-
-    pub fn io(&self) -> &IoRef {
-        &self.io
-    }
-
-    pub fn io_mut(&mut self) -> &mut IoRef {
-        &mut self.io
-    }
-
-    pub fn poll_response(
-        &mut self,
-    ) -> Result<Option<msgs::SetPskResult>, BrokerClientPollResponseError<Io::RecvError>> {
-        let res: &[u8] = match self.io.borrow_mut().recv_msg().map_err(io_pollerr)? {
-            Some(r) => r,
-            None => return Ok(None),
-        };
-
-        let typ = res.get(0).ok_or(invalid_msg_pollerr())?;
-        let typ = msgs::MsgType::try_from(*typ)?;
-        let msgs::MsgType::SetPsk = typ; // Assert type
-
-        let res: msgs::Envelope<_, msgs::SetPskResponse<&[u8]>> = res
-            .envelope_truncating()
-            .map_err(|_| invalid_msg_pollerr())?;
-        let res: msgs::SetPskResponse<&[u8]> = res
-            .payload()
-            .set_psk_response()
-            .map_err(|_| invalid_msg_pollerr())?;
-        let res: msgs::SetPskResponseReturnCode = res.return_code()[0]
-            .try_into()
-            .map_err(|_| invalid_msg_pollerr())?;
-        let res: msgs::SetPskResult = res.into();
-
-        Ok(Some(res))
-    }
-}
-
-impl<'a, Io, IoRef> WireGuardBroker for BrokerClient<'a, Io, IoRef>
-where
-    Io: BrokerClientIo,
-    IoRef: 'a + BorrowMut<Io>,
-{
-    type Error = BrokerClientSetPskError<Io::SendError>;
-
-    fn set_psk(
-        &mut self,
-        iface: &str,
-        peer_id: [u8; 32],
-        psk: [u8; 32],
-    ) -> Result<(), Self::Error> {
-        use BrokerClientSetPskError::*;
-        const BUF_SIZE: usize = <msgs::Envelope<(), msgs::SetPskRequest<()>> as LenseView>::LEN;
-
-        // Allocate message
-        let mut req = [0u8; BUF_SIZE];
-
-        // Construct message view
-        let mut req: msgs::Envelope<_, msgs::SetPskRequest<&mut [u8]>> =
-            (&mut req as &mut [u8]).envelope_truncating().unwrap();
-
-        // Populate envelope
-        req.msg_type_mut()
-            .copy_from_slice(&[msgs::MsgType::SetPsk as u8]);
-        {
-            // Derived payload
-            let mut req: msgs::SetPskRequest<&mut [u8]> =
-                req.payload_mut().set_psk_request().unwrap();
-
-            // Populate payload
-            req.peer_id_mut().copy_from_slice(&peer_id);
-            req.psk_mut().copy_from_slice(&psk);
-            req.set_iface(iface).ok_or(IfaceOutOfBounds)?;
-        }
-
-        // Send message
-        self.io
-            .borrow_mut()
-            .send_msg(req.all_bytes())
-            .map_err(IoError)?;
-
-        Ok(())
-    }
-}

wireguard-broker/src/api/mio_client.rs

@@ -1,204 +0,0 @@
-use std::collections::VecDeque;
-use std::io::{ErrorKind, Read, Write};
-
-use anyhow::{bail, ensure};
-
-use crate::WireGuardBroker;
-
-use super::client::{
-    BrokerClient, BrokerClientIo, BrokerClientPollResponseError, BrokerClientSetPskError,
-};
-use super::msgs;
-
-#[derive(Debug)]
-pub struct MioBrokerClient {
-    inner: BrokerClient<'static, MioBrokerClientIo, MioBrokerClientIo>,
-}
-
-#[derive(Debug)]
-struct MioBrokerClientIo {
-    socket: mio::net::UnixStream,
-    send_buf: VecDeque<u8>,
-    receiving_size: bool,
-    recv_buf: Vec<u8>,
-    recv_off: usize,
-}
-
-impl MioBrokerClient {
-    pub fn new(socket: mio::net::UnixStream) -> Self {
-        let io = MioBrokerClientIo {
-            socket,
-            send_buf: VecDeque::new(),
-            receiving_size: false,
-            recv_buf: Vec::new(),
-            recv_off: 0,
-        };
-        let inner = BrokerClient::new(io);
-        Self { inner }
-    }
-
-    pub fn poll(&mut self) -> anyhow::Result<Option<msgs::SetPskResult>> {
-        self.inner.io_mut().flush()?;
-
-        // This sucks
-        match self.inner.poll_response() {
-            Ok(res) => {
-                return Ok(res);
-            }
-            Err(BrokerClientPollResponseError::IoError(e)) => {
-                return Err(e);
-            }
-            Err(BrokerClientPollResponseError::InvalidMessage) => {
-                bail!("Invalid message");
-            }
-        };
-    }
-}
-
-impl WireGuardBroker for MioBrokerClient {
-    type Error = anyhow::Error;
-
-    fn set_psk(&mut self, iface: &str, peer_id: [u8; 32], psk: [u8; 32]) -> anyhow::Result<()> {
-        use BrokerClientSetPskError::*;
-        let e = self.inner.set_psk(iface, peer_id, psk);
-        match e {
-            Ok(()) => Ok(()),
-            Err(IoError(e)) => Err(e),
-            Err(IfaceOutOfBounds) => bail!("Interface name size is out of bounds."),
-        }
-    }
-}
-
-impl BrokerClientIo for MioBrokerClientIo {
-    type SendError = anyhow::Error;
-    type RecvError = anyhow::Error;
-
-    fn send_msg(&mut self, buf: &[u8]) -> Result<(), Self::SendError> {
-        self.flush()?;
-        self.send_or_buffer(&(buf.len() as u64).to_le_bytes())?;
-        self.send_or_buffer(&buf)?;
-        self.flush()?;
-
-        Ok(())
-    }
-
-    fn recv_msg(&mut self) -> Result<Option<&[u8]>, Self::RecvError> {
-        // Stale message in receive buffer. Reset!
-        if self.recv_off == self.recv_buf.len() {
-            self.receiving_size = true;
-            self.recv_off = 0;
-            self.recv_buf.resize(8, 0);
-        }
-
-        // Try filling the receive buffer
-        self.recv_off += raw_recv(&self.socket, &mut self.recv_buf[self.recv_off..])?;
-        if self.recv_off < self.recv_buf.len() {
-            return Ok(None);
-        }
-
-        // Received size, now start receiving
-        if self.receiving_size {
-            // Received the size
-            // Parse the received length
-            let len: &[u8; 8] = self.recv_buf[..].try_into().unwrap();
-            let len: usize = u64::from_le_bytes(*len) as usize;
-
-            ensure!(
-                len <= msgs::RESPONSE_MSG_BUFFER_SIZE,
-                "Oversized buffer ({len}) in psk buffer response."
-            );
-
-            // Prepare the message buffer for receiving an actual message of the given size
-            self.receiving_size = false;
-            self.recv_off = 0;
-            self.recv_buf.resize(len, 0);
-
-            // Try to receive the message
-            return self.recv_msg();
-        }
-
-        // Received an actual message
-        return Ok(Some(&self.recv_buf[..]));
-    }
-}
-
-impl MioBrokerClientIo {
-    fn flush(&mut self) -> anyhow::Result<()> {
-        let (fst, snd) = self.send_buf.as_slices();
-
-        let (written, res) = match raw_send(&self.socket, fst) {
-            Ok(w1) if w1 >= fst.len() => match raw_send(&self.socket, snd) {
-                Ok(w2) => (w1 + w2, Ok(())),
-                Err(e) => (w1, Err(e)),
-            },
-            Ok(w1) => (w1, Ok(())),
-            Err(e) => (0, Err(e)),
-        };
-
-        self.send_buf.drain(..written);
-
-        (&self.socket).try_io(|| (&self.socket).flush())?;
-
-        res
-    }
-
-    fn send_or_buffer(&mut self, buf: &[u8]) -> anyhow::Result<()> {
-        let mut off = 0;
-
-        if self.send_buf.is_empty() {
-            off += raw_send(&self.socket, buf)?;
-        }
-
-        self.send_buf.extend((&buf[off..]).iter());
-
-        Ok(())
-    }
-}
-
-fn raw_send(mut socket: &mio::net::UnixStream, data: &[u8]) -> anyhow::Result<usize> {
-    let mut off = 0;
-
-    socket.try_io(|| {
-        loop {
-            if off == data.len() {
-                return Ok(());
-            }
-            match socket.write(&data[off..]) {
-                Ok(n) => {
-                    off += n;
-                }
-                Err(e) if e.kind() == ErrorKind::Interrupted => {
-                    // pass – retry
-                }
-                Err(e) if off > 0 || e.kind() == ErrorKind::WouldBlock => return Ok(()),
-                Err(e) => return Err(e),
-            }
-        }
-    })?;
-
-    return Ok(off);
-}
-
-fn raw_recv(mut socket: &mio::net::UnixStream, out: &mut [u8]) -> anyhow::Result<usize> {
-    let mut off = 0;
-
-    socket.try_io(|| {
-        loop {
-            if off == out.len() {
-                return Ok(());
-            }
-            match socket.read(&mut out[off..]) {
-                Ok(n) => {
-                    off += n;
-                }
-                Err(e) if e.kind() == ErrorKind::Interrupted => {
-                    // pass – retry
-                }
-                Err(e) if off > 0 || e.kind() == ErrorKind::WouldBlock => return Ok(()),
-                Err(e) => return Err(e),
-            }
-        }
-    })?;
-
-    return Ok(off);
-}

wireguard-broker/src/api/mod.rs

@@ -1,4 +0,0 @@
-pub mod client;
-pub mod mio_client;
-pub mod msgs;
-pub mod server;

wireguard-broker/src/api/msgs.rs

@@ -1,140 +0,0 @@
-use std::result::Result;
-use std::str::{from_utf8, Utf8Error};
-
-use rosenpass_lenses::{lense, LenseView};
-
-pub const REQUEST_MSG_BUFFER_SIZE: usize = <Envelope<(), SetPskRequest<()>> as LenseView>::LEN;
-pub const RESPONSE_MSG_BUFFER_SIZE: usize = <Envelope<(), SetPskResponse<()>> as LenseView>::LEN;
-
-lense! { Envelope<M> :=
-    /// [MsgType] of this message
-    msg_type: 1,
-    /// Reserved for future use
-    reserved: 3,
-    /// The actual Paylod
-    payload: M::LEN
-}
-
-lense! { SetPskRequest :=
-    peer_id: 32,
-    psk: 32,
-    iface_size: 1, // TODO: We should have variable length strings in lenses
-    iface_buf: 255
-}
-
-impl SetPskRequest<&[u8]> {
-    pub fn iface_bin(&self) -> &[u8] {
-        let len = self.iface_size()[0] as usize;
-        &self.iface_buf()[..len]
-    }
-
-    pub fn iface(&self) -> Result<&str, Utf8Error> {
-        from_utf8(self.iface_bin())
-    }
-}
-
-impl SetPskRequest<&mut [u8]> {
-    pub fn set_iface_bin(&mut self, iface: &[u8]) -> Option<()> {
-        (iface.len() < 256).then_some(())?; // Assert iface.len() < 256
-
-        self.iface_size_mut()[0] = iface.len() as u8;
-
-        self.iface_buf_mut().fill(0);
-        (&mut self.iface_buf_mut()[..iface.len()]).copy_from_slice(iface);
-
-        Some(())
-    }
-
-    pub fn set_iface(&mut self, iface: &str) -> Option<()> {
-        self.set_iface_bin(iface.as_bytes())
-    }
-}
-
-lense! { SetPskResponse :=
-    return_code: 1
-}
-
-#[derive(thiserror::Error, Debug, Clone, Eq, PartialEq)]
-pub enum SetPskError {
-    #[error("The wireguard pre-shared-key assignment broker experienced an internal error.")]
-    InternalError,
-    #[error("The indicated wireguard interface does not exist")]
-    NoSuchInterface,
-    #[error("The indicated peer does not exist on the wireguard interface")]
-    NoSuchPeer,
-}
-
-pub type SetPskResult = Result<(), SetPskError>;
-
-#[repr(u8)]
-#[derive(Hash, PartialEq, Eq, PartialOrd, Ord, Debug, Clone, Copy)]
-pub enum SetPskResponseReturnCode {
-    Success = 0x00,
-    InternalError = 0x01,
-    NoSuchInterface = 0x02,
-    NoSuchPeer = 0x03,
-}
-
-#[derive(Eq, PartialEq, Debug, Clone)]
-pub struct InvalidSetPskResponseError;
-
-impl TryFrom<u8> for SetPskResponseReturnCode {
-    type Error = InvalidSetPskResponseError;
-
-    fn try_from(value: u8) -> Result<Self, Self::Error> {
-        use SetPskResponseReturnCode::*;
-        match value {
-            0x00 => Ok(Success),
-            0x01 => Ok(InternalError),
-            0x02 => Ok(NoSuchInterface),
-            0x03 => Ok(NoSuchPeer),
-            _ => Err(InvalidSetPskResponseError),
-        }
-    }
-}
-
-impl From<SetPskResponseReturnCode> for SetPskResult {
-    fn from(value: SetPskResponseReturnCode) -> Self {
-        use SetPskError as E;
-        use SetPskResponseReturnCode as C;
-        match value {
-            C::Success => Ok(()),
-            C::InternalError => Err(E::InternalError),
-            C::NoSuchInterface => Err(E::NoSuchInterface),
-            C::NoSuchPeer => Err(E::NoSuchPeer),
-        }
-    }
-}
-
-impl From<SetPskResult> for SetPskResponseReturnCode {
-    fn from(value: SetPskResult) -> Self {
-        use SetPskError as E;
-        use SetPskResponseReturnCode as C;
-        match value {
-            Ok(()) => C::Success,
-            Err(E::InternalError) => C::InternalError,
-            Err(E::NoSuchInterface) => C::NoSuchInterface,
-            Err(E::NoSuchPeer) => C::NoSuchPeer,
-        }
-    }
-}
-
-#[repr(u8)]
-#[derive(Hash, PartialEq, Eq, PartialOrd, Ord, Debug, Clone, Copy)]
-pub enum MsgType {
-    SetPsk = 0x01,
-}
-
-#[derive(Eq, PartialEq, Debug, Clone)]
-pub struct InvalidMessageTypeError;
-
-impl TryFrom<u8> for MsgType {
-    type Error = InvalidMessageTypeError;
-
-    fn try_from(value: u8) -> Result<Self, Self::Error> {
-        match value {
-            0x01 => Ok(MsgType::SetPsk),
-            _ => Err(InvalidMessageTypeError),
-        }
-    }
-}

wireguard-broker/src/api/server.rs

@@ -1,99 +0,0 @@
-use std::borrow::BorrowMut;
-use std::marker::PhantomData;
-use std::result::Result;
-
-use rosenpass_lenses::LenseError;
-
-use crate::api::msgs::{self, EnvelopeExt, SetPskRequestExt, SetPskResponseExt};
-use crate::WireGuardBroker;
-
-#[derive(thiserror::Error, Debug, Clone, Eq, PartialEq)]
-pub enum BrokerServerError {
-    #[error("No such request type: {}", .0)]
-    NoSuchRequestType(u8),
-    #[error("Invalid message received.")]
-    InvalidMessage,
-}
-
-impl From<LenseError> for BrokerServerError {
-    fn from(value: LenseError) -> Self {
-        use BrokerServerError as Be;
-        use LenseError as Le;
-        match value {
-            Le::BufferSizeMismatch => Be::InvalidMessage,
-        }
-    }
-}
-
-impl From<msgs::InvalidMessageTypeError> for BrokerServerError {
-    fn from(value: msgs::InvalidMessageTypeError) -> Self {
-        let msgs::InvalidMessageTypeError = value; // Assert that this is a unit type
-        BrokerServerError::InvalidMessage
-    }
-}
-
-pub struct BrokerServer<'a, Err, Inner, Ref>
-where
-    msgs::SetPskError: From<Err>,
-    Inner: WireGuardBroker<Error = Err>,
-    Ref: BorrowMut<Inner> + 'a,
-{
-    inner: Ref,
-    _phantom: PhantomData<&'a mut Inner>,
-}
-
-impl<'a, Err, Inner, Ref> BrokerServer<'a, Err, Inner, Ref>
-where
-    msgs::SetPskError: From<Err>,
-    Inner: WireGuardBroker<Error = Err>,
-    Ref: 'a + BorrowMut<Inner>,
-{
-    pub fn new(inner: Ref) -> Self {
-        Self {
-            inner,
-            _phantom: PhantomData,
-        }
-    }
-
-    pub fn handle_message(
-        &mut self,
-        req: &[u8],
-        res: &mut [u8; msgs::RESPONSE_MSG_BUFFER_SIZE],
-    ) -> Result<usize, BrokerServerError> {
-        use BrokerServerError::*;
-
-        let typ = req.get(0).ok_or(InvalidMessage)?;
-        let typ = msgs::MsgType::try_from(*typ)?;
-        let msgs::MsgType::SetPsk = typ; // Assert type
-
-        let req: msgs::Envelope<_, msgs::SetPskRequest<&[u8]>> = req.envelope_truncating()?;
-        let mut res: msgs::Envelope<_, msgs::SetPskResponse<&mut [u8]>> =
-            (res as &mut [u8]).envelope_truncating()?;
-        (&mut res).msg_type_mut()[0] = msgs::MsgType::SetPsk as u8;
-        self.handle_set_psk(
-            req.payload().set_psk_request()?,
-            res.payload_mut().set_psk_response()?,
-        )?;
-        Ok(res.all_bytes().len())
-    }
-
-    fn handle_set_psk(
-        &mut self,
-        req: msgs::SetPskRequest<&[u8]>,
-        mut res: msgs::SetPskResponse<&mut [u8]>,
-    ) -> Result<(), BrokerServerError> {
-        // Using unwrap here since lenses can not return fixed-size arrays
-        // TODO: Slices should give access to fixed size arrays
-        let r: Result<(), Err> = self.inner.borrow_mut().set_psk(
-            req.iface()
-                .map_err(|_e| BrokerServerError::InvalidMessage)?,
-            req.peer_id().try_into().unwrap(),
-            req.psk().try_into().unwrap(),
-        );
-        let r: msgs::SetPskResult = r.map_err(|e| e.into());
-        let r: msgs::SetPskResponseReturnCode = r.into();
-        res.return_code_mut()[0] = r as u8;
-
-        Ok(())
-    }
-}

wireguard-broker/src/bin/priviledged.rs

@@ -1,56 +0,0 @@
-use std::io::{stdin, stdout, Read, Write};
-use std::result::Result;
-
-use rosenpass_wireguard_broker::api::msgs;
-use rosenpass_wireguard_broker::api::server::BrokerServer;
-use rosenpass_wireguard_broker::netlink as wg;
-
-#[derive(thiserror::Error, Debug)]
-pub enum BrokerAppError {
-    #[error(transparent)]
-    IoError(#[from] std::io::Error),
-    #[error(transparent)]
-    WgConnectError(#[from] wg::ConnectError),
-    #[error(transparent)]
-    WgSetPskError(#[from] wg::SetPskError),
-    #[error("Oversized message {}; something about the request is fatally wrong", .0)]
-    OversizedMessage(u64),
-}
-
-fn main() -> Result<(), BrokerAppError> {
-    let mut broker = BrokerServer::new(wg::NetlinkWireGuardBroker::new()?);
-
-    let mut stdin = stdin().lock();
-    let mut stdout = stdout().lock();
-    loop {
-        // Read the message length
-        let mut len = [0u8; 8];
-        stdin.read_exact(&mut len)?;
-
-        // Parse the message length
-        let len = u64::from_le_bytes(len);
-        if (len as usize) > msgs::REQUEST_MSG_BUFFER_SIZE {
-            return Err(BrokerAppError::OversizedMessage(len));
-        }
-
-        // Read the message itself
-        let mut req_buf = [0u8; msgs::REQUEST_MSG_BUFFER_SIZE];
-        let req_buf = &mut req_buf[..(len as usize)];
-        stdin.read_exact(req_buf)?;
-
-        // Process the message
-        let mut res_buf = [0u8; msgs::RESPONSE_MSG_BUFFER_SIZE];
-        let res = match broker.handle_message(req_buf, &mut res_buf) {
-            Ok(len) => &res_buf[..len],
-            Err(e) => {
-                eprintln!("Error processing message for wireguard PSK broker: {e:?}");
-                continue;
-            }
-        };
-
-        // Write the response
-        stdout.write_all(&(res.len() as u64).to_le_bytes())?;
-        stdout.write_all(&res)?;
-        stdout.flush()?;
-    }
-}

wireguard-broker/src/bin/socket_handler.rs

@@ -1,191 +0,0 @@
-use std::process::Stdio;
-
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::net::{UnixListener, UnixStream};
-use tokio::process::Command;
-use tokio::sync::{mpsc, oneshot};
-use tokio::task;
-
-use anyhow::{bail, ensure, Result};
-use clap::{ArgGroup, Parser};
-
-use rosenpass_util::fd::claim_fd;
-use rosenpass_wireguard_broker::api::msgs;
-
-#[derive(Parser, Debug)]
-#[command(author, version, about, long_about = None)]
-#[clap(group(
-            ArgGroup::new("socket")
-                .required(true)
-                .args(&["listen_path", "listen_fd", "stream_fd"]),
-        ))]
-struct Args {
-    /// Where in the file-system to create the unix socket this broker will be listening for
-    /// connections on
-    #[arg(long)]
-    listen_path: Option<String>,
-
-    /// When this broker is called from another process, the other process can open and bind the
-    /// unix socket to use themselves, passing it to this process. In Rust this can be achieved
-    /// using the [command-fds](https://docs.rs/command-fds/latest/command_fds/) crate.
-    #[arg(long)]
-    listen_fd: Option<i32>,
-
-    /// When this broker is called from another process, the other process can connect the unix socket
-    /// themselves, for instance using the `socketpair(2)` system call.
-    #[arg(long)]
-    stream_fd: Option<i32>,
-
-    /// The underlying broker, accepting commands through stdin and sending results through stdout.
-    #[arg(
-        last = true,
-        allow_hyphen_values = true,
-        default_value = "rosenpass-wireguard-broker-privileged"
-    )]
-    command: Vec<String>,
-}
-
-struct BrokerRequest {
-    reply_to: oneshot::Sender<BrokerResponse>,
-    request: Vec<u8>,
-}
-
-struct BrokerResponse {
-    response: Vec<u8>,
-}
-
-#[tokio::main]
-async fn main() -> Result<()> {
-    env_logger::init();
-
-    let args = Args::parse();
-
-    let (proc_tx, proc_rx) = mpsc::channel(100);
-
-    // Start the inner broker handler
-    task::spawn(async move {
-        if let Err(e) = direct_broker_process(proc_rx, args.command).await {
-            log::error!("Error in broker command handler: {e}");
-            panic!("Can not proceed without underlying broker process");
-        }
-    });
-
-    // Listen for incoming requests
-    if let Some(path) = args.listen_path {
-        let sock = UnixListener::bind(path)?;
-        listen_for_clients(proc_tx, sock).await
-    } else if let Some(fd) = args.listen_fd {
-        let sock = std::os::unix::net::UnixListener::from(claim_fd(fd)?);
-        sock.set_nonblocking(true)?;
-        listen_for_clients(proc_tx, UnixListener::from_std(sock)?).await
-    } else if let Some(fd) = args.stream_fd {
-        let stream = std::os::unix::net::UnixStream::from(claim_fd(fd)?);
-        stream.set_nonblocking(true)?;
-        on_accept(proc_tx, UnixStream::from_std(stream)?).await
-    } else {
-        unreachable!();
-    }
-}
-
-async fn direct_broker_process(
-    mut queue: mpsc::Receiver<BrokerRequest>,
-    cmd: Vec<String>,
-) -> Result<()> {
-    let proc = Command::new(&cmd[0])
-        .args(&cmd[1..])
-        .stdin(Stdio::piped())
-        .stdout(Stdio::piped())
-        .spawn()?;
-
-    let mut stdin = proc.stdin.unwrap();
-    let mut stdout = proc.stdout.unwrap();
-
-    loop {
-        let BrokerRequest { reply_to, request } = queue.recv().await.unwrap();
-
-        stdin
-            .write_all(&(request.len() as u64).to_le_bytes())
-            .await?;
-        stdin.write_all(&request[..]).await?;
-
-        // Read the response length
-        let mut len = [0u8; 8];
-        stdout.read_exact(&mut len).await?;
-
-        // Parse the response length
-        let len = u64::from_le_bytes(len) as usize;
-        ensure!(
-            len <= msgs::RESPONSE_MSG_BUFFER_SIZE,
-            "Oversized buffer ({len}) in broker stdout."
-        );
-
-        // Read the message itself
-        let mut res_buf = request; // Avoid allocating memory if we don't have to
-        res_buf.resize(len as usize, 0);
-        stdout.read_exact(&mut res_buf[..len]).await?;
-
-        // Return to the unix socket connection worker
-        reply_to
-            .send(BrokerResponse { response: res_buf })
-            .or_else(|_| bail!("Unable to send respnse to unix socket worker."))?;
-    }
-}
-
-async fn listen_for_clients(queue: mpsc::Sender<BrokerRequest>, sock: UnixListener) -> Result<()> {
-    loop {
-        let (stream, _addr) = sock.accept().await?;
-        let queue = queue.clone();
-        task::spawn(async move {
-            if let Err(e) = on_accept(queue, stream).await {
-                log::error!("Error during connection processing: {e}");
-            }
-        });
-    }
-
-    // NOTE: If loop can ever terminate we need to join the spawned tasks
-}
-
-async fn on_accept(queue: mpsc::Sender<BrokerRequest>, mut stream: UnixStream) -> Result<()> {
-    let mut req_buf = Vec::new();
-
-    loop {
-        stream.readable().await?;
-
-        // Read the message length
-        let mut len = [0u8; 8];
-        stream.read_exact(&mut len).await?;
-
-        // Parse the message length
-        let len = u64::from_le_bytes(len) as usize;
-        ensure!(
-            len <= msgs::REQUEST_MSG_BUFFER_SIZE,
-            "Oversized buffer ({len}) in unix socket input."
-        );
-
-        // Read the message itself
-        req_buf.resize(len as usize, 0);
-        stream.read_exact(&mut req_buf[..len]).await?;
-
-        // Handle the message
-        let (reply_tx, reply_rx) = oneshot::channel();
-        queue
-            .send(BrokerRequest {
-                reply_to: reply_tx,
-                request: req_buf,
-            })
-            .await?;
-
-        // Wait for the reply
-        let BrokerResponse { response } = reply_rx.await.unwrap();
-
-        // Write reply back to unix socket
-        stream
-            .write_all(&(response.len() as u64).to_le_bytes())
-            .await?;
-        stream.write_all(&response[..]).await?;
-        stream.flush().await?;
-
-        // Reuse the same memory for the next message
-        req_buf = response;
-    }
-}

wireguard-broker/src/lib.rs

@@ -1,15 +0,0 @@
-use std::result::Result;
-
-pub trait WireGuardBroker {
-    type Error;
-
-    fn set_psk(
-        &mut self,
-        interface: &str,
-        peer_id: [u8; 32],
-        psk: [u8; 32],
-    ) -> Result<(), Self::Error>;
-}
-
-pub mod api;
-pub mod netlink;

wireguard-broker/src/netlink.rs

@@ -1,103 +0,0 @@
-use wireguard_uapi::linux as wg;
-
-use crate::api::msgs;
-use crate::WireGuardBroker;
-
-#[derive(thiserror::Error, Debug)]
-pub enum ConnectError {
-    #[error(transparent)]
-    ConnectError(#[from] wg::err::ConnectError),
-}
-
-#[derive(thiserror::Error, Debug)]
-pub enum NetlinkError {
-    #[error(transparent)]
-    SetDevice(#[from] wg::err::SetDeviceError),
-    #[error(transparent)]
-    GetDevice(#[from] wg::err::GetDeviceError),
-}
-
-#[derive(thiserror::Error, Debug)]
-pub enum SetPskError {
-    #[error("The indicated wireguard interface does not exist")]
-    NoSuchInterface,
-    #[error("The indicated peer does not exist on the wireguard interface")]
-    NoSuchPeer,
-    #[error(transparent)]
-    NetlinkError(#[from] NetlinkError),
-}
-
-impl From<wg::err::SetDeviceError> for SetPskError {
-    fn from(err: wg::err::SetDeviceError) -> Self {
-        NetlinkError::from(err).into()
-    }
-}
-
-impl From<wg::err::GetDeviceError> for SetPskError {
-    fn from(err: wg::err::GetDeviceError) -> Self {
-        NetlinkError::from(err).into()
-    }
-}
-
-use msgs::SetPskError as SetPskMsgsError;
-use SetPskError as SetPskNetlinkError;
-impl From<SetPskNetlinkError> for SetPskMsgsError {
-    fn from(err: SetPskError) -> Self {
-        match err {
-            SetPskNetlinkError::NoSuchPeer => SetPskMsgsError::NoSuchPeer,
-            _ => SetPskMsgsError::InternalError,
-        }
-    }
-}
-
-pub struct NetlinkWireGuardBroker {
-    sock: wg::WgSocket,
-}
-
-impl NetlinkWireGuardBroker {
-    pub fn new() -> Result<Self, ConnectError> {
-        let sock = wg::WgSocket::connect()?;
-        Ok(Self { sock })
-    }
-}
-
-impl WireGuardBroker for NetlinkWireGuardBroker {
-    type Error = SetPskError;
-
-    fn set_psk(
-        &mut self,
-        interface: &str,
-        peer_id: [u8; 32],
-        psk: [u8; 32],
-    ) -> Result<(), Self::Error> {
-        // Ensure that the peer exists by querying the device configuration
-        // TODO: Use InvalidInterfaceError
-        let state = self
-            .sock
-            .get_device(wg::DeviceInterface::from_name(interface.to_owned()))?;
-
-        if state
-            .peers
-            .iter()
-            .find(|p| &p.public_key == &peer_id)
-            .is_none()
-        {
-            return Err(SetPskError::NoSuchPeer);
-        }
-
-        // Peer update description
-        let mut set_peer = wireguard_uapi::set::Peer::from_public_key(&peer_id);
-        set_peer
-            .flags
-            .push(wireguard_uapi::linux::set::WgPeerF::UpdateOnly);
-        set_peer.preshared_key = Some(&psk);
-
-        // Device update description
-        let mut set_dev = wireguard_uapi::set::Device::from_ifname(interface.to_owned());
-        set_dev.peers.push(set_peer);
-
-        self.sock.set_device(set_dev)?;
-
-        Ok(())
-    }
-}