add control socket serde code

- add new, optional configuration parameter to the config file, `control_socket`
- enhance debug and trace logging in `app_server.rs`
- add optional attribute `maybe_control_socket` to `AppServer`
- registers the uds (if present) in mio, so that one `mio::poll` call can both check on control commands and normal handshake traffic
- sprinkle a little more documentation over `app_server.rs`
- inject control socket handling skeleton code to `AppServer::try_recv`
  - control socket is always processed first, then incoming traffic

.ci/gen-workflow-files.nu

@@ -1,6 +1,6 @@
 #!/usr/bin/env nu
 
-use std log
+use log *
 
 # cd to git root
 cd (git rev-parse --show-toplevel)
@@ -116,7 +116,6 @@ for system in ($targets | columns) {
       } }
       | filter {|it| $it.needed}
       | each {|it| job-id $system $it.name}
-      | sort
     )
 
     mut new_job = {
@@ -198,4 +197,4 @@ $cachix_workflow | to yaml | save --force .github/workflows/nix.yaml
 $release_workflow | to yaml | save --force .github/workflows/release.yaml
 
 log info "prettify generated yaml"
-prettier -w .github/workflows/
+prettier -w .github/workflows/

.ci/run-regression.sh

@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-
-iterations="$1"
-sleep_time="$2"
-
-PWD="$(pwd)"
-EXEC="$PWD/target/release/rosenpass"
-LOGS="$PWD/output/logs"
-
-mkdir -p "$LOGS"
-
-run_command() {
-  local file=$1
-  local log_file="$2"
-  ("$EXEC" exchange-config "$file" 2>&1 | tee -a "$log_file") &
-  echo $!
-}
-
-pids=()
-
-(cd output/dut && run_command "configs/dut-$iterations.toml" "$LOGS/dut.log")
-for (( x=0; x<iterations; x++ )); do
-  (cd output/ate && run_command "configs/ate-$x.toml" "$LOGS/ate-$x.log") & pids+=($!)
-done
-
-sleep "$sleep_time"
-
-lsof -i :9999 | awk 'NR!=1 {print $2}' | xargs kill
-
-for (( x=0; x<iterations; x++ )); do
-    port=$((x + 50000))
-    lsof -i :$port | awk 'NR!=1 {print $2}' | xargs kill
-done

.devcontainer/Dockerfile

@@ -1 +0,0 @@
-FROM ghcr.io/xtruder/nix-devcontainer:v1

.devcontainer/devcontainer.json

@@ -1,33 +0,0 @@
-// For format details, see https://aka.ms/vscode-remote/devcontainer.json or the definition README at
-// https://github.com/microsoft/vscode-dev-containers/tree/master/containers/docker-existing-dockerfile
-{
-  "name": "devcontainer-project",
-  "dockerFile": "Dockerfile",
-  "context": "${localWorkspaceFolder}",
-  "build": {
-    "args": {
-      "USER_UID": "${localEnv:USER_UID}",
-      "USER_GID": "${localEnv:USER_GID}"
-    }
-  },
-
-  // run arguments passed to docker
-  "runArgs": ["--security-opt", "label=disable"],
-
-  // disable command overriding and updating remote user ID
-  "overrideCommand": false,
-  "userEnvProbe": "loginShell",
-  "updateRemoteUserUID": false,
-
-  // build development environment on creation, make sure you already have shell.nix
-  "onCreateCommand": "nix develop",
-
-  // Use 'forwardPorts' to make a list of ports inside the container available locally.
-  "forwardPorts": [],
-
-  "customizations": {
-    "vscode": {
-      "extensions": ["rust-lang.rust-analyzer", "tamasfe.even-better-toml"]
-    }
-  }
-}

.github/codecov.yml

@@ -1,14 +0,0 @@
-codecov:
-  branch: main
-coverage:
-  status:
-    project:
-      default:
-        # basic
-        target: auto #default
-        threshold: 5
-        base: auto
-        if_ci_failed: error #success, failure, error, ignore
-        informational: false
-        only_pulls: true
-    patch: off

.github/dependabot.yml

@@ -1,6 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "daily"

.github/workflows/dependent-issues.yml

@@ -1,63 +0,0 @@
-name: Dependent Issues
-
-on:
-  issues:
-    types:
-      - opened
-      - edited
-      - closed
-      - reopened
-  pull_request_target:
-    types:
-      - opened
-      - edited
-      - closed
-      - reopened
-      # Makes sure we always add status check for PRs. Useful only if
-      # this action is required to pass before merging. Otherwise, it
-      # can be removed.
-      - synchronize
-
-  # Schedule a daily check. Useful if you reference cross-repository
-  # issues or pull requests. Otherwise, it can be removed.
-  schedule:
-    - cron: "0 0 * * *"
-
-jobs:
-  check:
-    permissions:
-      issues: write
-      pull-requests: write
-      statuses: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: z0al/dependent-issues@v1
-        env:
-          # (Required) The token to use to make API calls to GitHub.
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # (Optional) The token to use to make API calls to GitHub for remote repos.
-          GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
-
-        with:
-          # (Optional) The label to use to mark dependent issues
-          label: dependent
-
-          # (Optional) Enable checking for dependencies in issues.
-          # Enable by setting the value to "on". Default "off"
-          check_issues: off
-
-          # (Optional) Ignore dependabot PRs.
-          # Enable by setting the value to "on". Default "off"
-          ignore_dependabot: off
-
-          # (Optional) A comma-separated list of keywords. Default
-          # "depends on, blocked by"
-          keywords: depends on, blocked by
-
-          # (Optional) A custom comment body. It supports `{{ dependencies }}` token.
-          comment: >
-            This PR/issue depends on:
-
-            {{ dependencies }}
-
-            By **[Dependent Issues](https://github.com/z0al/dependent-issues)** (🤖). Happy coding!

.github/workflows/nix.yaml

@@ -95,7 +95,6 @@ jobs:
       - macos-13
     needs:
       - x86_64-darwin---rosenpass
-      - x86_64-darwin---rp
       - x86_64-darwin---rosenpass-oci-image
     steps:
       - uses: actions/checkout@v3
@@ -124,22 +123,6 @@ jobs:
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
       - name: Build
         run: nix build .#packages.x86_64-darwin.rosenpass --print-build-logs
-  x86_64-darwin---rp:
-    name: Build x86_64-darwin.rp
-    runs-on:
-      - macos-13
-    needs: []
-    steps:
-      - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v22
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-      - uses: cachix/cachix-action@v12
-        with:
-          name: rosenpass
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - name: Build
-        run: nix build .#packages.x86_64-darwin.rp --print-build-logs
   x86_64-darwin---rosenpass-oci-image:
     name: Build x86_64-darwin.rosenpass-oci-image
     runs-on:
@@ -227,9 +210,8 @@ jobs:
     runs-on:
       - ubuntu-latest
     needs:
-      - x86_64-linux---rosenpass-static
       - x86_64-linux---rosenpass-static-oci-image
-      - x86_64-linux---rp-static
+      - x86_64-linux---rosenpass-static
     steps:
       - uses: actions/checkout@v3
       - uses: cachix/install-nix-action@v22
@@ -241,30 +223,6 @@ jobs:
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
       - name: Build
         run: nix build .#packages.x86_64-linux.release-package --print-build-logs
-  aarch64-linux---release-package:
-    name: Build aarch64-linux.release-package
-    runs-on:
-      - ubuntu-latest
-    needs:
-      - aarch64-linux---rosenpass-oci-image
-      - aarch64-linux---rosenpass
-      - aarch64-linux---rp
-    steps:
-      - run: |
-          DEBIAN_FRONTEND=noninteractive
-          sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi binfmt-support qemu-user-static
-      - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v22
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-          extra_nix_config: |
-            system = aarch64-linux
-      - uses: cachix/cachix-action@v12
-        with:
-          name: rosenpass
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - name: Build
-        run: nix build .#packages.aarch64-linux.release-package --print-build-logs
   x86_64-linux---rosenpass:
     name: Build x86_64-linux.rosenpass
     runs-on:
@@ -281,48 +239,6 @@ jobs:
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
       - name: Build
         run: nix build .#packages.x86_64-linux.rosenpass --print-build-logs
-  aarch64-linux---rosenpass:
-    name: Build aarch64-linux.rosenpass
-    runs-on:
-      - ubuntu-latest
-    needs: []
-    steps:
-      - run: |
-          DEBIAN_FRONTEND=noninteractive
-          sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi binfmt-support qemu-user-static
-      - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v22
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-          extra_nix_config: |
-            system = aarch64-linux
-      - uses: cachix/cachix-action@v12
-        with:
-          name: rosenpass
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - name: Build
-        run: nix build .#packages.aarch64-linux.rosenpass --print-build-logs
-  aarch64-linux---rp:
-    name: Build aarch64-linux.rp
-    runs-on:
-      - ubuntu-latest
-    needs: []
-    steps:
-      - run: |
-          DEBIAN_FRONTEND=noninteractive
-          sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi binfmt-support qemu-user-static
-      - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v22
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-          extra_nix_config: |
-            system = aarch64-linux
-      - uses: cachix/cachix-action@v12
-        with:
-          name: rosenpass
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - name: Build
-        run: nix build .#packages.aarch64-linux.rp --print-build-logs
   x86_64-linux---rosenpass-oci-image:
     name: Build x86_64-linux.rosenpass-oci-image
     runs-on:
@@ -340,28 +256,6 @@ jobs:
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
       - name: Build
         run: nix build .#packages.x86_64-linux.rosenpass-oci-image --print-build-logs
-  aarch64-linux---rosenpass-oci-image:
-    name: Build aarch64-linux.rosenpass-oci-image
-    runs-on:
-      - ubuntu-latest
-    needs:
-      - aarch64-linux---rosenpass
-    steps:
-      - run: |
-          DEBIAN_FRONTEND=noninteractive
-          sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi binfmt-support qemu-user-static
-      - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v22
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-          extra_nix_config: |
-            system = aarch64-linux
-      - uses: cachix/cachix-action@v12
-        with:
-          name: rosenpass
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - name: Build
-        run: nix build .#packages.aarch64-linux.rosenpass-oci-image --print-build-logs
   x86_64-linux---rosenpass-static:
     name: Build x86_64-linux.rosenpass-static
     runs-on:
@@ -378,22 +272,6 @@ jobs:
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
       - name: Build
         run: nix build .#packages.x86_64-linux.rosenpass-static --print-build-logs
-  x86_64-linux---rp-static:
-    name: Build x86_64-linux.rp-static
-    runs-on:
-      - ubuntu-latest
-    needs: []
-    steps:
-      - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v22
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-      - uses: cachix/cachix-action@v12
-        with:
-          name: rosenpass
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - name: Build
-        run: nix build .#packages.x86_64-linux.rp-static --print-build-logs
   x86_64-linux---rosenpass-static-oci-image:
     name: Build x86_64-linux.rosenpass-static-oci-image
     runs-on:

.github/workflows/qc.yaml

@@ -25,44 +25,6 @@ jobs:
       - name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master
 
-  rustfmt:
-    name: Rust Format
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Run Rust Formatting Script
-        run: bash format_rust_code.sh --mode check
-
-  cargo-bench:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/cache@v3
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-        # liboqs requires quite a lot of stack memory, thus we adjust
-        # the default stack size picked for new threads (which is used
-        # by `cargo test`) to be _big enough_. Setting it to 8 MiB
-      - run: RUST_MIN_STACK=8388608 cargo bench --workspace --exclude rosenpass-fuzzing
-
-  mandoc:
-    name: mandoc
-    runs-on: ubuntu-latest
-    steps:
-      - name: Install mandoc
-        run: sudo apt-get install -y mandoc
-      - uses: actions/checkout@v3
-      - name: Check rosenpass.1
-        run: doc/check.sh doc/rosenpass.1
-      - name: Check rp.1
-        run: doc/check.sh doc/rp.1
-
   cargo-audit:
     runs-on: ubuntu-latest
     steps:
@@ -85,6 +47,8 @@ jobs:
             target/
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
       - run: rustup component add clippy
+      - name: Install libsodium
+        run: sudo apt-get install -y libsodium-dev
       - uses: actions-rs/clippy-check@v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -104,18 +68,15 @@ jobs:
             target/
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
       - run: rustup component add clippy
+      - name: Install libsodium
+        run: sudo apt-get install -y libsodium-dev
       # `--no-deps` used as a workaround for a rust compiler bug. See:
       # - https://github.com/rosenpass/rosenpass/issues/62
       # - https://github.com/rust-lang/rust/issues/108378
       - run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --document-private-items
 
   cargo-test:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-13]
-        # - ubuntu is x86-64
-        # - macos-13 is also x86-64 architecture
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
       - uses: actions/cache@v3
@@ -127,10 +88,12 @@ jobs:
             ~/.cargo/git/db/
             target/
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+      - name: Install libsodium
+        run: sudo apt-get install -y libsodium-dev
         # liboqs requires quite a lot of stack memory, thus we adjust
         # the default stack size picked for new threads (which is used
         # by `cargo test`) to be _big enough_. Setting it to 8 MiB
-      - run: RUST_MIN_STACK=8388608 cargo test --workspace --all-features
+      - run: RUST_MIN_STACK=8388608 cargo test
 
   cargo-test-nix-devshell-x86_64-linux:
     runs-on:
@@ -153,55 +116,4 @@ jobs:
         with:
           name: rosenpass
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - run: nix develop --command cargo test --workspace --all-features
-
-  cargo-fuzz:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/cache@v3
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-      - name: Install nightly toolchain
-        run: |
-          rustup toolchain install nightly
-          rustup default nightly
-      - name: Install cargo-fuzz
-        run: cargo install cargo-fuzz
-      - name: Run fuzzing
-        run: |
-          cargo fuzz run fuzz_aead_enc_into -- -max_total_time=5
-          cargo fuzz run fuzz_blake2b -- -max_total_time=5
-          cargo fuzz run fuzz_handle_msg -- -max_total_time=5
-          ulimit -s 8192000 && RUST_MIN_STACK=33554432000 && cargo fuzz run fuzz_kyber_encaps -- -max_total_time=5
-          cargo fuzz run fuzz_mceliece_encaps -- -max_total_time=5
-          cargo fuzz run fuzz_box_secret_alloc_malloc -- -max_total_time=5
-          cargo fuzz run fuzz_box_secret_alloc_memfdsec -- -max_total_time=5
-          cargo fuzz run fuzz_box_secret_alloc_memfdsec_mallocfb -- -max_total_time=5
-          cargo fuzz run fuzz_vec_secret_alloc_malloc -- -max_total_time=5
-          cargo fuzz run fuzz_vec_secret_alloc_memfdsec -- -max_total_time=5
-          cargo fuzz run fuzz_vec_secret_alloc_memfdsec_mallocfb -- -max_total_time=5
-
-  codecov:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - run: rustup component add llvm-tools-preview
-      - run: |
-          cargo install cargo-llvm-cov || true
-          cargo llvm-cov --lcov --output-path coverage.lcov
-      # If using tarapulin
-      #- run: cargo install cargo-tarpaulin
-      #- run: cargo tarpaulin --out Xml
-      - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v4.0.1
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./coverage.lcov
-          verbose: true
+      - run: nix develop --command cargo test

.github/workflows/regressions.yml

@@ -1,21 +0,0 @@
-name: QC
-on:
-  pull_request:
-  push:
-    branches: [main]
-
-permissions:
-  checks: write
-  contents: read
-
-jobs:
-  multi-peer:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - run: cargo build --bin rosenpass --release
-      - run: python misc/generate_configs.py
-      - run: chmod +x .ci/run-regression.sh
-      - run: .ci/run-regression.sh 100 20
-      - run: |
-          [ $(ls -1 output/ate/out | wc -l) -eq 100 ]

.gitignore

@@ -20,8 +20,3 @@ _markdown_*
 **/result
 **/result-*
 .direnv
-
-# Visual studio code
-.vscode
-
-/output

.mailmap

@@ -1 +0,0 @@
-Clara Engler <cve@cve.cx> <me@emilengler.com>

CONTRIBUTING.md

@@ -1,38 +0,0 @@
-**Making a new Release of Rosenpass — Cooking Recipe**
-
-If you have to change a file, do what it takes to get the change as commit on the main branch, then **start from step 0**.
-If any other issue occurs
-
-0. Make sure you are in the root directory of the project
-   - `cd "$(git rev-parse --show-toplevel)"`
-1. Make sure you locally checked out the head of the main branch
-   - `git stash --include-untracked && git checkout main && git pull`
-2. Make sure all tests pass
-   - `cargo test`
-3. Make sure the current version in `rosenpass/Cargo.toml` matches that in the [last release on GitHub](https://github.com/rosenpass/rosenpass/releases)
-   - Only normal releases count, release candidates and draft releases can be ignored
-4. Pick the kind of release that you want to make (`major`, `minor`, `patch`, `rc`, ...)
-   - See `cargo release --help` for more information on the available release types
-   - Pick `rc` if in doubt
-5. Try to release a new version
-   - `cargo release rc --package rosenpass`
-   - An issue was reported? Go fix it, start again with step 0!
-6. Actually make the release
-   - `cargo release rc --package rosenpass --execute`
-   - Tentatively wait for any interactions, such as entering ssh keys etc.
-   - You may be asked for your ssh key multiple times!
-
-**Frequently Asked Questions (FAQ)**
-
-- You have untracked files, which `cargo release` complains about?
-  - `git stash --include-untracked`
-- You cannot push to crates.io because you are not logged in?
-  - Follow the steps displayed in [`cargo login`](https://doc.rust-lang.org/cargo/commands/cargo-login.html)
-- How is the release page added to [GitHub Releases](https://github.com/rosenpass/rosenpass/releases) itself?
-  - Our CI Pipeline will create the release, once `cargo release` pushed the new version tag to the repo. The new release should pop up almost immediately in [GitHub Releases](https://github.com/rosenpass/rosenpass/releases) after the [Actions/Release](https://github.com/rosenpass/rosenpass/actions/workflows/release.yaml) pipeline started.
-- No new release pops up in the `Release` sidebar element on the [main page](https://github.com/rosenpass/rosenpass)
-  - Did you push a `rc` release? This view only shows non-draft release, but `rc` releases are considered as draft. See [Releases](https://github.com/rosenpass/rosenpass/releases) page to see all (including draft!) releases.
-- The release page was created on GitHub, but there are no assets/artifacts other than the source code tar ball/zip?
-  - The artifacts are generated and pushed automatically to the release, but this takes some time (a couple of minutes). You can check the respective CI pipeline: [Actions/Release](https://github.com/rosenpass/rosenpass/actions/workflows/release.yaml), which should start immediately after `cargo release` pushed the new release tag to the repo. The release artifacts only are added later to the release, once all jobs in bespoke pipeline finished.
-- How are the release artifacts generated, and what are they?
-  - The release artifacts are built using one Nix derivation per platform, `nix build .#release-package`. It contains both statically linked versions of `rosenpass` itself and OCI container images.

Cargo.toml

@@ -1,86 +1,42 @@
-[workspace]
-resolver = "2"
+[package]
+name = "rosenpass"
+version = "0.2.0"
+authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
+edition = "2021"
+license = "MIT OR Apache-2.0"
+description = "Build post-quantum-secure VPNs with WireGuard!"
+homepage = "https://rosenpass.eu/"
+repository = "https://github.com/rosenpass/rosenpass"
+readme = "readme.md"
 
-members = [
-    "rosenpass",
-    "cipher-traits",
-    "ciphers",
-    "util",
-    "constant-time",
-    "oqs",
-    "to",
-    "fuzz",
-    "secret-memory",
-    "rp",
-    "wireguard-broker",
-]
+[[bench]]
+name = "handshake"
+harness = false
 
-default-members = ["rosenpass", "rp", "wireguard-broker"]
-
-[workspace.metadata.release]
-# ensure that adding `--package` as argument to `cargo release` still creates version tags in the form of `vx.y.z`
-tag-prefix = ""
-
-[workspace.dependencies]
-rosenpass = { path = "rosenpass" }
-rosenpass-util = { path = "util" }
-rosenpass-constant-time = { path = "constant-time" }
-rosenpass-cipher-traits = { path = "cipher-traits" }
-rosenpass-ciphers = { path = "ciphers" }
-rosenpass-to = { path = "to" }
-rosenpass-secret-memory = { path = "secret-memory" }
-rosenpass-oqs = { path = "oqs" }
-rosenpass-wireguard-broker = { path = "wireguard-broker" }
-doc-comment = "0.3.3"
-base64ct = {version = "1.6.0", default-features=false}
-zeroize = "1.8.1"
-memoffset = "0.9.1"
-thiserror = "1.0.63"
-paste = "1.0.15"
-env_logger = "0.10.2"
-toml = "0.7.8"
+[dependencies]
+anyhow = { version = "1.0.71", features = ["backtrace"] }
+base64 = "0.21.1"
 static_assertions = "1.1.0"
-allocator-api2 = "0.2.14"
-memsec = { git="https://github.com/rosenpass/memsec.git" ,rev="aceb9baee8aec6844125bd6612f92e9a281373df", features = [ "alloc_ext", ] }
-rand = "0.8.5"
-typenum = "1.17.0"
-log = { version = "0.4.22" }
-clap = { version = "4.5.13", features = ["derive"] }
-serde = { version = "1.0.204", features = ["derive"] }
-arbitrary = { version = "1.3.2", features = ["derive"] }
-anyhow = { version = "1.0.86", features = ["backtrace", "std"] }
-mio = { version = "1.0.1", features = ["net", "os-poll"] }
-oqs-sys = { version = "0.9.1", default-features = false, features = [
-  'classic_mceliece',
-  'kyber',
-] }
-blake2 = "0.10.6"
-chacha20poly1305 = { version = "0.10.1", default-features = false, features = [
-  "std",
-  "heapless",
-] }
-zerocopy = { version = "0.7.35", features = ["derive"] }
-home = "0.5.9"
-derive_builder = "0.20.0"
-tokio = { version = "1.39", features = ["macros", "rt-multi-thread"] }
-postcard= {version = "1.0.8", features = ["alloc"]}
-libcrux = { version = "0.0.2-pre.2" }
-hex-literal = { version = "0.4.1" }
-hex = { version = "0.4.3" }
-heck = { version = "0.5.0"  }
+memoffset = "0.9.0"
+libsodium-sys-stable = { version = "1.19.28", features = ["use-pkg-config"] }
+oqs-sys = { version = "0.8", default-features = false, features = ['classic_mceliece', 'kyber'] }
+lazy_static = "1.4.0"
+thiserror = "1.0.40"
+paste = "1.0.12"
+log = { version = "0.4.17", optional = true }
+env_logger = { version = "0.10.0", optional = true }
+serde = { version = "1.0.163", features = ["derive"] }
+toml = "0.7.4"
+clap = { version = "4.3.0", features = ["derive"] }
+mio = { version = "0.8.6", features = ["net", "os-poll"] }
 
-#Dev dependencies
-serial_test = "3.1.1"
-tempfile = "3"
-stacker = "0.1.15"
-libfuzzer-sys = "0.4"
-test_bin = "0.4.0"
+[build-dependencies]
+anyhow = "1.0.71"
+
+[dev-dependencies]
 criterion = "0.4.0"
-allocator-api2-tests = "0.2.15"
-procspawn = {version = "1.0.0", features= ["test-support"]}
+test_bin = "0.4.0"
+stacker = "0.1.15"
 
-
-#Broker dependencies (might need cleanup or changes)
-wireguard-uapi = { version = "3.0.0", features = ["xplatform"] }
-command-fds = "0.2.3"
-rustix = { version = "0.38.27", features = ["net", "fs"] }
+[features]
+default = ["log", "env_logger"]

analysis/03_identity_hiding_initiator.entry.mpv

@@ -1,25 +0,0 @@
-#define INITIATOR_TEST 1
-
-#include "rosenpass/03_identity_hiding.mpv"
-
-// nounif a:Atom, s:seed, a2:Atom;
-// 	ConsumeSeed(a, s, a2) / 6300[conclusion].
-
-nounif v:seed_prec;   attacker(prepare_seed(trusted_seed( v )))/6217[hypothesis].
-nounif v:seed;        attacker(prepare_seed( v ))/6216[hypothesis].
-nounif v:seed;        attacker(rng_kem_sk( v ))/6215[hypothesis].
-nounif v:seed;        attacker(rng_key( v ))/6214[hypothesis].
-nounif v:key_prec;    attacker(prepare_key(trusted_key( v )))/6213[hypothesis].
-nounif v:kem_sk_prec; attacker(prepare_kem_sk(trusted_kem_sk( v )))/6212[hypothesis].
-nounif v:key;         attacker(prepare_key( v ))/6211[hypothesis].
-nounif v:kem_sk;      attacker(prepare_kem_sk( v ))/6210[hypothesis].
-nounif Spk:kem_sk_tmpl;
-  attacker(Creveal_kem_pk(Spk))/6110[conclusion].
-nounif sid:SessionId, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Seski:seed_tmpl, Ssptr:seed_tmpl;
-  attacker(Cinitiator( *sid, *Ssskm, *Spsk, *Sspkt, *Seski, *Ssptr ))/6109[conclusion].
-nounif sid:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Septi:seed_tmpl, Sspti:seed_tmpl, ih:InitHello_t;
-  attacker(Cinit_hello( *sid, *biscuit_no, *Ssskm, *Spsk, *Sspkt, *Septi, *Sspti, *ih ))/6108[conclusion].
-nounif rh:RespHello_t;
-  attacker(Cresp_hello( *rh ))/6107[conclusion].
-nounif Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:InitConf_t;
-  attacker(Cinit_conf( *Ssskm, *Spsk, *Sspkt, *ic ))/6106[conclusion].

analysis/03_identity_hiding_responder.entry.mpv

@@ -1,96 +0,0 @@
-#define RESPONDER_TEST 1
-
-#include "rosenpass/03_identity_hiding.mpv"
-
-// select k:kem_pk,ih: InitHello_t;         attacker(prf(prf(prf(prf(key0, PROTOCOL), MAC), kem_pk2b(k) ), IH2b(ih))) phase 1/6300[hypothesis].
-
-// select epki:kem_pk, sctr:bits, pidiC:bits, auth:bits, epki2:kem_pk, sctr2:bits, pidiC2:bits, auth2:bits;
-// 	mess(D, prf(prf(prf(prf(key0,PROTOCOL),MAC),kem_pk2b(kem_pub(trusted_kem_sk(responder1)))),
-// 			IH2b(InitHello(secure_sidi, *epki, *sctr, *pidiC, *auth)))
-// 		) [hypothesis, conclusion].
-
-// select epki:kem_pk, sctr:bits, pidiC:bits, auth:bits, epki2:kem_pk, sctr2:bits, pidiC2:bits, auth2:bits;
-// attacker(choice[prf(prf(prf(prf(key0,PROTOCOL),MAC),kem_pk2b(kem_pub(trusted_kem_sk(responder1)))),
-// 		IH2b(InitHello(secure_sidi, *epki, *sctr, *pidiC, *auth))),
-
-// 		prf(prf(prf(prf(key0,PROTOCOL),MAC),kem_pk2b(kem_pub(trusted_kem_sk(responder2)))),
-// 				IH2b(InitHello(secure_sidi, *epki2, *sctr2, *pidiC2, *auth2)))]
-// 	) [hypothesis, conclusion].
-
-// select 
-// attacker(prf(prf(key0,PROTOCOL),MAC)) [hypothesis, conclusion].
-
-// select 
-// attacker(prf(key0,PROTOCOL)) [conclusion].
-
-// select  
-// attacker(key0) [conclusion].
-
-// select  
-// attacker(PROTOCOL) [conclusion].
-
-// select 
-// attacker(kem_pub(trusted_kem_sk(responder1))) /9999 [hypothesis, conclusion].
-
-// select 
-// attacker(kem_pub(trusted_kem_sk(responder2))) /9999 [hypothesis, conclusion].
-
-// nounif ih:InitHello_t;
-// 	attacker(ih) / 9999 [hypothesis].
-
-// nounif rh:RespHello_t;
-// 	attacker(rh) / 9999 [hypothesis].
-
-// nounif ic:InitConf_t;
-// 	attacker(ic) / 9999 [hypothesis].
-
-// nounif k:key;
-// attacker(ck_hs_enc( *k )) [hypothesis, conclusion].
-
-// nounif k:key;
-// attacker(ck_hs_enc( *k )) phase 1   [hypothesis, conclusion].
-
-// nounif k:key, b:bits;
-// attacker(ck_mix( *k , *b ))   [hypothesis, conclusion].
-
-// nounif k:key, b:bits;
-// attacker(ck_mix( *k , *b ))phase 1   [hypothesis, conclusion].
-
-// // select k:kem_pk, epki2:kem_pk, sctr2:bits, pidiC2:bits, auth2:bits, epki:kem_pk, sctr:bits, pidiC:bits, auth:bits;
-// // attacker(choice[Envelope(prf(prf(prf(prf(key0,PROTOCOL),MAC),kem_pub(trusted_kem_sk(responder1))),
-// // 	InitHello(secure_sidi, *epki2, *sctr2, *pidiC2, *auth2)
-// // 	), InitHello(secure_sidi, *epki2, *sctr2, *pidiC2, *auth2))
-// // 	Envelope(prf(prf(prf(prf(key0,PROTOCOL),MAC),kem_pub(trusted_kem_sk(responder2))),
-// // 		InitHello(secure_sidi, *epki, *sctr, *pidiC, *auth)),
-// // 		InitHello(secure_sidi, *epki, *sctr, *pidiC, *auth))
-// // 	]) / 9999[hypothesis, conclusion].
-
-// nounif k:key, b1:bits, b2:bits;
-// 	attacker(xaead_enc( *k, *b1, *b2)) / 9999[hypothesis,conclusion].
-
-// nounif pk:kem_pk, k:key; 
-// 	attacker(kem_enc( *pk , *k )) / 9999[hypothesis,conclusion].
-
-// nounif sid:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Septi:seed_tmpl, Sspti:seed_tmpl, ih:InitHello_t;
-//   attacker(Cinit_hello( *sid, *biscuit_no, *Ssskm, *Spsk, *Sspkt, *Septi, *Sspti, *ih ))/9999[hypothesis, conclusion].
-// nounif Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:InitConf_t;
-//   attacker(Cinit_conf( *Ssskm, *Spsk, *Sspkt, *ic ))/9999[hypothesis, conclusion].
-// nounif sid:SessionId, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Seski:seed_tmpl, Ssptr:seed_tmpl;
-//   attacker(Cinitiator( *sid, *Ssskm, *Spsk, *Sspkt, *Seski, *Ssptr )) /9999 [hypothesis, conclusion].
-
-// nounif sid:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Septi:seed_tmpl, Sspti:seed_tmpl, ih:InitHello_t;
-//   mess(C, Cinit_hello( *sid, *biscuit_no, *Ssskm, *Spsk, *Sspkt, *Septi, *Sspti, *ih ))/9999[hypothesis, conclusion].
-// nounif Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:InitConf_t;
-//   mess(C, Cinit_conf( *Ssskm, *Spsk, *Sspkt, *ic ))/9999[hypothesis, conclusion].
-// nounif sid:SessionId, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Seski:seed_tmpl, Ssptr:seed_tmpl;
-//   mess(C, Cinitiator( *sid, *Ssskm, *Spsk, *Sspkt, *Seski, *Ssptr )) /9999 [hypothesis, conclusion].
-// nounif rh:RespHello_t;
-//   attacker(Cresp_hello( *rh ))[conclusion].
-// nounif v:seed_prec;   attacker(prepare_seed(trusted_seed( v )))/6217[hypothesis].
-// nounif v:seed;        attacker(prepare_seed( v ))/6216[hypothesis].
-// nounif v:seed;        attacker(rng_kem_sk( v ))/6215[hypothesis].
-// nounif v:seed;        attacker(rng_key( v ))/6214[hypothesis].
-// nounif v:key_prec;    attacker(prepare_key(trusted_key( v )))/6213[hypothesis].
-// nounif v:kem_sk_prec; attacker(prepare_kem_sk(trusted_kem_sk( v )))/6212[hypothesis].
-// nounif v:key;         attacker(prepare_key( v ))/6211[hypothesis].
-// nounif v:kem_sk;      attacker(prepare_kem_sk( v ))/6210[hypothesis].

analysis/03_identity_hiding_test.entry.mpv

@@ -1,29 +0,0 @@
-#define INITIATOR_TEST 1
-#define CUSTOM_MAIN 1
-
-#include "rosenpass/03_identity_hiding.mpv"
-
-let Oinitiator_bad_actor_inner(sk_tmp:kem_sk_prec) =
-
-  in(C, Cinitiator(sidi, Ssskm, Spsk, Sspkt, Seski, Ssptr));
-
-  #if RANDOMIZED_CALL_IDS
-    new call:Atom;
-  #else
-    call <- Cinitiator(sidi, Ssskm, Spsk, Sspkt, Seski, Ssptr);
-  #endif
-
-  in(C, last_cookie:key);
-  tmpl <- make_trusted_kem_sk(sk_tmp);
-  out(C, setup_kem_sk(tmpl));
-  Oinitiator_inner(sidi, Ssskm, Spsk, tmpl, Seski, Ssptr, last_cookie, C, call).
-
-let Oinitiator_bad_actor() =
-  Oinitiator_bad_actor_inner(responder1) | Oinitiator_bad_actor_inner(responder2) | Oinitiator_bad_actor_inner(initiator1) | Oinitiator_bad_actor_inner(initiator2).
-
-
-let identity_hiding_main2() = 
-  0 | Oinitiator_bad_actor() | rosenpass_main2() | participants_communication() | phase 1; secretCommunication().
-
-
-let main = identity_hiding_main2.

analysis/04_dos_protection.entry.mpv

@@ -1,136 +0,0 @@
-#define CHAINING_KEY_EVENTS 1
-#define MESSAGE_TRANSMISSION_EVENTS 0
-#define SESSION_START_EVENTS 0
-#define RANDOMIZED_CALL_IDS 0
-#define COOKIE_EVENTS 1
-#define KEM_EVENTS 1
-
-#include "config.mpv"
-#include "prelude/basic.mpv"
-#include "crypto/key.mpv"
-#include "crypto/kem.mpv"
-#include "rosenpass/handshake_state.mpv"
-
-/* The cookie data structure is implemented based on the WireGuard protocol.
- * The ip and port is based purely on the public key and the implementation of the private cookie key is intended to mirror the biscuit key.
- * The code tests the response to a possible DOS attack by setting up alternative branches for the protocol
- * processes: Oinit_conf, Oinit_hello and resp_hello to simulate what happens when the responder or initiator is overloaded.
- * When under heavy load a valid cookie is required. When such a cookie is not present a cookie message is sent as a response.
- * Queries then test to make sure that expensive KEM operations are only conducted after a cookie has been successfully validated.
- */
-
-type CookieMsg_t.
-fun CookieMsg(
-  SessionId,  // sender
-  bits,     // nonce
-  bits      // cookie
-) : CookieMsg_t [data].
-
-#define COOKIE_EVENTS(eventLbl) \
-  COOKIE_EV(event MCAT(eventLbl, _UnderLoadEV) (SessionId, SessionId, Atom).)   \
-  COOKIE_EV(event MCAT(eventLbl, _CookieValidated) (SessionId, SessionId, Atom).)   \
-  COOKIE_EV(event MCAT(eventLbl, _CookieSent) (SessionId, SessionId, Atom, CookieMsg_t).)
-
-fun cookie_key(kem_sk) : key [private].
-fun ip_and_port(kem_pk):bits.
-letfun create_mac2_key(sskm:kem_sk, spkt:kem_pk) = prf(cookie_key(sskm), ip_and_port(spkt)).
-letfun create_cookie(sskm:kem_sk, spkm:kem_pk, spkt:kem_pk, nonce:bits, msg:bits) = xaead_enc(lprf2(COOKIE, kem_pk2b(spkm), nonce),
-    k2b(create_mac2_key(sskm, spkm)), msg).
-
-#define COOKIE_PROCESS(eventLbl, innerFunc) \
-  new nonce:bits; \
-  in(C, Ccookie(mac1, mac2)); \
-  COOKIE_EV(event MCAT(eventLbl, _UnderLoadEV) (sidi, sidr, call);)  \
-  msgB <- Envelope(mac1, msg); \
-  mac2_key <- create_mac2_key(sskm, spkt); \
-  if k2b(create_mac2(mac2_key, msgB)) = mac2 then  \
-    COOKIE_EV(event MCAT(eventLbl, _CookieValidated) (sidi, sidr, call);)  \
-    innerFunc \
-  else \
-    cookie <- create_cookie(sskm, spkm, spkt, nonce, msg); \
-    cookie_msg <- CookieMsg(sidi, nonce, cookie); \
-    COOKIE_EV(event MCAT(eventLbl, _CookieSent) (sidi, sidr, call, cookie_msg);)  \
-    out(C, cookie_msg). \
-
-#include "rosenpass/oracles.mpv"
-
-#include "rosenpass/responder.macro"
-COOKIE_EVENTS(Oinit_conf)
-let Oinit_conf_underLoad() =
-  in(C, Cinit_conf(Ssskm, Spsk, Sspkt, ic));
-  in(C, last_cookie:bits);
-
-  msg <- IC2b(ic);
-  let InitConf(sidi, sidr, biscuit, auth) = ic in 
-
-  new call:Atom;
-
-  SETUP_HANDSHAKE_STATE()
-
-  COOKIE_PROCESS(Oinit_conf, Oinit_conf_inner(Ssskm, Spsk, Sspkt, ic, call))
-
-#include "rosenpass/responder.macro"
-COOKIE_EVENTS(Oinit_hello)
-let Oinit_hello_underLoad() =
-
-  in(C, Cinit_hello(sidr, biscuit_no, Ssskm, Spsk, Sspkt, Septi, Sspti, ih));
-  in(C, Oinit_hello_last_cookie:key);
-  new call:Atom;
-
-  msg <- IH2b(ih);
-  let InitHello(sidi, epki, sctr, pidic, auth) = ih in
-  SETUP_HANDSHAKE_STATE()
-
-  COOKIE_PROCESS(Oinit_hello, Oinit_hello_inner(sidr, biscuit_no, Ssskm, Spsk, Sspkt, Septi, Sspti, ih, Oinit_hello_last_cookie, C, call))
-
-let rosenpass_dos_main() = 0
-  | !Oreveal_kem_pk
-  | REP(INITIATOR_BOUND, Oinitiator)
-  | REP(RESPONDER_BOUND, Oinit_hello)
-  | REP(RESPONDER_BOUND, Oinit_conf)
-  | REP(RESPONDER_BOUND, Oinit_hello_underLoad)
-  | REP(RESPONDER_BOUND, Oinit_conf_underLoad).
-
-let main = rosenpass_dos_main.
-
-select cookie:CookieMsg_t;         attacker(cookie)/6220[hypothesis].
-nounif v:key;         attacker(prepare_key( v ))/6217[hypothesis].
-nounif v:seed;        attacker(prepare_seed( v ))/6216[hypothesis].
-nounif v:seed;        attacker(prepare_seed( v ))/6216[hypothesis].
-nounif v:seed;        attacker(rng_kem_sk( v ))/6215[hypothesis].
-nounif v:seed;        attacker(rng_key( v ))/6214[hypothesis].
-nounif v:kem_sk;      attacker(prepare_kem_sk( v ))/6210[hypothesis].
-
-// nounif Spk:kem_sk_tmpl;
-//   attacker(Creveal_kem_pk(Spk))/6110[conclusion].
-// nounif sid:SessionId, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Seski:seed_tmpl, Ssptr:seed_tmpl;
-//   attacker(Cinitiator( *sid, *Ssskm, *Spsk, *Sspkt, *Seski, *Ssptr ))/6109[conclusion].
-// nounif sid:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Septi:seed_tmpl, Sspti:seed_tmpl, ih:InitHello_t;
-//   attacker(Cinit_hello( *sid, *biscuit_no, *Ssskm, *Spsk, *Sspkt, *Septi, *Sspti, *ih ))/6108[conclusion].
-nounif rh:RespHello_t;
-  attacker(Cresp_hello( *rh ))/6107[conclusion].
-nounif Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:InitConf_t;
-  attacker(Cinit_conf( *Ssskm, *Spsk, *Sspkt, *ic ))/6106[conclusion].
-
-@reachable "DOS protection: cookie sent"
-query sidi:SessionId, sidr:SessionId, call:Atom, cookieMsg:CookieMsg_t;
-  event (Oinit_hello_CookieSent(sidi, sidr, call, cookieMsg)).
-
-@lemma "DOS protection: Oinit_hello kem use when under load implies validated cookie"
-lemma sidi:SessionId, sidr:SessionId, call:Atom;
-event(Oinit_hello_UnderLoadEV(sidi, sidr, call))
-  && event(Oinit_hello_KemUse(sidi, sidr, call))
-  ==> event(Oinit_hello_CookieValidated(sidi, sidr, call)).
-
-@lemma "DOS protection: Oinit_conf kem use when under load implies validated cookie"
-lemma sidi:SessionId, sidr:SessionId, call:Atom;
-event(Oinit_conf_UnderLoadEV(sidi, sidr, call))
-  && event(Oinit_conf_KemUse(sidi, sidr, call))
-  ==> event(Oinit_conf_CookieValidated(sidi, sidr, call)).
-
-@lemma "DOS protection: Oresp_hello kem use when under load implies validated cookie"
-lemma sidi:SessionId, sidr:SessionId, call:Atom;
-event(Oresp_hello_UnderLoadEV(sidi, sidr, call))
-  && event(Oresp_hello_KemUse(sidi, sidr, call))
-  ==> event(Oresp_hello_CookieValidated(sidi, sidr, call)).
-

analysis/rosenpass/03_identity_hiding.mpv

@@ -1,155 +0,0 @@
-/*
-  This identity hiding process tests whether the rosenpass protocol is able to protect the identity of an initiator or responder.
-  The participants in the test are trusted initiators, trusted responders and compromised initiators and responders.
-  The test consists of two phases. In the first phase all of the participants can communicate with each other using the rosenpass protocol.
-  An attacker observes the first phase and is able to intercept and modify messages and choose participants to communicate with each other
-
-  In the second phase if the anonymity of an initiator is being tested then one of two trusted initiators is chosen.
-  The chosen initiator communicates directly with a trusted responder.
-  If an attacker can determine which initiator was chosen then the anonymity of the initiator has been compromised.
-  Otherwise the protocol has successfully protected the initiators’ identity.
-
-  If the anonymity of a responder is being tested then one of two trusted responders is chosen instead.
-  Then an initiator communicates directly with the chosen responder.
-  If an attacker can determine which responder was chosen then the anonymity of the responder is compromised.
-  Otherwise the protocol successfully protects the identity of a responder.
-
-  The Proverif code treats the public key as synonymous with identity.
-  In the above test when a responder or initiator is chosen what is actually chosen is the public/private key pair to use for communication.
-  Traditionally when a responder or initiator is chosen they would be chosen randomly.
-  The way Proverif makes a "choice" is by simulating multiple processes, one process per choice
-  Then the processes are compared and if an association between a public key and a process can be made the test fails.
-  As the choice is at least as bad as choosing the worst possible option the credibility of the test is maintained.
-  The drawback is that Proverif is only able to tell if the identity can be brute forced but misses any probabilistic associations.
-  As usual Proverif also assumes perfect encryption and in particular assumes encryption cannot be linked to identity.
-
-  One of the tradeoffs made here is that the choice function in Proverif is slow but this is in favour of being able to write more precise tests.
-  Another issue is the choice function does not work with queries so a test needs to be run for each set of assumptions.
-  In this case the test uses secure rng and a fresh secure biscuit key.
-*/
-
-#include "config.mpv"
-
-#define CHAINING_KEY_EVENTS 1
-#define MESSAGE_TRANSMISSION_EVENTS 1
-#define SESSION_START_EVENTS 0
-#define RANDOMIZED_CALL_IDS 0
-#undef FULL_MODEL
-#undef SIMPLE_MODEL
-#define SIMPLE_MODEL 1
-
-#include "prelude/basic.mpv"
-#include "crypto/key.mpv"
-#include "rosenpass/oracles.mpv"
-#include "crypto/kem.mpv"
-
-#define NEW_TRUSTED_SEED(name)            \
-  new MCAT(name, _secret_seed):seed_prec; \
-  name <- make_trusted_seed(MCAT(name, _secret_seed)); \
-
-free D:channel [private].
-free secure_biscuit_no:Atom [private].
-free secure_sidi,secure_sidr:SessionId [private].
-free secure_psk:key [private].
-free initiator1, initiator2:kem_sk_prec.
-free responder1, responder2:kem_sk_prec.
-
-let secure_init_hello(initiator: kem_sk_tmpl, sidi : SessionId, psk: key_tmpl, responder: kem_sk_tmpl) =
-
-  new epkit:kem_pk;    // epki
-  new sctrt:bits;      // sctr 
-  new pidiCt:bits;      // pidiC
-  new autht:bits;       // auth
-
-  NEW_TRUSTED_SEED(seski_trusted_seed)
-  NEW_TRUSTED_SEED(ssptr_trusted_seed)
-  new last_cookie:key;
-  new call:Atom;
-
-  Oinitiator_inner(sidi, initiator, psk, responder, seski_trusted_seed, ssptr_trusted_seed, last_cookie, D, call).
-
-let secure_resp_hello(initiator: kem_sk_tmpl, responder: kem_sk_tmpl, sidi:SessionId, sidr:SessionId, biscuit_no:Atom, psk:key_tmpl) =
-
-  in(D, InitHello(=secure_sidi, epki, sctr, pidiC, auth));
-
-  ih <- InitHello(sidi, epki, sctr, pidiC, auth);
-  NEW_TRUSTED_SEED(septi_trusted_seed)
-  NEW_TRUSTED_SEED(sspti_trusted_seed)
-  new last_cookie:key;
-  new call:Atom;
-
-  Oinit_hello_inner(sidr, biscuit_no, responder, psk, initiator, septi_trusted_seed, sspti_trusted_seed, ih, last_cookie, D, call).
-
-let secure_init_conf(initiator: kem_sk_tmpl, responder: kem_sk_tmpl, psk:key_tmpl, sidi:SessionId, sidr:SessionId) =
-  in(D,  InitConf(=sidi, =sidr, biscuit, auth3));
-  ic <- InitConf(sidi,sidr,biscuit, auth3);
-  NEW_TRUSTED_SEED(seski_trusted_seed)
-  NEW_TRUSTED_SEED(ssptr_trusted_seed)
-  new last_cookie:key;
-  call <- Cinit_conf(initiator, psk, responder, ic);
-
-  Oinit_conf_inner(initiator, psk, responder, ic, call).
-
-let secure_communication(initiator: kem_sk_tmpl, responder:kem_sk_tmpl, key:key) =
-  key_tmpl <- prepare_key(key);
-  (!secure_init_hello(initiator, secure_sidi, key_tmpl, responder))
-  | !secure_resp_hello(initiator, responder, secure_sidi, secure_sidr, secure_biscuit_no, key_tmpl)
-  | !(secure_init_conf(initiator, responder, key_tmpl, secure_sidi, secure_sidr)).
-
-let participant_communication_initiator(participant:kem_sk_tmpl) =
-  in(C, responder:kem_sk_tmpl);
-  in(C, k:key);
-  secure_communication(participant, responder, k).
-
-let participant_communication_responder(participant:kem_sk_tmpl) =
-  in(C, initiator:kem_sk_tmpl);
-  in(C, k:key);
-  secure_communication(initiator, participant, k).
-
-let participants_communication() =
-  initiator1_tmpl <- make_trusted_kem_sk(initiator1);
-  initiator2_tmpl <- make_trusted_kem_sk(initiator2);
-  responder1_tmpl <- make_trusted_kem_sk(responder1);
-  responder2_tmpl <- make_trusted_kem_sk(responder2);
-
-  !participant_communication_initiator(initiator1_tmpl) | !participant_communication_responder(initiator1_tmpl)
-  | !participant_communication_initiator(initiator2_tmpl) | !participant_communication_responder(initiator2_tmpl)
-  | !participant_communication_initiator(responder1_tmpl) | !participant_communication_responder(responder1_tmpl)
-  | !participant_communication_initiator(responder2_tmpl) | !participant_communication_responder(responder2_tmpl).
-
-let pipeChannel(D:channel, C:channel) =
-  in(D, b:bits);
-  out(C, b).
-
-let secretCommunication() =
-
-#ifdef INITIATOR_TEST
-  initiator_seed <- choice[make_trusted_kem_sk(initiator1), make_trusted_kem_sk(initiator2)];
-#else
-  initiator_seed <- make_trusted_kem_sk(initiator1);
-#endif
-#ifdef RESPONDER_TEST
-  responder_seed <- choice[make_trusted_kem_sk(responder1), make_trusted_kem_sk(responder2)];
-#else
-  responder_seed <- make_trusted_kem_sk(responder1);
-#endif
-
-  secure_communication(initiator_seed, responder_seed, secure_psk) | !pipeChannel(D, C).
-
-let reveal_pks() =
-  out(C, setup_kem_pk(make_trusted_kem_sk(responder1)));
-  out(C, setup_kem_pk(make_trusted_kem_sk(responder2)));
-  out(C, setup_kem_pk(make_trusted_kem_sk(initiator1)));
-  out(C, setup_kem_pk(make_trusted_kem_sk(initiator2))).
-
-let rosenpass_main2() = 
-  REP(INITIATOR_BOUND, Oinitiator)
-  | REP(RESPONDER_BOUND, Oinit_hello)
-  | REP(RESPONDER_BOUND, Oinit_conf).
-
-let identity_hiding_main() = 
-  0 | reveal_pks() | rosenpass_main2() | participants_communication() | phase 1; secretCommunication().
-
-#ifndef CUSTOM_MAIN
-let main = identity_hiding_main.
-#endif 

analysis/rosenpass/cookie.mpv

@@ -1,36 +0,0 @@
-
-fun cookie_key(kem_sk) : key [private].
-fun ip_and_port(kem_pk):bits.
-letfun create_mac2_key(sskm:kem_sk, spkt:kem_pk) = prf(cookie_key(sskm), ip_and_port(spkt)).
-
-letfun create_cookie(sskm:kem_sk, spkm:kem_pk, spkt:kem_pk, nonce:bits, msg:bits) = xaead_enc(lprf2(COOKIE, kem_pk2b(spkm), nonce),
-    k2b(create_mac2_key(sskm, spkm)), msg).
-
-type CookieMsg_t.
-fun CookieMsg(
-  SessionId,	// sender
-  bits, 		// nonce
-  bits			// cookie
-) : CookieMsg_t [data].
-
-
-#define COOKIE_PROCESS(eventLbl, innerFunc)       \
-  in(C, Ccookie(mac1, mac2));	\
-  COOKIE_EV(event MCAT(eventLbl, _UnderLoadEV) (spkm, spkt, last_cookie);)	\
-  msgB <- Envelope(mac1, RH2b(rh));	\
-  mac2_key <- create_mac2_key(sskm, spkt)	\
-  let RespHello(sidi, sidr, ecti, scti, biscuit, auth) = rh in \
-  if Envelope(mac2_key, msgB) = mac2 then	\
-    COOKIE_EV(event MCAT(eventLbl, _CookieValidated) (spkm, last_cookie);)	\
-    innerFunc	\
-  else	\
-    new nonce:bits;	\
-    cookie <- create_cookie(sskm, spkm, spkt, nonce, msg)	\
-    cookie_msg <- CookieMsg(sidi, nonce, cookie);	\
-    COOKIE_EV(event MCAT(eventLbl, _CookieSent) (spkm, cookie, cookie_k, cookie_msg);)	\
-    out(C, cookie_msg).	
-
-#define COOKIE_EVENTS(eventLbl) \
-	COOKIE_EV(event MCAT(eventLbl, _UnderLoadEV) (kem_pk, kem_pk, bits).)		\
-	COOKIE_EV(event MCAT(eventLbl, _CookieValidated) (kem_pk, bits, key, CookieMsg_t).)		\
-	COOKIE_EV(event MCAT(eventLbl, _CookieSent) (kem_pk, bits).)		

benches/handshake.rs

@@ -1,12 +1,11 @@
 use anyhow::Result;
-use rosenpass::protocol::{CryptoServer, HandleMsgResult, MsgBuf, PeerPtr, SPk, SSk, SymKey};
-use std::ops::DerefMut;
-
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::StaticKem;
+use rosenpass::{
+    pqkem::{EphemeralKEM, CCAKEM},
+    protocol::{CcaPk, CcaSk, CryptoServer, HandleMsgResult, MsgBuf, PeerPtr, SymKey},
+    sodium::sodium_init,
+};
 
 use criterion::{black_box, criterion_group, criterion_main, Criterion};
-use rosenpass_secret_memory::secret_policy_try_use_memfd_secrets;
 
 fn handle(
     tx: &mut CryptoServer,
@@ -39,9 +38,9 @@ fn hs(ini: &mut CryptoServer, res: &mut CryptoServer) -> Result<()> {
     Ok(())
 }
 
-fn keygen() -> Result<(SSk, SPk)> {
-    let (mut sk, mut pk) = (SSk::zero(), SPk::zero());
-    StaticKem::keygen(sk.secret_mut(), pk.deref_mut())?;
+fn keygen() -> Result<(CcaSk, CcaPk)> {
+    let (mut sk, mut pk) = (CcaSk::zero(), CcaPk::zero());
+    CCAKEM::keygen(sk.secret_mut(), pk.secret_mut())?;
     Ok((sk, pk))
 }
 
@@ -58,16 +57,16 @@ fn make_server_pair() -> Result<(CryptoServer, CryptoServer)> {
 }
 
 fn criterion_benchmark(c: &mut Criterion) {
-    secret_policy_try_use_memfd_secrets();
+    sodium_init().unwrap();
     let (mut a, mut b) = make_server_pair().unwrap();
     c.bench_function("cca_secret_alloc", |bench| {
         bench.iter(|| {
-            SSk::zero();
+            CcaSk::zero();
         })
     });
     c.bench_function("cca_public_alloc", |bench| {
         bench.iter(|| {
-            SPk::zero();
+            CcaPk::zero();
         })
     });
     c.bench_function("keygen", |bench| {

build.rs

@@ -30,7 +30,8 @@ fn generate_man() -> String {
         return man;
     }
 
-    "Cannot render manual page. Please visit https://rosenpass.eu/docs/manuals/\n".into()
+    // TODO: Link to online manual here
+    "Cannot render manual page\n".into()
 }
 
 fn man() {

cipher-traits/Cargo.toml

@@ -1,12 +0,0 @@
-[package]
-name = "rosenpass-cipher-traits"
-authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
-version = "0.1.0"
-edition = "2021"
-license = "MIT OR Apache-2.0"
-description = "Rosenpass internal traits for cryptographic primitives"
-homepage = "https://rosenpass.eu/"
-repository = "https://github.com/rosenpass/rosenpass"
-readme = "readme.md"
-
-[dependencies]

cipher-traits/readme.md

@@ -1,5 +0,0 @@
-# Rosenpass internal cryptographic traits
-
-Rosenpass internal library providing traits for cryptographic primitives.
-
-This is an internal library; not guarantee is made about its API at this point in time.

cipher-traits/src/kem.rs

@@ -1,45 +0,0 @@
-//! Traits and implementations for Key Encapsulation Mechanisms (KEMs)
-//!
-//! KEMs are the interface provided by almost all post-quantum
-//! secure key exchange mechanisms.
-//!
-//! Conceptually KEMs are akin to public-key encryption, but instead of encrypting
-//! arbitrary data, KEMs are limited to the transmission of keys, randomly chosen during
-//!
-//! encapsulation.
-//! The [KEM] Trait describes the basic API offered by a Key Encapsulation
-//! Mechanism. Two implementations for it are provided, [StaticKEM] and [EphemeralKEM].
-
-/// Key Encapsulation Mechanism
-///
-/// The KEM interface defines three operations: Key generation, key encapsulation and key
-/// decapsulation.
-pub trait Kem {
-    type Error;
-
-    /// Secrete Key length
-    const SK_LEN: usize;
-    /// Public Key length
-    const PK_LEN: usize;
-    /// Ciphertext length
-    const CT_LEN: usize;
-    /// Shared Secret length
-    const SHK_LEN: usize;
-
-    /// Generate a keypair consisting of secret key (`sk`) and public key (`pk`)
-    ///
-    /// `keygen() -> sk, pk`
-    fn keygen(sk: &mut [u8], pk: &mut [u8]) -> Result<(), Self::Error>;
-
-    /// From a public key (`pk`), generate a shared key (`shk`, for local use)
-    /// and a cipher text (`ct`, to be sent to the owner of the `pk`).
-    ///
-    /// `encaps(pk) -> shk, ct`
-    fn encaps(shk: &mut [u8], ct: &mut [u8], pk: &[u8]) -> Result<(), Self::Error>;
-
-    /// From a secret key (`sk`) and a cipher text (`ct`) derive a shared key
-    /// (`shk`)
-    ///
-    /// `decaps(sk, ct) -> shk`
-    fn decaps(shk: &mut [u8], sk: &[u8], ct: &[u8]) -> Result<(), Self::Error>;
-}

cipher-traits/src/lib.rs

@@ -1,2 +0,0 @@
-mod kem;
-pub use kem::Kem;

ciphers/Cargo.toml

@@ -1,26 +0,0 @@
-[package]
-name = "rosenpass-ciphers"
-authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
-version = "0.1.0"
-edition = "2021"
-license = "MIT OR Apache-2.0"
-description = "Rosenpass internal ciphers and other cryptographic primitives used by rosenpass."
-homepage = "https://rosenpass.eu/"
-repository = "https://github.com/rosenpass/rosenpass"
-readme = "readme.md"
-
-[features]
-experiment_libcrux = ["dep:libcrux"]
-
-[dependencies]
-anyhow = { workspace = true }
-rosenpass-to = { workspace = true }
-rosenpass-constant-time = { workspace = true }
-rosenpass-secret-memory = { workspace = true }
-rosenpass-oqs = { workspace = true }
-rosenpass-util = { workspace = true }
-static_assertions = { workspace = true }
-zeroize = { workspace = true }
-chacha20poly1305 = { workspace = true }
-blake2 = { workspace = true }
-libcrux = { workspace = true, optional = true } 

ciphers/readme.md

@@ -1,5 +0,0 @@
-# Rosenpass internal cryptographic primitives
-
-Ciphers and other cryptographic primitives used by rosenpass.
-
-This is an internal library; not guarantee is made about its API at this point in time.

ciphers/src/hash_domain.rs

@@ -1,109 +0,0 @@
-use anyhow::Result;
-use rosenpass_secret_memory::Secret;
-use rosenpass_to::To;
-
-use crate::subtle::incorrect_hmac_blake2b as hash;
-
-pub use hash::KEY_LEN;
-
-// TODO Use a proper Dec interface
-#[derive(Clone, Debug)]
-pub struct HashDomain([u8; KEY_LEN]);
-#[derive(Clone, Debug)]
-pub struct HashDomainNamespace([u8; KEY_LEN]);
-#[derive(Clone, Debug)]
-pub struct SecretHashDomain(Secret<KEY_LEN>);
-#[derive(Clone, Debug)]
-pub struct SecretHashDomainNamespace(Secret<KEY_LEN>);
-
-impl HashDomain {
-    pub fn zero() -> Self {
-        Self([0u8; KEY_LEN])
-    }
-
-    pub fn dup(self) -> HashDomainNamespace {
-        HashDomainNamespace(self.0)
-    }
-
-    pub fn turn_secret(self) -> SecretHashDomain {
-        SecretHashDomain(Secret::from_slice(&self.0))
-    }
-
-    // TODO: Protocol! Use domain separation to ensure that
-    pub fn mix(self, v: &[u8]) -> Result<Self> {
-        Ok(Self(hash::hash(&self.0, v).collect::<[u8; KEY_LEN]>()?))
-    }
-
-    pub fn mix_secret<const N: usize>(self, v: Secret<N>) -> Result<SecretHashDomain> {
-        SecretHashDomain::invoke_primitive(&self.0, v.secret())
-    }
-
-    pub fn into_value(self) -> [u8; KEY_LEN] {
-        self.0
-    }
-}
-
-impl HashDomainNamespace {
-    pub fn mix(&self, v: &[u8]) -> Result<HashDomain> {
-        Ok(HashDomain(
-            hash::hash(&self.0, v).collect::<[u8; KEY_LEN]>()?,
-        ))
-    }
-
-    pub fn mix_secret<const N: usize>(&self, v: Secret<N>) -> Result<SecretHashDomain> {
-        SecretHashDomain::invoke_primitive(&self.0, v.secret())
-    }
-}
-
-impl SecretHashDomain {
-    pub fn invoke_primitive(k: &[u8], d: &[u8]) -> Result<SecretHashDomain> {
-        let mut r = SecretHashDomain(Secret::zero());
-        hash::hash(k, d).to(r.0.secret_mut())?;
-        Ok(r)
-    }
-
-    pub fn zero() -> Self {
-        Self(Secret::zero())
-    }
-
-    pub fn dup(self) -> SecretHashDomainNamespace {
-        SecretHashDomainNamespace(self.0)
-    }
-
-    pub fn danger_from_secret(k: Secret<KEY_LEN>) -> Self {
-        Self(k)
-    }
-
-    pub fn mix(self, v: &[u8]) -> Result<SecretHashDomain> {
-        Self::invoke_primitive(self.0.secret(), v)
-    }
-
-    pub fn mix_secret<const N: usize>(self, v: Secret<N>) -> Result<SecretHashDomain> {
-        Self::invoke_primitive(self.0.secret(), v.secret())
-    }
-
-    pub fn into_secret(self) -> Secret<KEY_LEN> {
-        self.0
-    }
-
-    pub fn into_secret_slice(mut self, v: &[u8], dst: &[u8]) -> Result<()> {
-        hash::hash(v, dst).to(self.0.secret_mut())
-    }
-}
-
-impl SecretHashDomainNamespace {
-    pub fn mix(&self, v: &[u8]) -> Result<SecretHashDomain> {
-        SecretHashDomain::invoke_primitive(self.0.secret(), v)
-    }
-
-    pub fn mix_secret<const N: usize>(&self, v: Secret<N>) -> Result<SecretHashDomain> {
-        SecretHashDomain::invoke_primitive(self.0.secret(), v.secret())
-    }
-
-    // TODO: This entire API is not very nice; we need this for biscuits, but
-    // it might be better to extract a special "biscuit"
-    // labeled subkey and reinitialize the chain with this
-    pub fn danger_into_secret(self) -> Secret<KEY_LEN> {
-        self.0
-    }
-}

ciphers/src/lib.rs

@@ -1,32 +0,0 @@
-use static_assertions::const_assert;
-
-pub mod subtle;
-
-pub const KEY_LEN: usize = 32;
-const_assert!(KEY_LEN == aead::KEY_LEN);
-const_assert!(KEY_LEN == xaead::KEY_LEN);
-const_assert!(KEY_LEN == hash_domain::KEY_LEN);
-
-/// Authenticated encryption with associated data
-pub mod aead {
-    #[cfg(not(feature = "experiment_libcrux"))]
-    pub use crate::subtle::chacha20poly1305_ietf::{decrypt, encrypt, KEY_LEN, NONCE_LEN, TAG_LEN};
-    #[cfg(feature = "experiment_libcrux")]
-    pub use crate::subtle::chacha20poly1305_ietf_libcrux::{
-        decrypt, encrypt, KEY_LEN, NONCE_LEN, TAG_LEN,
-    };
-}
-
-/// Authenticated encryption with associated data with a constant nonce
-pub mod xaead {
-    pub use crate::subtle::xchacha20poly1305_ietf::{
-        decrypt, encrypt, KEY_LEN, NONCE_LEN, TAG_LEN,
-    };
-}
-
-pub mod hash_domain;
-
-pub mod kem {
-    pub use rosenpass_oqs::ClassicMceliece460896 as StaticKem;
-    pub use rosenpass_oqs::Kyber512 as EphemeralKem;
-}

ciphers/src/subtle/blake2b.rs

@@ -1,42 +0,0 @@
-use zeroize::Zeroizing;
-
-use blake2::digest::crypto_common::generic_array::GenericArray;
-use blake2::digest::crypto_common::typenum::U32;
-use blake2::digest::crypto_common::KeySizeUser;
-use blake2::digest::{FixedOutput, Mac, OutputSizeUser};
-use blake2::Blake2bMac;
-
-use rosenpass_to::{ops::copy_slice, with_destination, To};
-use rosenpass_util::typenum2const;
-
-type Impl = Blake2bMac<U32>;
-
-type KeyLen = <Impl as KeySizeUser>::KeySize;
-type OutLen = <Impl as OutputSizeUser>::OutputSize;
-
-const KEY_LEN: usize = typenum2const! { KeyLen };
-const OUT_LEN: usize = typenum2const! { OutLen };
-
-pub const KEY_MIN: usize = KEY_LEN;
-pub const KEY_MAX: usize = KEY_LEN;
-pub const OUT_MIN: usize = OUT_LEN;
-pub const OUT_MAX: usize = OUT_LEN;
-
-#[inline]
-pub fn hash<'a>(key: &'a [u8], data: &'a [u8]) -> impl To<[u8], anyhow::Result<()>> + 'a {
-    with_destination(|out: &mut [u8]| {
-        let mut h = Impl::new_from_slice(key)?;
-        h.update(data);
-
-        // Jesus christ, blake2 crate, your usage of GenericArray might be nice and fancy
-        // but it introduces a ton of complexity. This cost me half an hour just to figure
-        // out the right way to use the imports while allowing for zeroization.
-        // An API based on slices might actually be simpler.
-        let mut tmp = Zeroizing::new([0u8; OUT_LEN]);
-        let tmp = GenericArray::from_mut_slice(tmp.as_mut());
-        h.finalize_into(tmp);
-        copy_slice(tmp.as_ref()).to(out);
-
-        Ok(())
-    })
-}

ciphers/src/subtle/chacha20poly1305_ietf.rs

@@ -1,43 +0,0 @@
-use rosenpass_to::ops::copy_slice;
-use rosenpass_to::To;
-use rosenpass_util::typenum2const;
-
-use chacha20poly1305::aead::generic_array::GenericArray;
-use chacha20poly1305::ChaCha20Poly1305 as AeadImpl;
-use chacha20poly1305::{AeadCore, AeadInPlace, KeyInit, KeySizeUser};
-
-pub const KEY_LEN: usize = typenum2const! { <AeadImpl as KeySizeUser>::KeySize };
-pub const TAG_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::TagSize };
-pub const NONCE_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::NonceSize };
-
-#[inline]
-pub fn encrypt(
-    ciphertext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    plaintext: &[u8],
-) -> anyhow::Result<()> {
-    let nonce = GenericArray::from_slice(nonce);
-    let (ct, mac) = ciphertext.split_at_mut(ciphertext.len() - TAG_LEN);
-    copy_slice(plaintext).to(ct);
-    let mac_value = AeadImpl::new_from_slice(key)?.encrypt_in_place_detached(nonce, ad, ct)?;
-    copy_slice(&mac_value[..]).to(mac);
-    Ok(())
-}
-
-#[inline]
-pub fn decrypt(
-    plaintext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    ciphertext: &[u8],
-) -> anyhow::Result<()> {
-    let nonce = GenericArray::from_slice(nonce);
-    let (ct, mac) = ciphertext.split_at(ciphertext.len() - TAG_LEN);
-    let tag = GenericArray::from_slice(mac);
-    copy_slice(ct).to(plaintext);
-    AeadImpl::new_from_slice(key)?.decrypt_in_place_detached(nonce, ad, plaintext, tag)?;
-    Ok(())
-}

ciphers/src/subtle/chacha20poly1305_ietf_libcrux.rs

@@ -1,60 +0,0 @@
-use rosenpass_to::ops::copy_slice;
-use rosenpass_to::To;
-
-use zeroize::Zeroize;
-
-pub const KEY_LEN: usize = 32; // Grrrr! Libcrux, please provide me these constants.
-pub const TAG_LEN: usize = 16;
-pub const NONCE_LEN: usize = 12;
-
-#[inline]
-pub fn encrypt(
-    ciphertext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    plaintext: &[u8],
-) -> anyhow::Result<()> {
-    let (ciphertext, mac) = ciphertext.split_at_mut(ciphertext.len() - TAG_LEN);
-
-    use libcrux::aead as C;
-    let crux_key = C::Key::Chacha20Poly1305(C::Chacha20Key(key.try_into().unwrap()));
-    let crux_iv = C::Iv(nonce.try_into().unwrap());
-
-    copy_slice(plaintext).to(ciphertext);
-    let crux_tag = libcrux::aead::encrypt(&crux_key, ciphertext, crux_iv, ad).unwrap();
-    copy_slice(crux_tag.as_ref()).to(mac);
-
-    match crux_key {
-        C::Key::Chacha20Poly1305(mut k) => k.0.zeroize(),
-        _ => panic!(),
-    }
-
-    Ok(())
-}
-
-#[inline]
-pub fn decrypt(
-    plaintext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    ciphertext: &[u8],
-) -> anyhow::Result<()> {
-    let (ciphertext, mac) = ciphertext.split_at(ciphertext.len() - TAG_LEN);
-
-    use libcrux::aead as C;
-    let crux_key = C::Key::Chacha20Poly1305(C::Chacha20Key(key.try_into().unwrap()));
-    let crux_iv = C::Iv(nonce.try_into().unwrap());
-    let crux_tag = C::Tag::from_slice(mac).unwrap();
-
-    copy_slice(ciphertext).to(plaintext);
-    libcrux::aead::decrypt(&crux_key, plaintext, crux_iv, ad, &crux_tag).unwrap();
-
-    match crux_key {
-        C::Key::Chacha20Poly1305(mut k) => k.0.zeroize(),
-        _ => panic!(),
-    }
-
-    Ok(())
-}

ciphers/src/subtle/incorrect_hmac_blake2b.rs

@@ -1,46 +0,0 @@
-use anyhow::ensure;
-use zeroize::Zeroizing;
-
-use rosenpass_constant_time::xor;
-use rosenpass_to::{ops::copy_slice, with_destination, To};
-
-use crate::subtle::blake2b;
-
-pub const KEY_LEN: usize = 32;
-pub const KEY_MIN: usize = KEY_LEN;
-pub const KEY_MAX: usize = KEY_LEN;
-pub const OUT_MIN: usize = blake2b::OUT_MIN;
-pub const OUT_MAX: usize = blake2b::OUT_MAX;
-
-/// This is a woefully incorrect implementation of hmac_blake2b.
-/// See <https://github.com/rosenpass/rosenpass/issues/68#issuecomment-1563612222>
-///
-/// It accepts 32 byte keys, exclusively.
-///
-/// This will be replaced, likely by Kekkac at some point soon.
-/// <https://github.com/rosenpass/rosenpass/pull/145>
-#[inline]
-pub fn hash<'a>(key: &'a [u8], data: &'a [u8]) -> impl To<[u8], anyhow::Result<()>> + 'a {
-    const IPAD: [u8; KEY_LEN] = [0x36u8; KEY_LEN];
-    const OPAD: [u8; KEY_LEN] = [0x5Cu8; KEY_LEN];
-
-    with_destination(|out: &mut [u8]| {
-        // Not bothering with padding; the implementation
-        // uses appropriately sized keys.
-        ensure!(key.len() == KEY_LEN);
-
-        type Key = Zeroizing<[u8; KEY_LEN]>;
-        let mut tmp_key = Key::default();
-
-        copy_slice(key).to(tmp_key.as_mut());
-        xor(&IPAD).to(tmp_key.as_mut());
-        let mut outer_data = Key::default();
-        blake2b::hash(tmp_key.as_ref(), data).to(outer_data.as_mut())?;
-
-        copy_slice(key).to(tmp_key.as_mut());
-        xor(&OPAD).to(tmp_key.as_mut());
-        blake2b::hash(tmp_key.as_ref(), outer_data.as_ref()).to(out)?;
-
-        Ok(())
-    })
-}

ciphers/src/subtle/mod.rs

@@ -1,7 +0,0 @@
-pub mod blake2b;
-#[cfg(not(feature = "experiment_libcrux"))]
-pub mod chacha20poly1305_ietf;
-#[cfg(feature = "experiment_libcrux")]
-pub mod chacha20poly1305_ietf_libcrux;
-pub mod incorrect_hmac_blake2b;
-pub mod xchacha20poly1305_ietf;

ciphers/src/subtle/xchacha20poly1305_ietf.rs

@@ -1,45 +0,0 @@
-use rosenpass_to::ops::copy_slice;
-use rosenpass_to::To;
-use rosenpass_util::typenum2const;
-
-use chacha20poly1305::aead::generic_array::GenericArray;
-use chacha20poly1305::XChaCha20Poly1305 as AeadImpl;
-use chacha20poly1305::{AeadCore, AeadInPlace, KeyInit, KeySizeUser};
-
-pub const KEY_LEN: usize = typenum2const! { <AeadImpl as KeySizeUser>::KeySize };
-pub const TAG_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::TagSize };
-pub const NONCE_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::NonceSize };
-
-#[inline]
-pub fn encrypt(
-    ciphertext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    plaintext: &[u8],
-) -> anyhow::Result<()> {
-    let nonce = GenericArray::from_slice(nonce);
-    let (n, ct_mac) = ciphertext.split_at_mut(NONCE_LEN);
-    let (ct, mac) = ct_mac.split_at_mut(ct_mac.len() - TAG_LEN);
-    copy_slice(nonce).to(n);
-    copy_slice(plaintext).to(ct);
-    let mac_value = AeadImpl::new_from_slice(key)?.encrypt_in_place_detached(nonce, ad, ct)?;
-    copy_slice(&mac_value[..]).to(mac);
-    Ok(())
-}
-
-#[inline]
-pub fn decrypt(
-    plaintext: &mut [u8],
-    key: &[u8],
-    ad: &[u8],
-    ciphertext: &[u8],
-) -> anyhow::Result<()> {
-    let (n, ct_mac) = ciphertext.split_at(NONCE_LEN);
-    let (ct, mac) = ct_mac.split_at(ct_mac.len() - TAG_LEN);
-    let nonce = GenericArray::from_slice(n);
-    let tag = GenericArray::from_slice(mac);
-    copy_slice(ct).to(plaintext);
-    AeadImpl::new_from_slice(key)?.decrypt_in_place_detached(nonce, ad, plaintext, tag)?;
-    Ok(())
-}

config-examples/peer-a-config.toml

@@ -2,6 +2,7 @@ public_key = "peer-a-public-key"
 secret_key = "peer-a-secret-key"
 listen = ["[::]:10001"]
 verbosity = "Quiet"
+control_socket = "rosenpassd.sock"
 
 [[peers]]
 public_key = "peer-b-public-key"

constant-time/Cargo.toml

@@ -1,22 +0,0 @@
-[package]
-name = "rosenpass-constant-time"
-version = "0.1.0"
-authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
-edition = "2021"
-license = "MIT OR Apache-2.0"
-description = "Rosenpass internal utilities for constant time crypto implementations"
-homepage = "https://rosenpass.eu/"
-repository = "https://github.com/rosenpass/rosenpass"
-readme = "readme.md"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[features]
-constant_time_tests = []
-
-[dependencies]
-rosenpass-to = { workspace = true }
-memsec = { workspace = true }
-
-[dev-dependencies]
-rand = "0.8.5"

constant-time/readme.md

@@ -1,5 +0,0 @@
-# Rosenpass constant time library
-
-Rosenpass internal library providing basic constant-time operations.
-
-This is an internal library; not guarantee is made about its API at this point in time.

constant-time/src/compare.rs

@@ -1,39 +0,0 @@
-use core::ptr;
-
-/// Little endian memcmp version of quinier/memsec
-/// https://github.com/quininer/memsec/blob/bbc647967ff6d20d6dccf1c85f5d9037fcadd3b0/src/lib.rs#L30
-#[inline(never)]
-pub unsafe fn memcmp_le(b1: *const u8, b2: *const u8, len: usize) -> i32 {
-    let mut res = 0;
-    for i in 0..len {
-        let diff =
-            i32::from(ptr::read_volatile(b1.add(i))) - i32::from(ptr::read_volatile(b2.add(i)));
-        res = (res & (((diff - 1) & !diff) >> 8)) | diff;
-    }
-    ((res - 1) >> 8) + (res >> 8) + 1
-}
-
-/// compares two slices of memory content and returns an integer indicating the relationship between
-/// the slices
-///
-/// ## Returns
-/// - <0 if the first byte that does not match both slices has a lower value in `a` than in `b`
-/// - 0 if the contents are equal
-/// - >0 if the first byte that does not match both slices has a higher value in `a` than in `b`
-///
-/// ## Leaks
-/// If the two slices have differents lengths, the function will return immediately. This
-/// effectively leaks the information whether the slices have equal length or not. This is widely
-/// considered safe.
-///
-/// The execution time of the function grows approx. linear with the length of the input. This is
-/// considered safe.
-///
-/// ## Tests
-/// For discussion on how to ensure the constant-time execution of this function, see
-/// <https://github.com/rosenpass/rosenpass/issues/232>
-#[inline]
-pub fn compare(a: &[u8], b: &[u8]) -> i32 {
-    assert!(a.len() == b.len());
-    unsafe { memcmp_le(a.as_ptr(), b.as_ptr(), a.len()) }
-}

constant-time/src/increment.rs

@@ -1,48 +0,0 @@
-use core::hint::black_box;
-
-/// Interpret the given slice as a little-endian unsigned integer
-/// and increment that integer.
-///
-/// # Leaks
-/// TODO: mention here if this function leaks any information, see
-/// <https://github.com/rosenpass/rosenpass/issues/232>
-///
-/// ## Tests
-/// For discussion on how to ensure the constant-time execution of this function, see
-/// <https://github.com/rosenpass/rosenpass/issues/232>
-///
-/// # Examples
-///
-/// ```
-/// use rosenpass_constant_time::increment as inc;
-/// use rosenpass_to::To;
-///
-/// fn testcase(v: &[u8], correct: &[u8]) {
-///   let mut v = v.to_owned();
-///   inc(&mut v);
-///   assert_eq!(&v, correct);
-/// }
-///
-/// testcase(b"", b"");
-/// testcase(b"\x00", b"\x01");
-/// testcase(b"\x01", b"\x02");
-/// testcase(b"\xfe", b"\xff");
-/// testcase(b"\xff", b"\x00");
-/// testcase(b"\x00\x00", b"\x01\x00");
-/// testcase(b"\x01\x00", b"\x02\x00");
-/// testcase(b"\xfe\x00", b"\xff\x00");
-/// testcase(b"\xff\x00", b"\x00\x01");
-/// testcase(b"\x00\x00\x00\x00\x00\x00", b"\x01\x00\x00\x00\x00\x00");
-/// testcase(b"\x00\xa3\x00\x77\x00\x00", b"\x01\xa3\x00\x77\x00\x00");
-/// testcase(b"\xff\xa3\x00\x77\x00\x00", b"\x00\xa4\x00\x77\x00\x00");
-/// testcase(b"\xff\xff\xff\x77\x00\x00", b"\x00\x00\x00\x78\x00\x00");
-/// ```
-#[inline]
-pub fn increment(v: &mut [u8]) {
-    let mut carry = 1u8;
-    for val in v.iter_mut() {
-        let (v, c) = black_box(*val).overflowing_add(black_box(carry));
-        *black_box(val) = v;
-        *black_box(&mut carry) = black_box(black_box(c) as u8);
-    }
-}

constant-time/src/lib.rs

@@ -1,17 +0,0 @@
-//! constant-time implementations of some primitives
-//!
-//! Rosenpass internal library providing basic constant-time operations.
-//!
-//! ## TODO
-//! Figure out methodology to ensure that code is actually constant time, see
-//! <https://github.com/rosenpass/rosenpass/issues/232>
-
-mod compare;
-mod increment;
-mod memcmp;
-mod xor;
-
-pub use compare::compare;
-pub use increment::increment;
-pub use memcmp::memcmp;
-pub use xor::xor;

constant-time/src/memcmp.rs

@@ -1,107 +0,0 @@
-/// compares two sclices of memory content and returns whether they are equal
-///
-/// ## Leaks
-/// If the two slices have differents lengths, the function will return immediately. This
-/// effectively leaks the information whether the slices have equal length or not. This is widely
-/// considered safe.
-///
-/// The execution time of the function grows approx. linear with the length of the input. This is
-/// considered safe.
-#[inline]
-pub fn memcmp(a: &[u8], b: &[u8]) -> bool {
-    a.len() == b.len() && unsafe { memsec::memeq(a.as_ptr(), b.as_ptr(), a.len()) }
-}
-
-/// [tests::memcmp_runs_in_constant_time] runs a stasticial test that the equality of the two
-/// input parameters does not correlate with the run time.
-///
-/// For discussion on how to (further) ensure the constant-time execution of this function,
-/// see <https://github.com/rosenpass/rosenpass/issues/232>
-#[cfg(all(test, feature = "constant_time_tests"))]
-mod tests {
-    use super::*;
-    use rand::seq::SliceRandom;
-    use rand::thread_rng;
-    use std::time::Instant;
-
-    #[test]
-    /// tests whether [memcmp] actually runs in constant time
-    ///
-    /// This test function will run an equal amount of comparisons on two different sets of parameters:
-    /// - completely equal slices
-    /// - completely unequal slices.
-    /// All comparisons are executed in a randomized order. The test will fail if one of the
-    /// two sets is checked for equality significantly faster than the other set
-    /// (absolute correlation coefficient ≥ 0.01)
-    fn memcmp_runs_in_constant_time() {
-        // prepare data to compare
-        let n: usize = 1E6 as usize; // number of comparisons to run
-        let len = 1024; // length of each slice passed as parameters to the tested comparison function
-        let a1 = "a".repeat(len);
-        let a2 = a1.clone();
-        let b = "b".repeat(len);
-
-        let a1 = a1.as_bytes();
-        let a2 = a2.as_bytes();
-        let b = b.as_bytes();
-
-        // vector representing all timing tests
-        //
-        // Each element is a tuple of:
-        // 0: whether the test compared two equal slices
-        // 1: the duration needed for the comparison to run
-        let mut tests = (0..n)
-            .map(|i| (i < n / 2, std::time::Duration::ZERO))
-            .collect::<Vec<_>>();
-        tests.shuffle(&mut thread_rng());
-
-        // run comparisons / call function to test
-        for test in tests.iter_mut() {
-            let now = Instant::now();
-            if test.0 {
-                memcmp(a1, a2);
-            } else {
-                memcmp(a1, b);
-            }
-            test.1 = now.elapsed();
-            // println!("eq: {}, elapsed: {:.2?}", test.0, test.1);
-        }
-
-        // sort by execution time and calculate Pearson correlation coefficient
-        tests.sort_by_key(|v| v.1);
-        let tests = tests
-            .iter()
-            .map(|t| (if t.0 { 1_f64 } else { 0_f64 }, t.1.as_nanos() as f64))
-            .collect::<Vec<_>>();
-        // averages
-        let (avg_x, avg_y): (f64, f64) = (
-            tests.iter().map(|t| t.0).sum::<f64>() / n as f64,
-            tests.iter().map(|t| t.1).sum::<f64>() / n as f64,
-        );
-        assert!((avg_x - 0.5).abs() < 1E-12);
-        // standard deviations
-        let sd_x = 0.5;
-        let sd_y = (1_f64 / n as f64
-            * tests
-                .iter()
-                .map(|t| {
-                    let difference = t.1 - avg_y;
-                    difference * difference
-                })
-                .sum::<f64>())
-        .sqrt();
-        // covariance
-        let cv = 1_f64 / n as f64
-            * tests
-                .iter()
-                .map(|t| (t.0 - avg_x) * (t.1 - avg_y))
-                .sum::<f64>();
-        // Pearson correlation
-        let correlation = cv / (sd_x * sd_y);
-        println!("correlation: {:.6?}", correlation);
-        assert!(
-            correlation.abs() < 0.01,
-            "execution time correlates with result"
-        )
-    }
-}

constant-time/src/xor.rs

@@ -1,34 +0,0 @@
-use core::hint::black_box;
-use rosenpass_to::{with_destination, To};
-
-/// Xors the source into the destination
-///
-/// # Panics
-/// If source and destination are of different sizes.
-///
-/// # Leaks
-/// TODO: mention here if this function leaks any information, see
-/// <https://github.com/rosenpass/rosenpass/issues/232>
-///
-/// ## Tests
-/// For discussion on how to ensure the constant-time execution of this function, see
-/// <https://github.com/rosenpass/rosenpass/issues/232>
-///
-/// # Examples
-///
-/// ```
-/// use rosenpass_constant_time::xor;
-/// use rosenpass_to::To;
-/// assert_eq!(
-///     xor(b"world").to_this(|| b"hello".to_vec()),
-///     b"\x1f\n\x1e\x00\x0b");
-/// ```
-#[inline]
-pub fn xor(src: &[u8]) -> impl To<[u8], ()> + '_ {
-    with_destination(|dst: &mut [u8]| {
-        assert!(black_box(src.len()) == black_box(dst.len()));
-        for (dv, sv) in dst.iter_mut().zip(src.iter()) {
-            *black_box(dv) ^= black_box(*sv);
-        }
-    })
-}

doc/check.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-
-# We have to filter this STYLE error out, because it is very platform specific
-OUTPUT=$(mandoc -Tlint "$1" | grep --invert-match "STYLE: referenced manual not found")
-
-if [ -z "$OUTPUT" ]
-then
-	exit 0
-else
-	echo "$1 is malformatted, check mandoc -Tlint $1"
-	echo "$OUTPUT"
-	exit 1
-fi

doc/rosenpass.1

@@ -12,18 +12,18 @@
 .Sh DESCRIPTION
 .Nm
 performs cryptographic key exchanges that are secure against quantum-computers
-and then outputs the keys.
-These keys can then be passed to various services, such as wireguard or other
-vpn services, as pre-shared-keys to achieve security against attackers with
+and outputs the keys.
+These keys can then be passed to various services such as wireguard or other
+vpn services as pre-shared-keys to achieve security against attackers with
 quantum computers.
 .Pp
 This is a research project and quantum computers are not thought to become
-practical in fewer than ten years.
+practical in less than ten years.
 If you are not specifically tasked with developing post-quantum secure systems,
 you probably do not need this tool.
 .Ss COMMANDS
 .Bl -tag -width Ds
-.It Ar gen-keys --secret-key <file-path> --public-key <file-path>
+.It Ar keygen private-key <file-path> public-key <file-path>
 Generate a keypair to use in the exchange command later.
 Send the public-key file to your communication partner and keep the private-key
 file secret!
@@ -31,7 +31,7 @@ file secret!
 Start a process to exchange keys with the specified peers.
 You should specify at least one peer.
 .Pp
-Its
+It's
 .Ar OPTIONS
 are as follows:
 .Bl -tag -width Ds
@@ -39,7 +39,7 @@ are as follows:
 Instructs
 .Nm
 to listen on the specified interface and port.
-By default,
+By default
 .Nm
 will listen on all interfaces and select a random port.
 .It Ar verbose
@@ -91,24 +91,15 @@ This makes it possible to add peers entirely from
 .Sh SEE ALSO
 .Xr rp 1 ,
 .Xr wg 1
-.Rs
-.%A Karolin Varner
-.%A Benjamin Lipp
-.%A Wanja Zaeske
-.%A Lisa Schmidt
-.%D 2023
-.%T Rosenpass
-.%U https://rosenpass.eu/whitepaper.pdf
-.Re
 .Sh STANDARDS
-This tool is the reference implementation of the Rosenpass protocol, as
-specified within the whitepaper referenced above.
+This tool is the reference implementation of the Rosenpass protocol, written
+by Karolin Varner, Benjamin Lipp, Wanja Zaeske, and Lisa Schmidt.
 .Sh AUTHORS
 Rosenpass was created by Karolin Varner, Benjamin Lipp, Wanja Zaeske,
 Marei Peischl, Stephan Ajuvo, and Lisa Schmidt.
 .Pp
 This manual page was written by
-.An Clara Engler
+.An Emil Engler
 .Sh BUGS
 The bugs are tracked at
 .Lk https://github.com/rosenpass/rosenpass/issues .

doc/rp.1

@@ -113,7 +113,7 @@ Rosenpass was created by Karolin Varner, Benjamin Lipp, Wanja Zaeske,
 Marei Peischl, Stephan Ajuvo, and Lisa Schmidt.
 .Pp
 This manual page was written by
-.An Clara Engler
+.An Emil Engler
 .Sh BUGS
 The bugs are tracked at
 .Lk https://github.com/rosenpass/rosenpass/issues .

flake.lock

@@ -2,15 +2,17 @@
   "nodes": {
     "fenix": {
       "inputs": {
-        "nixpkgs": ["nixpkgs"],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1712298178,
-        "narHash": "sha256-590fpCPXYAkaAeBz/V91GX4/KGzPObdYtqsTWzT6AhI=",
+        "lastModified": 1692771621,
+        "narHash": "sha256-W1qOIeOvzkJxdITGGWqSxmFbu9ob+ZP8lXNkkQi8UL4=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "569b5b5781395da08e7064e825953c548c26af76",
+        "rev": "add522038f2a32aa1263c8d3c81e1ea2265cc4e1",
         "type": "github"
       },
       "original": {
@@ -24,11 +26,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "lastModified": 1689068808,
+        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
         "type": "github"
       },
       "original": {
@@ -39,14 +41,16 @@
     },
     "naersk": {
       "inputs": {
-        "nixpkgs": ["nixpkgs"]
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1698420672,
-        "narHash": "sha256-/TdeHMPRjjdJub7p7+w55vyABrsJlt5QkznPYy55vKA=",
+        "lastModified": 1692351612,
+        "narHash": "sha256-KTGonidcdaLadRnv9KFgwSMh1ZbXoR/OBmPjeNMhFwU=",
         "owner": "nix-community",
         "repo": "naersk",
-        "rev": "aeb58d5e8faead8980a807c840232697982d47b9",
+        "rev": "78789c30d64dea2396c9da516bbcc8db3a475207",
         "type": "github"
       },
       "original": {
@@ -57,18 +61,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1712168706,
-        "narHash": "sha256-XP24tOobf6GGElMd0ux90FEBalUtw6NkBSVh/RlA6ik=",
+        "lastModified": 1691522891,
+        "narHash": "sha256-xqQqVryXKJoFQ/+RL0A7DihkLkev8dk6afM7B04TilU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1487bdea619e4a7a53a4590c475deabb5a9d1bfb",
+        "rev": "78287547942dd8e8afff0ae47fb8e2553db79d7e",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "nixos-23.11",
-        "repo": "nixpkgs",
-        "type": "github"
+        "id": "nixpkgs",
+        "type": "indirect"
       }
     },
     "root": {
@@ -82,11 +84,11 @@
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1712156296,
-        "narHash": "sha256-St7ZQrkrr5lmQX9wC1ZJAFxL8W7alswnyZk9d1se3Us=",
+        "lastModified": 1692701491,
+        "narHash": "sha256-Lz5GXi/CImvcIXtpBpQ9jVI9Ni9eU/4xk36PvKmjwJM=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "8e581ac348e223488622f4d3003cb2bd412bf27e",
+        "rev": "9e3bf69ad3c736893b285f47f4d014ae1aed1cb0",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,6 +1,5 @@
 {
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11";
     flake-utils.url = "github:numtide/flake-utils";
 
     # for quicker rust builds
@@ -30,155 +29,52 @@
       ]
         (system:
           let
-            scoped = (scope: scope.result);
             lib = nixpkgs.lib;
 
             # normal nixpkgs
             pkgs = import nixpkgs {
               inherit system;
+
+              # TODO remove overlay once a fix for
+              # https://github.com/NixOS/nixpkgs/issues/216904 got merged
+              overlays = [
+                (
+                  final: prev: {
+                    iproute2 = prev.iproute2.overrideAttrs (old:
+                      let
+                        isStatic = prev.stdenv.hostPlatform.isStatic;
+                      in
+                      {
+                        makeFlags = old.makeFlags ++ prev.lib.optional isStatic [
+                          "TC_CONFIG_NO_XT=y"
+                        ];
+                      });
+                  }
+                )
+              ];
             };
 
             # parsed Cargo.toml
-            cargoToml = builtins.fromTOML (builtins.readFile ./rosenpass/Cargo.toml);
+            cargoToml = builtins.fromTOML (builtins.readFile ./Cargo.toml);
 
             # source files relevant for rust
-            src = scoped rec {
-              # File suffices to include
-              extensions = [
-                "lock"
-                "rs"
-                "toml"
-              ];
-              # Files to explicitly include
-              files = [
-                "to/README.md"
-              ];
+            src = pkgs.lib.sourceByRegex ./. [
+              "Cargo\\.(toml|lock)"
+              "build.rs"
+              "(src|benches)(/.*\\.(rs|md))?"
+              "rp"
+            ];
 
-              src = ./.;
-              filter = (path: type: scoped rec {
-                inherit (lib) any id removePrefix hasSuffix;
-                anyof = (any id);
-
-                basename = baseNameOf (toString path);
-                relative = removePrefix (toString src + "/") (toString path);
-
-                result = anyof [
-                  (type == "directory")
-                  (any (ext: hasSuffix ".${ext}" basename) extensions)
-                  (any (file: file == relative) files)
-                ];
-              });
-
-              result = pkgs.lib.sources.cleanSourceWith { inherit src filter; };
-            };
+            # builds a bin path for all dependencies for the `rp` shellscript
+            rpBinPath = p: with p; lib.makeBinPath [
+              coreutils
+              findutils
+              gawk
+              wireguard-tools
+            ];
 
             # a function to generate a nix derivation for rosenpass against any
             # given set of nixpkgs
-            rosenpassDerivation = p:
-              let
-                # whether we want to build a statically linked binary
-                isStatic = p.targetPlatform.isStatic;
-
-                # the rust target of `p`
-                target = p.rust.toRustTargetSpec p.targetPlatform;
-
-                # convert a string to shout case
-                shout = string: builtins.replaceStrings [ "-" ] [ "_" ] (pkgs.lib.toUpper string);
-
-                # suitable Rust toolchain
-                toolchain = with inputs.fenix.packages.${system}; combine [
-                  stable.cargo
-                  stable.rustc
-                  targets.${target}.stable.rust-std
-                ];
-
-                # naersk with a custom toolchain
-                naersk = pkgs.callPackage inputs.naersk {
-                  cargo = toolchain;
-                  rustc = toolchain;
-                };
-
-                # used to trick the build.rs into believing that CMake was ran **again**
-                fakecmake = pkgs.writeScriptBin "cmake" ''
-                  #! ${pkgs.stdenv.shell} -e
-                  true
-                '';
-              in
-              naersk.buildPackage
-                {
-                  # metadata and source
-                  name = cargoToml.package.name;
-                  version = cargoToml.package.version;
-                  inherit src;
-
-                  cargoBuildOptions = x: x ++ [ "-p" "rosenpass" ];
-                  cargoTestOptions = x: x ++ [ "-p" "rosenpass" ];
-
-                  doCheck = true;
-
-                  nativeBuildInputs = with pkgs; [
-                    p.stdenv.cc
-                    cmake # for oqs build in the oqs-sys crate
-                    mandoc # for the built-in manual
-                    removeReferencesTo
-                    rustPlatform.bindgenHook # for C-bindings in the crypto libs
-                  ];
-                  buildInputs = with p; [ bash ];
-
-                  override = x: {
-                    preBuild =
-                      # nix defaults to building for aarch64 _without_ the armv8-a crypto
-                      # extensions, but liboqs depens on these
-                      (lib.optionalString (system == "aarch64-linux") ''
-                        NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -march=armv8-a+crypto"
-                      ''
-                      );
-
-                    # fortify is only compatible with dynamic linking
-                    hardeningDisable = lib.optional isStatic "fortify";
-                  };
-
-                  overrideMain = x: {
-                    # CMake detects that it was served a _foreign_ target dir, and CMake
-                    # would be executed again upon the second build step of naersk.
-                    # By adding our specially optimized CMake version, we reduce the cost
-                    # of recompilation by 99 % while, while avoiding any CMake errors.
-                    nativeBuildInputs = [ (lib.hiPrio fakecmake) ] ++ x.nativeBuildInputs;
-
-                    # make sure that libc is linked, under musl this is not the case per
-                    # default
-                    preBuild = (lib.optionalString isStatic ''
-                      NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -lc"
-                    '');
-                  };
-
-                  # We want to build for a specific target...
-                  CARGO_BUILD_TARGET = target;
-
-                  # ... which might require a non-default linker:
-                  "CARGO_TARGET_${shout target}_LINKER" =
-                    let
-                      inherit (p.stdenv) cc;
-                    in
-                    "${cc}/bin/${cc.targetPrefix}cc";
-
-                  meta = with pkgs.lib;
-                    {
-                      inherit (cargoToml.package) description homepage;
-                      license = with licenses; [ mit asl20 ];
-                      maintainers = [ maintainers.wucke13 ];
-                      platforms = platforms.all;
-                    };
-                } // (lib.mkIf isStatic {
-                # otherwise pkg-config tries to link non-existent dynamic libs
-                # documented here: https://docs.rs/pkg-config/latest/pkg_config/
-                PKG_CONFIG_ALL_STATIC = true;
-
-                # tell rust to build everything statically linked
-                CARGO_BUILD_RUSTFLAGS = "-C target-feature=+crt-static";
-              });
-            # a function to generate a nix derivation for the rp helper against any
-            # given set of nixpkgs
             rpDerivation = p:
               let
                 # whether we want to build a statically linked binary
@@ -216,19 +112,18 @@
                   version = cargoToml.package.version;
                   inherit src;
 
-                  cargoBuildOptions = x: x ++ [ "-p" "rp" ];
-                  cargoTestOptions = x: x ++ [ "-p" "rp" ];
-
                   doCheck = true;
 
                   nativeBuildInputs = with pkgs; [
                     p.stdenv.cc
                     cmake # for oqs build in the oqs-sys crate
                     mandoc # for the built-in manual
+                    makeWrapper # for the rp shellscript
+                    pkg-config # let libsodium-sys-stable find libsodium
                     removeReferencesTo
                     rustPlatform.bindgenHook # for C-bindings in the crypto libs
                   ];
-                  buildInputs = with p; [ bash ];
+                  buildInputs = with p; [ bash libsodium ];
 
                   override = x: {
                     preBuild =
@@ -255,8 +150,18 @@
                     preBuild = (lib.optionalString isStatic ''
                       NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -lc"
                     '');
+
+                    preInstall = ''
+                      install -D ${./rp} $out/bin/rp
+                      wrapProgram $out/bin/rp --prefix PATH : "${ rpBinPath p }"
+                    '';
                   };
 
+                  # liboqs requires quite a lot of stack memory, thus we adjust
+                  # the default stack size picked for new threads (which is used
+                  # by `cargo test`) to be _big enough_
+                  RUST_MIN_STACK = 8 * 1024 * 1024; # 8 MiB
+
                   # We want to build for a specific target...
                   CARGO_BUILD_TARGET = target;
 
@@ -296,8 +201,7 @@
           rec {
             packages = rec {
               default = rosenpass;
-              rosenpass = rosenpassDerivation pkgs;
-              rp = rpDerivation pkgs;
+              rosenpass = rpDerivation pkgs;
               rosenpass-oci-image = rosenpassOCI "rosenpass";
 
               # derivation for the release
@@ -308,10 +212,6 @@
                     if pkgs.hostPlatform.isLinux then
                       packages.rosenpass-static
                     else packages.rosenpass;
-                  rp =
-                    if pkgs.hostPlatform.isLinux then
-                      packages.rp-static
-                    else packages.rp;
                   oci-image =
                     if pkgs.hostPlatform.isLinux then
                       packages.rosenpass-static-oci-image
@@ -320,15 +220,14 @@
                 pkgs.runCommandNoCC "lace-result" { }
                   ''
                     mkdir {bin,$out}
-                    tar -cvf $out/rosenpass-${system}-${version}.tar \
-                      -C ${package} bin/rosenpass \
-                      -C ${rp} bin/rp
+                    cp ${./.}/rp bin/
+                    tar -cvf $out/rosenpass-${system}-${version}.tar bin/rp \
+                      -C ${package} bin/rosenpass
                     cp ${oci-image} \
                       $out/rosenpass-oci-image-${system}-${version}.tar.gz
                   '';
             } // (if pkgs.stdenv.isLinux then rec {
-              rosenpass-static = rosenpassDerivation pkgs.pkgsStatic;
-              rp-static = rpDerivation pkgs.pkgsStatic;
+              rosenpass-static = rpDerivation pkgs.pkgsStatic;
               rosenpass-static-oci-image = rosenpassOCI "rosenpass-static";
             } else { });
           }
@@ -370,6 +269,7 @@
               ];
               buildPhase = ''
                 export HOME=$(mktemp -d)
+                export OSFONTDIR="$(kpsewhich --var-value TEXMF)/fonts/{opentype/public/nunito,truetype/google/noto}"
                 latexmk -r tex/CI.rc
               '';
               installPhase = ''
@@ -390,7 +290,7 @@
           packages.proof-proverif = pkgs.stdenv.mkDerivation {
             name = "rosenpass-proverif-proof";
             version = "unstable";
-            src = pkgs.lib.sources.sourceByRegex ./. [
+            src = pkgs.lib.sourceByRegex ./. [
               "analyze.sh"
               "marzipan(/marzipan.awk)?"
               "analysis(/.*)?"
@@ -409,19 +309,20 @@
           #
           devShells.default = pkgs.mkShell {
             inherit (packages.proof-proverif) CRYPTOVERIF_LIB;
+            inherit (packages.rosenpass) RUST_MIN_STACK;
             inputsFrom = [ packages.default ];
             nativeBuildInputs = with pkgs; [
-              inputs.fenix.packages.${system}.complete.toolchain
               cmake # override the fakecmake from the main step above
               cargo-release
               clippy
               nodePackages.prettier
-              nushell # for the .ci/gen-workflow-files.nu script
+              rustfmt
               packages.proverif-patched
             ];
           };
           devShells.coverage = pkgs.mkShell {
             inputsFrom = [ packages.default ];
+            inherit (packages.rosenpass) RUST_MIN_STACK;
             nativeBuildInputs = with pkgs; [ inputs.fenix.packages.${system}.complete.toolchain cargo-llvm-cov ];
           };
 
@@ -429,7 +330,7 @@
           checks = {
             cargo-fmt = pkgs.runCommand "check-cargo-fmt"
               { inherit (self.devShells.${system}.default) nativeBuildInputs buildInputs; } ''
-              cargo fmt --manifest-path=${./.}/Cargo.toml --check --all && touch $out
+              cargo fmt --manifest-path=${./.}/Cargo.toml --check && touch $out
             '';
             nixpkgs-fmt = pkgs.runCommand "check-nixpkgs-fmt"
               { nativeBuildInputs = [ pkgs.nixpkgs-fmt ]; } ''

format_rust_code.sh

@@ -1,115 +0,0 @@
-#!/usr/bin/env bash
-
-# Parse command line options
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        --mode)
-            mode="$2"
-            shift 2
-            ;;
-        *)
-            echo "Unknown option: $1"
-            exit 1
-            ;;
-    esac
-done
-
-# Check if mode is specified
-if [ -z "$mode" ]; then
-    echo "Please specify the mode using --mode option. Valid modes are 'check' and 'fix'."
-    exit 1
-fi
-
-# Find all Markdown files in the current directory and its subdirectories
-mapfile -t md_files < <(find . -type f -name "*.md")
-
-count=0
-# Iterate through each Markdown file
-for file in "${md_files[@]}"; do
-    # Use awk to extract Rust code blocks enclosed within triple backticks
-    rust_code_blocks=$(awk '/```rust/{flag=1; next}/```/{flag=0} flag' "$file")
-
-    # Count the number of Rust code blocks
-    num_fences=$(awk '/```rust/{f=1} f{if(/```/){f=0; count++}} END{print count}' "$file")
-
-    if [ -n "$rust_code_blocks" ]; then
-        echo "Processing Rust code in $file"
-        # Iterate through each Rust code block
-        for ((i=1; i <= num_fences ; i++)); do
-            # Extract individual Rust code block using awk
-            current_rust_block=$(awk -v i="$i" '/```rust/{f=1; if (++count == i) next} f&&/```/{f=0;next} f' "$file")
-            # Variable to check if we have added the main function
-            add_main=0  
-            # Check if the Rust code block is already inside a function
-            if ! echo "$current_rust_block" | grep -q "fn main()"; then
-                # If not, wrap it in a main function
-                current_rust_block=$'fn main() {\n'"$current_rust_block"$'\n}'
-                add_main=1
-            fi
-            if [ "$mode" == "check" ]; then
-                # Apply changes to the Rust code block
-                formatted_rust_code=$(echo "$current_rust_block" | rustfmt)
-                # Use rustfmt to format the Rust code block, remove first and last lines, and remove the first 4 spaces if added  main function
-                if [ "$add_main" == 1 ]; then
-                    formatted_rust_code=$(echo "$formatted_rust_code" | sed '1d;$d' | sed 's/^    //')
-                    current_rust_block=$(echo "$current_rust_block" | sed '1d;')
-                    current_rust_block=$(echo "$current_rust_block" | sed '$d')
-                fi
-                if [ "$formatted_rust_code" == "$current_rust_block" ]; then
-                    echo "No changes needed in Rust code block $i in $file"
-                else
-                    echo -e "\nChanges needed in Rust code block $i in $file:\n"
-                    echo "$formatted_rust_code"
-                    count=+1
-                fi
-
-            elif [ "$mode" == "fix" ]; then
-                # Replace current_rust_block with formatted_rust_code in the file
-                formatted_rust_code=$(echo "$current_rust_block" | rustfmt)
-                # Use rustfmt to format the Rust code block, remove first and last lines, and remove the first 4 spaces if added  main function
-                if [ "$add_main" == 1 ]; then
-                    formatted_rust_code=$(echo "$formatted_rust_code" | sed '1d;$d' | sed 's/^    //')
-                    current_rust_block=$(echo "$current_rust_block" | sed '1d;')
-                    current_rust_block=$(echo "$current_rust_block" | sed '$d')
-                fi
-                # Check if the formatted code is the same as the current Rust code block
-                if [ "$formatted_rust_code" == "$current_rust_block" ]; then
-                    echo "No changes needed in Rust code block $i in $file"
-                else
-                    echo "Formatting Rust code block $i in $file"
-                    # Replace current_rust_block with formatted_rust_code in the file
-                    # Use awk to find the line number of the pattern
-
-                    start_line=$(grep -n "^\`\`\`rust" "$file" | sed -n "${i}p" | cut -d: -f1)
-                    end_line=$(grep -n "^\`\`\`" "$file" | awk -F: -v start_line="$start_line" '$1 > start_line {print $1; exit;}')
-
-                    if [ -n "$start_line" ] && [ -n "$end_line" ]; then
-                        # Print lines before the Rust code block
-                        head -n "$((start_line - 1))" "$file"
-
-                        # Print the formatted Rust code block
-                        echo "\`\`\`rust"
-                        echo "$formatted_rust_code"
-                        echo "\`\`\`"
-
-                        # Print lines after the Rust code block
-                        tail -n +"$((end_line + 1))" "$file"
-                    else
-                        # Rust code block not found or end line not found
-                        cat "$file"
-                    fi > tmpfile && mv tmpfile "$file"
-
-                fi
-            else  
-                echo "Unknown mode: $mode. Valid modes are 'check' and 'fix'."
-                exit 1
-            fi
-        done
-    fi
-done
-
-# CI failure if changes are needed
-if [ $count -gt 0 ]; then
-    echo "CI failed: Changes needed in Rust code blocks."
-    exit 1
-fi

fuzz/.gitignore

@@ -1,4 +0,0 @@
-target
-corpus
-artifacts
-coverage

fuzz/Cargo.toml

@@ -1,87 +0,0 @@
-[package]
-name = "rosenpass-fuzzing"
-version = "0.0.1"
-publish = false
-edition = "2021"
-
-[features]
-experiment_libcrux = ["rosenpass-ciphers/experiment_libcrux"]
-
-[package.metadata]
-cargo-fuzz = true
-
-[dependencies]
-arbitrary = { workspace = true }
-libfuzzer-sys = { workspace = true }
-stacker = { workspace = true }
-rosenpass-secret-memory = { workspace = true }
-rosenpass-ciphers = { workspace = true }
-rosenpass-cipher-traits = { workspace = true }
-rosenpass-to = { workspace = true }
-rosenpass = { workspace = true }
-
-[[bin]]
-name = "fuzz_handle_msg"
-path = "fuzz_targets/handle_msg.rs"
-test = false
-doc = false
-
-[[bin]]
-name = "fuzz_blake2b"
-path = "fuzz_targets/blake2b.rs"
-test = false
-doc = false
-
-[[bin]]
-name = "fuzz_aead_enc_into"
-path = "fuzz_targets/aead_enc_into.rs"
-test = false
-doc = false
-
-[[bin]]
-name = "fuzz_mceliece_encaps"
-path = "fuzz_targets/mceliece_encaps.rs"
-test = false
-doc = false
-
-[[bin]]
-name = "fuzz_kyber_encaps"
-path = "fuzz_targets/kyber_encaps.rs"
-test = false
-doc = false
-
-[[bin]]
-name = "fuzz_box_secret_alloc_malloc"
-path = "fuzz_targets/box_secret_alloc_malloc.rs"
-test = false
-doc = false
-
-[[bin]]
-name = "fuzz_vec_secret_alloc_malloc"
-path = "fuzz_targets/vec_secret_alloc_malloc.rs"
-test = false
-doc = false
-
-[[bin]]
-name = "fuzz_box_secret_alloc_memfdsec"
-path = "fuzz_targets/box_secret_alloc_memfdsec.rs"
-test = false
-doc = false
-
-[[bin]]
-name = "fuzz_vec_secret_alloc_memfdsec"
-path = "fuzz_targets/vec_secret_alloc_memfdsec.rs"
-test = false
-doc = false
-
-[[bin]]
-name = "fuzz_box_secret_alloc_memfdsec_mallocfb"
-path = "fuzz_targets/box_secret_alloc_memfdsec_mallocfb.rs"
-test = false
-doc = false
-
-[[bin]]
-name = "fuzz_vec_secret_alloc_memfdsec_mallocfb"
-path = "fuzz_targets/vec_secret_alloc_memfdsec_mallocfb.rs"
-test = false
-doc = false

fuzz/fuzz_targets/aead_enc_into.rs

@@ -1,28 +0,0 @@
-#![no_main]
-extern crate arbitrary;
-extern crate rosenpass;
-
-use libfuzzer_sys::fuzz_target;
-
-use rosenpass_ciphers::aead;
-
-#[derive(arbitrary::Arbitrary, Debug)]
-pub struct Input {
-    pub key: [u8; 32],
-    pub nonce: [u8; 12],
-    pub ad: Box<[u8]>,
-    pub plaintext: Box<[u8]>,
-}
-
-fuzz_target!(|input: Input| {
-    let mut ciphertext = vec![0u8; input.plaintext.len() + 16];
-
-    aead::encrypt(
-        ciphertext.as_mut_slice(),
-        &input.key,
-        &input.nonce,
-        &input.ad,
-        &input.plaintext,
-    )
-    .unwrap();
-});

fuzz/fuzz_targets/blake2b.rs

@@ -1,20 +0,0 @@
-#![no_main]
-extern crate arbitrary;
-extern crate rosenpass;
-
-use libfuzzer_sys::fuzz_target;
-
-use rosenpass_ciphers::subtle::blake2b;
-use rosenpass_to::To;
-
-#[derive(arbitrary::Arbitrary, Debug)]
-pub struct Blake2b {
-    pub key: [u8; 32],
-    pub data: Box<[u8]>,
-}
-
-fuzz_target!(|input: Blake2b| {
-    let mut out = [0u8; 32];
-
-    blake2b::hash(&input.key, &input.data).to(&mut out).unwrap();
-});

fuzz/fuzz_targets/box_secret_alloc_malloc.rs

@@ -1,12 +0,0 @@
-#![no_main]
-
-use libfuzzer_sys::fuzz_target;
-use rosenpass_secret_memory::alloc::secret_box;
-use rosenpass_secret_memory::policy::*;
-use std::sync::Once;
-static ONCE: Once = Once::new();
-
-fuzz_target!(|data: &[u8]| {
-    ONCE.call_once(secret_policy_use_only_malloc_secrets);
-    let _ = secret_box(data);
-});

fuzz/fuzz_targets/box_secret_alloc_memfdsec.rs

@@ -1,13 +0,0 @@
-#![no_main]
-
-use libfuzzer_sys::fuzz_target;
-use rosenpass_secret_memory::alloc::secret_box;
-use rosenpass_secret_memory::policy::*;
-use std::sync::Once;
-
-static ONCE: Once = Once::new();
-
-fuzz_target!(|data: &[u8]| {
-    ONCE.call_once(secret_policy_use_only_memfd_secrets);
-    let _ = secret_box(data);
-});

fuzz/fuzz_targets/box_secret_alloc_memfdsec_mallocfb.rs

@@ -1,13 +0,0 @@
-#![no_main]
-
-use libfuzzer_sys::fuzz_target;
-use rosenpass_secret_memory::alloc::secret_box;
-use rosenpass_secret_memory::policy::*;
-use std::sync::Once;
-
-static ONCE: Once = Once::new();
-
-fuzz_target!(|data: &[u8]| {
-    ONCE.call_once(secret_policy_try_use_memfd_secrets);
-    let _ = secret_box(data);
-});

fuzz/fuzz_targets/handle_msg.rs

@@ -1,24 +0,0 @@
-#![no_main]
-extern crate rosenpass;
-
-use libfuzzer_sys::fuzz_target;
-
-use rosenpass::protocol::CryptoServer;
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::StaticKem;
-use rosenpass_secret_memory::policy::*;
-use rosenpass_secret_memory::{PublicBox, Secret};
-use std::sync::Once;
-
-static ONCE: Once = Once::new();
-fuzz_target!(|rx_buf: &[u8]| {
-    ONCE.call_once(secret_policy_use_only_malloc_secrets);
-    let sk = Secret::from_slice(&[0; StaticKem::SK_LEN]);
-    let pk = PublicBox::from_slice(&[0; StaticKem::PK_LEN]);
-
-    let mut cs = CryptoServer::new(sk, pk);
-    let mut tx_buf = [0; 10240];
-
-    // We expect errors while fuzzing therefore we do not check the result.
-    let _ = cs.handle_msg(rx_buf, &mut tx_buf);
-});

fuzz/fuzz_targets/kyber_encaps.rs

@@ -1,20 +0,0 @@
-#![no_main]
-extern crate arbitrary;
-extern crate rosenpass;
-
-use libfuzzer_sys::fuzz_target;
-
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::EphemeralKem;
-
-#[derive(arbitrary::Arbitrary, Debug)]
-pub struct Input {
-    pub pk: [u8; EphemeralKem::PK_LEN],
-}
-
-fuzz_target!(|input: Input| {
-    let mut ciphertext = [0u8; EphemeralKem::CT_LEN];
-    let mut shared_secret = [0u8; EphemeralKem::SHK_LEN];
-
-    EphemeralKem::encaps(&mut shared_secret, &mut ciphertext, &input.pk).unwrap();
-});

fuzz/fuzz_targets/mceliece_encaps.rs

@@ -1,15 +0,0 @@
-#![no_main]
-extern crate rosenpass;
-
-use libfuzzer_sys::fuzz_target;
-
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::StaticKem;
-
-fuzz_target!(|input: [u8; StaticKem::PK_LEN]| {
-    let mut ciphertext = [0u8; StaticKem::CT_LEN];
-    let mut shared_secret = [0u8; StaticKem::SHK_LEN];
-
-    // We expect errors while fuzzing therefore we do not check the result.
-    let _ = StaticKem::encaps(&mut shared_secret, &mut ciphertext, &input);
-});

fuzz/fuzz_targets/vec_secret_alloc_malloc.rs

@@ -1,15 +0,0 @@
-#![no_main]
-
-use std::sync::Once;
-
-use libfuzzer_sys::fuzz_target;
-use rosenpass_secret_memory::alloc::secret_vec;
-use rosenpass_secret_memory::policy::*;
-
-static ONCE: Once = Once::new();
-
-fuzz_target!(|data: &[u8]| {
-    ONCE.call_once(secret_policy_use_only_malloc_secrets);
-    let mut vec = secret_vec();
-    vec.extend_from_slice(data);
-});

fuzz/fuzz_targets/vec_secret_alloc_memfdsec.rs

@@ -1,15 +0,0 @@
-#![no_main]
-
-use std::sync::Once;
-
-use libfuzzer_sys::fuzz_target;
-use rosenpass_secret_memory::alloc::secret_vec;
-use rosenpass_secret_memory::policy::*;
-
-static ONCE: Once = Once::new();
-
-fuzz_target!(|data: &[u8]| {
-    ONCE.call_once(secret_policy_use_only_memfd_secrets);
-    let mut vec = secret_vec();
-    vec.extend_from_slice(data);
-});

fuzz/fuzz_targets/vec_secret_alloc_memfdsec_mallocfb.rs

@@ -1,15 +0,0 @@
-#![no_main]
-
-use std::sync::Once;
-
-use libfuzzer_sys::fuzz_target;
-use rosenpass_secret_memory::alloc::secret_vec;
-use rosenpass_secret_memory::policy::*;
-
-static ONCE: Once = Once::new();
-
-fuzz_target!(|data: &[u8]| {
-    ONCE.call_once(secret_policy_try_use_memfd_secrets);
-    let mut vec = secret_vec();
-    vec.extend_from_slice(data);
-});

misc/README.md

@@ -1,40 +0,0 @@
-# Additional files
-
-This folder contains additional files that are used in the project.
-
-## `generate_configs.py`
-
-The script is used to generate configuration files for a benchmark setup
-consisting of a device under testing (DUT) and automatic test equipment (ATE),
-basically a strong machine capable of running multiple Rosenpass instances at
-once.
-
-At the top of the script multiple variables can be set to configure the DUT IP
-address and more. Once configured you may run `python3 generate_configs.py` to
-create the configuration files.
-
-A new folder called `output/` is created containing the subfolder `dut/` and
-`ate/`. The former has to be copied on the DUT, ideally reproducible hardware
-like a Raspberry Pi, while the latter is copied to the ATE, i.e. a laptop.
-
-### Running a benchmark
-
-On the ATE a run script is required since multiple instances of `rosenpass` are
-started with different configurations in parallel. The scripts are named after
-the number of instances they start, e.g. `run-50.sh` starts 50 instances.
-
-```shell
-# on the ATE aka laptop
-cd output/ate
-./run-10.sh
-```
-
-On the DUT you start a single Rosenpass instance with the configuration matching
-the ATE number of peers.
-
-```shell
-# on the DUT aka Raspberry Pi
-rosenpass exchange-config configs/dut-10.toml
-```
-
-Use whatever measurement tool you like to monitor the DUT and ATE.

misc/generate_configs.py

@@ -1,105 +0,0 @@
-from pathlib import Path
-from subprocess import run
-import os
-
-config = dict(
-    peer_counts=[1, 5, 10, 50, 100, 500],
-    peer_count_max=100,
-    ate_ip="127.0.0.1",
-    dut_ip="127.0.0.1",
-    dut_port=9999,
-    path_to_rosenpass_bin=os.getcwd() + "/target/release/rosenpass",
-)
-
-print(config)
-
-output_dir = Path("output")
-output_dir.mkdir(exist_ok=True)
-
-template_dut = """
-public_key = "keys/dut-public-key"
-secret_key = "keys/dut-secret-key"
-listen = ["{dut_ip}:{dut_port}"]
-verbosity = "Quiet"
-"""
-template_dut_peer = """
-[[peers]] # ATE-{i}
-public_key = "keys/ate-{i}-public-key"
-endpoint = "{ate_ip}:{ate_port}"
-key_out = "out/key_out_{i}"
-"""
-
-template_ate = """
-public_key = "keys/ate-{i}-public-key"
-secret_key = "keys/ate-{i}-secret-key"
-listen = ["{ate_ip}:{ate_port}"]
-verbosity = "Quiet"
-
-[[peers]] # DUT
-public_key = "keys/dut-public-key"
-endpoint = "{dut_ip}:{dut_port}"
-key_out = "out/key_out_{i}"
-"""
-
-(output_dir / "dut" / "keys").mkdir(exist_ok=True, parents=True)
-(output_dir / "dut" / "out").mkdir(exist_ok=True, parents=True)
-(output_dir / "dut" / "configs").mkdir(exist_ok=True, parents=True)
-(output_dir / "ate" / "keys").mkdir(exist_ok=True, parents=True)
-(output_dir / "ate" / "out").mkdir(exist_ok=True, parents=True)
-(output_dir / "ate" / "configs").mkdir(exist_ok=True, parents=True)
-
-for peer_count in config["peer_counts"]:
-    dut_config = template_dut.format(**config)
-    for i in range(peer_count):
-        dut_config += template_dut_peer.format(**config, i=i, ate_port=50000 + i)
-
-    (output_dir / "dut" / "configs" / f"dut-{peer_count}.toml").write_text(dut_config)
-
-    if not (output_dir / "dut" / "keys" / "dut-public-key").exists():
-        print("Generate DUT keys")
-        run(
-            [
-                config["path_to_rosenpass_bin"],
-                "gen-keys",
-                f"configs/dut-{peer_count}.toml",
-            ],
-            cwd=output_dir / "dut",
-        )
-    else:
-        print("DUT keys already exist")
-
-# copy the DUT public key to the ATE
-(output_dir / "ate" / "keys" / "dut-public-key").write_bytes(
-    (output_dir / "dut" / "keys" / "dut-public-key").read_bytes()
-)
-
-ate_script = "(trap 'kill 0' SIGINT; \\\n"
-
-for i in range(config["peer_count_max"]):
-    (output_dir / "ate" / "configs" / f"ate-{i}.toml").write_text(
-        template_ate.format(**config, i=i, ate_port=50000 + i)
-    )
-
-    if not (output_dir / "ate" / "keys" / f"ate-{i}-public-key").exists():
-        # generate ATE keys
-        run(
-            [config["path_to_rosenpass_bin"], "gen-keys", f"configs/ate-{i}.toml"],
-            cwd=output_dir / "ate",
-        )
-    else:
-        print(f"ATE-{i} keys already exist")
-
-    # copy the ATE public keys to the DUT
-    (output_dir / "dut" / "keys" / f"ate-{i}-public-key").write_bytes(
-        (output_dir / "ate" / "keys" / f"ate-{i}-public-key").read_bytes()
-    )
-
-    ate_script += (
-        f"{config['path_to_rosenpass_bin']} exchange-config configs/ate-{i}.toml & \\\n"
-    )
-
-    if (i + 1) in config["peer_counts"]:
-        write_script = ate_script
-        write_script += "wait)"
-
-        (output_dir / "ate" / f"run-{i+1}.sh").write_text(write_script)

oqs/Cargo.toml

@@ -1,16 +0,0 @@
-[package]
-name = "rosenpass-oqs"
-authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
-version = "0.1.0"
-edition = "2021"
-license = "MIT OR Apache-2.0"
-description = "Rosenpass internal bindings to liboqs"
-homepage = "https://rosenpass.eu/"
-repository = "https://github.com/rosenpass/rosenpass"
-readme = "readme.md"
-
-[dependencies]
-rosenpass-cipher-traits = { workspace = true }
-rosenpass-util = { workspace = true }
-oqs-sys = { workspace = true }
-paste = { workspace = true }

oqs/readme.md

@@ -1,5 +0,0 @@
-# Rosenpass internal liboqs bindings
-
-Rosenpass internal library providing bindings to liboqs.
-
-This is an internal library; not guarantee is made about its API at this point in time.

oqs/src/kem_macro.rs

@@ -1,80 +0,0 @@
-macro_rules! oqs_kem {
-    ($name:ident) => { ::paste::paste!{
-        mod [< $name:snake >] {
-            use rosenpass_cipher_traits::Kem;
-            use rosenpass_util::result::Guaranteed;
-
-            pub enum [< $name:camel >]  {}
-
-            /// # Panic & Safety
-            ///
-            /// This Trait impl calls unsafe [oqs_sys] functions, that write to byte
-            /// slices only identified using raw pointers. It must be ensured that the raw
-            /// pointers point into byte slices of sufficient length, to avoid UB through
-            /// overwriting of arbitrary data. This is ensured through assertions in the
-            /// implementation.
-            ///
-            /// __Note__: This requirement is stricter than necessary, it would suffice
-            /// to only check that the buffers are big enough, allowing them to be even
-            /// bigger. However, from a correctness point of view it does not make sense to
-            /// allow bigger buffers.
-            impl Kem for [< $name:camel >] {
-                type Error = ::std::convert::Infallible;
-
-                const SK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_secret_key >] as usize;
-                const PK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_public_key >] as usize;
-                const CT_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_ciphertext >] as usize;
-                const SHK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_shared_secret >] as usize;
-
-                fn keygen(sk: &mut [u8], pk: &mut [u8]) -> Guaranteed<()> {
-                    assert_eq!(sk.len(), Self::SK_LEN);
-                    assert_eq!(pk.len(), Self::PK_LEN);
-                    unsafe {
-                        oqs_call!(
-                            ::oqs_sys::kem::[< OQS_KEM _ $name:snake _ keypair >],
-                            pk.as_mut_ptr(),
-                            sk.as_mut_ptr()
-                        );
-                    }
-
-                    Ok(())
-                }
-
-                fn encaps(shk: &mut [u8], ct: &mut [u8], pk: &[u8]) -> Guaranteed<()> {
-                    assert_eq!(shk.len(), Self::SHK_LEN);
-                    assert_eq!(ct.len(), Self::CT_LEN);
-                    assert_eq!(pk.len(), Self::PK_LEN);
-                    unsafe {
-                        oqs_call!(
-                            ::oqs_sys::kem::[< OQS_KEM _ $name:snake _ encaps >],
-                            ct.as_mut_ptr(),
-                            shk.as_mut_ptr(),
-                            pk.as_ptr()
-                        );
-                    }
-
-                    Ok(())
-                }
-
-                fn decaps(shk: &mut [u8], sk: &[u8], ct: &[u8]) -> Guaranteed<()> {
-                    assert_eq!(shk.len(), Self::SHK_LEN);
-                    assert_eq!(sk.len(), Self::SK_LEN);
-                    assert_eq!(ct.len(), Self::CT_LEN);
-                    unsafe {
-                        oqs_call!(
-                            ::oqs_sys::kem::[< OQS_KEM _ $name:snake _ decaps >],
-                            shk.as_mut_ptr(),
-                            ct.as_ptr(),
-                            sk.as_ptr()
-                        );
-                    }
-
-                    Ok(())
-                }
-            }
-
-        }
-
-        pub use [< $name:snake >] :: [< $name:camel >];
-    }}
-}

oqs/src/lib.rs

@@ -1,21 +0,0 @@
-macro_rules! oqs_call {
-    ($name:path, $($args:expr),*) => {{
-        use oqs_sys::common::OQS_STATUS::*;
-
-        match $name($($args),*) {
-            OQS_SUCCESS => {}, // nop
-            OQS_EXTERNAL_LIB_ERROR_OPENSSL => {
-                panic!("OpenSSL error in liboqs' {}.", stringify!($name));
-            },
-            OQS_ERROR => {
-                panic!("Unknown error in liboqs' {}.", stringify!($name));
-            }
-        }
-    }};
-    ($name:ident) => { oqs_call!($name, ) };
-}
-
-#[macro_use]
-mod kem_macro;
-oqs_kem!(kyber_512);
-oqs_kem!(classic_mceliece_460896);

papers/tex/template-rosenpass.tex

@@ -177,11 +177,7 @@ version={4.0},
 		\titlehead{\centerline{\includegraphics[width=4cm]{RosenPass-Logo}}}
 		\title{\inserttitle}
 	}
-	\ifx\csname insertauthor\endcsname\relax
-	\author{}
-	\else
-	\author{\parbox{\linewidth}{\centering\insertauthor}}
-	\fi
+	\author{\csname insertauthor\endcsname}
 	\subject{\csname insertsubject\endcsname}
 	\date{\vspace{-1cm}}
 }

papers/whitepaper.md

@@ -6,7 +6,6 @@ author:
 - Benjamin Lipp = Max Planck Institute for Security and Privacy (MPI-SP)
 - Wanja Zaeske
 - Lisa Schmidt = {Scientific Illustrator – \\url{mullana.de}}
-- Prabhpreet Dua
 abstract: |
        Rosenpass is used to create post-quantum-secure VPNs. Rosenpass computes a shared key, WireGuard (WG) [@wg] uses the shared key to establish a secure connection. Rosenpass can also be used without WireGuard, deriving post-quantum-secure symmetric keys for another application. The Rosenpass protocol builds on “Post-quantum WireGuard” (PQWG) [@pqwg] and improves it by using a cookie mechanism to provide security against state disruption attacks.
 
@@ -219,7 +218,6 @@ The server needs to store the following variables:
 * `spkm`
 * `biscuit_key` – Randomly chosen key used to encrypt biscuits
 * `biscuit_ctr` – Retransmission protection for biscuits
-* `cookie_secret`- A randomized cookie secret to derive cookies sent to peer when under load. This secret changes every 120 seconds
 
 Not mandated per se, but required in practice:
 
@@ -245,7 +243,6 @@ The initiator stores the following local state for each ongoing handshake:
 * `ck` – The chaining key
 * `eski` – The initiator's ephemeral secret key
 * `epki` – The initiator's ephemeral public key
-* `cookie_value`- Cookie value sent by an initiator peer under load, used to compute cookie field in outgoing handshake to peer under load. This value expires 120 seconds from when a peer sends this value using the CookieReply message
 
 The responder stores no state. While the responder has access to all of the above variables except for `eski`, the responder discards them after generating the RespHello message. Instead, the responder state is contained inside a cookie called a biscuit. This value is returned to the responder inside the InitConf packet. The biscuit consists of:
 
@@ -431,92 +428,12 @@ The responder code handling InitConf needs to deal with the biscuits and package
 
 ICR5 and ICR6 perform biscuit replay protection using the biscuit number. This is not handled in `load_biscuit()` itself because there is the case that `biscuit_no = biscuit_used` which needs to be dealt with for retransmission handling.
 
-### Denial of Service Mitigation and Cookies
-
-Rosenpass derives its cookie-based DoS mitigation technique for a responder when receiving InitHello messages from Wireguard [@wg]. 
-
-When the responder is under load, it may choose to not process further InitHello handshake messages, but instead to respond with a cookie reply message (see Figure \ref{img:MessageTypes}).
-
-The sender of the exchange then uses this cookie in order to resend the message and have it accepted the following time by the reciever. 
-
-For an initiator, Rosenpass ignores all messages when under load.
-
-#### Cookie Reply Message
-
-The cookie reply message is sent by the responder on receiving an InitHello message when under load. It consists of the `sidi` of the initiator, a random 24-byte bitstring `nonce` and encrypting `cookie_value` into a `cookie_encrypted` reply field which consists of the following:
-
-```pseudorust
-cookie_value = lhash("cookie-value", cookie_secret, initiator_host_info)[0..16]
-cookie_encrypted = XAEAD(lhash("cookie-key", spkm), nonce, cookie_value, mac_peer)
-```
-
-where `cookie_secret` is a secret variable that changes every two minutes to a random value. `initiator_host_info` is used to identify the initiator host, and is implementation-specific for the client. This paramaters used to identify the host must be carefully chosen to ensure there is a unique mapping, especially when using IPv4 and IPv6 addresses to identify the host (such as taking care of IPv6 link-local addresses). `cookie_value` is a truncated 16 byte value from the above hash operation. `mac_peer` is the `mac` field of the peer's handshake message to which message is the reply.  
-
-#### Envelope `mac` Field
-
-Similar to `mac.1` in Wireguard handshake messages, the `mac` field of a Rosenpass envelope from a handshake packet sender's point of view consists of the following:
-
-```pseudorust
-mac = lhash("mac", spkt, MAC_WIRE_DATA)[0..16]
-```
-
-where `MAC_WIRE_DATA` represents all bytes of msg prior to `mac` field in the envelope.
-
-If a client receives an invalid `mac` value for any message, it will discard the message.
-
-#### Envelope cookie field
-
-The initiator, on receiving a CookieReply message, decrypts `cookie_encrypted` and stores the `cookie_value` for the session into `peer[sid].cookie_value` for a limited time (120 seconds). This value is then used to set `cookie` field set for subsequent messages and retransmissions to the responder as follows:
-
-```pseudorust
-if (peer.cookie_value.is_none()  ||  seconds_since_update(peer[sid].cookie_value) >= 120) {
-    cookie.zeroize(); //zeroed out 16 bytes bitstring
-}
-else {
-    cookie = lhash("cookie",peer.cookie_value.unwrap(),COOKIE_WIRE_DATA)
-}
-```
-
-Here, `seconds_since_update(peer.cookie_value)` is the amount of time in seconds ellapsed since last cookie was received, and `COOKIE_WIRE_DATA` are the message contents of all bytes of the retransmitted message prior to the `cookie` field.
-
-The inititator can use an invalid value for the `cookie` value, when the responder is not under load, and the responder must ignore this value.
-However, when the responder is under load, it may reject InitHello messages with the invalid `cookie` value, and issue a cookie reply message. 
-
-### Conditions to trigger DoS Mechanism
-
-This whitepaper does not mandate any specific mechanism to detect responder contention (also mentioned as the under load condition) that would trigger use of the cookie mechanism.
-
-For the reference implemenation, Rosenpass has derived inspiration from the linux implementation of Wireguard.  This implementation suggests that the reciever keep track of the number of messages it is processing at a given time. 
-
-On receiving an incoming message, if the length of the message queue to be processed exceeds a threshold `MAX_QUEUED_INCOMING_HANDSHAKES_THRESHOLD`, the client is considered under load and its state is stored as under load. In addition, the timestamp of this instant when the client was last under load is stored. When recieving subsequent messages, if the client is still in an under load state, the client will check if the time ellpased since the client was last under load has exceeded `LAST_UNDER_LOAD_WINDOW` seconds. If this is the case, the client will update its state to normal operation, and process the message in a normal fashion.
-
-Currently, the following constants are derived from the Linux kernel implementation of Wireguard:
-
-```pseudorust
-MAX_QUEUED_INCOMING_HANDSHAKES_THRESHOLD = 4096
-LAST_UNDER_LOAD_WINDOW = 1 //seconds
-```
-
 ## Dealing with Packet Loss
 
 The initiator deals with packet loss by storing the messages it sends to the responder and retransmitting them in randomized, exponentially increasing intervals until they get a response. Receiving RespHello terminates retransmission of InitHello. A Data or EmptyData message serves as acknowledgement of receiving InitConf and terminates its retransmission.
 
 The responder does not need to do anything special to handle RespHello retransmission – if the RespHello package is lost, the initiator retransmits InitHello and the responder can generate another RespHello package from that. InitConf retransmission needs to be handled specifically in the responder code because accepting an InitConf retransmission would reset the live session including the nonce counter, which would cause nonce reuse. Implementations must detect the case that `biscuit_no = biscuit_used` in ICR5, skip execution of ICR6 and ICR7, and just transmit another EmptyData package to confirm that the initiator can stop transmitting InitConf.
 
-### Interaction with cookie reply system
-
-The cookie reply system does not interfere with the retransmission logic discussed above. 
-
-When the initator is under load, it will ignore processing any incoming messages.
-
-When a responder is under load and it receives an InitHello handshake message, the InitHello message will be discarded and a cookie reply message is sent. The initiator, then on the reciept of the cookie reply message, will store a decrypted `cookie_value` to set the `cookie` field to subsequently sent messages. As per the retransmission mechanism above, the initiator will send a retransmitted InitHello message with a valid `cookie` value appended. On receiving the retransmitted handshake message, the responder will validate the `cookie` value and resume with the handshake process. 
-
-When the responder is under load and it recieves an InitConf message, the message will be directly processed without checking the validity of the cookie field.
-
-# Changelog
-
-- Added section "Denial of Service Mitigation and Cookies", and modify "Dealing with Packet Loss" for DoS cookie mechanism
-
 \printbibliography
 
 \setupimage{landscape,fullpage,label=img:HandlingCode}

readme.md

@@ -25,11 +25,11 @@ Follow [quick start instructions](https://rosenpass.eu/#start) to get a VPN up a
 
 ## Software architecture
 
-The [rosenpass tool](./src/) is written in Rust and uses liboqs[^liboqs]. The tool establishes a symmetric key and provides it to WireGuard. Since it supplies WireGuard with key through the PSK feature using Rosenpass+WireGuard is cryptographically no less secure than using WireGuard on its own ("hybrid security"). Rosenpass refreshes the symmetric key every two minutes.
+The [rosenpass tool](./src/) is written in Rust and uses liboqs[^liboqs] and libsodium[^libsodium]. The tool establishes a symmetric key and provides it to WireGuard. Since it supplies WireGuard with key through the PSK feature using Rosenpass+WireGuard is cryptographically no less secure than using WireGuard on its own ("hybrid security"). Rosenpass refreshes the symmetric key every two minutes.
 
 As with any application a small risk of critical security issues (such as buffer overflows, remote code execution) exists; the Rosenpass application is written in the Rust programming language which is much less prone to such issues. Rosenpass can also write keys to files instead of supplying them to WireGuard With a bit of scripting the stand alone mode of the implementation can be used to run the application in a Container, VM or on another host. This mode can also be used to integrate tools other than WireGuard with Rosenpass.
 
-The [`rp`](./rp) tool written in Rust makes it easy to create a VPN using WireGuard and Rosenpass.
+The [`rp`](./rp) tool written in bash makes it easy to create a VPN using WireGuard and Rosenpass.
 
 `rp` is easy to get started with but has a few drawbacks; it runs as root, demanding access to both WireGuard
 and Rosenpass private keys, takes control of the interface and works with exactly one interface. If you do not feel confident about running Rosenpass as root, you should use the stand-alone mode to create a more secure setup using containers, jails, or virtual machines.
@@ -59,6 +59,7 @@ The code uses a variety of optimizations to speed up analysis such as using secr
 A wrapper script provides instant feedback about which queries execute as expected in color: A red cross if a query fails and a green check if it succeeds.
 
 [^liboqs]: https://openquantumsafe.org/liboqs/
+[^libsodium]: https://doc.libsodium.org/
 [^wg]: https://www.wireguard.com/
 [^pqwg]: https://eprint.iacr.org/2020/379
 [^pqwg-statedis]: Unless supplied with a pre-shared-key, but this defeats the purpose of a key exchange protocol
@@ -66,8 +67,6 @@ A wrapper script provides instant feedback about which queries execute as expect
 
 # Getting Rosenpass
 
-Documentation and installation guides can be found at the [Rosenpass website](https://rosenpass.eu/docs).
-
 Rosenpass is packaged for more and more distributions, maybe also for the distribution of your choice?
 
 [![Packaging status](https://repology.org/badge/vertical-allrepos/rosenpass.svg)](https://repology.org/project/rosenpass/versions)

rosenpass/Cargo.toml

@@ -1,74 +0,0 @@
-[package]
-name = "rosenpass"
-version = "0.2.1"
-authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
-edition = "2021"
-license = "MIT OR Apache-2.0"
-description = "Build post-quantum-secure VPNs with WireGuard!"
-homepage = "https://rosenpass.eu/"
-repository = "https://github.com/rosenpass/rosenpass"
-readme = "readme.md"
-
-[[bin]]
-name = "rosenpass"
-path = "src/main.rs"
-
-[[bin]]
-name = "rosenpass-gen-ipc-msg-types"
-path = "src/bin/gen-ipc-msg-types.rs"
-required-features = ["experiment_api", "internal_bin_gen_ipc_msg_types"]
-
-[[test]]
-name = "api-integration-tests"
-required-features = ["experiment_api", "internal_testing"]
-
-[[bench]]
-name = "handshake"
-harness = false
-
-[dependencies]
-rosenpass-util = { workspace = true }
-rosenpass-constant-time = { workspace = true }
-rosenpass-ciphers = { workspace = true }
-rosenpass-cipher-traits = { workspace = true }
-rosenpass-to = { workspace = true }
-rosenpass-secret-memory = { workspace = true }
-anyhow = { workspace = true }
-static_assertions = { workspace = true }
-memoffset = { workspace = true }
-thiserror = { workspace = true }
-paste = { workspace = true }
-log = { workspace = true }
-env_logger = { workspace = true }
-serde = { workspace = true }
-toml = { workspace = true }
-clap = { workspace = true }
-mio = { workspace = true }
-rand = { workspace = true }
-zerocopy = { workspace = true }
-home = { workspace = true }
-derive_builder = {workspace = true}
-rosenpass-wireguard-broker = {workspace = true}
-zeroize = { workspace = true }
-hex-literal = { workspace = true, optional = true }
-hex = { workspace = true, optional = true }
-heck = { workspace = true, optional = true }
-
-[build-dependencies]
-anyhow = { workspace = true }
-
-[dev-dependencies]
-criterion = { workspace = true }
-test_bin = { workspace = true }
-stacker = { workspace = true }
-serial_test = {workspace = true}
-procspawn = {workspace = true}
-tempfile = { workspace = true }
-
-[features]
-enable_broker_api = ["rosenpass-wireguard-broker/enable_broker_api"]
-experiment_memfd_secret = []
-experiment_libcrux = ["rosenpass-ciphers/experiment_libcrux"]
-experiment_api = ["hex-literal"]
-internal_testing  = []
-internal_bin_gen_ipc_msg_types = ["hex", "heck"]

rosenpass/readme.md

@@ -1 +0,0 @@
-../readme.md

rosenpass/src/api/boilerplate/byte_slice_ext.rs

@@ -1,116 +0,0 @@
-use zerocopy::{ByteSlice, Ref};
-
-use rosenpass_util::zerocopy::{RefMaker, ZerocopySliceExt};
-
-use super::{
-    PingRequest, PingResponse, RawMsgType, RefMakerRawMsgTypeExt, RequestMsgType, RequestRef,
-    ResponseMsgType, ResponseRef,
-};
-
-pub trait ByteSliceRefExt: ByteSlice {
-    fn msg_type_maker(self) -> RefMaker<Self, RawMsgType> {
-        self.zk_ref_maker()
-    }
-
-    fn msg_type(self) -> anyhow::Result<Ref<Self, PingRequest>> {
-        self.zk_parse()
-    }
-
-    fn msg_type_from_prefix(self) -> anyhow::Result<Ref<Self, PingRequest>> {
-        self.zk_parse_prefix()
-    }
-
-    fn msg_type_from_suffix(self) -> anyhow::Result<Ref<Self, PingRequest>> {
-        self.zk_parse_suffix()
-    }
-
-    fn request_msg_type(self) -> anyhow::Result<RequestMsgType> {
-        self.msg_type_maker().parse_request_msg_type()
-    }
-
-    fn request_msg_type_from_prefix(self) -> anyhow::Result<RequestMsgType> {
-        self.msg_type_maker()
-            .from_prefix()?
-            .parse_request_msg_type()
-    }
-
-    fn request_msg_type_from_suffix(self) -> anyhow::Result<RequestMsgType> {
-        self.msg_type_maker()
-            .from_suffix()?
-            .parse_request_msg_type()
-    }
-
-    fn response_msg_type(self) -> anyhow::Result<ResponseMsgType> {
-        self.msg_type_maker().parse_response_msg_type()
-    }
-
-    fn response_msg_type_from_prefix(self) -> anyhow::Result<ResponseMsgType> {
-        self.msg_type_maker()
-            .from_prefix()?
-            .parse_response_msg_type()
-    }
-
-    fn response_msg_type_from_suffix(self) -> anyhow::Result<ResponseMsgType> {
-        self.msg_type_maker()
-            .from_suffix()?
-            .parse_response_msg_type()
-    }
-
-    fn parse_request(self) -> anyhow::Result<RequestRef<Self>> {
-        RequestRef::parse(self)
-    }
-
-    fn parse_request_from_prefix(self) -> anyhow::Result<RequestRef<Self>> {
-        RequestRef::parse_from_prefix(self)
-    }
-
-    fn parse_request_from_suffix(self) -> anyhow::Result<RequestRef<Self>> {
-        RequestRef::parse_from_suffix(self)
-    }
-
-    fn parse_response(self) -> anyhow::Result<ResponseRef<Self>> {
-        ResponseRef::parse(self)
-    }
-
-    fn parse_response_from_prefix(self) -> anyhow::Result<ResponseRef<Self>> {
-        ResponseRef::parse_from_prefix(self)
-    }
-
-    fn parse_response_from_suffix(self) -> anyhow::Result<ResponseRef<Self>> {
-        ResponseRef::parse_from_suffix(self)
-    }
-
-    fn ping_request_maker(self) -> RefMaker<Self, PingRequest> {
-        self.zk_ref_maker()
-    }
-
-    fn ping_request(self) -> anyhow::Result<Ref<Self, PingRequest>> {
-        self.zk_parse()
-    }
-
-    fn ping_request_from_prefix(self) -> anyhow::Result<Ref<Self, PingRequest>> {
-        self.zk_parse_prefix()
-    }
-
-    fn ping_request_from_suffix(self) -> anyhow::Result<Ref<Self, PingRequest>> {
-        self.zk_parse_suffix()
-    }
-
-    fn ping_response_maker(self) -> RefMaker<Self, PingResponse> {
-        self.zk_ref_maker()
-    }
-
-    fn ping_response(self) -> anyhow::Result<Ref<Self, PingResponse>> {
-        self.zk_parse()
-    }
-
-    fn ping_response_from_prefix(self) -> anyhow::Result<Ref<Self, PingResponse>> {
-        self.zk_parse_prefix()
-    }
-
-    fn ping_response_from_suffix(self) -> anyhow::Result<Ref<Self, PingResponse>> {
-        self.zk_parse_suffix()
-    }
-}
-
-impl<B: ByteSlice> ByteSliceRefExt for B {}

rosenpass/src/api/boilerplate/message_trait.rs

@@ -1,29 +0,0 @@
-use zerocopy::{ByteSliceMut, Ref};
-
-use rosenpass_util::zerocopy::RefMaker;
-
-use super::RawMsgType;
-
-pub trait Message {
-    type Payload;
-    type MessageClass: Into<RawMsgType>;
-    const MESSAGE_TYPE: Self::MessageClass;
-
-    fn from_payload(payload: Self::Payload) -> Self;
-    fn init(&mut self);
-    fn setup<B: ByteSliceMut>(buf: B) -> anyhow::Result<Ref<B, Self>>;
-}
-
-pub trait ZerocopyResponseMakerSetupMessageExt<B, T> {
-    fn setup_msg(self) -> anyhow::Result<Ref<B, T>>;
-}
-
-impl<B, T> ZerocopyResponseMakerSetupMessageExt<B, T> for RefMaker<B, T>
-where
-    B: ByteSliceMut,
-    T: Message,
-{
-    fn setup_msg(self) -> anyhow::Result<Ref<B, T>> {
-        T::setup(self.into_buf())
-    }
-}

rosenpass/src/api/boilerplate/message_type.rs

@@ -1,117 +0,0 @@
-use hex_literal::hex;
-use rosenpass_util::zerocopy::RefMaker;
-use zerocopy::ByteSlice;
-
-use crate::RosenpassError::{self, InvalidApiMessageType};
-
-pub type RawMsgType = u128;
-
-// constants generated by gen-ipc-msg-types:
-// hash domain hash of: Rosenpass IPC API -> Rosenpass Protocol Server -> Ping Request
-pub const PING_REQUEST: RawMsgType =
-    RawMsgType::from_le_bytes(hex!("2397 3ecc c441 704d    0b02 ea31 45d3 4999"));
-// hash domain hash of: Rosenpass IPC API -> Rosenpass Protocol Server -> Ping Response
-pub const PING_RESPONSE: RawMsgType =
-    RawMsgType::from_le_bytes(hex!("4ec7 f6f0 2bbc ba64    48f1 da14 c7cf 0260"));
-
-pub trait MessageAttributes {
-    fn message_size(&self) -> usize;
-}
-
-#[derive(Hash, PartialEq, Eq, PartialOrd, Ord, Debug, Clone, Copy)]
-pub enum RequestMsgType {
-    Ping,
-}
-
-#[derive(Hash, PartialEq, Eq, PartialOrd, Ord, Debug, Clone, Copy)]
-pub enum ResponseMsgType {
-    Ping,
-}
-
-impl MessageAttributes for RequestMsgType {
-    fn message_size(&self) -> usize {
-        match self {
-            Self::Ping => std::mem::size_of::<super::PingRequest>(),
-        }
-    }
-}
-
-impl MessageAttributes for ResponseMsgType {
-    fn message_size(&self) -> usize {
-        match self {
-            Self::Ping => std::mem::size_of::<super::PingResponse>(),
-        }
-    }
-}
-
-impl TryFrom<RawMsgType> for RequestMsgType {
-    type Error = RosenpassError;
-
-    fn try_from(value: RawMsgType) -> Result<Self, Self::Error> {
-        use RequestMsgType as E;
-        Ok(match value {
-            self::PING_REQUEST => E::Ping,
-            _ => return Err(InvalidApiMessageType(value)),
-        })
-    }
-}
-
-impl From<RequestMsgType> for RawMsgType {
-    fn from(val: RequestMsgType) -> Self {
-        use RequestMsgType as E;
-        match val {
-            E::Ping => self::PING_REQUEST,
-        }
-    }
-}
-
-impl TryFrom<RawMsgType> for ResponseMsgType {
-    type Error = RosenpassError;
-
-    fn try_from(value: RawMsgType) -> Result<Self, Self::Error> {
-        use ResponseMsgType as E;
-        Ok(match value {
-            self::PING_RESPONSE => E::Ping,
-            _ => return Err(InvalidApiMessageType(value)),
-        })
-    }
-}
-
-impl From<ResponseMsgType> for RawMsgType {
-    fn from(val: ResponseMsgType) -> Self {
-        use ResponseMsgType as E;
-        match val {
-            E::Ping => self::PING_RESPONSE,
-        }
-    }
-}
-
-pub trait RawMsgTypeExt {
-    fn into_request_msg_type(self) -> Result<RequestMsgType, RosenpassError>;
-    fn into_response_msg_type(self) -> Result<ResponseMsgType, RosenpassError>;
-}
-
-impl RawMsgTypeExt for RawMsgType {
-    fn into_request_msg_type(self) -> Result<RequestMsgType, RosenpassError> {
-        self.try_into()
-    }
-
-    fn into_response_msg_type(self) -> Result<ResponseMsgType, RosenpassError> {
-        self.try_into()
-    }
-}
-
-pub trait RefMakerRawMsgTypeExt {
-    fn parse_request_msg_type(self) -> anyhow::Result<RequestMsgType>;
-    fn parse_response_msg_type(self) -> anyhow::Result<ResponseMsgType>;
-}
-
-impl<B: ByteSlice> RefMakerRawMsgTypeExt for RefMaker<B, RawMsgType> {
-    fn parse_request_msg_type(self) -> anyhow::Result<RequestMsgType> {
-        Ok(self.parse()?.read().try_into()?)
-    }
-
-    fn parse_response_msg_type(self) -> anyhow::Result<ResponseMsgType> {
-        Ok(self.parse()?.read().try_into()?)
-    }
-}

rosenpass/src/api/boilerplate/mod.rs

@@ -1,17 +0,0 @@
-mod byte_slice_ext;
-mod message_trait;
-mod message_type;
-mod payload;
-mod request_ref;
-mod request_response;
-mod response_ref;
-mod server;
-
-pub use byte_slice_ext::*;
-pub use message_trait::*;
-pub use message_type::*;
-pub use payload::*;
-pub use request_ref::*;
-pub use request_response::*;
-pub use response_ref::*;
-pub use server::*;

rosenpass/src/api/boilerplate/payload.rs

@@ -1,96 +0,0 @@
-use rosenpass_util::zerocopy::ZerocopyMutSliceExt;
-use zerocopy::{AsBytes, ByteSliceMut, FromBytes, FromZeroes, Ref};
-
-use super::{Message, RawMsgType, RequestMsgType, ResponseMsgType};
-
-/// Size required to fit any message in binary form
-pub const MAX_REQUEST_LEN: usize = 2500; // TODO fix this
-pub const MAX_RESPONSE_LEN: usize = 2500; // TODO fix this
-
-#[repr(packed)]
-#[derive(Debug, Copy, Clone, Hash, AsBytes, FromBytes, FromZeroes, PartialEq, Eq)]
-pub struct Envelope<M: AsBytes + FromBytes> {
-    /// Which message this is
-    pub msg_type: RawMsgType,
-    /// The actual Paylod
-    pub payload: M,
-}
-
-pub type RequestEnvelope<M> = Envelope<M>;
-pub type ResponseEnvelope<M> = Envelope<M>;
-
-#[repr(packed)]
-#[derive(Debug, Copy, Clone, Hash, AsBytes, FromBytes, FromZeroes, PartialEq, Eq)]
-pub struct PingRequestPayload {
-    /// Randomly generated connection id
-    pub echo: [u8; 256],
-}
-
-pub type PingRequest = RequestEnvelope<PingRequestPayload>;
-
-impl PingRequest {
-    pub fn new(echo: [u8; 256]) -> Self {
-        Self::from_payload(PingRequestPayload { echo })
-    }
-}
-
-impl Message for PingRequest {
-    type Payload = PingRequestPayload;
-    type MessageClass = RequestMsgType;
-    const MESSAGE_TYPE: Self::MessageClass = RequestMsgType::Ping;
-
-    fn from_payload(payload: Self::Payload) -> Self {
-        Self {
-            msg_type: Self::MESSAGE_TYPE.into(),
-            payload,
-        }
-    }
-
-    fn setup<B: ByteSliceMut>(buf: B) -> anyhow::Result<Ref<B, Self>> {
-        let mut r: Ref<B, Self> = buf.zk_zeroized()?;
-        r.init();
-        Ok(r)
-    }
-
-    fn init(&mut self) {
-        self.msg_type = Self::MESSAGE_TYPE.into();
-    }
-}
-
-#[repr(packed)]
-#[derive(Debug, Copy, Clone, Hash, AsBytes, FromBytes, FromZeroes, PartialEq, Eq)]
-pub struct PingResponsePayload {
-    /// Randomly generated connection id
-    pub echo: [u8; 256],
-}
-
-pub type PingResponse = ResponseEnvelope<PingResponsePayload>;
-
-impl PingResponse {
-    pub fn new(echo: [u8; 256]) -> Self {
-        Self::from_payload(PingResponsePayload { echo })
-    }
-}
-
-impl Message for PingResponse {
-    type Payload = PingResponsePayload;
-    type MessageClass = ResponseMsgType;
-    const MESSAGE_TYPE: Self::MessageClass = ResponseMsgType::Ping;
-
-    fn from_payload(payload: Self::Payload) -> Self {
-        Self {
-            msg_type: Self::MESSAGE_TYPE.into(),
-            payload,
-        }
-    }
-
-    fn setup<B: ByteSliceMut>(buf: B) -> anyhow::Result<Ref<B, Self>> {
-        let mut r: Ref<B, Self> = buf.zk_zeroized()?;
-        r.init();
-        Ok(r)
-    }
-
-    fn init(&mut self) {
-        self.msg_type = Self::MESSAGE_TYPE.into();
-    }
-}

rosenpass/src/api/boilerplate/request_ref.rs

@@ -1,107 +0,0 @@
-use anyhow::ensure;
-
-use zerocopy::{ByteSlice, ByteSliceMut, Ref};
-
-use super::{ByteSliceRefExt, MessageAttributes, PingRequest, RequestMsgType};
-
-struct RequestRefMaker<B> {
-    buf: B,
-    msg_type: RequestMsgType,
-}
-
-impl<B: ByteSlice> RequestRef<B> {
-    pub fn parse(buf: B) -> anyhow::Result<Self> {
-        RequestRefMaker::new(buf)?.parse()
-    }
-
-    pub fn parse_from_prefix(buf: B) -> anyhow::Result<Self> {
-        RequestRefMaker::new(buf)?.from_prefix()?.parse()
-    }
-
-    pub fn parse_from_suffix(buf: B) -> anyhow::Result<Self> {
-        RequestRefMaker::new(buf)?.from_suffix()?.parse()
-    }
-
-    pub fn message_type(&self) -> RequestMsgType {
-        match self {
-            Self::Ping(_) => RequestMsgType::Ping,
-        }
-    }
-}
-
-impl<B> From<Ref<B, PingRequest>> for RequestRef<B> {
-    fn from(v: Ref<B, PingRequest>) -> Self {
-        Self::Ping(v)
-    }
-}
-
-impl<B: ByteSlice> RequestRefMaker<B> {
-    fn new(buf: B) -> anyhow::Result<Self> {
-        let msg_type = buf.deref().request_msg_type_from_prefix()?;
-        Ok(Self { buf, msg_type })
-    }
-
-    fn target_size(&self) -> usize {
-        self.msg_type.message_size()
-    }
-
-    fn parse(self) -> anyhow::Result<RequestRef<B>> {
-        Ok(match self.msg_type {
-            RequestMsgType::Ping => RequestRef::Ping(self.buf.ping_request()?),
-        })
-    }
-
-    #[allow(clippy::wrong_self_convention)]
-    fn from_prefix(self) -> anyhow::Result<Self> {
-        self.ensure_fit()?;
-        let point = self.target_size();
-        let Self { buf, msg_type } = self;
-        let (buf, _) = buf.split_at(point);
-        Ok(Self { buf, msg_type })
-    }
-
-    #[allow(clippy::wrong_self_convention)]
-    fn from_suffix(self) -> anyhow::Result<Self> {
-        self.ensure_fit()?;
-        let point = self.buf.len() - self.target_size();
-        let Self { buf, msg_type } = self;
-        let (buf, _) = buf.split_at(point);
-        Ok(Self { buf, msg_type })
-    }
-
-    pub fn ensure_fit(&self) -> anyhow::Result<()> {
-        let have = self.buf.len();
-        let need = self.target_size();
-        ensure!(
-            need <= have,
-            "Buffer is undersized at {have} bytes (need {need} bytes)!"
-        );
-        Ok(())
-    }
-}
-
-pub enum RequestRef<B> {
-    Ping(Ref<B, PingRequest>),
-}
-
-impl<B> RequestRef<B>
-where
-    B: ByteSlice,
-{
-    pub fn bytes(&self) -> &[u8] {
-        match self {
-            Self::Ping(r) => r.bytes(),
-        }
-    }
-}
-
-impl<B> RequestRef<B>
-where
-    B: ByteSliceMut,
-{
-    pub fn bytes_mut(&mut self) -> &[u8] {
-        match self {
-            Self::Ping(r) => r.bytes_mut(),
-        }
-    }
-}

rosenpass/src/api/boilerplate/request_response.rs

@@ -1,103 +0,0 @@
-use rosenpass_util::zerocopy::{
-    RefMaker, ZerocopyEmancipateExt, ZerocopyEmancipateMutExt, ZerocopySliceExt,
-};
-use zerocopy::{ByteSlice, ByteSliceMut, Ref};
-
-use super::{Message, PingRequest, PingResponse};
-use super::{RequestRef, ResponseRef, ZerocopyResponseMakerSetupMessageExt};
-
-pub trait RequestMsg: Sized + Message {
-    type ResponseMsg: ResponseMsg;
-
-    fn zk_response_maker<B: ByteSlice>(buf: B) -> RefMaker<B, Self::ResponseMsg> {
-        buf.zk_ref_maker()
-    }
-
-    fn setup_response<B: ByteSliceMut>(buf: B) -> anyhow::Result<Ref<B, Self::ResponseMsg>> {
-        Self::zk_response_maker(buf).setup_msg()
-    }
-
-    fn setup_response_from_prefix<B: ByteSliceMut>(
-        buf: B,
-    ) -> anyhow::Result<Ref<B, Self::ResponseMsg>> {
-        Self::zk_response_maker(buf).from_prefix()?.setup_msg()
-    }
-
-    fn setup_response_from_suffix<B: ByteSliceMut>(
-        buf: B,
-    ) -> anyhow::Result<Ref<B, Self::ResponseMsg>> {
-        Self::zk_response_maker(buf).from_prefix()?.setup_msg()
-    }
-}
-
-pub trait ResponseMsg: Message {
-    type RequestMsg: RequestMsg;
-}
-
-impl RequestMsg for PingRequest {
-    type ResponseMsg = PingResponse;
-}
-
-impl ResponseMsg for PingResponse {
-    type RequestMsg = PingRequest;
-}
-
-pub type PingPair<B1, B2> = (Ref<B1, PingRequest>, Ref<B2, PingResponse>);
-
-pub enum RequestResponsePair<B1, B2> {
-    Ping(PingPair<B1, B2>),
-}
-
-impl<B1, B2> From<PingPair<B1, B2>> for RequestResponsePair<B1, B2> {
-    fn from(v: PingPair<B1, B2>) -> Self {
-        RequestResponsePair::Ping(v)
-    }
-}
-
-impl<B1, B2> RequestResponsePair<B1, B2>
-where
-    B1: ByteSlice,
-    B2: ByteSlice,
-{
-    pub fn both(&self) -> (RequestRef<&[u8]>, ResponseRef<&[u8]>) {
-        match self {
-            Self::Ping((req, res)) => {
-                let req = RequestRef::Ping(req.emancipate());
-                let res = ResponseRef::Ping(res.emancipate());
-                (req, res)
-            }
-        }
-    }
-
-    pub fn request(&self) -> RequestRef<&[u8]> {
-        self.both().0
-    }
-
-    pub fn response(&self) -> ResponseRef<&[u8]> {
-        self.both().1
-    }
-}
-
-impl<B1, B2> RequestResponsePair<B1, B2>
-where
-    B1: ByteSliceMut,
-    B2: ByteSliceMut,
-{
-    pub fn both_mut(&mut self) -> (RequestRef<&mut [u8]>, ResponseRef<&mut [u8]>) {
-        match self {
-            Self::Ping((req, res)) => {
-                let req = RequestRef::Ping(req.emancipate_mut());
-                let res = ResponseRef::Ping(res.emancipate_mut());
-                (req, res)
-            }
-        }
-    }
-
-    pub fn request_mut(&mut self) -> RequestRef<&mut [u8]> {
-        self.both_mut().0
-    }
-
-    pub fn response_mut(&mut self) -> ResponseRef<&mut [u8]> {
-        self.both_mut().1
-    }
-}

rosenpass/src/api/boilerplate/response_ref.rs

@@ -1,108 +0,0 @@
-// TODO: This is copied verbatim from ResponseRef…not pretty
-use anyhow::ensure;
-
-use zerocopy::{ByteSlice, ByteSliceMut, Ref};
-
-use super::{ByteSliceRefExt, MessageAttributes, PingResponse, ResponseMsgType};
-
-struct ResponseRefMaker<B> {
-    buf: B,
-    msg_type: ResponseMsgType,
-}
-
-impl<B: ByteSlice> ResponseRef<B> {
-    pub fn parse(buf: B) -> anyhow::Result<Self> {
-        ResponseRefMaker::new(buf)?.parse()
-    }
-
-    pub fn parse_from_prefix(buf: B) -> anyhow::Result<Self> {
-        ResponseRefMaker::new(buf)?.from_prefix()?.parse()
-    }
-
-    pub fn parse_from_suffix(buf: B) -> anyhow::Result<Self> {
-        ResponseRefMaker::new(buf)?.from_suffix()?.parse()
-    }
-
-    pub fn message_type(&self) -> ResponseMsgType {
-        match self {
-            Self::Ping(_) => ResponseMsgType::Ping,
-        }
-    }
-}
-
-impl<B> From<Ref<B, PingResponse>> for ResponseRef<B> {
-    fn from(v: Ref<B, PingResponse>) -> Self {
-        Self::Ping(v)
-    }
-}
-
-impl<B: ByteSlice> ResponseRefMaker<B> {
-    fn new(buf: B) -> anyhow::Result<Self> {
-        let msg_type = buf.deref().response_msg_type_from_prefix()?;
-        Ok(Self { buf, msg_type })
-    }
-
-    fn target_size(&self) -> usize {
-        self.msg_type.message_size()
-    }
-
-    fn parse(self) -> anyhow::Result<ResponseRef<B>> {
-        Ok(match self.msg_type {
-            ResponseMsgType::Ping => ResponseRef::Ping(self.buf.ping_response()?),
-        })
-    }
-
-    #[allow(clippy::wrong_self_convention)]
-    fn from_prefix(self) -> anyhow::Result<Self> {
-        self.ensure_fit()?;
-        let point = self.target_size();
-        let Self { buf, msg_type } = self;
-        let (buf, _) = buf.split_at(point);
-        Ok(Self { buf, msg_type })
-    }
-
-    #[allow(clippy::wrong_self_convention)]
-    fn from_suffix(self) -> anyhow::Result<Self> {
-        self.ensure_fit()?;
-        let point = self.buf.len() - self.target_size();
-        let Self { buf, msg_type } = self;
-        let (buf, _) = buf.split_at(point);
-        Ok(Self { buf, msg_type })
-    }
-
-    pub fn ensure_fit(&self) -> anyhow::Result<()> {
-        let have = self.buf.len();
-        let need = self.target_size();
-        ensure!(
-            need <= have,
-            "Buffer is undersized at {have} bytes (need {need} bytes)!"
-        );
-        Ok(())
-    }
-}
-
-pub enum ResponseRef<B> {
-    Ping(Ref<B, PingResponse>),
-}
-
-impl<B> ResponseRef<B>
-where
-    B: ByteSlice,
-{
-    pub fn bytes(&self) -> &[u8] {
-        match self {
-            Self::Ping(r) => r.bytes(),
-        }
-    }
-}
-
-impl<B> ResponseRef<B>
-where
-    B: ByteSliceMut,
-{
-    pub fn bytes_mut(&mut self) -> &[u8] {
-        match self {
-            Self::Ping(r) => r.bytes_mut(),
-        }
-    }
-}

rosenpass/src/api/boilerplate/server.rs

@@ -1,40 +0,0 @@
-use zerocopy::{ByteSlice, ByteSliceMut};
-
-use super::{ByteSliceRefExt, Message, PingRequest, PingResponse, RequestRef, RequestResponsePair};
-
-pub trait Server {
-    fn ping(&mut self, req: &PingRequest, res: &mut PingResponse) -> anyhow::Result<()>;
-
-    fn dispatch<ReqBuf, ResBuf>(
-        &mut self,
-        p: &mut RequestResponsePair<ReqBuf, ResBuf>,
-    ) -> anyhow::Result<()>
-    where
-        ReqBuf: ByteSlice,
-        ResBuf: ByteSliceMut,
-    {
-        match p {
-            RequestResponsePair::Ping((req, res)) => self.ping(req, res),
-        }
-    }
-
-    fn handle_message<ReqBuf, ResBuf>(&mut self, req: ReqBuf, res: ResBuf) -> anyhow::Result<usize>
-    where
-        ReqBuf: ByteSlice,
-        ResBuf: ByteSliceMut,
-    {
-        let req = req.parse_request_from_prefix()?;
-        // TODO: This is not pretty; This match should be moved into RequestRef
-        let mut pair = match req {
-            RequestRef::Ping(req) => {
-                let mut res = res.ping_response_from_prefix()?;
-                res.init();
-                RequestResponsePair::Ping((req, res))
-            }
-        };
-        self.dispatch(&mut pair)?;
-
-        let res_len = pair.request().bytes().len();
-        Ok(res_len)
-    }
-}

rosenpass/src/api/cli.rs

@@ -1,40 +0,0 @@
-use std::path::PathBuf;
-
-use clap::Args;
-
-use crate::config::Rosenpass as RosenpassConfig;
-
-use super::config::ApiConfig;
-
-#[cfg(feature = "experiment_api")]
-#[derive(Args, Debug)]
-pub struct ApiCli {
-    /// Where in the file-system to create the unix socket the rosenpass API will be listening for
-    /// connections on.
-    #[arg(long)]
-    api_listen_path: Vec<PathBuf>,
-
-    /// When rosenpass is called from another process, the other process can open and bind the
-    /// unix socket for the Rosenpass API to use themselves, passing it to this process. In Rust this can be achieved
-    /// using the [command-fds](https://docs.rs/command-fds/latest/command_fds/) crate.
-    #[arg(long)]
-    api_listen_fd: Vec<i32>,
-
-    /// When rosenpass is called from another process, the other process can connect the unix socket for the API
-    /// themselves, for instance using the `socketpair(2)` system call.
-    #[arg(long)]
-    api_stream_fd: Vec<i32>,
-}
-
-impl ApiCli {
-    pub fn apply_to_config(&self, cfg: &mut RosenpassConfig) -> anyhow::Result<()> {
-        self.apply_to_api_config(&mut cfg.api)
-    }
-
-    pub fn apply_to_api_config(&self, cfg: &mut ApiConfig) -> anyhow::Result<()> {
-        cfg.listen_path.extend_from_slice(&self.api_listen_path);
-        cfg.listen_fd.extend_from_slice(&self.api_listen_fd);
-        cfg.stream_fd.extend_from_slice(&self.api_stream_fd);
-        Ok(())
-    }
-}

rosenpass/src/api/config.rs

@@ -1,41 +0,0 @@
-use std::path::PathBuf;
-
-use mio::net::UnixListener;
-use rosenpass_util::mio::{UnixListenerExt, UnixStreamExt};
-use serde::{Deserialize, Serialize};
-
-use crate::app_server::AppServer;
-
-#[derive(Debug, Serialize, Deserialize, Default, Clone)]
-pub struct ApiConfig {
-    /// Where in the file-system to create the unix socket the rosenpass API will be listening for
-    /// connections on
-    pub listen_path: Vec<PathBuf>,
-
-    /// When rosenpass is called from another process, the other process can open and bind the
-    /// unix socket for the Rosenpass API to use themselves, passing it to this process. In Rust this can be achieved
-    /// using the [command-fds](https://docs.rs/command-fds/latest/command_fds/) crate.
-    pub listen_fd: Vec<i32>,
-
-    /// When rosenpass is called from another process, the other process can connect the unix socket for the API
-    /// themselves, for instance using the `socketpair(2)` system call.
-    pub stream_fd: Vec<i32>,
-}
-
-impl ApiConfig {
-    pub fn apply_to_app_server(&self, srv: &mut AppServer) -> anyhow::Result<()> {
-        for path in self.listen_path.iter() {
-            srv.add_api_listener(UnixListener::bind(path)?)?;
-        }
-
-        for fd in self.listen_fd.iter() {
-            srv.add_api_listener(UnixListenerExt::claim_fd(*fd)?)?;
-        }
-
-        for fd in self.stream_fd.iter() {
-            srv.add_api_connection(UnixStreamExt::claim_fd(*fd)?)?;
-        }
-
-        Ok(())
-    }
-}

rosenpass/src/api/crypto_server_api_handler.rs

@@ -1,44 +0,0 @@
-use rosenpass_to::{ops::copy_slice, To};
-
-use crate::protocol::CryptoServer;
-
-use super::Server as ApiServer;
-
-#[derive(Debug)]
-pub struct CryptoServerApiState {
-    _dummy: (),
-}
-
-impl CryptoServerApiState {
-    #[allow(clippy::new_without_default)]
-    pub fn new() -> Self {
-        Self { _dummy: () }
-    }
-
-    pub fn acquire_backend<'a>(
-        &'a mut self,
-        crypto: &'a mut Option<CryptoServer>,
-    ) -> CryptoServerApiHandler<'a> {
-        let state = self;
-        CryptoServerApiHandler { state, crypto }
-    }
-}
-
-pub struct CryptoServerApiHandler<'a> {
-    #[allow(unused)] // TODO: Remove
-    crypto: &'a mut Option<CryptoServer>,
-    #[allow(unused)] // TODO: Remove
-    state: &'a mut CryptoServerApiState,
-}
-
-impl<'a> ApiServer for CryptoServerApiHandler<'a> {
-    fn ping(
-        &mut self,
-        req: &super::PingRequest,
-        res: &mut super::PingResponse,
-    ) -> anyhow::Result<()> {
-        let (req, res) = (&req.payload, &mut res.payload);
-        copy_slice(&req.echo).to(&mut res.echo);
-        Ok(())
-    }
-}

rosenpass/src/api/mio/connection.rs

@@ -1,167 +0,0 @@
-use mio::{net::UnixStream, Interest};
-use rosenpass_util::{
-    io::{IoResultKindHintExt, TryIoResultKindHintExt},
-    length_prefix_encoding::{
-        decoder::{self as lpe_decoder, LengthPrefixDecoder},
-        encoder::{self as lpe_encoder, LengthPrefixEncoder},
-    },
-};
-use zeroize::Zeroize;
-
-use crate::{api::Server, app_server::MioTokenDispenser, protocol::CryptoServer};
-
-use super::super::{CryptoServerApiState, MAX_REQUEST_LEN, MAX_RESPONSE_LEN};
-
-#[derive(Debug)]
-pub struct MioConnection {
-    io: UnixStream,
-    invalid_read: bool,
-    read_buffer: LengthPrefixDecoder<[u8; MAX_REQUEST_LEN]>,
-    write_buffer: LengthPrefixEncoder<[u8; MAX_RESPONSE_LEN]>,
-    api_state: CryptoServerApiState,
-}
-
-impl MioConnection {
-    pub fn new(
-        mut io: UnixStream,
-        registry: &mio::Registry,
-        token_dispenser: &mut MioTokenDispenser, // TODO: We should actually start using tokens…
-    ) -> std::io::Result<Self> {
-        registry.register(
-            &mut io,
-            token_dispenser.dispense(),
-            Interest::READABLE | Interest::WRITABLE,
-        )?;
-
-        let invalid_read = false;
-        let read_buffer = LengthPrefixDecoder::new([0u8; MAX_REQUEST_LEN]);
-        let write_buffer = LengthPrefixEncoder::from_buffer([0u8; MAX_RESPONSE_LEN]);
-        let api_state = CryptoServerApiState::new();
-        Ok(Self {
-            io,
-            invalid_read,
-            read_buffer,
-            write_buffer,
-            api_state,
-        })
-    }
-
-    pub fn poll(&mut self, crypto: &mut Option<CryptoServer>) -> anyhow::Result<()> {
-        self.flush_write_buffer()?;
-        if self.write_buffer.exhausted() {
-            self.recv(crypto)?;
-        }
-        Ok(())
-    }
-
-    // This is *exclusively* called by recv if the read_buffer holds a message
-    fn handle_incoming_message(&mut self, crypto: &mut Option<CryptoServer>) -> anyhow::Result<()> {
-        // Unwrap is allowed because recv() confirms before the call that a message was
-        // received
-        let req = self.read_buffer.message().unwrap().unwrap();
-
-        // TODO: The API should not return anyhow::Result
-        let response_len = self
-            .api_state
-            .acquire_backend(crypto)
-            .handle_message(req, self.write_buffer.buffer_bytes_mut())?;
-        self.read_buffer.zeroize(); // clear for new message to read
-        self.write_buffer
-            .restart_write_with_new_message(response_len)?;
-
-        self.flush_write_buffer()?;
-        Ok(())
-    }
-
-    fn flush_write_buffer(&mut self) -> anyhow::Result<()> {
-        if self.write_buffer.exhausted() {
-            return Ok(());
-        }
-
-        loop {
-            use lpe_encoder::WriteToIoReturn as Ret;
-            use std::io::ErrorKind as K;
-
-            match self
-                .write_buffer
-                .write_to_stdio(&self.io)
-                .io_err_kind_hint()
-            {
-                // Done
-                Ok(Ret { done: true, .. }) => {
-                    self.write_buffer.zeroize(); // clear for new message to write
-                    break;
-                }
-
-                // Would block
-                Ok(Ret {
-                    bytes_written: 0, ..
-                }) => break,
-                Err((_e, K::WouldBlock)) => break,
-
-                // Just continue
-                Ok(_) => continue, /* Ret { bytes_written > 0, done = false } acc. to previous cases*/
-                Err((_e, K::Interrupted)) => continue,
-
-                // Other errors
-                Err((e, _ek)) => Err(e)?,
-            }
-        }
-
-        Ok(())
-    }
-
-    fn recv(&mut self, crypto: &mut Option<CryptoServer>) -> anyhow::Result<()> {
-        if !self.write_buffer.exhausted() || self.invalid_read {
-            return Ok(());
-        }
-
-        loop {
-            use lpe_decoder::{ReadFromIoError as E, ReadFromIoReturn as Ret};
-            use std::io::ErrorKind as K;
-
-            match self
-                .read_buffer
-                .read_from_stdio(&self.io)
-                .try_io_err_kind_hint()
-            {
-                // We actually received a proper message
-                // (Impl below match to appease borrow checker)
-                Ok(Ret {
-                    message: Some(_msg),
-                    ..
-                }) => {}
-
-                // Message does not fit in buffer
-                Err((e @ E::MessageTooLargeError { .. }, _)) => {
-                    log::warn!("Received message on API that was too big to fit in our buffers; \
-                        looks like the client is broken. Stopping to process messages of the client.\n\
-                        Error: {e:?}");
-                    // TODO: We should properly close down the socket in this case, but to do that,
-                    // we need to have the facilities in the Rosenpass IO handling system to close
-                    // open connections.
-                    // Just leaving the API connections dangling for now.
-                    // This should be fixed for non-experimental use of the API.
-                    self.invalid_read = true;
-                    break;
-                }
-
-                // Would block
-                Ok(Ret { bytes_read: 0, .. }) => break,
-                Err((_, Some(K::WouldBlock))) => break,
-
-                // Just keep going
-                Ok(Ret { bytes_read: _, .. }) => continue,
-                Err((_, Some(K::Interrupted))) => continue,
-
-                // Other IO Error (just pass on to the caller)
-                Err((E::IoError(e), _)) => Err(e)?,
-            };
-
-            self.handle_incoming_message(crypto)?;
-            break; // Handle just one message, leave some room for other IO handlers
-        }
-
-        Ok(())
-    }
-}

rosenpass/src/api/mio/manager.rs

@@ -1,93 +0,0 @@
-use std::io;
-
-use mio::net::{UnixListener, UnixStream};
-
-use rosenpass_util::{io::nonblocking_handle_io_errors, mio::interest::RW as MIO_RW};
-
-use crate::{app_server::MioTokenDispenser, protocol::CryptoServer};
-
-use super::MioConnection;
-
-#[derive(Default, Debug)]
-pub struct MioManager {
-    listeners: Vec<UnixListener>,
-    connections: Vec<MioConnection>,
-}
-
-impl MioManager {
-    pub fn new() -> Self {
-        Self::default()
-    }
-
-    pub fn add_listener(
-        &mut self,
-        mut listener: UnixListener,
-        registry: &mio::Registry,
-        token_dispenser: &mut MioTokenDispenser,
-    ) -> io::Result<()> {
-        registry.register(&mut listener, token_dispenser.dispense(), MIO_RW)?;
-        self.listeners.push(listener);
-        Ok(())
-    }
-
-    pub fn add_connection(
-        &mut self,
-        connection: UnixStream,
-        registry: &mio::Registry,
-        token_dispenser: &mut MioTokenDispenser,
-    ) -> io::Result<()> {
-        let connection = MioConnection::new(connection, registry, token_dispenser)?;
-        self.connections.push(connection);
-        Ok(())
-    }
-
-    pub fn poll(
-        &mut self,
-        crypto: &mut Option<CryptoServer>,
-        registry: &mio::Registry,
-        token_dispenser: &mut MioTokenDispenser,
-    ) -> anyhow::Result<()> {
-        self.accept_connections(registry, token_dispenser)?;
-        self.poll_connections(crypto)?;
-        Ok(())
-    }
-
-    fn accept_connections(
-        &mut self,
-        registry: &mio::Registry,
-        token_dispenser: &mut MioTokenDispenser,
-    ) -> io::Result<()> {
-        for idx in 0..self.listeners.len() {
-            self.accept_from(idx, registry, token_dispenser)?;
-        }
-        Ok(())
-    }
-
-    fn accept_from(
-        &mut self,
-        idx: usize,
-        registry: &mio::Registry,
-        token_dispenser: &mut MioTokenDispenser,
-    ) -> io::Result<()> {
-        // Accept connection until the socket would block or returns another error
-        // TODO: This currently only adds connections--we eventually need the ability to remove
-        // them as well, see the note in connection.rs
-        loop {
-            match nonblocking_handle_io_errors(|| self.listeners[idx].accept())? {
-                None => break,
-                Some((conn, _addr)) => {
-                    self.add_connection(conn, registry, token_dispenser)?;
-                }
-            };
-        }
-
-        Ok(())
-    }
-
-    fn poll_connections(&mut self, crypto: &mut Option<CryptoServer>) -> anyhow::Result<()> {
-        for conn in self.connections.iter_mut() {
-            conn.poll(crypto)?
-        }
-        Ok(())
-    }
-}

rosenpass/src/api/mio/mod.rs

@@ -1,5 +0,0 @@
-mod connection;
-mod manager;
-
-pub use connection::*;
-pub use manager::*;

rosenpass/src/api/mod.rs

@@ -1,9 +0,0 @@
-mod boilerplate;
-mod crypto_server_api_handler;
-
-pub use boilerplate::*;
-pub use crypto_server_api_handler::*;
-
-pub mod cli;
-pub mod config;
-pub mod mio;

rosenpass/src/bin/gen-ipc-msg-types.rs

@@ -1,86 +0,0 @@
-use anyhow::{Context, Result};
-use heck::ToShoutySnakeCase;
-
-use rosenpass_ciphers::{hash_domain::HashDomain, KEY_LEN};
-
-fn calculate_hash_value(hd: HashDomain, values: &[&str]) -> Result<[u8; KEY_LEN]> {
-    match values.split_first() {
-        Some((head, tail)) => calculate_hash_value(hd.mix(head.as_bytes())?, tail),
-        None => Ok(hd.into_value()),
-    }
-}
-
-fn print_literal(path: &[&str]) -> Result<()> {
-    let val = calculate_hash_value(HashDomain::zero(), path)?;
-    let (last, prefix) = path.split_last().context("developer error!")?;
-    let var_name = last.to_shouty_snake_case();
-
-    print!("// hash domain hash of: ");
-    for n in prefix.iter() {
-        print!("{n} -> ");
-    }
-    println!("{last}");
-
-    let c = hex::encode(val)
-        .chars()
-        .collect::<Vec<char>>()
-        .chunks_exact(4)
-        .map(|chunk| chunk.iter().collect::<String>())
-        .collect::<Vec<_>>();
-    println!("const {var_name} : RawMsgType = RawMsgType::from_le_bytes(hex!(\"{} {} {} {}    {} {} {} {}\"));",
-        c[0], c[1], c[2], c[3], c[4], c[5], c[6], c[7]);
-
-    Ok(())
-}
-
-#[derive(Debug, Clone)]
-enum Tree {
-    Branch(String, Vec<Tree>),
-    Leaf(String),
-}
-
-impl Tree {
-    fn name(&self) -> &str {
-        match self {
-            Self::Branch(name, _) => name,
-            Self::Leaf(name) => name,
-        }
-    }
-
-    fn gen_code_inner(&self, prefix: &[&str]) -> Result<()> {
-        let mut path = prefix.to_owned();
-        path.push(self.name());
-
-        match self {
-            Self::Branch(_, ref children) => {
-                for c in children.iter() {
-                    c.gen_code_inner(&path)?
-                }
-            }
-            Self::Leaf(_) => print_literal(&path)?,
-        };
-
-        Ok(())
-    }
-
-    fn gen_code(&self) -> Result<()> {
-        self.gen_code_inner(&[])
-    }
-}
-
-fn main() -> Result<()> {
-    let tree = Tree::Branch(
-        "Rosenpass IPC API".to_owned(),
-        vec![Tree::Branch(
-            "Rosenpass Protocol Server".to_owned(),
-            vec![
-                Tree::Leaf("Ping Request".to_owned()),
-                Tree::Leaf("Ping Response".to_owned()),
-            ],
-        )],
-    );
-
-    println!("type RawMsgType = u128;");
-    println!();
-    tree.gen_code()
-}

rosenpass/src/cli.rs

@@ -1,397 +0,0 @@
-use anyhow::{bail, ensure};
-use clap::{Parser, Subcommand};
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::StaticKem;
-use rosenpass_secret_memory::file::StoreSecret;
-use rosenpass_util::file::{LoadValue, LoadValueB64, StoreValue};
-use rosenpass_wireguard_broker::brokers::native_unix::{
-    NativeUnixBroker, NativeUnixBrokerConfigBaseBuilder, NativeUnixBrokerConfigBaseBuilderError,
-};
-use std::ops::DerefMut;
-use std::path::PathBuf;
-
-use crate::app_server::AppServerTest;
-use crate::app_server::{AppServer, BrokerPeer};
-use crate::protocol::{SPk, SSk, SymKey};
-
-use super::config;
-
-/// struct holding all CLI arguments for `clap` crate to parse
-#[derive(Parser, Debug)]
-#[command(author, version, about, long_about)]
-pub struct CliArgs {
-    /// lowest log level to show – log messages at higher levels will be omitted
-    #[arg(long = "log-level", value_name = "LOG_LEVEL", group = "log-level")]
-    log_level: Option<log::LevelFilter>,
-
-    /// show verbose log output – sets log level to "debug"
-    #[arg(short, long, group = "log-level")]
-    verbose: bool,
-
-    /// show no log output – sets log level to "error"
-    #[arg(short, long, group = "log-level")]
-    quiet: bool,
-
-    #[command(flatten)]
-    #[cfg(feature = "experiment_api")]
-    api: crate::api::cli::ApiCli,
-
-    #[command(subcommand)]
-    pub command: CliCommand,
-}
-
-impl CliArgs {
-    pub fn apply_to_config(&self, _cfg: &mut config::Rosenpass) -> anyhow::Result<()> {
-        #[cfg(feature = "experiment_api")]
-        self.api.apply_to_config(_cfg)?;
-        Ok(())
-    }
-
-    /// returns the log level filter set by CLI args
-    /// returns `None` if the user did not specify any log level filter via CLI
-    ///
-    /// NOTE: the clap feature of ["argument groups"](https://docs.rs/clap/latest/clap/_derive/_tutorial/chapter_3/index.html#argument-relations)
-    /// ensures that the user can not specify more than one of the possible log level arguments.
-    /// Note the `#[arg("group")]` in the [`CliArgs`] struct.
-    pub fn get_log_level(&self) -> Option<log::LevelFilter> {
-        if self.verbose {
-            return Some(log::LevelFilter::Info);
-        }
-        if self.quiet {
-            return Some(log::LevelFilter::Error);
-        }
-        if let Some(level_filter) = self.log_level {
-            return Some(level_filter);
-        }
-        None
-    }
-}
-
-/// represents a command specified via CLI
-#[derive(Subcommand, Debug)]
-pub enum CliCommand {
-    /// Start Rosenpass in server mode and carry on with the key exchange
-    ///
-    /// This will parse the configuration file and perform the key exchange
-    /// with the specified peers. If a peer's endpoint is specified, this
-    /// Rosenpass instance will try to initiate a key exchange with the peer,
-    /// otherwise only initiation attempts from the peer will be responded to.
-    ExchangeConfig { config_file: PathBuf },
-
-    /// Start in daemon mode, performing key exchanges
-    ///
-    /// The configuration is read from the command line. The `peer` token
-    /// always separates multiple peers, e. g. if the token `peer` appears
-    /// in the WIREGUARD_EXTRA_ARGS it is not put into the WireGuard arguments
-    /// but instead a new peer is created.
-    /* Explanation: `first_arg` and `rest_of_args` are combined into one
-     * `Vec<String>`. They are only used to trick clap into displaying some
-     * guidance on the CLI usage.
-     */
-    #[allow(rustdoc::broken_intra_doc_links)]
-    #[allow(rustdoc::invalid_html_tags)]
-    Exchange {
-        /// public-key <PATH> secret-key <PATH> [listen <ADDR>:<PORT>]... [verbose]
-        #[clap(value_name = "OWN_CONFIG")]
-        first_arg: String,
-
-        /// peer public-key <PATH> [ENDPOINT] [PSK] [OUTFILE] [WG]
-        ///
-        /// ENDPOINT := endpoint <HOST/IP>:<PORT>
-        ///
-        /// PSK := preshared-key <PATH>
-        ///
-        /// OUTFILE := outfile <PATH>
-        ///
-        /// WG := wireguard <WIREGUARD_DEV> <WIREGUARD_PEER> [WIREGUARD_EXTRA_ARGS]...
-        #[clap(value_name = "PEERS")]
-        rest_of_args: Vec<String>,
-
-        /// Save the parsed configuration to a file before starting the daemon
-        #[clap(short, long)]
-        config_file: Option<PathBuf>,
-    },
-
-    /// Generate a demo config file
-    GenConfig {
-        config_file: PathBuf,
-
-        /// Forcefully overwrite existing config file
-        #[clap(short, long)]
-        force: bool,
-    },
-
-    /// Generate the keys mentioned in a configFile
-    ///
-    /// Generates secret- & public-key to their destination. If a config file
-    /// is provided then the key file destination is taken from there.
-    /// Otherwise the
-    GenKeys {
-        config_file: Option<PathBuf>,
-
-        /// where to write public-key to
-        #[clap(short, long)]
-        public_key: Option<PathBuf>,
-
-        /// where to write secret-key to
-        #[clap(short, long)]
-        secret_key: Option<PathBuf>,
-
-        /// Forcefully overwrite public- & secret-key file
-        #[clap(short, long)]
-        force: bool,
-    },
-
-    /// Deprecated - use gen-keys instead
-    #[allow(rustdoc::broken_intra_doc_links)]
-    #[allow(rustdoc::invalid_html_tags)]
-    Keygen {
-        // NOTE yes, the legacy keygen argument initially really accepted "privet-key", not "secret-key"!
-        /// public-key <PATH> private-key <PATH>
-        args: Vec<String>,
-    },
-
-    /// Validate a configuration
-    Validate { config_files: Vec<PathBuf> },
-
-    /// Show the rosenpass manpage
-    // TODO make this the default, but only after the manpage has been adjusted once the CLI stabilizes
-    Man,
-}
-
-impl CliArgs {
-    /// runs the command specified via CLI
-    ///
-    /// ## TODO
-    /// - This method consumes the [`CliCommand`] value. It might be wise to use a reference...
-    pub fn run(self, test_helpers: Option<AppServerTest>) -> anyhow::Result<()> {
-        use CliCommand::*;
-        match &self.command {
-            Man => {
-                let man_cmd = std::process::Command::new("man")
-                    .args(["1", "rosenpass"])
-                    .status();
-
-                if !(man_cmd.is_ok() && man_cmd.unwrap().success()) {
-                    println!(include_str!(env!("ROSENPASS_MAN")));
-                }
-            }
-            GenConfig { config_file, force } => {
-                ensure!(
-                    *force || !config_file.exists(),
-                    "config file {config_file:?} already exists"
-                );
-
-                config::Rosenpass::example_config().store(config_file)?;
-            }
-
-            // Deprecated - use gen-keys instead
-            Keygen { args } => {
-                log::warn!("The 'keygen' command is deprecated. Please use the 'gen-keys' command instead.");
-
-                let mut public_key: Option<PathBuf> = None;
-                let mut secret_key: Option<PathBuf> = None;
-
-                // Manual arg parsing, since clap wants to prefix flags with "--"
-                let mut args = args.iter();
-                loop {
-                    match (args.next().map(|x| x.as_str()), args.next()) {
-                        (Some("private-key"), Some(opt)) | (Some("secret-key"), Some(opt)) => {
-                            secret_key = Some(opt.into());
-                        }
-                        (Some("public-key"), Some(opt)) => {
-                            public_key = Some(opt.into());
-                        }
-                        (Some(flag), _) => {
-                            bail!("Unknown option `{}`", flag);
-                        }
-                        (_, _) => break,
-                    };
-                }
-
-                if secret_key.is_none() {
-                    bail!("private-key is required");
-                }
-                if public_key.is_none() {
-                    bail!("public-key is required");
-                }
-
-                generate_and_save_keypair(secret_key.unwrap(), public_key.unwrap())?;
-            }
-
-            GenKeys {
-                config_file,
-                public_key,
-                secret_key,
-                force,
-            } => {
-                // figure out where the key file is specified, in the config file or directly as flag?
-                let (pkf, skf) = match (config_file, public_key, secret_key) {
-                    (Some(config_file), _, _) => {
-                        ensure!(
-                            config_file.exists(),
-                            "config file {config_file:?} does not exist"
-                        );
-
-                        let config = config::Rosenpass::load(config_file)?;
-
-                        (config.public_key, config.secret_key)
-                    }
-                    (_, Some(pkf), Some(skf)) => (pkf.clone(), skf.clone()),
-                    _ => {
-                        bail!("either a config-file or both public-key and secret-key file are required")
-                    }
-                };
-
-                // check that we are not overriding something unintentionally
-                let mut problems = vec![];
-                if !force && pkf.is_file() {
-                    problems.push(format!(
-                        "public-key file {pkf:?} exist, refusing to overwrite it"
-                    ));
-                }
-                if !force && skf.is_file() {
-                    problems.push(format!(
-                        "secret-key file {skf:?} exist, refusing to overwrite it"
-                    ));
-                }
-                if !problems.is_empty() {
-                    bail!(problems.join("\n"));
-                }
-
-                // generate the keys and store them in files
-                generate_and_save_keypair(skf, pkf)?;
-            }
-
-            ExchangeConfig { config_file } => {
-                ensure!(
-                    config_file.exists(),
-                    "config file '{config_file:?}' does not exist"
-                );
-
-                let mut config = config::Rosenpass::load(config_file)?;
-                config.validate()?;
-                self.apply_to_config(&mut config)?;
-
-                Self::event_loop(config, test_helpers)?;
-            }
-
-            Exchange {
-                first_arg,
-                rest_of_args,
-                config_file,
-            } => {
-                let mut rest_of_args = rest_of_args.clone();
-                rest_of_args.insert(0, first_arg.clone());
-                let args = rest_of_args;
-                let mut config = config::Rosenpass::parse_args(args)?;
-
-                if let Some(p) = config_file {
-                    config.store(p)?;
-                    config.config_file_path.clone_from(p);
-                }
-                config.validate()?;
-                self.apply_to_config(&mut config)?;
-
-                Self::event_loop(config, test_helpers)?;
-            }
-
-            Validate { config_files } => {
-                for file in config_files {
-                    match config::Rosenpass::load(file) {
-                        Ok(config) => {
-                            eprintln!("{file:?} is valid TOML and conforms to the expected schema");
-                            match config.validate() {
-                                Ok(_) => eprintln!("{file:?} has passed all logical checks"),
-                                Err(_) => eprintln!("{file:?} contains logical errors"),
-                            }
-                        }
-                        Err(e) => eprintln!("{file:?} is not valid: {e}"),
-                    }
-                }
-            }
-        }
-
-        Ok(())
-    }
-
-    fn event_loop(
-        config: config::Rosenpass,
-        test_helpers: Option<AppServerTest>,
-    ) -> anyhow::Result<()> {
-        const MAX_PSK_SIZE: usize = 1000;
-
-        // load own keys
-        let sk = SSk::load(&config.secret_key)?;
-        let pk = SPk::load(&config.public_key)?;
-
-        // start an application server
-        let mut srv = std::boxed::Box::<AppServer>::new(AppServer::new(
-            sk,
-            pk,
-            config.listen.clone(),
-            config.verbosity,
-            test_helpers,
-        )?);
-
-        config.apply_to_app_server(&mut srv)?;
-
-        let broker_store_ptr = srv.register_broker(Box::new(NativeUnixBroker::new()))?;
-
-        fn cfg_err_map(e: NativeUnixBrokerConfigBaseBuilderError) -> anyhow::Error {
-            anyhow::Error::msg(format!("NativeUnixBrokerConfigBaseBuilderError: {:?}", e))
-        }
-
-        for cfg_peer in config.peers {
-            let broker_peer = if let Some(wg) = &cfg_peer.wg {
-                let peer_cfg = NativeUnixBrokerConfigBaseBuilder::default()
-                    .peer_id_b64(&wg.peer)?
-                    .interface(wg.device.clone())
-                    .extra_params_ser(&wg.extra_params)?
-                    .build()
-                    .map_err(cfg_err_map)?;
-
-                let broker_peer = BrokerPeer::new(broker_store_ptr.clone(), Box::new(peer_cfg));
-
-                Some(broker_peer)
-            } else {
-                None
-            };
-
-            srv.add_peer(
-                // psk, pk, outfile, outwg, tx_addr
-                cfg_peer
-                    .pre_shared_key
-                    .map(SymKey::load_b64::<MAX_PSK_SIZE, _>)
-                    .transpose()?,
-                SPk::load(&cfg_peer.public_key)?,
-                cfg_peer.key_out,
-                broker_peer,
-                cfg_peer.endpoint.clone(),
-            )?;
-        }
-
-        srv.event_loop()
-    }
-}
-
-/// generate secret and public keys, store in files according to the paths passed as arguments
-fn generate_and_save_keypair(secret_key: PathBuf, public_key: PathBuf) -> anyhow::Result<()> {
-    let mut ssk = crate::protocol::SSk::random();
-    let mut spk = crate::protocol::SPk::random();
-    StaticKem::keygen(ssk.secret_mut(), spk.deref_mut())?;
-    ssk.store_secret(secret_key)?;
-    spk.store(public_key)
-}
-
-#[cfg(feature = "internal_testing")]
-pub mod testing {
-    use super::*;
-
-    pub fn generate_and_save_keypair(
-        secret_key: PathBuf,
-        public_key: PathBuf,
-    ) -> anyhow::Result<()> {
-        super::generate_and_save_keypair(secret_key, public_key)
-    }
-}

rosenpass/src/hash_domains.rs

@@ -1,48 +0,0 @@
-//! Pseudo Random Functions (PRFs) with a tree-like label scheme which
-//! ensures their uniqueness
-
-use anyhow::Result;
-use rosenpass_ciphers::{hash_domain::HashDomain, KEY_LEN};
-
-// TODO Use labels that can serve as identifiers
-macro_rules! hash_domain_ns {
-    ($base:ident, $name:ident, $($lbl:expr),* ) => {
-        pub fn $name() -> Result<HashDomain> {
-            let t = $base()?;
-            $( let t = t.mix($lbl.as_bytes())?; )*
-            Ok(t)
-        }
-    }
-}
-
-macro_rules! hash_domain {
-    ($base:ident, $name:ident, $($lbl:expr),* ) => {
-        pub fn $name() -> Result<[u8; KEY_LEN]> {
-            let t = $base()?;
-            $( let t = t.mix($lbl.as_bytes())?; )*
-            Ok(t.into_value())
-        }
-    }
-}
-
-pub fn protocol() -> Result<HashDomain> {
-    HashDomain::zero().mix("Rosenpass v1 mceliece460896 Kyber512 ChaChaPoly1305 BLAKE2s".as_bytes())
-}
-
-hash_domain_ns!(protocol, mac, "mac");
-hash_domain_ns!(protocol, cookie, "cookie");
-hash_domain_ns!(protocol, cookie_value, "cookie-value");
-hash_domain_ns!(protocol, cookie_key, "cookie-key");
-hash_domain_ns!(protocol, peerid, "peer id");
-hash_domain_ns!(protocol, biscuit_ad, "biscuit additional data");
-hash_domain_ns!(protocol, ckinit, "chaining key init");
-hash_domain_ns!(protocol, _ckextract, "chaining key extract");
-
-hash_domain!(_ckextract, mix, "mix");
-hash_domain!(_ckextract, hs_enc, "handshake encryption");
-hash_domain!(_ckextract, ini_enc, "initiator handshake encryption");
-hash_domain!(_ckextract, res_enc, "responder handshake encryption");
-
-hash_domain_ns!(_ckextract, _user, "user");
-hash_domain_ns!(_user, _rp, "rosenpass.eu");
-hash_domain!(_rp, osk, "wireguard psk");

rosenpass/src/lib.rs

@@ -1,20 +0,0 @@
-#[cfg(feature = "experiment_api")]
-pub mod api;
-pub mod app_server;
-pub mod cli;
-pub mod config;
-pub mod hash_domains;
-pub mod msgs;
-pub mod protocol;
-
-#[derive(thiserror::Error, Debug)]
-pub enum RosenpassError {
-    #[error("buffer size mismatch")]
-    BufferSizeMismatch,
-    #[error("invalid message type")]
-    InvalidMessageType(u8),
-    #[error("invalid API message type")]
-    InvalidApiMessageType(u128),
-    #[error("could not parse API message")]
-    InvalidApiMessage,
-}

rosenpass/src/main.rs

@@ -1,44 +0,0 @@
-use clap::Parser;
-use log::error;
-use rosenpass::cli::CliArgs;
-use std::process::exit;
-
-/// Catches errors, prints them through the logger, then exits
-pub fn main() {
-    // parse CLI arguments
-    let args = CliArgs::parse();
-
-    {
-        use rosenpass_secret_memory as SM;
-        #[cfg(feature = "experiment_memfd_secret")]
-        SM::secret_policy_try_use_memfd_secrets();
-        #[cfg(not(feature = "experiment_memfd_secret"))]
-        SM::secret_policy_use_only_malloc_secrets();
-    }
-
-    // init logging
-    {
-        let mut log_builder = env_logger::Builder::from_default_env(); // sets log level filter from environment (or defaults)
-        if let Some(level) = args.get_log_level() {
-            log::debug!("setting log level to {:?} (set via CLI parameter)", level);
-            log_builder.filter_level(level); // set log level filter from CLI args if available
-        }
-        log_builder.init();
-
-        // // check the effectiveness of the log level filter with the following lines:
-        // use log::{debug, error, info, trace, warn};
-        // trace!("trace dummy");
-        // debug!("debug dummy");
-        // info!("info dummy");
-        // warn!("warn dummy");
-        // error!("error dummy");
-    }
-
-    match args.run(None) {
-        Ok(_) => {}
-        Err(e) => {
-            error!("{e:?}");
-            exit(1);
-        }
-    }
-}

rosenpass/src/msgs.rs

@@ -1,213 +0,0 @@
-//! Data structures representing the messages going over the wire
-//!
-//! This module contains de-/serialization of the protocol's messages. Thats kind
-//! of a lie, since no actual ser/de happens. Instead, the structures offer views
-//! into mutable byte slices (`&mut [u8]`), allowing to modify the fields of an
-//! always serialized instance of the data in question. This is closely related
-//! to the concept of lenses in function programming; more on that here:
-//! [https://sinusoid.es/misc/lager/lenses.pdf](https://sinusoid.es/misc/lager/lenses.pdf)
-//! To achieve this we utilize the zerocopy library.
-//!
-use std::mem::size_of;
-use zerocopy::{AsBytes, FromBytes, FromZeroes};
-
-use super::RosenpassError;
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::{EphemeralKem, StaticKem};
-use rosenpass_ciphers::{aead, xaead, KEY_LEN};
-pub const MSG_SIZE_LEN: usize = 1;
-pub const RESERVED_LEN: usize = 3;
-pub const MAC_SIZE: usize = 16;
-pub const COOKIE_SIZE: usize = 16;
-pub const SID_LEN: usize = 4;
-
-#[repr(packed)]
-#[derive(AsBytes, FromBytes, FromZeroes)]
-pub struct Envelope<M: AsBytes + FromBytes> {
-    /// [MsgType] of this message
-    pub msg_type: u8,
-    /// Reserved for future use
-    pub reserved: [u8; 3],
-    /// The actual Paylod
-    pub payload: M,
-    /// Message Authentication Code (mac) over all bytes until (exclusive)
-    /// `mac` itself
-    pub mac: [u8; 16],
-    /// Currently unused, TODO: do something with this
-    pub cookie: [u8; 16],
-}
-
-#[repr(packed)]
-#[derive(AsBytes, FromBytes, FromZeroes)]
-pub struct InitHello {
-    /// Randomly generated connection id
-    pub sidi: [u8; 4],
-    /// Kyber 512 Ephemeral Public Key
-    pub epki: [u8; EphemeralKem::PK_LEN],
-    /// Classic McEliece Ciphertext
-    pub sctr: [u8; StaticKem::CT_LEN],
-    /// Encryped: 16 byte hash of McEliece initiator static key
-    pub pidic: [u8; aead::TAG_LEN + 32],
-    /// Encrypted TAI64N Time Stamp (against replay attacks)
-    pub auth: [u8; aead::TAG_LEN],
-}
-
-#[repr(packed)]
-#[derive(AsBytes, FromBytes, FromZeroes)]
-pub struct RespHello {
-    /// Randomly generated connection id
-    pub sidr: [u8; 4],
-    /// Copied from InitHello
-    pub sidi: [u8; 4],
-    /// Kyber 512 Ephemeral Ciphertext
-    pub ecti: [u8; EphemeralKem::CT_LEN],
-    /// Classic McEliece Ciphertext
-    pub scti: [u8; StaticKem::CT_LEN],
-    /// Empty encrypted message (just an auth tag)
-    pub auth: [u8; aead::TAG_LEN],
-    /// Responders handshake state in encrypted form
-    pub biscuit: [u8; BISCUIT_CT_LEN],
-}
-
-#[repr(packed)]
-#[derive(AsBytes, FromBytes, FromZeroes)]
-pub struct InitConf {
-    /// Copied from InitHello
-    pub sidi: [u8; 4],
-    /// Copied from RespHello
-    pub sidr: [u8; 4],
-    /// Responders handshake state in encrypted form
-    pub biscuit: [u8; BISCUIT_CT_LEN],
-    /// Empty encrypted message (just an auth tag)
-    pub auth: [u8; aead::TAG_LEN],
-}
-
-#[repr(packed)]
-#[derive(AsBytes, FromBytes, FromZeroes)]
-pub struct EmptyData {
-    /// Copied from RespHello
-    pub sid: [u8; 4],
-    /// Nonce
-    pub ctr: [u8; 8],
-    /// Empty encrypted message (just an auth tag)
-    pub auth: [u8; aead::TAG_LEN],
-}
-
-#[repr(packed)]
-#[derive(AsBytes, FromBytes, FromZeroes)]
-pub struct Biscuit {
-    /// H(spki) – Ident ifies the initiator
-    pub pidi: [u8; KEY_LEN],
-    /// The biscuit number (replay protection)
-    pub biscuit_no: [u8; 12],
-    /// Chaining key
-    pub ck: [u8; KEY_LEN],
-}
-
-#[repr(packed)]
-#[derive(AsBytes, FromBytes, FromZeroes)]
-pub struct DataMsg {
-    pub dummy: [u8; 4],
-}
-
-#[repr(packed)]
-#[derive(AsBytes, FromBytes, FromZeroes)]
-pub struct CookieReplyInner {
-    /// [MsgType] of this message
-    pub msg_type: u8,
-    /// Reserved for future use
-    pub reserved: [u8; 3],
-    /// Session ID of the sender (initiator)
-    pub sid: [u8; 4],
-    /// Encrypted cookie with authenticated initiator `mac`
-    pub cookie_encrypted: [u8; xaead::NONCE_LEN + COOKIE_SIZE + xaead::TAG_LEN],
-}
-
-#[repr(packed)]
-#[derive(AsBytes, FromBytes, FromZeroes)]
-pub struct CookieReply {
-    pub inner: CookieReplyInner,
-    pub padding: [u8; size_of::<Envelope<InitHello>>() - size_of::<CookieReplyInner>()],
-}
-
-// Traits /////////////////////////////////////////////////////////////////////
-
-pub trait WireMsg: std::fmt::Debug {
-    const MSG_TYPE: MsgType;
-    const MSG_TYPE_U8: u8 = Self::MSG_TYPE as u8;
-    const BYTES: usize;
-}
-
-// Constants //////////////////////////////////////////////////////////////////
-
-pub const SESSION_ID_LEN: usize = 4;
-pub const BISCUIT_ID_LEN: usize = 12;
-
-pub const WIRE_ENVELOPE_LEN: usize = 1 + 3 + 16 + 16; // TODO verify this
-
-/// Size required to fit any message in binary form
-pub const MAX_MESSAGE_LEN: usize = 2500; // TODO fix this
-
-/// Recognized message types
-#[repr(u8)]
-#[derive(Hash, PartialEq, Eq, PartialOrd, Ord, Debug, Clone, Copy)]
-pub enum MsgType {
-    InitHello = 0x81,
-    RespHello = 0x82,
-    InitConf = 0x83,
-    EmptyData = 0x84,
-    DataMsg = 0x85,
-    CookieReply = 0x86,
-}
-
-impl TryFrom<u8> for MsgType {
-    type Error = RosenpassError;
-
-    fn try_from(value: u8) -> Result<Self, Self::Error> {
-        Ok(match value {
-            0x81 => MsgType::InitHello,
-            0x82 => MsgType::RespHello,
-            0x83 => MsgType::InitConf,
-            0x84 => MsgType::EmptyData,
-            0x85 => MsgType::DataMsg,
-            0x86 => MsgType::CookieReply,
-            _ => return Err(RosenpassError::InvalidMessageType(value)),
-        })
-    }
-}
-
-impl From<MsgType> for u8 {
-    fn from(val: MsgType) -> Self {
-        val as u8
-    }
-}
-
-/// length in bytes of an unencrypted Biscuit (plain text)
-pub const BISCUIT_PT_LEN: usize = size_of::<Biscuit>();
-
-/// Length in bytes of an encrypted Biscuit (cipher text)
-pub const BISCUIT_CT_LEN: usize = BISCUIT_PT_LEN + xaead::NONCE_LEN + xaead::TAG_LEN;
-
-#[cfg(test)]
-mod test_constants {
-    use crate::msgs::{BISCUIT_CT_LEN, BISCUIT_PT_LEN};
-    use rosenpass_ciphers::{xaead, KEY_LEN};
-
-    #[test]
-    fn sodium_keysize() {
-        assert_eq!(KEY_LEN, 32);
-    }
-
-    #[test]
-    fn biscuit_pt_len() {
-        assert_eq!(BISCUIT_PT_LEN, 2 * KEY_LEN + 12);
-    }
-
-    #[test]
-    fn biscuit_ct_len() {
-        assert_eq!(
-            BISCUIT_CT_LEN,
-            BISCUIT_PT_LEN + xaead::NONCE_LEN + xaead::TAG_LEN
-        );
-    }
-}

rosenpass/tests/api-integration-tests.rs

@@ -1,180 +0,0 @@
-use std::{
-    io::{BufRead, BufReader},
-    net::ToSocketAddrs,
-    os::unix::net::UnixStream,
-    process::Stdio,
-};
-
-use anyhow::{bail, Context};
-use rosenpass::api;
-use rosenpass_to::{ops::copy_slice_least_src, To};
-use rosenpass_util::zerocopy::ZerocopySliceExt;
-use rosenpass_util::{
-    file::LoadValueB64,
-    length_prefix_encoding::{decoder::LengthPrefixDecoder, encoder::LengthPrefixEncoder},
-};
-use tempfile::TempDir;
-use zerocopy::AsBytes;
-
-use rosenpass::protocol::SymKey;
-
-#[test]
-fn api_integration_test() -> anyhow::Result<()> {
-    rosenpass_secret_memory::policy::secret_policy_use_only_malloc_secrets();
-
-    let dir = TempDir::with_prefix("rosenpass-api-integration-test")?;
-
-    macro_rules! tempfile {
-        ($($lst:expr),+) => {{
-            let mut buf =  dir.path().to_path_buf();
-            $(buf.push($lst);)*
-            buf
-        }}
-    }
-
-    let peer_a_endpoint = "[::1]:61423";
-    let peer_a_osk = tempfile!("a.osk");
-    let peer_b_osk = tempfile!("b.osk");
-
-    use rosenpass::config;
-    let peer_a = config::Rosenpass {
-        config_file_path: tempfile!("a.config"),
-        secret_key: tempfile!("a.sk"),
-        public_key: tempfile!("a.pk"),
-        listen: peer_a_endpoint.to_socket_addrs()?.collect(), // TODO: This could collide by accident
-        verbosity: config::Verbosity::Verbose,
-        api: api::config::ApiConfig {
-            listen_path: vec![tempfile!("a.sock")],
-            listen_fd: vec![],
-            stream_fd: vec![],
-        },
-        peers: vec![config::RosenpassPeer {
-            public_key: tempfile!("b.pk"),
-            key_out: Some(peer_a_osk.clone()),
-            endpoint: None,
-            pre_shared_key: None,
-            wg: None,
-        }],
-    };
-
-    let peer_b = config::Rosenpass {
-        config_file_path: tempfile!("b.config"),
-        secret_key: tempfile!("b.sk"),
-        public_key: tempfile!("b.pk"),
-        listen: vec![],
-        verbosity: config::Verbosity::Verbose,
-        api: api::config::ApiConfig {
-            listen_path: vec![tempfile!("b.sock")],
-            listen_fd: vec![],
-            stream_fd: vec![],
-        },
-        peers: vec![config::RosenpassPeer {
-            public_key: tempfile!("a.pk"),
-            key_out: Some(peer_b_osk.clone()),
-            endpoint: Some(peer_a_endpoint.to_owned()),
-            pre_shared_key: None,
-            wg: None,
-        }],
-    };
-
-    // Generate the keys
-    rosenpass::cli::testing::generate_and_save_keypair(
-        peer_a.secret_key.clone(),
-        peer_a.public_key.clone(),
-    )?;
-    rosenpass::cli::testing::generate_and_save_keypair(
-        peer_b.secret_key.clone(),
-        peer_b.public_key.clone(),
-    )?;
-
-    // Write the configuration files
-    peer_a.commit()?;
-    peer_b.commit()?;
-
-    // Start peer a
-    let proc_a = std::process::Command::new(env!("CARGO_BIN_EXE_rosenpass"))
-        .args([
-            "exchange-config",
-            peer_a.config_file_path.to_str().context("")?,
-        ])
-        .stdin(Stdio::null())
-        .stdout(Stdio::piped())
-        .spawn()?;
-
-    // Start peer b
-    let proc_b = std::process::Command::new(env!("CARGO_BIN_EXE_rosenpass"))
-        .args([
-            "exchange-config",
-            peer_b.config_file_path.to_str().context("")?,
-        ])
-        .stdin(Stdio::null())
-        .stdout(Stdio::piped())
-        .spawn()?;
-
-    // Acquire stdout
-    let mut out_a = BufReader::new(proc_a.stdout.context("")?).lines();
-    let mut out_b = BufReader::new(proc_b.stdout.context("")?).lines();
-
-    // Wait for the keys to successfully exchange a key
-    let mut attempt = 0;
-    loop {
-        let line_a = out_a.next().context("")??;
-        let line_b = out_b.next().context("")??;
-
-        let words_a = line_a.split(' ').collect::<Vec<_>>();
-        let words_b = line_b.split(' ').collect::<Vec<_>>();
-
-        // FIXED     FIXED PEER-ID                                      FIXED    FILENAME       STATUS
-        // output-key peer KZqXTZ4l2aNnkJtLPhs4D8JxHTGmRSL9w3Qr+X8JxFk= key-file "client-A-osk" exchanged
-        let peer_a_id = words_b
-            .get(2)
-            .with_context(|| format!("Bad rosenpass output: `{line_b}`"))?;
-        let peer_b_id = words_a
-            .get(2)
-            .with_context(|| format!("Bad rosenpass output: `{line_a}`"))?;
-        assert_eq!(
-            line_a,
-            format!(
-                "output-key peer {peer_b_id} key-file \"{}\" exchanged",
-                peer_a_osk.to_str().context("")?
-            )
-        );
-        assert_eq!(
-            line_b,
-            format!(
-                "output-key peer {peer_a_id} key-file \"{}\" exchanged",
-                peer_b_osk.to_str().context("")?
-            )
-        );
-
-        // Read OSKs
-        let osk_a = SymKey::load_b64::<64, _>(peer_a_osk.clone())?;
-        let osk_b = SymKey::load_b64::<64, _>(peer_b_osk.clone())?;
-        match osk_a.secret() == osk_b.secret() {
-            true => break,
-            false if attempt > 10 => bail!("Peers did not produce a matching key even after ten attempts. Something is wrong with the key exchange!"),
-            false => {},
-        };
-
-        attempt += 1;
-    }
-
-    // Now connect to the peers
-    let api_a = UnixStream::connect(&peer_a.api.listen_path[0])?;
-    let api_b = UnixStream::connect(&peer_b.api.listen_path[0])?;
-
-    for conn in ([api_a, api_b]).iter() {
-        let mut echo = [0u8; 256];
-        copy_slice_least_src("Hello World".as_bytes()).to(&mut echo);
-
-        let req = api::PingRequest::new(echo);
-        LengthPrefixEncoder::from_message(req.as_bytes()).write_all_to_stdio(conn)?;
-
-        let mut decoder = LengthPrefixDecoder::new([0u8; api::MAX_RESPONSE_LEN]);
-        let res = decoder.read_all_from_stdio(conn)?;
-        let res = res.zk_parse::<api::PingResponse>()?;
-        assert_eq!(*res, api::PingResponse::new(echo));
-    }
-
-    Ok(())
-}

rosenpass/tests/integration_test.rs

@@ -1,338 +0,0 @@
-use std::{
-    fs,
-    net::UdpSocket,
-    path::PathBuf,
-    sync::{Arc, Mutex},
-    time::Duration,
-};
-
-use clap::Parser;
-use rosenpass::{app_server::AppServerTestBuilder, cli::CliArgs};
-use rosenpass_secret_memory::{Public, Secret};
-use rosenpass_wireguard_broker::{WireguardBrokerMio, WG_KEY_LEN, WG_PEER_LEN};
-use serial_test::serial;
-use std::io::Write;
-
-const BIN: &str = "rosenpass";
-
-fn setup_tests() {
-    use rosenpass_secret_memory as SM;
-    #[cfg(feature = "experiment_memfd_secret")]
-    SM::secret_policy_try_use_memfd_secrets();
-    #[cfg(not(feature = "experiment_memfd_secret"))]
-    SM::secret_policy_use_only_malloc_secrets();
-}
-
-// check that we can generate keys
-#[test]
-fn generate_keys() {
-    setup_tests();
-
-    let tmpdir = PathBuf::from(env!("CARGO_TARGET_TMPDIR")).join("keygen");
-    fs::create_dir_all(&tmpdir).unwrap();
-
-    let secret_key_path = tmpdir.join("secret-key");
-    let public_key_path = tmpdir.join("public-key");
-
-    let output = test_bin::get_test_bin(BIN)
-        .args(["gen-keys", "--secret-key"])
-        .arg(&secret_key_path)
-        .arg("--public-key")
-        .arg(&public_key_path)
-        .output()
-        .expect("Failed to start {BIN}");
-
-    assert_eq!(String::from_utf8_lossy(&output.stdout), "");
-
-    assert!(secret_key_path.is_file());
-    assert!(public_key_path.is_file());
-
-    // cleanup
-    fs::remove_dir_all(&tmpdir).unwrap();
-}
-
-fn find_udp_socket() -> Option<u16> {
-    (1025..=u16::MAX).find(|&port| UdpSocket::bind(("::1", port)).is_ok())
-}
-
-fn setup_logging() {
-    let mut log_builder = env_logger::Builder::from_default_env(); // sets log level filter from environment (or defaults)
-    log_builder.filter_level(log::LevelFilter::Debug);
-    log_builder.format_timestamp_nanos();
-    log_builder.format(|buf, record| {
-        let ts_format = buf.timestamp_nanos().to_string();
-        writeln!(
-            buf,
-            "\x1b[1m{:?}\x1b[0m {}: {}",
-            std::thread::current().id(),
-            &ts_format[14..],
-            record.args()
-        )
-    });
-
-    let _ = log_builder.try_init();
-}
-
-fn generate_key_pairs(secret_key_paths: &[PathBuf], public_key_paths: &[PathBuf]) {
-    for (secret_key_path, pub_key_path) in secret_key_paths.iter().zip(public_key_paths.iter()) {
-        let output = test_bin::get_test_bin(BIN)
-            .args(["gen-keys", "--secret-key"])
-            .arg(secret_key_path)
-            .arg("--public-key")
-            .arg(pub_key_path)
-            .output()
-            .expect("Failed to start {BIN}");
-
-        assert_eq!(String::from_utf8_lossy(&output.stdout), "");
-        assert!(secret_key_path.is_file());
-        assert!(pub_key_path.is_file());
-    }
-}
-
-fn run_server_client_exchange(
-    (server_cmd, server_test_builder): (&std::process::Command, AppServerTestBuilder),
-    (client_cmd, client_test_builder): (&std::process::Command, AppServerTestBuilder),
-) {
-    let (server_terminate, server_terminate_rx) = std::sync::mpsc::channel();
-    let (client_terminate, client_terminate_rx) = std::sync::mpsc::channel();
-
-    let cli = CliArgs::try_parse_from(
-        [server_cmd.get_program()]
-            .into_iter()
-            .chain(server_cmd.get_args()),
-    )
-    .unwrap();
-
-    std::thread::spawn(move || {
-        let test_helpers = server_test_builder
-            .termination_handler(Some(server_terminate_rx))
-            .build()
-            .unwrap();
-        cli.run(Some(test_helpers)).unwrap();
-    });
-
-    let cli = CliArgs::try_parse_from(
-        [client_cmd.get_program()]
-            .into_iter()
-            .chain(client_cmd.get_args()),
-    )
-    .unwrap();
-
-    std::thread::spawn(move || {
-        let test_helpers = client_test_builder
-            .termination_handler(Some(client_terminate_rx))
-            .build()
-            .unwrap();
-        cli.run(Some(test_helpers)).unwrap();
-    });
-
-    // give them some time to do the key exchange under load
-    std::thread::sleep(Duration::from_secs(10));
-
-    // time's up, kill the childs
-    server_terminate.send(()).unwrap();
-    client_terminate.send(()).unwrap();
-}
-
-// check that we can exchange keys
-#[test]
-#[serial]
-fn check_exchange_under_normal() {
-    setup_tests();
-    setup_logging();
-
-    let tmpdir = PathBuf::from(env!("CARGO_TARGET_TMPDIR")).join("exchange");
-    fs::create_dir_all(&tmpdir).unwrap();
-
-    let secret_key_paths = [tmpdir.join("secret-key-0"), tmpdir.join("secret-key-1")];
-    let public_key_paths = [tmpdir.join("public-key-0"), tmpdir.join("public-key-1")];
-    let shared_key_paths = [tmpdir.join("shared-key-0"), tmpdir.join("shared-key-1")];
-
-    // generate key pairs
-    generate_key_pairs(&secret_key_paths, &public_key_paths);
-
-    // start first process, the server
-    let port = loop {
-        if let Some(port) = find_udp_socket() {
-            break port;
-        }
-    };
-
-    let listen_addr = format!("::1:{port}");
-    let mut server_cmd = std::process::Command::new(BIN);
-
-    server_cmd
-        .args(["exchange", "secret-key"])
-        .arg(&secret_key_paths[0])
-        .arg("public-key")
-        .arg(&public_key_paths[0])
-        .args(["listen", &listen_addr, "verbose", "peer", "public-key"])
-        .arg(&public_key_paths[1])
-        .arg("outfile")
-        .arg(&shared_key_paths[0]);
-
-    let server_test_builder = AppServerTestBuilder::default();
-
-    let mut client_cmd = std::process::Command::new(BIN);
-    client_cmd
-        .args(["exchange", "secret-key"])
-        .arg(&secret_key_paths[1])
-        .arg("public-key")
-        .arg(&public_key_paths[1])
-        .args(["verbose", "peer", "public-key"])
-        .arg(&public_key_paths[0])
-        .args(["endpoint", &listen_addr])
-        .arg("outfile")
-        .arg(&shared_key_paths[1]);
-
-    let client_test_builder = AppServerTestBuilder::default();
-
-    run_server_client_exchange(
-        (&server_cmd, server_test_builder),
-        (&client_cmd, client_test_builder),
-    );
-
-    // read the shared keys they created
-    let shared_keys: Vec<_> = shared_key_paths
-        .iter()
-        .map(|p| fs::read_to_string(p).unwrap())
-        .collect();
-
-    // check that they created two equal keys
-    assert_eq!(shared_keys.len(), 2);
-    assert_eq!(shared_keys[0], shared_keys[1]);
-
-    // cleanup
-    fs::remove_dir_all(&tmpdir).unwrap();
-}
-
-// check that we can trigger a DoS condition  and we can exchange keys under DoS
-// This test creates a responder (server) with the feature flag "integration_test_always_under_load" to always be under load condition for the test.
-#[test]
-#[serial]
-fn check_exchange_under_dos() {
-    setup_tests();
-    setup_logging();
-
-    //Generate binary with responder with feature integration_test
-    let tmpdir = PathBuf::from(env!("CARGO_TARGET_TMPDIR")).join("exchange-dos");
-    fs::create_dir_all(&tmpdir).unwrap();
-
-    let secret_key_paths = [tmpdir.join("secret-key-0"), tmpdir.join("secret-key-1")];
-    let public_key_paths = [tmpdir.join("public-key-0"), tmpdir.join("public-key-1")];
-    let shared_key_paths = [tmpdir.join("shared-key-0"), tmpdir.join("shared-key-1")];
-
-    // generate key pairs
-    generate_key_pairs(&secret_key_paths, &public_key_paths);
-
-    // start first process, the server
-    let port = loop {
-        if let Some(port) = find_udp_socket() {
-            break port;
-        }
-    };
-
-    let listen_addr = format!("::1:{port}");
-
-    let mut server_cmd = std::process::Command::new(BIN);
-
-    server_cmd
-        .args(["exchange", "secret-key"])
-        .arg(&secret_key_paths[0])
-        .arg("public-key")
-        .arg(&public_key_paths[0])
-        .args(["listen", &listen_addr, "verbose", "peer", "public-key"])
-        .arg(&public_key_paths[1])
-        .arg("outfile")
-        .arg(&shared_key_paths[0]);
-
-    let server_test_builder = AppServerTestBuilder::default().enable_dos_permanently(true);
-
-    let mut client_cmd = std::process::Command::new(BIN);
-    client_cmd
-        .args(["exchange", "secret-key"])
-        .arg(&secret_key_paths[1])
-        .arg("public-key")
-        .arg(&public_key_paths[1])
-        .args(["verbose", "peer", "public-key"])
-        .arg(&public_key_paths[0])
-        .args(["endpoint", &listen_addr])
-        .arg("outfile")
-        .arg(&shared_key_paths[1]);
-
-    let client_test_builder = AppServerTestBuilder::default();
-
-    run_server_client_exchange(
-        (&server_cmd, server_test_builder),
-        (&client_cmd, client_test_builder),
-    );
-
-    // read the shared keys they created
-    let shared_keys: Vec<_> = shared_key_paths
-        .iter()
-        .map(|p| fs::read_to_string(p).unwrap())
-        .collect();
-
-    // check that they created two equal keys
-    assert_eq!(shared_keys.len(), 2);
-    assert_eq!(shared_keys[0], shared_keys[1]);
-
-    // cleanup
-    fs::remove_dir_all(&tmpdir).unwrap();
-}
-
-#[allow(dead_code)]
-#[derive(Debug, Default)]
-struct MockBrokerInner {
-    psk: Option<Secret<WG_KEY_LEN>>,
-    peer_id: Option<Public<WG_PEER_LEN>>,
-    interface: Option<String>,
-}
-
-#[allow(dead_code)]
-#[derive(Debug, Default)]
-struct MockBroker {
-    inner: Arc<Mutex<MockBrokerInner>>,
-}
-
-impl WireguardBrokerMio for MockBroker {
-    type MioError = anyhow::Error;
-
-    fn register(
-        &mut self,
-        _registry: &mio::Registry,
-        _token: mio::Token,
-    ) -> Result<(), Self::MioError> {
-        Ok(())
-    }
-
-    fn process_poll(&mut self) -> Result<(), Self::MioError> {
-        Ok(())
-    }
-
-    fn unregister(&mut self, _registry: &mio::Registry) -> Result<(), Self::MioError> {
-        Ok(())
-    }
-}
-
-impl rosenpass_wireguard_broker::WireGuardBroker for MockBroker {
-    type Error = anyhow::Error;
-
-    fn set_psk(
-        &mut self,
-        config: rosenpass_wireguard_broker::SerializedBrokerConfig<'_>,
-    ) -> Result<(), Self::Error> {
-        loop {
-            let mut lock = self.inner.try_lock();
-
-            if let Ok(ref mut mutex) = lock {
-                **mutex = MockBrokerInner {
-                    psk: Some(config.psk.clone()),
-                    peer_id: Some(*config.peer_id),
-                    interface: Some(std::str::from_utf8(config.interface).unwrap().to_string()),
-                };
-                break Ok(());
-            }
-        }
-    }
-}