fix: Add test for rosenpass_constant_time::compare being little endian

It only takes a few seconds to run, enable it.

Signed-off-by: Paul Spooren <mail@aparcar.org>

.ci/gen-workflow-files.nu

@@ -33,7 +33,7 @@ let systems_map = {
   # aarch64-linux
   
   i686-linux: ubuntu-latest,
-  x86_64-darwin: macos-latest,
+  x86_64-darwin: macos-13,
   x86_64-linux: ubuntu-latest
 }
 
@@ -64,7 +64,7 @@ let runner_setup = [
     uses: "actions/checkout@v3"
   }
   {
-    uses: "cachix/install-nix-action@v21",
+    uses: "cachix/install-nix-action@v22",
     with: { nix_path: "nixpkgs=channel:nixos-unstable" }
   }
   {

.github/workflows/nix.yaml

@@ -15,7 +15,7 @@ jobs:
       - i686-linux---rosenpass
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -31,7 +31,7 @@ jobs:
     needs: []
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -48,7 +48,7 @@ jobs:
       - i686-linux---rosenpass
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -63,7 +63,7 @@ jobs:
       - ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -75,12 +75,12 @@ jobs:
   x86_64-darwin---default:
     name: Build x86_64-darwin.default
     runs-on:
-      - macos-latest
+      - macos-13
     needs:
       - x86_64-darwin---rosenpass
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -92,13 +92,13 @@ jobs:
   x86_64-darwin---release-package:
     name: Build x86_64-darwin.release-package
     runs-on:
-      - macos-latest
+      - macos-13
     needs:
       - x86_64-darwin---rosenpass
       - x86_64-darwin---rosenpass-oci-image
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -110,11 +110,11 @@ jobs:
   x86_64-darwin---rosenpass:
     name: Build x86_64-darwin.rosenpass
     runs-on:
-      - macos-latest
+      - macos-13
     needs: []
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -126,12 +126,12 @@ jobs:
   x86_64-darwin---rosenpass-oci-image:
     name: Build x86_64-darwin.rosenpass-oci-image
     runs-on:
-      - macos-latest
+      - macos-13
     needs:
       - x86_64-darwin---rosenpass
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -143,10 +143,10 @@ jobs:
   x86_64-darwin---check:
     name: Run Nix checks on x86_64-darwin
     runs-on:
-      - macos-latest
+      - macos-13
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -163,7 +163,7 @@ jobs:
       - x86_64-linux---rosenpass
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -180,7 +180,7 @@ jobs:
       - x86_64-linux---proverif-patched
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -196,7 +196,7 @@ jobs:
     needs: []
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -210,11 +210,11 @@ jobs:
     runs-on:
       - ubuntu-latest
     needs:
-      - x86_64-linux---rosenpass-static
       - x86_64-linux---rosenpass-static-oci-image
+      - x86_64-linux---rosenpass-static
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -223,6 +223,29 @@ jobs:
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
       - name: Build
         run: nix build .#packages.x86_64-linux.release-package --print-build-logs
+  aarch64-linux---release-package:
+    name: Build aarch64-linux.release-package
+    runs-on:
+      - ubuntu-latest
+    needs:
+      - aarch64-linux---rosenpass-oci-image
+      - aarch64-linux---rosenpass
+    steps:
+      - run: |
+          DEBIAN_FRONTEND=noninteractive
+          sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi binfmt-support qemu-user-static
+      - uses: actions/checkout@v3
+      - uses: cachix/install-nix-action@v22
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+          extra_nix_config: |
+            system = aarch64-linux
+      - uses: cachix/cachix-action@v12
+        with:
+          name: rosenpass
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Build
+        run: nix build .#packages.aarch64-linux.release-package --print-build-logs
   x86_64-linux---rosenpass:
     name: Build x86_64-linux.rosenpass
     runs-on:
@@ -230,7 +253,7 @@ jobs:
     needs: []
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -239,6 +262,27 @@ jobs:
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
       - name: Build
         run: nix build .#packages.x86_64-linux.rosenpass --print-build-logs
+  aarch64-linux---rosenpass:
+    name: Build aarch64-linux.rosenpass
+    runs-on:
+      - ubuntu-latest
+    needs: []
+    steps:
+      - run: |
+          DEBIAN_FRONTEND=noninteractive
+          sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi binfmt-support qemu-user-static
+      - uses: actions/checkout@v3
+      - uses: cachix/install-nix-action@v22
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+          extra_nix_config: |
+            system = aarch64-linux
+      - uses: cachix/cachix-action@v12
+        with:
+          name: rosenpass
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Build
+        run: nix build .#packages.aarch64-linux.rosenpass --print-build-logs
   x86_64-linux---rosenpass-oci-image:
     name: Build x86_64-linux.rosenpass-oci-image
     runs-on:
@@ -247,7 +291,7 @@ jobs:
       - x86_64-linux---rosenpass
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -256,6 +300,28 @@ jobs:
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
       - name: Build
         run: nix build .#packages.x86_64-linux.rosenpass-oci-image --print-build-logs
+  aarch64-linux---rosenpass-oci-image:
+    name: Build aarch64-linux.rosenpass-oci-image
+    runs-on:
+      - ubuntu-latest
+    needs:
+      - aarch64-linux---rosenpass
+    steps:
+      - run: |
+          DEBIAN_FRONTEND=noninteractive
+          sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi binfmt-support qemu-user-static
+      - uses: actions/checkout@v3
+      - uses: cachix/install-nix-action@v22
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+          extra_nix_config: |
+            system = aarch64-linux
+      - uses: cachix/cachix-action@v12
+        with:
+          name: rosenpass
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Build
+        run: nix build .#packages.aarch64-linux.rosenpass-oci-image --print-build-logs
   x86_64-linux---rosenpass-static:
     name: Build x86_64-linux.rosenpass-static
     runs-on:
@@ -263,7 +329,7 @@ jobs:
     needs: []
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -280,7 +346,7 @@ jobs:
       - x86_64-linux---rosenpass-static
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -296,7 +362,7 @@ jobs:
     needs: []
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -311,7 +377,7 @@ jobs:
       - ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -326,7 +392,7 @@ jobs:
     if: ${{ github.ref == 'refs/heads/main' }}
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12

.github/workflows/qc.yaml

@@ -17,6 +17,42 @@ jobs:
         with:
           args: --check .
 
+  shellcheck:
+    name: Shellcheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@master
+
+  rustfmt:
+    name: Rust Format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Run Rust Formatting Script
+        run: bash format_rust_code.sh --mode check
+
+  cargo-bench:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+      - name: Install libsodium
+        run: sudo apt-get install -y libsodium-dev
+        # liboqs requires quite a lot of stack memory, thus we adjust
+        # the default stack size picked for new threads (which is used
+        # by `cargo test`) to be _big enough_. Setting it to 8 MiB
+      - run: RUST_MIN_STACK=8388608 cargo bench --workspace
+
   cargo-audit:
     runs-on: ubuntu-latest
     steps:
@@ -66,3 +102,77 @@ jobs:
       # - https://github.com/rosenpass/rosenpass/issues/62
       # - https://github.com/rust-lang/rust/issues/108378
       - run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --document-private-items
+
+  cargo-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+      - name: Install libsodium
+        run: sudo apt-get install -y libsodium-dev
+        # liboqs requires quite a lot of stack memory, thus we adjust
+        # the default stack size picked for new threads (which is used
+        # by `cargo test`) to be _big enough_. Setting it to 8 MiB
+      - run: RUST_MIN_STACK=8388608 cargo test --workspace --all-features
+
+  cargo-test-nix-devshell-x86_64-linux:
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+      - uses: cachix/install-nix-action@v21
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v12
+        with:
+          name: rosenpass
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - run: nix develop --command cargo test --workspace --all-features
+
+  cargo-fuzz:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+      - name: Install libsodium
+        run: sudo apt-get install -y libsodium-dev
+      - name: Install nightly toolchain
+        run: |
+          rustup toolchain install nightly
+          rustup default nightly
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz
+      - name: Run fuzzing
+        run: |
+          cargo fuzz run fuzz_aead_enc_into -- -max_total_time=5
+          cargo fuzz run fuzz_blake2b -- -max_total_time=5
+          cargo fuzz run fuzz_handle_msg -- -max_total_time=5
+          ulimit -s 8192000 && RUST_MIN_STACK=33554432000 && cargo fuzz run fuzz_kyber_encaps -- -max_total_time=5
+          cargo fuzz run fuzz_mceliece_encaps -- -max_total_time=5
+          cargo fuzz run fuzz_box_secret_alloc -- -max_total_time=5
+          cargo fuzz run fuzz_vec_secret_alloc -- -max_total_time=5

.github/workflows/release.yaml

@@ -12,7 +12,7 @@ jobs:
       - ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -30,10 +30,10 @@ jobs:
   x86_64-darwin---release:
     name: Build release artifacts for x86_64-darwin
     runs-on:
-      - macos-latest
+      - macos-13
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -54,7 +54,7 @@ jobs:
       - ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v22
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12

.gitlab-ci.yml

@@ -0,0 +1,17 @@
+# TODO use CI_JOB_TOKEN once https://gitlab.com/groups/gitlab-org/-/epics/6310 is fixed
+pull-from-gh:
+  only: ["schedules"]
+  variables:
+    REMOTE: "https://github.com/rosenpass/rosenpass.git"
+    LOCAL: " git@gitlab.com:rosenpass/rosenpass.git"
+    GIT_STRATEGY: none
+  before_script:
+    - mkdir ~/.ssh/
+    - echo "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
+    - echo "$REPO_SSH_KEY" > ~/.ssh/id_ed25519
+    - chmod 600 --recursive ~/.ssh/
+    - git config --global user.email "ci@gitlab.com"
+    - git config --global user.name "CI"
+  script:
+    - git clone --mirror $REMOTE rosenpass
+    - cd rosenpass && git push --mirror $LOCAL

Cargo.toml

@@ -1,40 +1,61 @@
-[package]
-name = "rosenpass"
-version = "0.1.2-rc.4"
-authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
-edition = "2021"
-license = "MIT OR Apache-2.0"
-description = "Build post-quantum-secure VPNs with WireGuard!"
-homepage = "https://rosenpass.eu/"
-repository = "https://github.com/rosenpass/rosenpass"
-readme = "readme.md"
+[workspace]
+resolver = "2"
 
-[[bench]]
-name = "handshake"
-harness = false
+members = [
+    "rosenpass",
+    "cipher-traits",
+    "ciphers",
+    "util",
+    "constant-time",
+    "oqs",
+    "to",
+    "fuzz",
+    "secret-memory",
+]
 
-[dependencies]
-base64 = "0.21.1"
-static_assertions = "1.1.0"
-memoffset = "0.9.0"
-libsodium-sys-stable = { version = "1.19.28", features = ["use-pkg-config"] }
-oqs-sys = { version = "0.7.2", default-features = false, features = ['classic_mceliece', 'kyber'] }
-lazy_static = "1.4.0"
-thiserror = "1.0.40"
-paste = "1.0.12"
-log = { version = "0.4.17", optional = true }
-env_logger = { version = "0.10.0", optional = true }
-serde = { version = "1.0.163", features = ["derive"] }
-toml = "0.7.4"
-clap = { version = "4.3.0", features = ["derive"] }
-mio = { version = "0.8.6", features = ["net", "os-poll"] }
+default-members = [
+    "rosenpass"
+]
 
-[build-dependencies]
-anyhow = "1.0.71"
+[workspace.metadata.release]
+# ensure that adding `--package` as argument to `cargo release` still creates version tags in the form of `vx.y.z`
+tag-prefix = ""
 
-[dev-dependencies]
+[workspace.dependencies]
+rosenpass = { path = "rosenpass" }
+rosenpass-util = { path = "util" }
+rosenpass-constant-time = { path = "constant-time" }
+rosenpass-cipher-traits = { path = "cipher-traits" }
+rosenpass-ciphers = { path = "ciphers" }
+rosenpass-to = { path = "to" }
+rosenpass-secret-memory = { path = "secret-memory" }
+rosenpass-oqs = { path = "oqs" }
 criterion = "0.4.0"
 test_bin = "0.4.0"
-
-[features]
-default = ["log", "env_logger"]
+libfuzzer-sys = "0.4"
+stacker = "0.1.15"
+doc-comment = "0.3.3"
+base64 = "0.21.5"
+zeroize = "1.7.0"
+memoffset = "0.9.0"
+thiserror = "1.0.50"
+paste = "1.0.14"
+env_logger = "0.10.1"
+toml = "0.7.8"
+static_assertions = "1.1.0"
+allocator-api2 = "0.2.14"
+allocator-api2-tests = "0.2.14"
+memsec = "0.6.3"
+rand = "0.8.5"
+typenum = "1.17.0"
+log = { version = "0.4.20" }
+clap = { version = "4.4.10", features = ["derive"] }
+serde = { version = "1.0.193", features = ["derive"] }
+arbitrary = { version = "1.3.2", features = ["derive"] }
+anyhow = { version = "1.0.75", features = ["backtrace", "std"] }
+mio = { version = "0.8.9", features = ["net", "os-poll"] }
+oqs-sys = { version = "0.8", default-features = false, features = ['classic_mceliece', 'kyber']  }
+blake2 = "0.10.6"
+chacha20poly1305 = { version = "0.10.1", default-features = false, features = [ "std", "heapless" ] }
+zerocopy = { version = "0.7.32", features = ["derive"] }
+home = "0.5.9"

analysis/01_secrecy.entry.mpv

@@ -3,12 +3,33 @@
 #define SESSION_START_EVENTS 0
 #define RANDOMIZED_CALL_IDS 0
 
+
 #include "config.mpv"
 #include "prelude/basic.mpv"
 #include "crypto/key.mpv"
 #include "crypto/kem.mpv"
+
 #include "rosenpass/oracles.mpv"
 
+nounif v:seed_prec;   attacker(prepare_seed(trusted_seed( v )))/6217[hypothesis].
+nounif v:seed;        attacker(prepare_seed( v ))/6216[hypothesis].
+nounif v:seed;        attacker(rng_kem_sk( v ))/6215[hypothesis].
+nounif v:seed;        attacker(rng_key( v ))/6214[hypothesis].
+nounif v:key_prec;    attacker(prepare_key(trusted_key( v )))/6213[hypothesis].
+nounif v:kem_sk_prec; attacker(prepare_kem_sk(trusted_kem_sk( v )))/6212[hypothesis].
+nounif v:key;         attacker(prepare_key( v ))/6211[hypothesis].
+nounif v:kem_sk;      attacker(prepare_kem_sk( v ))/6210[hypothesis].
+nounif Spk:kem_sk_tmpl;
+  attacker(Creveal_kem_pk(Spk))/6110[conclusion].
+nounif sid:SessionId, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Seski:seed_tmpl, Ssptr:seed_tmpl;
+  attacker(Cinitiator( *sid, *Ssskm, *Spsk, *Sspkt, *Seski, *Ssptr ))/6109[conclusion].
+nounif sid:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Septi:seed_tmpl, Sspti:seed_tmpl, ih:InitHello_t;
+  attacker(Cinit_hello( *sid, *biscuit_no, *Ssskm, *Spsk, *Sspkt, *Septi, *Sspti, *ih ))/6108[conclusion].
+nounif rh:RespHello_t;
+  attacker(Cresp_hello( *rh ))/6107[conclusion].
+nounif Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:InitConf_t;
+  attacker(Cinit_conf( *Ssskm, *Spsk, *Sspkt, *ic ))/6106[conclusion].
+
 let main = rosenpass_main.
 
 @lemma "state coherence, initiator: Initiator accepting a RespHello message implies they also generated the associated InitHello message"

analysis/02_availability.entry.mpv

@@ -10,6 +10,26 @@
 
 let main = rosenpass_main.
 
+nounif v:seed_prec;   attacker(prepare_seed(trusted_seed( v )))/6217[hypothesis].
+nounif v:seed;        attacker(prepare_seed( v ))/6216[hypothesis].
+nounif v:seed;        attacker(rng_kem_sk( v ))/6215[hypothesis].
+nounif v:seed;        attacker(rng_key( v ))/6214[hypothesis].
+nounif v:key_prec;    attacker(prepare_key(trusted_key( v )))/6213[hypothesis].
+nounif v:kem_sk_prec; attacker(prepare_kem_sk(trusted_kem_sk( v )))/6212[hypothesis].
+nounif v:key;         attacker(prepare_key( v ))/6211[hypothesis].
+nounif v:kem_sk;      attacker(prepare_kem_sk( v ))/6210[hypothesis].
+nounif Spk:kem_sk_tmpl;
+  attacker(Creveal_kem_pk(Spk))/6110[conclusion].
+nounif sid:SessionId, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Seski:seed_tmpl, Ssptr:seed_tmpl;
+  attacker(Cinitiator( *sid, *Ssskm, *Spsk, *Sspkt, *Seski, *Ssptr ))/6109[conclusion].
+nounif sid:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Septi:seed_tmpl, Sspti:seed_tmpl, ih:InitHello_t;
+  attacker(Cinit_hello( *sid, *biscuit_no, *Ssskm, *Spsk, *Sspkt, *Septi, *Sspti, *ih ))/6108[conclusion].
+nounif rh:RespHello_t;
+  attacker(Cresp_hello( *rh ))/6107[conclusion].
+nounif Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:InitConf_t;
+  attacker(Cinit_conf( *Ssskm, *Spsk, *Sspkt, *ic ))/6106[conclusion].
+
+
 @lemma "non-interruptability: Adv cannot prevent a genuine InitHello message from being accepted"
 lemma ih:InitHello_t, psk:key, sski:kem_sk, sskr:kem_sk;
   event(IHRjct(ih, psk, sskr, kem_pub(sski)))

analysis/03_identity_hiding_initiator.entry.mpv

@@ -0,0 +1,25 @@
+#define INITIATOR_TEST 1
+
+#include "rosenpass/03_identity_hiding.mpv"
+
+// nounif a:Atom, s:seed, a2:Atom;
+// 	ConsumeSeed(a, s, a2) / 6300[conclusion].
+
+nounif v:seed_prec;   attacker(prepare_seed(trusted_seed( v )))/6217[hypothesis].
+nounif v:seed;        attacker(prepare_seed( v ))/6216[hypothesis].
+nounif v:seed;        attacker(rng_kem_sk( v ))/6215[hypothesis].
+nounif v:seed;        attacker(rng_key( v ))/6214[hypothesis].
+nounif v:key_prec;    attacker(prepare_key(trusted_key( v )))/6213[hypothesis].
+nounif v:kem_sk_prec; attacker(prepare_kem_sk(trusted_kem_sk( v )))/6212[hypothesis].
+nounif v:key;         attacker(prepare_key( v ))/6211[hypothesis].
+nounif v:kem_sk;      attacker(prepare_kem_sk( v ))/6210[hypothesis].
+nounif Spk:kem_sk_tmpl;
+  attacker(Creveal_kem_pk(Spk))/6110[conclusion].
+nounif sid:SessionId, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Seski:seed_tmpl, Ssptr:seed_tmpl;
+  attacker(Cinitiator( *sid, *Ssskm, *Spsk, *Sspkt, *Seski, *Ssptr ))/6109[conclusion].
+nounif sid:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Septi:seed_tmpl, Sspti:seed_tmpl, ih:InitHello_t;
+  attacker(Cinit_hello( *sid, *biscuit_no, *Ssskm, *Spsk, *Sspkt, *Septi, *Sspti, *ih ))/6108[conclusion].
+nounif rh:RespHello_t;
+  attacker(Cresp_hello( *rh ))/6107[conclusion].
+nounif Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:InitConf_t;
+  attacker(Cinit_conf( *Ssskm, *Spsk, *Sspkt, *ic ))/6106[conclusion].

analysis/03_identity_hiding_responder.entry.mpv

@@ -0,0 +1,96 @@
+#define RESPONDER_TEST 1
+
+#include "rosenpass/03_identity_hiding.mpv"
+
+// select k:kem_pk,ih: InitHello_t;         attacker(prf(prf(prf(prf(key0, PROTOCOL), MAC), kem_pk2b(k) ), IH2b(ih))) phase 1/6300[hypothesis].
+
+// select epki:kem_pk, sctr:bits, pidiC:bits, auth:bits, epki2:kem_pk, sctr2:bits, pidiC2:bits, auth2:bits;
+// 	mess(D, prf(prf(prf(prf(key0,PROTOCOL),MAC),kem_pk2b(kem_pub(trusted_kem_sk(responder1)))),
+// 			IH2b(InitHello(secure_sidi, *epki, *sctr, *pidiC, *auth)))
+// 		) [hypothesis, conclusion].
+
+// select epki:kem_pk, sctr:bits, pidiC:bits, auth:bits, epki2:kem_pk, sctr2:bits, pidiC2:bits, auth2:bits;
+// attacker(choice[prf(prf(prf(prf(key0,PROTOCOL),MAC),kem_pk2b(kem_pub(trusted_kem_sk(responder1)))),
+// 		IH2b(InitHello(secure_sidi, *epki, *sctr, *pidiC, *auth))),
+
+// 		prf(prf(prf(prf(key0,PROTOCOL),MAC),kem_pk2b(kem_pub(trusted_kem_sk(responder2)))),
+// 				IH2b(InitHello(secure_sidi, *epki2, *sctr2, *pidiC2, *auth2)))]
+// 	) [hypothesis, conclusion].
+
+// select 
+// attacker(prf(prf(key0,PROTOCOL),MAC)) [hypothesis, conclusion].
+
+// select 
+// attacker(prf(key0,PROTOCOL)) [conclusion].
+
+// select  
+// attacker(key0) [conclusion].
+
+// select  
+// attacker(PROTOCOL) [conclusion].
+
+// select 
+// attacker(kem_pub(trusted_kem_sk(responder1))) /9999 [hypothesis, conclusion].
+
+// select 
+// attacker(kem_pub(trusted_kem_sk(responder2))) /9999 [hypothesis, conclusion].
+
+// nounif ih:InitHello_t;
+// 	attacker(ih) / 9999 [hypothesis].
+
+// nounif rh:RespHello_t;
+// 	attacker(rh) / 9999 [hypothesis].
+
+// nounif ic:InitConf_t;
+// 	attacker(ic) / 9999 [hypothesis].
+
+// nounif k:key;
+// attacker(ck_hs_enc( *k )) [hypothesis, conclusion].
+
+// nounif k:key;
+// attacker(ck_hs_enc( *k )) phase 1   [hypothesis, conclusion].
+
+// nounif k:key, b:bits;
+// attacker(ck_mix( *k , *b ))   [hypothesis, conclusion].
+
+// nounif k:key, b:bits;
+// attacker(ck_mix( *k , *b ))phase 1   [hypothesis, conclusion].
+
+// // select k:kem_pk, epki2:kem_pk, sctr2:bits, pidiC2:bits, auth2:bits, epki:kem_pk, sctr:bits, pidiC:bits, auth:bits;
+// // attacker(choice[Envelope(prf(prf(prf(prf(key0,PROTOCOL),MAC),kem_pub(trusted_kem_sk(responder1))),
+// // 	InitHello(secure_sidi, *epki2, *sctr2, *pidiC2, *auth2)
+// // 	), InitHello(secure_sidi, *epki2, *sctr2, *pidiC2, *auth2))
+// // 	Envelope(prf(prf(prf(prf(key0,PROTOCOL),MAC),kem_pub(trusted_kem_sk(responder2))),
+// // 		InitHello(secure_sidi, *epki, *sctr, *pidiC, *auth)),
+// // 		InitHello(secure_sidi, *epki, *sctr, *pidiC, *auth))
+// // 	]) / 9999[hypothesis, conclusion].
+
+// nounif k:key, b1:bits, b2:bits;
+// 	attacker(xaead_enc( *k, *b1, *b2)) / 9999[hypothesis,conclusion].
+
+// nounif pk:kem_pk, k:key; 
+// 	attacker(kem_enc( *pk , *k )) / 9999[hypothesis,conclusion].
+
+// nounif sid:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Septi:seed_tmpl, Sspti:seed_tmpl, ih:InitHello_t;
+//   attacker(Cinit_hello( *sid, *biscuit_no, *Ssskm, *Spsk, *Sspkt, *Septi, *Sspti, *ih ))/9999[hypothesis, conclusion].
+// nounif Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:InitConf_t;
+//   attacker(Cinit_conf( *Ssskm, *Spsk, *Sspkt, *ic ))/9999[hypothesis, conclusion].
+// nounif sid:SessionId, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Seski:seed_tmpl, Ssptr:seed_tmpl;
+//   attacker(Cinitiator( *sid, *Ssskm, *Spsk, *Sspkt, *Seski, *Ssptr )) /9999 [hypothesis, conclusion].
+
+// nounif sid:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Septi:seed_tmpl, Sspti:seed_tmpl, ih:InitHello_t;
+//   mess(C, Cinit_hello( *sid, *biscuit_no, *Ssskm, *Spsk, *Sspkt, *Septi, *Sspti, *ih ))/9999[hypothesis, conclusion].
+// nounif Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:InitConf_t;
+//   mess(C, Cinit_conf( *Ssskm, *Spsk, *Sspkt, *ic ))/9999[hypothesis, conclusion].
+// nounif sid:SessionId, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Seski:seed_tmpl, Ssptr:seed_tmpl;
+//   mess(C, Cinitiator( *sid, *Ssskm, *Spsk, *Sspkt, *Seski, *Ssptr )) /9999 [hypothesis, conclusion].
+// nounif rh:RespHello_t;
+//   attacker(Cresp_hello( *rh ))[conclusion].
+// nounif v:seed_prec;   attacker(prepare_seed(trusted_seed( v )))/6217[hypothesis].
+// nounif v:seed;        attacker(prepare_seed( v ))/6216[hypothesis].
+// nounif v:seed;        attacker(rng_kem_sk( v ))/6215[hypothesis].
+// nounif v:seed;        attacker(rng_key( v ))/6214[hypothesis].
+// nounif v:key_prec;    attacker(prepare_key(trusted_key( v )))/6213[hypothesis].
+// nounif v:kem_sk_prec; attacker(prepare_kem_sk(trusted_kem_sk( v )))/6212[hypothesis].
+// nounif v:key;         attacker(prepare_key( v ))/6211[hypothesis].
+// nounif v:kem_sk;      attacker(prepare_kem_sk( v ))/6210[hypothesis].

analysis/03_identity_hiding_test.entry.mpv

@@ -0,0 +1,29 @@
+#define INITIATOR_TEST 1
+#define CUSTOM_MAIN 1
+
+#include "rosenpass/03_identity_hiding.mpv"
+
+let Oinitiator_bad_actor_inner(sk_tmp:kem_sk_prec) =
+
+  in(C, Cinitiator(sidi, Ssskm, Spsk, Sspkt, Seski, Ssptr));
+
+  #if RANDOMIZED_CALL_IDS
+    new call:Atom;
+  #else
+    call <- Cinitiator(sidi, Ssskm, Spsk, Sspkt, Seski, Ssptr);
+  #endif
+
+  in(C, last_cookie:key);
+  tmpl <- make_trusted_kem_sk(sk_tmp);
+  out(C, setup_kem_sk(tmpl));
+  Oinitiator_inner(sidi, Ssskm, Spsk, tmpl, Seski, Ssptr, last_cookie, C, call).
+
+let Oinitiator_bad_actor() =
+  Oinitiator_bad_actor_inner(responder1) | Oinitiator_bad_actor_inner(responder2) | Oinitiator_bad_actor_inner(initiator1) | Oinitiator_bad_actor_inner(initiator2).
+
+
+let identity_hiding_main2() = 
+  0 | Oinitiator_bad_actor() | rosenpass_main2() | participants_communication() | phase 1; secretCommunication().
+
+
+let main = identity_hiding_main2.

analysis/04_dos_protection.entry.mpv

@@ -0,0 +1,136 @@
+#define CHAINING_KEY_EVENTS 1
+#define MESSAGE_TRANSMISSION_EVENTS 0
+#define SESSION_START_EVENTS 0
+#define RANDOMIZED_CALL_IDS 0
+#define COOKIE_EVENTS 1
+#define KEM_EVENTS 1
+
+#include "config.mpv"
+#include "prelude/basic.mpv"
+#include "crypto/key.mpv"
+#include "crypto/kem.mpv"
+#include "rosenpass/handshake_state.mpv"
+
+/* The cookie data structure is implemented based on the WireGuard protocol.
+ * The ip and port is based purely on the public key and the implementation of the private cookie key is intended to mirror the biscuit key.
+ * The code tests the response to a possible DOS attack by setting up alternative branches for the protocol
+ * processes: Oinit_conf, Oinit_hello and resp_hello to simulate what happens when the responder or initiator is overloaded.
+ * When under heavy load a valid cookie is required. When such a cookie is not present a cookie message is sent as a response.
+ * Queries then test to make sure that expensive KEM operations are only conducted after a cookie has been successfully validated.
+ */
+
+type CookieMsg_t.
+fun CookieMsg(
+  SessionId,  // sender
+  bits,     // nonce
+  bits      // cookie
+) : CookieMsg_t [data].
+
+#define COOKIE_EVENTS(eventLbl) \
+  COOKIE_EV(event MCAT(eventLbl, _UnderLoadEV) (SessionId, SessionId, Atom).)   \
+  COOKIE_EV(event MCAT(eventLbl, _CookieValidated) (SessionId, SessionId, Atom).)   \
+  COOKIE_EV(event MCAT(eventLbl, _CookieSent) (SessionId, SessionId, Atom, CookieMsg_t).)
+
+fun cookie_key(kem_sk) : key [private].
+fun ip_and_port(kem_pk):bits.
+letfun create_mac2_key(sskm:kem_sk, spkt:kem_pk) = prf(cookie_key(sskm), ip_and_port(spkt)).
+letfun create_cookie(sskm:kem_sk, spkm:kem_pk, spkt:kem_pk, nonce:bits, msg:bits) = xaead_enc(lprf2(COOKIE, kem_pk2b(spkm), nonce),
+    k2b(create_mac2_key(sskm, spkm)), msg).
+
+#define COOKIE_PROCESS(eventLbl, innerFunc) \
+  new nonce:bits; \
+  in(C, Ccookie(mac1, mac2)); \
+  COOKIE_EV(event MCAT(eventLbl, _UnderLoadEV) (sidi, sidr, call);)  \
+  msgB <- Envelope(mac1, msg); \
+  mac2_key <- create_mac2_key(sskm, spkt); \
+  if k2b(create_mac2(mac2_key, msgB)) = mac2 then  \
+    COOKIE_EV(event MCAT(eventLbl, _CookieValidated) (sidi, sidr, call);)  \
+    innerFunc \
+  else \
+    cookie <- create_cookie(sskm, spkm, spkt, nonce, msg); \
+    cookie_msg <- CookieMsg(sidi, nonce, cookie); \
+    COOKIE_EV(event MCAT(eventLbl, _CookieSent) (sidi, sidr, call, cookie_msg);)  \
+    out(C, cookie_msg). \
+
+#include "rosenpass/oracles.mpv"
+
+#include "rosenpass/responder.macro"
+COOKIE_EVENTS(Oinit_conf)
+let Oinit_conf_underLoad() =
+  in(C, Cinit_conf(Ssskm, Spsk, Sspkt, ic));
+  in(C, last_cookie:bits);
+
+  msg <- IC2b(ic);
+  let InitConf(sidi, sidr, biscuit, auth) = ic in 
+
+  new call:Atom;
+
+  SETUP_HANDSHAKE_STATE()
+
+  COOKIE_PROCESS(Oinit_conf, Oinit_conf_inner(Ssskm, Spsk, Sspkt, ic, call))
+
+#include "rosenpass/responder.macro"
+COOKIE_EVENTS(Oinit_hello)
+let Oinit_hello_underLoad() =
+
+  in(C, Cinit_hello(sidr, biscuit_no, Ssskm, Spsk, Sspkt, Septi, Sspti, ih));
+  in(C, Oinit_hello_last_cookie:key);
+  new call:Atom;
+
+  msg <- IH2b(ih);
+  let InitHello(sidi, epki, sctr, pidic, auth) = ih in
+  SETUP_HANDSHAKE_STATE()
+
+  COOKIE_PROCESS(Oinit_hello, Oinit_hello_inner(sidr, biscuit_no, Ssskm, Spsk, Sspkt, Septi, Sspti, ih, Oinit_hello_last_cookie, C, call))
+
+let rosenpass_dos_main() = 0
+  | !Oreveal_kem_pk
+  | REP(INITIATOR_BOUND, Oinitiator)
+  | REP(RESPONDER_BOUND, Oinit_hello)
+  | REP(RESPONDER_BOUND, Oinit_conf)
+  | REP(RESPONDER_BOUND, Oinit_hello_underLoad)
+  | REP(RESPONDER_BOUND, Oinit_conf_underLoad).
+
+let main = rosenpass_dos_main.
+
+select cookie:CookieMsg_t;         attacker(cookie)/6220[hypothesis].
+nounif v:key;         attacker(prepare_key( v ))/6217[hypothesis].
+nounif v:seed;        attacker(prepare_seed( v ))/6216[hypothesis].
+nounif v:seed;        attacker(prepare_seed( v ))/6216[hypothesis].
+nounif v:seed;        attacker(rng_kem_sk( v ))/6215[hypothesis].
+nounif v:seed;        attacker(rng_key( v ))/6214[hypothesis].
+nounif v:kem_sk;      attacker(prepare_kem_sk( v ))/6210[hypothesis].
+
+// nounif Spk:kem_sk_tmpl;
+//   attacker(Creveal_kem_pk(Spk))/6110[conclusion].
+// nounif sid:SessionId, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Seski:seed_tmpl, Ssptr:seed_tmpl;
+//   attacker(Cinitiator( *sid, *Ssskm, *Spsk, *Sspkt, *Seski, *Ssptr ))/6109[conclusion].
+// nounif sid:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Septi:seed_tmpl, Sspti:seed_tmpl, ih:InitHello_t;
+//   attacker(Cinit_hello( *sid, *biscuit_no, *Ssskm, *Spsk, *Sspkt, *Septi, *Sspti, *ih ))/6108[conclusion].
+nounif rh:RespHello_t;
+  attacker(Cresp_hello( *rh ))/6107[conclusion].
+nounif Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:InitConf_t;
+  attacker(Cinit_conf( *Ssskm, *Spsk, *Sspkt, *ic ))/6106[conclusion].
+
+@reachable "DOS protection: cookie sent"
+query sidi:SessionId, sidr:SessionId, call:Atom, cookieMsg:CookieMsg_t;
+  event (Oinit_hello_CookieSent(sidi, sidr, call, cookieMsg)).
+
+@lemma "DOS protection: Oinit_hello kem use when under load implies validated cookie"
+lemma sidi:SessionId, sidr:SessionId, call:Atom;
+event(Oinit_hello_UnderLoadEV(sidi, sidr, call))
+  && event(Oinit_hello_KemUse(sidi, sidr, call))
+  ==> event(Oinit_hello_CookieValidated(sidi, sidr, call)).
+
+@lemma "DOS protection: Oinit_conf kem use when under load implies validated cookie"
+lemma sidi:SessionId, sidr:SessionId, call:Atom;
+event(Oinit_conf_UnderLoadEV(sidi, sidr, call))
+  && event(Oinit_conf_KemUse(sidi, sidr, call))
+  ==> event(Oinit_conf_CookieValidated(sidi, sidr, call)).
+
+@lemma "DOS protection: Oresp_hello kem use when under load implies validated cookie"
+lemma sidi:SessionId, sidr:SessionId, call:Atom;
+event(Oresp_hello_UnderLoadEV(sidi, sidr, call))
+  && event(Oresp_hello_KemUse(sidi, sidr, call))
+  ==> event(Oresp_hello_CookieValidated(sidi, sidr, call)).
+

analysis/config.mpv

@@ -88,6 +88,18 @@ set verboseCompleted=VERBOSE.
 #define SES_EV(...)
 #endif
 
+#if COOKIE_EVENTS
+#define COOKIE_EV(...) __VA_ARGS__
+#else
+#define COOKIE_EV(...)
+#endif
+
+#if KEM_EVENTS
+#define KEM_EV(...) __VA_ARGS__
+#else
+#define KEM_EV(...)
+#endif
+
 
 (* TODO: Authentication timing properties *)
 (* TODO: Proof that every adversary submitted package is equivalent to one generated by the proper algorithm using different coins. This probably requires introducing an oracle that extracts the coins used and explicitly adding the notion of coins used for Packet->Packet steps and an inductive RNG notion. *)

analysis/rosenpass/03_identity_hiding.mpv

@@ -0,0 +1,155 @@
+/*
+  This identity hiding process tests whether the rosenpass protocol is able to protect the identity of an initiator or responder.
+  The participants in the test are trusted initiators, trusted responders and compromised initiators and responders.
+  The test consists of two phases. In the first phase all of the participants can communicate with each other using the rosenpass protocol.
+  An attacker observes the first phase and is able to intercept and modify messages and choose participants to communicate with each other
+
+  In the second phase if the anonymity of an initiator is being tested then one of two trusted initiators is chosen.
+  The chosen initiator communicates directly with a trusted responder.
+  If an attacker can determine which initiator was chosen then the anonymity of the initiator has been compromised.
+  Otherwise the protocol has successfully protected the initiators’ identity.
+
+  If the anonymity of a responder is being tested then one of two trusted responders is chosen instead.
+  Then an initiator communicates directly with the chosen responder.
+  If an attacker can determine which responder was chosen then the anonymity of the responder is compromised.
+  Otherwise the protocol successfully protects the identity of a responder.
+
+  The Proverif code treats the public key as synonymous with identity.
+  In the above test when a responder or initiator is chosen what is actually chosen is the public/private key pair to use for communication.
+  Traditionally when a responder or initiator is chosen they would be chosen randomly.
+  The way Proverif makes a "choice" is by simulating multiple processes, one process per choice
+  Then the processes are compared and if an association between a public key and a process can be made the test fails.
+  As the choice is at least as bad as choosing the worst possible option the credibility of the test is maintained.
+  The drawback is that Proverif is only able to tell if the identity can be brute forced but misses any probabilistic associations.
+  As usual Proverif also assumes perfect encryption and in particular assumes encryption cannot be linked to identity.
+
+  One of the tradeoffs made here is that the choice function in Proverif is slow but this is in favour of being able to write more precise tests.
+  Another issue is the choice function does not work with queries so a test needs to be run for each set of assumptions.
+  In this case the test uses secure rng and a fresh secure biscuit key.
+*/
+
+#include "config.mpv"
+
+#define CHAINING_KEY_EVENTS 1
+#define MESSAGE_TRANSMISSION_EVENTS 1
+#define SESSION_START_EVENTS 0
+#define RANDOMIZED_CALL_IDS 0
+#undef FULL_MODEL
+#undef SIMPLE_MODEL
+#define SIMPLE_MODEL 1
+
+#include "prelude/basic.mpv"
+#include "crypto/key.mpv"
+#include "rosenpass/oracles.mpv"
+#include "crypto/kem.mpv"
+
+#define NEW_TRUSTED_SEED(name)            \
+  new MCAT(name, _secret_seed):seed_prec; \
+  name <- make_trusted_seed(MCAT(name, _secret_seed)); \
+
+free D:channel [private].
+free secure_biscuit_no:Atom [private].
+free secure_sidi,secure_sidr:SessionId [private].
+free secure_psk:key [private].
+free initiator1, initiator2:kem_sk_prec.
+free responder1, responder2:kem_sk_prec.
+
+let secure_init_hello(initiator: kem_sk_tmpl, sidi : SessionId, psk: key_tmpl, responder: kem_sk_tmpl) =
+
+  new epkit:kem_pk;    // epki
+  new sctrt:bits;      // sctr 
+  new pidiCt:bits;      // pidiC
+  new autht:bits;       // auth
+
+  NEW_TRUSTED_SEED(seski_trusted_seed)
+  NEW_TRUSTED_SEED(ssptr_trusted_seed)
+  new last_cookie:key;
+  new call:Atom;
+
+  Oinitiator_inner(sidi, initiator, psk, responder, seski_trusted_seed, ssptr_trusted_seed, last_cookie, D, call).
+
+let secure_resp_hello(initiator: kem_sk_tmpl, responder: kem_sk_tmpl, sidi:SessionId, sidr:SessionId, biscuit_no:Atom, psk:key_tmpl) =
+
+  in(D, InitHello(=secure_sidi, epki, sctr, pidiC, auth));
+
+  ih <- InitHello(sidi, epki, sctr, pidiC, auth);
+  NEW_TRUSTED_SEED(septi_trusted_seed)
+  NEW_TRUSTED_SEED(sspti_trusted_seed)
+  new last_cookie:key;
+  new call:Atom;
+
+  Oinit_hello_inner(sidr, biscuit_no, responder, psk, initiator, septi_trusted_seed, sspti_trusted_seed, ih, last_cookie, D, call).
+
+let secure_init_conf(initiator: kem_sk_tmpl, responder: kem_sk_tmpl, psk:key_tmpl, sidi:SessionId, sidr:SessionId) =
+  in(D,  InitConf(=sidi, =sidr, biscuit, auth3));
+  ic <- InitConf(sidi,sidr,biscuit, auth3);
+  NEW_TRUSTED_SEED(seski_trusted_seed)
+  NEW_TRUSTED_SEED(ssptr_trusted_seed)
+  new last_cookie:key;
+  call <- Cinit_conf(initiator, psk, responder, ic);
+
+  Oinit_conf_inner(initiator, psk, responder, ic, call).
+
+let secure_communication(initiator: kem_sk_tmpl, responder:kem_sk_tmpl, key:key) =
+  key_tmpl <- prepare_key(key);
+  (!secure_init_hello(initiator, secure_sidi, key_tmpl, responder))
+  | !secure_resp_hello(initiator, responder, secure_sidi, secure_sidr, secure_biscuit_no, key_tmpl)
+  | !(secure_init_conf(initiator, responder, key_tmpl, secure_sidi, secure_sidr)).
+
+let participant_communication_initiator(participant:kem_sk_tmpl) =
+  in(C, responder:kem_sk_tmpl);
+  in(C, k:key);
+  secure_communication(participant, responder, k).
+
+let participant_communication_responder(participant:kem_sk_tmpl) =
+  in(C, initiator:kem_sk_tmpl);
+  in(C, k:key);
+  secure_communication(initiator, participant, k).
+
+let participants_communication() =
+  initiator1_tmpl <- make_trusted_kem_sk(initiator1);
+  initiator2_tmpl <- make_trusted_kem_sk(initiator2);
+  responder1_tmpl <- make_trusted_kem_sk(responder1);
+  responder2_tmpl <- make_trusted_kem_sk(responder2);
+
+  !participant_communication_initiator(initiator1_tmpl) | !participant_communication_responder(initiator1_tmpl)
+  | !participant_communication_initiator(initiator2_tmpl) | !participant_communication_responder(initiator2_tmpl)
+  | !participant_communication_initiator(responder1_tmpl) | !participant_communication_responder(responder1_tmpl)
+  | !participant_communication_initiator(responder2_tmpl) | !participant_communication_responder(responder2_tmpl).
+
+let pipeChannel(D:channel, C:channel) =
+  in(D, b:bits);
+  out(C, b).
+
+let secretCommunication() =
+
+#ifdef INITIATOR_TEST
+  initiator_seed <- choice[make_trusted_kem_sk(initiator1), make_trusted_kem_sk(initiator2)];
+#else
+  initiator_seed <- make_trusted_kem_sk(initiator1);
+#endif
+#ifdef RESPONDER_TEST
+  responder_seed <- choice[make_trusted_kem_sk(responder1), make_trusted_kem_sk(responder2)];
+#else
+  responder_seed <- make_trusted_kem_sk(responder1);
+#endif
+
+  secure_communication(initiator_seed, responder_seed, secure_psk) | !pipeChannel(D, C).
+
+let reveal_pks() =
+  out(C, setup_kem_pk(make_trusted_kem_sk(responder1)));
+  out(C, setup_kem_pk(make_trusted_kem_sk(responder2)));
+  out(C, setup_kem_pk(make_trusted_kem_sk(initiator1)));
+  out(C, setup_kem_pk(make_trusted_kem_sk(initiator2))).
+
+let rosenpass_main2() = 
+  REP(INITIATOR_BOUND, Oinitiator)
+  | REP(RESPONDER_BOUND, Oinit_hello)
+  | REP(RESPONDER_BOUND, Oinit_conf).
+
+let identity_hiding_main() = 
+  0 | reveal_pks() | rosenpass_main2() | participants_communication() | phase 1; secretCommunication().
+
+#ifndef CUSTOM_MAIN
+let main = identity_hiding_main.
+#endif 

analysis/rosenpass/cookie.mpv

@@ -0,0 +1,36 @@
+
+fun cookie_key(kem_sk) : key [private].
+fun ip_and_port(kem_pk):bits.
+letfun create_mac2_key(sskm:kem_sk, spkt:kem_pk) = prf(cookie_key(sskm), ip_and_port(spkt)).
+
+letfun create_cookie(sskm:kem_sk, spkm:kem_pk, spkt:kem_pk, nonce:bits, msg:bits) = xaead_enc(lprf2(COOKIE, kem_pk2b(spkm), nonce),
+    k2b(create_mac2_key(sskm, spkm)), msg).
+
+type CookieMsg_t.
+fun CookieMsg(
+  SessionId,	// sender
+  bits, 		// nonce
+  bits			// cookie
+) : CookieMsg_t [data].
+
+
+#define COOKIE_PROCESS(eventLbl, innerFunc)       \
+  in(C, Ccookie(mac1, mac2));	\
+  COOKIE_EV(event MCAT(eventLbl, _UnderLoadEV) (spkm, spkt, last_cookie);)	\
+  msgB <- Envelope(mac1, RH2b(rh));	\
+  mac2_key <- create_mac2_key(sskm, spkt)	\
+  let RespHello(sidi, sidr, ecti, scti, biscuit, auth) = rh in \
+  if Envelope(mac2_key, msgB) = mac2 then	\
+    COOKIE_EV(event MCAT(eventLbl, _CookieValidated) (spkm, last_cookie);)	\
+    innerFunc	\
+  else	\
+    new nonce:bits;	\
+    cookie <- create_cookie(sskm, spkm, spkt, nonce, msg)	\
+    cookie_msg <- CookieMsg(sidi, nonce, cookie);	\
+    COOKIE_EV(event MCAT(eventLbl, _CookieSent) (spkm, cookie, cookie_k, cookie_msg);)	\
+    out(C, cookie_msg).	
+
+#define COOKIE_EVENTS(eventLbl) \
+	COOKIE_EV(event MCAT(eventLbl, _UnderLoadEV) (kem_pk, kem_pk, bits).)		\
+	COOKIE_EV(event MCAT(eventLbl, _CookieValidated) (kem_pk, bits, key, CookieMsg_t).)		\
+	COOKIE_EV(event MCAT(eventLbl, _CookieSent) (kem_pk, bits).)		

analysis/rosenpass/oracles.mpv

@@ -41,23 +41,32 @@ restriction s:seed, p1:Atom, p2:Atom, ad1:Atom, ad2:Atom;
   event(ConsumeSeed(p1, s, ad1)) && event(ConsumeSeed(p2, s, ad2))
     ==> p1 = p2 && ad1 = ad2.
 
+letfun create_mac2(k:key, msg:bits) = prf(k,msg).
+
 #include "rosenpass/responder.macro"
 fun Cinit_conf(kem_sk_tmpl, key_tmpl, kem_pk_tmpl, InitConf_t) : Atom [data].
 CK_EV(  event OskOinit_conf(key, key). )
 MTX_EV( event ICRjct(InitConf_t, key, kem_sk, kem_pk). )
 SES_EV( event ResponderSession(InitConf_t, key). )
-event ConsumeBiscuit(Atom, kem_sk, kem_pk, Atom).
-let Oinit_conf() = 
-  in(C, Cinit_conf(Ssskm, Spsk, Sspkt, ic));
-#if RANDOMIZED_CALL_IDS
-  new call:Atom;
-#else
-  call <- Cinit_conf(Ssskm, Spsk, Sspkt, ic);
+KEM_EV(event Oinit_conf_KemUse(SessionId, SessionId, Atom).)
+#ifdef KEM_EVENTS
+  restriction sidi:SessionId, sidr:SessionId, ad1:Atom, ad2:Atom;
+    event(Oinit_conf_KemUse(sidi, sidr, ad1)) && event(Oinit_conf_KemUse(sidi, sidr, ad2))
+      ==> ad1 = ad2.
 #endif
+event ConsumeBiscuit(Atom, kem_sk, kem_pk, Atom).
+
+fun Ccookie(key, bits) : Atom[data].
+
+let Oinit_conf_inner(Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:InitConf_t, call:Atom) =
+
   SETUP_HANDSHAKE_STATE()
+
   eski <- kem_sk0;
   epki <- kem_pk0;
   let try_ = (
+    let InitConf(sidi, sidr, biscuit, auth) = ic in 
+    KEM_EV(event Oinit_conf_KemUse(sidi, sidr, call);)
     INITCONF_CONSUME()
     event ConsumeBiscuit(biscuit_no, sskm, spkt, call);
     CK_EV(  event OskOinit_conf(ck_rh, osk); )
@@ -72,11 +81,21 @@ let Oinit_conf() =
     0
 #endif
   ).
+  
+let Oinit_conf() = 
+
+  in(C, Cinit_conf(Ssskm, Spsk, Sspkt, ic));
+  #if RANDOMIZED_CALL_IDS
+    new call:Atom;
+  #else
+    call <- Cinit_conf(Ssskm, Spsk, Sspkt, ic);
+  #endif
+
+  Oinit_conf_inner(Ssskm, Spsk, Sspkt, ic, call).
 
 restriction biscuit_no:Atom, sskm:kem_sk, spkr:kem_pk, ad1:Atom, ad2:Atom;
   event(ConsumeBiscuit(biscuit_no, sskm, spkr, ad1)) && event(ConsumeBiscuit(biscuit_no, sskm, spkr, ad2))
     ==> ad1 = ad2.
-
 // TODO: Restriction biscuit no invalidation
 
 #include "rosenpass/initiator.macro"
@@ -85,27 +104,56 @@ CK_EV(  event OskOresp_hello(key, key, key). )
 MTX_EV( event RHRjct(RespHello_t, key, kem_sk, kem_pk). )
 MTX_EV( event ICSent(RespHello_t, InitConf_t, key, kem_sk, kem_pk). )
 SES_EV( event InitiatorSession(RespHello_t, key). )
-let Oresp_hello(HS_DECL_ARGS) =
-  in(C, Cresp_hello(RespHello(sidr, =sidi, ecti, scti, biscuit, auth)));
-  rh <- RespHello(sidr, sidi, ecti, scti, biscuit, auth);
-  /* try */ let ic = (
-    ck_ini <- ck;
-    RESPHELLO_CONSUME()
-    ck_ih <- ck;
-    INITCONF_PRODUCE()
-    CK_EV (event OskOresp_hello(ck_ini, ck_ih, osk); ) // TODO: Queries testing that there is no duplication
-    MTX_EV( event ICSent(rh, ic, psk, sski, spkr); )
-    SES_EV( event InitiatorSession(rh, osk); )
-    ic
-  /* success */ ) in (
-    out(C, ic)
-  /* fail */ ) else (
-#if MESSAGE_TRANSMISSION_EVENTS
-    event RHRjct(rh, psk, sski, spkr)
-#else
-    0
+
+KEM_EV(event Oresp_hello_KemUse(SessionId, SessionId, Atom).)
+#ifdef KEM_EVENTS
+restriction sidi:SessionId, sidr:SessionId, ad1:Atom, ad2:Atom;
+  event(Oresp_hello_KemUse(sidi, sidr, ad1)) && event(Oresp_hello_KemUse(sidi, sidr, ad2))
+    ==> ad1 = ad2.
+#endif
+
+#ifdef COOKIE_EVENTS
+COOKIE_EVENTS(Oresp_hello)
+#endif
+let Oresp_hello(HS_DECL_ARGS, C_in:channel, call:Atom) =
+  in(C_in, Cresp_hello(RespHello(sidr, =sidi, ecti, scti, biscuit, auth)));
+  in(C_in, mac2_key:key);
+  rh <- RespHello(sidr, sidi, ecti, scti, biscuit, auth);
+  #ifdef COOKIE_EVENTS
+    msg <- RH2b(rh);
+
+    COOKIE_PROCESS(Oresp_hello,
+  #endif
+    /* try */ let ic = (
+      ck_ini <- ck;
+      KEM_EV(event Oresp_hello_KemUse(sidi, sidr, call);)
+      RESPHELLO_CONSUME()
+      ck_ih <- ck;
+      INITCONF_PRODUCE()
+      CK_EV (event OskOresp_hello(ck_ini, ck_ih, osk); ) // TODO: Queries testing that there is no duplication
+      MTX_EV( event ICSent(rh, ic, psk, sski, spkr); )
+      SES_EV( event InitiatorSession(rh, osk); )
+      ic
+    /* success */ ) in (
+      icbits <- IC2b(ic);
+      mac <- create_mac(spkt, icbits);
+      mac2 <- create_mac2(mac2_key, mac_envelope2b(mac));
+      out(C_in, ic);
+      out(C_in, mac);
+      out(C_in, mac2)
+
+    /* fail */ ) else (
+  #if MESSAGE_TRANSMISSION_EVENTS
+      event RHRjct(rh, psk, sski, spkr)
+  #else
+      0
+  #endif
+    )
+#ifdef COOKIE_EVENTS
+  )
+#else
+  .
 #endif
-  ).
 
 // TODO: Restriction: Biscuit no invalidation
 
@@ -116,24 +164,33 @@ MTX_EV( event IHRjct(InitHello_t, key, kem_sk, kem_pk). )
 MTX_EV( event RHSent(InitHello_t, RespHello_t, key, kem_sk, kem_pk). )
 event ConsumeSidr(SessionId, Atom).
 event ConsumeBn(Atom, kem_sk, kem_pk, Atom).
-let Oinit_hello() = 
-  in(C, Cinit_hello(sidr, biscuit_no, Ssskm, Spsk, Sspkt, Septi, Sspti, ih));
-#if RANDOMIZED_CALL_IDS
-  new call:Atom;
-#else
-  call <- Cinit_hello(sidr, biscuit_no, Ssskm, Spsk, Sspkt, Septi, Sspti, ih);
+KEM_EV(event Oinit_hello_KemUse(SessionId, SessionId, Atom).)
+
+#ifdef KEM_EVENTS
+restriction sidi:SessionId, sidr:SessionId, ad1:Atom, ad2:Atom;
+  event(Oinit_hello_KemUse(sidi, sidr, ad1)) && event(Oinit_hello_KemUse(sidi, sidr, ad2))
+    ==> ad1 = ad2.
 #endif
+
+let Oinit_hello_inner(sidm:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt: kem_sk_tmpl, Septi: seed_tmpl, Sspti: seed_tmpl, ih: InitHello_t, mac2_key:key, C_out:channel, call:Atom) = 
   // TODO: This is ugly
   let InitHello(sidi, epki, sctr, pidiC, auth) = ih in
+
   SETUP_HANDSHAKE_STATE()
+
   eski <- kem_sk0;
-  epti <- rng_key(setup_seed(Septi)); // RHR4
-  spti <- rng_key(setup_seed(Sspti)); // RHR5
+
   event ConsumeBn(biscuit_no, sskm, spkt, call);
   event ConsumeSidr(sidr, call);
+
+  epti <- rng_key(setup_seed(Septi)); // RHR4
+  spti <- rng_key(setup_seed(Sspti)); // RHR5
   event ConsumeSeed(Epti, setup_seed(Septi), call);
   event ConsumeSeed(Spti, setup_seed(Sspti), call);
+  // out(C_out, spkt);
+
   let rh = (
+    KEM_EV(event Oinit_hello_KemUse(sidi, sidr, call);)
     INITHELLO_CONSUME()
     ck_ini <- ck;
     RESPHELLO_PRODUCE()
@@ -141,7 +198,14 @@ let Oinit_hello() =
     MTX_EV( event RHSent(ih, rh, psk, sskr, spki); )
     rh
   /* success */ ) in (
-    out(C, rh)
+    rhbits <- RH2b(rh);
+    mac <- create_mac(spkt, rhbits);
+    
+    out(C_out, rh);
+    out(C_out, mac);
+    mac2 <- create_mac2(mac2_key, mac_envelope2b(mac));
+    out(C_out, mac2)
+
   /* fail */ ) else (
 #if MESSAGE_TRANSMISSION_EVENTS
     event IHRjct(ih, psk, sskr, spki)
@@ -150,6 +214,18 @@ let Oinit_hello() =
 #endif
   ).
 
+let Oinit_hello() = 
+  in(C, Cinit_hello(sidr, biscuit_no, Ssskm, Spsk, Sspkt, Septi, Sspti, ih));
+  in(C, mac2_key:key);
+
+  #if RANDOMIZED_CALL_IDS
+    new call:Atom;
+  #else
+    call <- Cinit_hello(sidr, biscuit_no, Ssskm, Spsk, Sspkt, Septi, Sspti, ih);
+  #endif
+
+  Oinit_hello_inner(sidr, biscuit_no, Ssskm, Spsk, Sspkt, Septi, Sspti, ih, mac2_key, C, call).
+
 restriction sid:SessionId, ad1:Atom, ad2:Atom;
   event(ConsumeSidr(sid, ad1)) && event(ConsumeSidr(sid, ad2))
     ==> ad1 = ad2.
@@ -166,27 +242,55 @@ fun Cinitiator(SessionId, kem_sk_tmpl, key_tmpl, kem_pk_tmpl, seed_tmpl, seed_tm
 CK_EV( event OskOinitiator_ck(key). )
 CK_EV( event OskOinitiator(key, key, kem_sk, kem_pk, key). )
 MTX_EV( event IHSent(InitHello_t, key, kem_sk, kem_pk). )
-event ConsumeSidi(SessionId, Atom).
-let Oinitiator() =
-  in(C, Cinitiator(sidi, Ssskm, Spsk, Sspkt, Seski, Ssptr));
-#if RANDOMIZED_CALL_IDS
-  new call:Atom;
-#else
-  call <- Cinitiator(sidi, Ssskm, Spsk, Sspkt, Seski, Ssptr);
+KEM_EV(event Oinitiator_inner_KemUse(SessionId, SessionId, Atom).)
+
+#ifdef KEM_EVENTS
+restriction sidi:SessionId, sidr:SessionId, ad1:Atom, ad2:Atom;
+  event(Oinitiator_inner_KemUse(sidi, sidr, ad1)) && event(Oinitiator_inner_KemUse(sidi, sidr, ad2))
+    ==> ad1 = ad2.
 #endif
-  SETUP_HANDSHAKE_STATE()
-  RNG_KEM_PAIR(eski, epki, Seski) // IHI3
-  sidr <- sid0;
-  sptr <- rng_key(setup_seed(Ssptr)); // IHI5
-  event ConsumeSidi(sidi, call);
-  event ConsumeSeed(Sptr, setup_seed(Ssptr), call);
-  event ConsumeSeed(Eski, setup_seed(Seski), call);
-  INITHELLO_PRODUCE()
-  CK_EV( event OskOinitiator_ck(ck); ) 
-  CK_EV( event OskOinitiator(ck, psk, sski, spkr, sptr); )
-  MTX_EV( event IHSent(ih, psk, sski, spkr); )
-  out(C, ih);
-  Oresp_hello(HS_PASS_ARGS).
+event ConsumeSidi(SessionId, Atom).
+
+let Oinitiator_inner(sidi: SessionId, Ssskm: kem_sk_tmpl, Spsk: key_tmpl, Sspkt: kem_sk_tmpl, Seski: seed_tmpl, Ssptr: seed_tmpl, last_cookie:key, C_out:channel, call:Atom) =
+
+    SETUP_HANDSHAKE_STATE()
+    sidr <- sid0;
+
+    KEM_EV(event Oinitiator_inner_KemUse(sidi, sidr, call);)
+
+    RNG_KEM_PAIR(eski, epki, Seski) // IHI3
+    sptr <- rng_key(setup_seed(Ssptr)); // IHI5
+    event ConsumeSidi(sidi, call);
+    event ConsumeSeed(Sptr, setup_seed(Ssptr), call);
+    event ConsumeSeed(Eski, setup_seed(Seski), call);
+
+    INITHELLO_PRODUCE()
+    CK_EV( event OskOinitiator_ck(ck); ) 
+    CK_EV( event OskOinitiator(ck, psk, sski, spkr, sptr); )
+    MTX_EV( event IHSent(ih, psk, sski, spkr); )
+  
+    out(C_out, ih);
+    ihbits <- IH2b(ih);
+    mac <- create_mac(spkt, ihbits);
+    out(C_out, mac);
+    mac2 <- create_mac2(last_cookie, mac_envelope2b(mac));
+    out(C_out, mac2);
+
+    Oresp_hello(HS_PASS_ARGS, C_out, call).
+
+let Oinitiator() =
+
+  in(C, Cinitiator(sidi, Ssskm, Spsk, Sspkt, Seski, Ssptr));
+
+  #if RANDOMIZED_CALL_IDS
+    new call:Atom;
+  #else
+    call <- Cinitiator(sidi, Ssskm, Spsk, Sspkt, Seski, Ssptr);
+  #endif
+
+  in(C, last_cookie:key);
+  Oinitiator_inner(sidi, Ssskm, Spsk, Sspkt, Seski, Ssptr, last_cookie, C, call).
+
 
 restriction sid:SessionId, ad1:Atom, ad2:Atom;
   event(ConsumeSidi(sid, ad1)) && event(ConsumeSidi(sid, ad2))
@@ -207,21 +311,3 @@ let rosenpass_main() = 0
   | REP(RESPONDER_BOUND, Oinit_hello)
   | REP(RESPONDER_BOUND, Oinit_conf).
 
-nounif v:seed_prec;   attacker(prepare_seed(trusted_seed( v )))/6217[hypothesis].
-nounif v:seed;        attacker(prepare_seed( v ))/6216[hypothesis].
-nounif v:seed;        attacker(rng_kem_sk( v ))/6215[hypothesis].
-nounif v:seed;        attacker(rng_key( v ))/6214[hypothesis].
-nounif v:key_prec;    attacker(prepare_key(trusted_key( v )))/6213[hypothesis].
-nounif v:kem_sk_prec; attacker(prepare_kem_sk(trusted_kem_sk( v )))/6212[hypothesis].
-nounif v:key;         attacker(prepare_key( v ))/6211[hypothesis].
-nounif v:kem_sk;      attacker(prepare_kem_sk( v ))/6210[hypothesis].
-nounif Spk:kem_sk_tmpl;
-  attacker(Creveal_kem_pk(Spk))/6110[conclusion].
-nounif sid:SessionId, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Seski:seed_tmpl, Ssptr:seed_tmpl;
-  attacker(Cinitiator( *sid, *Ssskm, *Spsk, *Sspkt, *Seski, *Ssptr ))/6109[conclusion].
-nounif sid:SessionId, biscuit_no:Atom, Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, Septi:seed_tmpl, Sspti:seed_tmpl, ih:InitHello_t;
-  attacker(Cinit_hello( *sid, *biscuit_no, *Ssskm, *Spsk, *Sspkt, *Septi, *Sspti, *ih ))/6108[conclusion].
-nounif rh:RespHello_t;
-  attacker(Cresp_hello( *rh ))/6107[conclusion].
-nounif Ssskm:kem_sk_tmpl, Spsk:key_tmpl, Sspkt:kem_sk_tmpl, ic:InitConf_t;
-  attacker(Cinit_conf( *Ssskm, *Spsk, *Sspkt, *ic ))/6106[conclusion].

analysis/rosenpass/protocol.mpv

@@ -2,6 +2,26 @@
 #include "crypto/kem.mpv"
 #include "rosenpass/handshake_state.mpv"
 
+fun Envelope(
+  key,
+  bits
+): bits [data].
+
+type mac_envelope_t.
+fun mac_envelope(
+  key,
+  bits
+) : mac_envelope_t.
+
+fun mac_envelope2b(mac_envelope_t) : bits [typeConverter].
+
+letfun create_mac(pk:kem_pk, payload:bits) = mac_envelope(lprf2(MAC, kem_pk2b(pk), payload), payload).
+
+fun mac_envelope_pk_test(mac_envelope_t, kem_pk) : bool
+  reduc forall pk:kem_pk, b:bits;
+    mac_envelope_pk_test(mac_envelope(prf(prf(prf(prf(key0,PROTOCOL),MAC),kem_pk2b(pk)),
+        b), b), pk) = true.
+
 type InitHello_t.
 fun InitHello(
   SessionId, // sidi
@@ -11,6 +31,8 @@ fun InitHello(
   bits       // auth
 ) : InitHello_t [data].
 
+fun IH2b(InitHello_t) : bitstring [typeConverter].
+
 #define INITHELLO_PRODUCE()       \
   ck <- lprf1(CK_INIT, kem_pk2b(spkr)); /* IHI1 */ \
   /* not handled here */                /* IHI2 */ \
@@ -41,7 +63,9 @@ fun RespHello(
     bits       // auth
 ) : RespHello_t [data].
 
-#define RESPHELLO_PRODUCE()                   \
+fun RH2b(RespHello_t) : bitstring [typeConverter].
+
+#define RESPHELLO_PRODUCE()  \
   /* not handled here */           /* RHR1 */ \
   MIX2(sid2b(sidr), sid2b(sidi))   /* RHR3 */ \
   ENCAPS_AND_MIX(ecti, epki, epti) /* RHR4 */ \
@@ -67,13 +91,14 @@ fun InitConf(
     bits       // auth
 ) : InitConf_t [data].
 
+fun IC2b(InitConf_t) : bitstring [typeConverter].
+
 #define INITCONF_PRODUCE()                  \
   MIX2(sid2b(sidi), sid2b(sidr)) /* ICI3 */ \
   ENCRYPT_AND_MIX(auth, empty)   /* ICI4 */ \
   ic <- InitConf(sidi, sidr, biscuit, auth);
 
 #define INITCONF_CONSUME()                        \
-  let InitConf(sidi, sidr, biscuit, auth) = ic in \
   LOAD_BISCUIT(biscuit_no, biscuit)   /* ICR1 */    \
   ENCRYPT_AND_MIX(rh_auth, empty)     /* ICIR */    \
   ck_rh <- ck;                        /* ---- */ /* TODO: Move into oracles.mpv */ \

cipher-traits/Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "rosenpass-cipher-traits"
+authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+description = "Rosenpass internal traits for cryptographic primitives"
+homepage = "https://rosenpass.eu/"
+repository = "https://github.com/rosenpass/rosenpass"
+readme = "readme.md"
+
+[dependencies]

cipher-traits/readme.md

@@ -0,0 +1,5 @@
+# Rosenpass internal libsodium bindings
+
+Rosenpass internal library providing traits for cryptographic primitives.
+
+This is an internal library; not guarantee is made about its API at this point in time.

cipher-traits/src/kem.rs

@@ -0,0 +1,47 @@
+//! Traits and implementations for Key Encapsulation Mechanisms (KEMs)
+//!
+//! KEMs are the interface provided by almost all post-quantum
+//! secure key exchange mechanisms.
+//!
+//! Conceptually KEMs are akin to public-key encryption, but instead of encrypting
+//! arbitrary data, KEMs are limited to the transmission of keys, randomly chosen during
+//!
+//! encapsulation.
+//! The [KEM] Trait describes the basic API offered by a Key Encapsulation
+//! Mechanism. Two implementations for it are provided, [StaticKEM] and [EphemeralKEM].
+
+use std::result::Result;
+
+/// Key Encapsulation Mechanism
+///
+/// The KEM interface defines three operations: Key generation, key encapsulation and key
+/// decapsulation.
+pub trait Kem {
+    type Error;
+
+    /// Secrete Key length
+    const SK_LEN: usize;
+    /// Public Key length
+    const PK_LEN: usize;
+    /// Ciphertext length
+    const CT_LEN: usize;
+    /// Shared Secret length
+    const SHK_LEN: usize;
+
+    /// Generate a keypair consisting of secret key (`sk`) and public key (`pk`)
+    ///
+    /// `keygen() -> sk, pk`
+    fn keygen(sk: &mut [u8], pk: &mut [u8]) -> Result<(), Self::Error>;
+
+    /// From a public key (`pk`), generate a shared key (`shk`, for local use)
+    /// and a cipher text (`ct`, to be sent to the owner of the `pk`).
+    ///
+    /// `encaps(pk) -> shk, ct`
+    fn encaps(shk: &mut [u8], ct: &mut [u8], pk: &[u8]) -> Result<(), Self::Error>;
+
+    /// From a secret key (`sk`) and a cipher text (`ct`) derive a shared key
+    /// (`shk`)
+    ///
+    /// `decaps(sk, ct) -> shk`
+    fn decaps(shk: &mut [u8], sk: &[u8], ct: &[u8]) -> Result<(), Self::Error>;
+}

cipher-traits/src/lib.rs

@@ -0,0 +1,2 @@
+mod kem;
+pub use kem::Kem;

ciphers/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "rosenpass-ciphers"
+authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+description = "Rosenpass internal ciphers and other cryptographic primitives used by rosenpass."
+homepage = "https://rosenpass.eu/"
+repository = "https://github.com/rosenpass/rosenpass"
+readme = "readme.md"
+
+[dependencies]
+anyhow = { workspace = true }
+rosenpass-to = { workspace = true }
+rosenpass-constant-time = { workspace = true }
+rosenpass-secret-memory = { workspace = true }
+rosenpass-oqs = { workspace = true }
+rosenpass-util = { workspace = true }
+static_assertions = { workspace = true }
+zeroize = { workspace = true }
+chacha20poly1305 = { workspace = true }
+blake2 = { workspace = true }

ciphers/readme.md

@@ -0,0 +1,5 @@
+# Rosenpass internal cryptographic primitives
+
+Ciphers and other cryptographic primitives used by rosenpass.
+
+This is an internal library; not guarantee is made about its API at this point in time.

ciphers/src/hash_domain.rs

@@ -0,0 +1,109 @@
+use anyhow::Result;
+use rosenpass_secret_memory::Secret;
+use rosenpass_to::To;
+
+use crate::subtle::incorrect_hmac_blake2b as hash;
+
+pub use hash::KEY_LEN;
+
+// TODO Use a proper Dec interface
+#[derive(Clone, Debug)]
+pub struct HashDomain([u8; KEY_LEN]);
+#[derive(Clone, Debug)]
+pub struct HashDomainNamespace([u8; KEY_LEN]);
+#[derive(Clone, Debug)]
+pub struct SecretHashDomain(Secret<KEY_LEN>);
+#[derive(Clone, Debug)]
+pub struct SecretHashDomainNamespace(Secret<KEY_LEN>);
+
+impl HashDomain {
+    pub fn zero() -> Self {
+        Self([0u8; KEY_LEN])
+    }
+
+    pub fn dup(self) -> HashDomainNamespace {
+        HashDomainNamespace(self.0)
+    }
+
+    pub fn turn_secret(self) -> SecretHashDomain {
+        SecretHashDomain(Secret::from_slice(&self.0))
+    }
+
+    // TODO: Protocol! Use domain separation to ensure that
+    pub fn mix(self, v: &[u8]) -> Result<Self> {
+        Ok(Self(hash::hash(&self.0, v).collect::<[u8; KEY_LEN]>()?))
+    }
+
+    pub fn mix_secret<const N: usize>(self, v: Secret<N>) -> Result<SecretHashDomain> {
+        SecretHashDomain::invoke_primitive(&self.0, v.secret())
+    }
+
+    pub fn into_value(self) -> [u8; KEY_LEN] {
+        self.0
+    }
+}
+
+impl HashDomainNamespace {
+    pub fn mix(&self, v: &[u8]) -> Result<HashDomain> {
+        Ok(HashDomain(
+            hash::hash(&self.0, v).collect::<[u8; KEY_LEN]>()?,
+        ))
+    }
+
+    pub fn mix_secret<const N: usize>(&self, v: Secret<N>) -> Result<SecretHashDomain> {
+        SecretHashDomain::invoke_primitive(&self.0, v.secret())
+    }
+}
+
+impl SecretHashDomain {
+    pub fn invoke_primitive(k: &[u8], d: &[u8]) -> Result<SecretHashDomain> {
+        let mut r = SecretHashDomain(Secret::zero());
+        hash::hash(k, d).to(r.0.secret_mut())?;
+        Ok(r)
+    }
+
+    pub fn zero() -> Self {
+        Self(Secret::zero())
+    }
+
+    pub fn dup(self) -> SecretHashDomainNamespace {
+        SecretHashDomainNamespace(self.0)
+    }
+
+    pub fn danger_from_secret(k: Secret<KEY_LEN>) -> Self {
+        Self(k)
+    }
+
+    pub fn mix(self, v: &[u8]) -> Result<SecretHashDomain> {
+        Self::invoke_primitive(self.0.secret(), v)
+    }
+
+    pub fn mix_secret<const N: usize>(self, v: Secret<N>) -> Result<SecretHashDomain> {
+        Self::invoke_primitive(self.0.secret(), v.secret())
+    }
+
+    pub fn into_secret(self) -> Secret<KEY_LEN> {
+        self.0
+    }
+
+    pub fn into_secret_slice(mut self, v: &[u8], dst: &[u8]) -> Result<()> {
+        hash::hash(v, dst).to(self.0.secret_mut())
+    }
+}
+
+impl SecretHashDomainNamespace {
+    pub fn mix(&self, v: &[u8]) -> Result<SecretHashDomain> {
+        SecretHashDomain::invoke_primitive(self.0.secret(), v)
+    }
+
+    pub fn mix_secret<const N: usize>(&self, v: Secret<N>) -> Result<SecretHashDomain> {
+        SecretHashDomain::invoke_primitive(self.0.secret(), v.secret())
+    }
+
+    // TODO: This entire API is not very nice; we need this for biscuits, but
+    // it might be better to extract a special "biscuit"
+    // labeled subkey and reinitialize the chain with this
+    pub fn danger_into_secret(self) -> Secret<KEY_LEN> {
+        self.0
+    }
+}

ciphers/src/lib.rs

@@ -0,0 +1,27 @@
+use static_assertions::const_assert;
+
+pub mod subtle;
+
+pub const KEY_LEN: usize = 32;
+const_assert!(KEY_LEN == aead::KEY_LEN);
+const_assert!(KEY_LEN == xaead::KEY_LEN);
+const_assert!(KEY_LEN == hash_domain::KEY_LEN);
+
+/// Authenticated encryption with associated data
+pub mod aead {
+    pub use crate::subtle::chacha20poly1305_ietf::{decrypt, encrypt, KEY_LEN, NONCE_LEN, TAG_LEN};
+}
+
+/// Authenticated encryption with associated data with a constant nonce
+pub mod xaead {
+    pub use crate::subtle::xchacha20poly1305_ietf::{
+        decrypt, encrypt, KEY_LEN, NONCE_LEN, TAG_LEN,
+    };
+}
+
+pub mod hash_domain;
+
+pub mod kem {
+    pub use rosenpass_oqs::ClassicMceliece460896 as StaticKem;
+    pub use rosenpass_oqs::Kyber512 as EphemeralKem;
+}

ciphers/src/subtle/blake2b.rs

@@ -0,0 +1,42 @@
+use zeroize::Zeroizing;
+
+use blake2::digest::crypto_common::generic_array::GenericArray;
+use blake2::digest::crypto_common::typenum::U32;
+use blake2::digest::crypto_common::KeySizeUser;
+use blake2::digest::{FixedOutput, Mac, OutputSizeUser};
+use blake2::Blake2bMac;
+
+use rosenpass_to::{ops::copy_slice, with_destination, To};
+use rosenpass_util::typenum2const;
+
+type Impl = Blake2bMac<U32>;
+
+type KeyLen = <Impl as KeySizeUser>::KeySize;
+type OutLen = <Impl as OutputSizeUser>::OutputSize;
+
+const KEY_LEN: usize = typenum2const! { KeyLen };
+const OUT_LEN: usize = typenum2const! { OutLen };
+
+pub const KEY_MIN: usize = KEY_LEN;
+pub const KEY_MAX: usize = KEY_LEN;
+pub const OUT_MIN: usize = OUT_LEN;
+pub const OUT_MAX: usize = OUT_LEN;
+
+#[inline]
+pub fn hash<'a>(key: &'a [u8], data: &'a [u8]) -> impl To<[u8], anyhow::Result<()>> + 'a {
+    with_destination(|out: &mut [u8]| {
+        let mut h = Impl::new_from_slice(key)?;
+        h.update(data);
+
+        // Jesus christ, blake2 crate, your usage of GenericArray might be nice and fancy
+        // but it introduces a ton of complexity. This cost me half an hour just to figure
+        // out the right way to use the imports while allowing for zeroization.
+        // An API based on slices might actually be simpler.
+        let mut tmp = Zeroizing::new([0u8; OUT_LEN]);
+        let mut tmp = GenericArray::from_mut_slice(tmp.as_mut());
+        h.finalize_into(&mut tmp);
+        copy_slice(tmp.as_ref()).to(out);
+
+        Ok(())
+    })
+}

ciphers/src/subtle/chacha20poly1305_ietf.rs

@@ -0,0 +1,43 @@
+use rosenpass_to::ops::copy_slice;
+use rosenpass_to::To;
+use rosenpass_util::typenum2const;
+
+use chacha20poly1305::aead::generic_array::GenericArray;
+use chacha20poly1305::ChaCha20Poly1305 as AeadImpl;
+use chacha20poly1305::{AeadCore, AeadInPlace, KeyInit, KeySizeUser};
+
+pub const KEY_LEN: usize = typenum2const! { <AeadImpl as KeySizeUser>::KeySize };
+pub const TAG_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::TagSize };
+pub const NONCE_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::NonceSize };
+
+#[inline]
+pub fn encrypt(
+    ciphertext: &mut [u8],
+    key: &[u8],
+    nonce: &[u8],
+    ad: &[u8],
+    plaintext: &[u8],
+) -> anyhow::Result<()> {
+    let nonce = GenericArray::from_slice(nonce);
+    let (ct, mac) = ciphertext.split_at_mut(ciphertext.len() - TAG_LEN);
+    copy_slice(plaintext).to(ct);
+    let mac_value = AeadImpl::new_from_slice(key)?.encrypt_in_place_detached(&nonce, ad, ct)?;
+    copy_slice(&mac_value[..]).to(mac);
+    Ok(())
+}
+
+#[inline]
+pub fn decrypt(
+    plaintext: &mut [u8],
+    key: &[u8],
+    nonce: &[u8],
+    ad: &[u8],
+    ciphertext: &[u8],
+) -> anyhow::Result<()> {
+    let nonce = GenericArray::from_slice(nonce);
+    let (ct, mac) = ciphertext.split_at(ciphertext.len() - TAG_LEN);
+    let tag = GenericArray::from_slice(mac);
+    copy_slice(ct).to(plaintext);
+    AeadImpl::new_from_slice(key)?.decrypt_in_place_detached(&nonce, ad, plaintext, tag)?;
+    Ok(())
+}

ciphers/src/subtle/incorrect_hmac_blake2b.rs

@@ -0,0 +1,46 @@
+use anyhow::ensure;
+use zeroize::Zeroizing;
+
+use rosenpass_constant_time::xor;
+use rosenpass_to::{ops::copy_slice, with_destination, To};
+
+use crate::subtle::blake2b;
+
+pub const KEY_LEN: usize = 32;
+pub const KEY_MIN: usize = KEY_LEN;
+pub const KEY_MAX: usize = KEY_LEN;
+pub const OUT_MIN: usize = blake2b::OUT_MIN;
+pub const OUT_MAX: usize = blake2b::OUT_MAX;
+
+/// This is a woefully incorrect implementation of hmac_blake2b.
+/// See <https://github.com/rosenpass/rosenpass/issues/68#issuecomment-1563612222>
+///
+/// It accepts 32 byte keys, exclusively.
+///
+/// This will be replaced, likely by Kekkac at some point soon.
+/// <https://github.com/rosenpass/rosenpass/pull/145>
+#[inline]
+pub fn hash<'a>(key: &'a [u8], data: &'a [u8]) -> impl To<[u8], anyhow::Result<()>> + 'a {
+    const IPAD: [u8; KEY_LEN] = [0x36u8; KEY_LEN];
+    const OPAD: [u8; KEY_LEN] = [0x5Cu8; KEY_LEN];
+
+    with_destination(|out: &mut [u8]| {
+        // Not bothering with padding; the implementation
+        // uses appropriately sized keys.
+        ensure!(key.len() == KEY_LEN);
+
+        type Key = Zeroizing<[u8; KEY_LEN]>;
+        let mut tmp_key = Key::default();
+
+        copy_slice(key).to(tmp_key.as_mut());
+        xor(&IPAD).to(tmp_key.as_mut());
+        let mut outer_data = Key::default();
+        blake2b::hash(tmp_key.as_ref(), data).to(outer_data.as_mut())?;
+
+        copy_slice(key).to(tmp_key.as_mut());
+        xor(&OPAD).to(tmp_key.as_mut());
+        blake2b::hash(tmp_key.as_ref(), outer_data.as_ref()).to(out)?;
+
+        Ok(())
+    })
+}

ciphers/src/subtle/mod.rs

@@ -0,0 +1,4 @@
+pub mod blake2b;
+pub mod chacha20poly1305_ietf;
+pub mod incorrect_hmac_blake2b;
+pub mod xchacha20poly1305_ietf;

ciphers/src/subtle/xchacha20poly1305_ietf.rs

@@ -0,0 +1,45 @@
+use rosenpass_to::ops::copy_slice;
+use rosenpass_to::To;
+use rosenpass_util::typenum2const;
+
+use chacha20poly1305::aead::generic_array::GenericArray;
+use chacha20poly1305::XChaCha20Poly1305 as AeadImpl;
+use chacha20poly1305::{AeadCore, AeadInPlace, KeyInit, KeySizeUser};
+
+pub const KEY_LEN: usize = typenum2const! { <AeadImpl as KeySizeUser>::KeySize };
+pub const TAG_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::TagSize };
+pub const NONCE_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::NonceSize };
+
+#[inline]
+pub fn encrypt(
+    ciphertext: &mut [u8],
+    key: &[u8],
+    nonce: &[u8],
+    ad: &[u8],
+    plaintext: &[u8],
+) -> anyhow::Result<()> {
+    let nonce = GenericArray::from_slice(nonce);
+    let (n, ct_mac) = ciphertext.split_at_mut(NONCE_LEN);
+    let (ct, mac) = ct_mac.split_at_mut(ct_mac.len() - TAG_LEN);
+    copy_slice(nonce).to(n);
+    copy_slice(plaintext).to(ct);
+    let mac_value = AeadImpl::new_from_slice(key)?.encrypt_in_place_detached(&nonce, ad, ct)?;
+    copy_slice(&mac_value[..]).to(mac);
+    Ok(())
+}
+
+#[inline]
+pub fn decrypt(
+    plaintext: &mut [u8],
+    key: &[u8],
+    ad: &[u8],
+    ciphertext: &[u8],
+) -> anyhow::Result<()> {
+    let (n, ct_mac) = ciphertext.split_at(NONCE_LEN);
+    let (ct, mac) = ct_mac.split_at(ct_mac.len() - TAG_LEN);
+    let nonce = GenericArray::from_slice(n);
+    let tag = GenericArray::from_slice(mac);
+    copy_slice(ct).to(plaintext);
+    AeadImpl::new_from_slice(key)?.decrypt_in_place_detached(&nonce, ad, plaintext, tag)?;
+    Ok(())
+}

constant-time/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "rosenpass-constant-time"
+version = "0.1.0"
+authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
+edition = "2021"
+license = "MIT OR Apache-2.0"
+description = "Rosenpass internal utilities for constant time crypto implementations"
+homepage = "https://rosenpass.eu/"
+repository = "https://github.com/rosenpass/rosenpass"
+readme = "readme.md"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[features]
+constant_time_tests = []
+
+[dependencies]
+rosenpass-to = { workspace = true }
+memsec = { workspace = true }
+
+[dev-dependencies]
+rand = "0.8.5"

constant-time/readme.md

@@ -0,0 +1,5 @@
+# Rosenpass constant time library
+
+Rosenpass internal library providing basic constant-time operations.
+
+This is an internal library; not guarantee is made about its API at this point in time.

constant-time/src/compare.rs

@@ -0,0 +1,42 @@
+/// Compares two slices of memory containing arbitrary-length little endian unsigned integers
+/// and returns an integer indicating the relationship between the slices.
+///
+/// ## Returns
+///
+/// - -1 if a < b
+/// - 0 if a = b
+/// - 1 if a > b
+///
+/// ## Leaks
+/// If the two slices have differents lengths, the function will return immediately. This
+/// effectively leaks the information whether the slices have equal length or not. This is widely
+/// considered safe.
+///
+/// The execution time of the function grows approx. linear with the length of the input. This is
+/// considered safe.
+///
+/// ## Tests
+///
+/// ```rust
+/// use rosenpass_constant_time::compare;
+/// assert_eq!(compare(&[], &[]),    0);
+///
+/// assert_eq!(compare(&[0], &[1]), -1);
+/// assert_eq!(compare(&[0], &[0]), 0);
+/// assert_eq!(compare(&[1], &[0]), 1);
+///
+/// assert_eq!(compare(&[0, 0], &[1, 0]), -1);
+/// assert_eq!(compare(&[0, 0], &[0, 0]), 0);
+/// assert_eq!(compare(&[1, 0], &[0, 0]), 1);
+///
+/// assert_eq!(compare(&[1, 0], &[0, 1]), -1);
+/// assert_eq!(compare(&[0, 1], &[0, 0]), 1);
+/// ```
+///
+/// For discussion on how to ensure the constant-time execution of this function, see
+/// <https://github.com/rosenpass/rosenpass/issues/232>
+#[inline]
+pub fn compare(a: &[u8], b: &[u8]) -> i32 {
+    assert!(a.len() == b.len());
+    unsafe { memsec::memcmp(a.as_ptr(), b.as_ptr(), a.len()) }
+}

constant-time/src/increment.rs

@@ -0,0 +1,48 @@
+use core::hint::black_box;
+
+/// Interpret the given slice as a little-endian unsigned integer
+/// and increment that integer.
+///
+/// # Leaks
+/// TODO: mention here if this function leaks any information, see
+/// <https://github.com/rosenpass/rosenpass/issues/232>
+///
+/// ## Tests
+/// For discussion on how to ensure the constant-time execution of this function, see
+/// <https://github.com/rosenpass/rosenpass/issues/232>
+///
+/// # Examples
+///
+/// ```
+/// use rosenpass_constant_time::increment as inc;
+/// use rosenpass_to::To;
+///
+/// fn testcase(v: &[u8], correct: &[u8]) {
+///   let mut v = v.to_owned();
+///   inc(&mut v);
+///   assert_eq!(&v, correct);
+/// }
+///
+/// testcase(b"", b"");
+/// testcase(b"\x00", b"\x01");
+/// testcase(b"\x01", b"\x02");
+/// testcase(b"\xfe", b"\xff");
+/// testcase(b"\xff", b"\x00");
+/// testcase(b"\x00\x00", b"\x01\x00");
+/// testcase(b"\x01\x00", b"\x02\x00");
+/// testcase(b"\xfe\x00", b"\xff\x00");
+/// testcase(b"\xff\x00", b"\x00\x01");
+/// testcase(b"\x00\x00\x00\x00\x00\x00", b"\x01\x00\x00\x00\x00\x00");
+/// testcase(b"\x00\xa3\x00\x77\x00\x00", b"\x01\xa3\x00\x77\x00\x00");
+/// testcase(b"\xff\xa3\x00\x77\x00\x00", b"\x00\xa4\x00\x77\x00\x00");
+/// testcase(b"\xff\xff\xff\x77\x00\x00", b"\x00\x00\x00\x78\x00\x00");
+/// ```
+#[inline]
+pub fn increment(v: &mut [u8]) {
+    let mut carry = 1u8;
+    for val in v.iter_mut() {
+        let (v, c) = black_box(*val).overflowing_add(black_box(carry));
+        *black_box(val) = v;
+        *black_box(&mut carry) = black_box(black_box(c) as u8);
+    }
+}

constant-time/src/lib.rs

@@ -0,0 +1,17 @@
+//! constant-time implementations of some primitives
+//!
+//! Rosenpass internal library providing basic constant-time operations.
+//!
+//! ## TODO
+//! Figure out methodology to ensure that code is actually constant time, see
+//! <https://github.com/rosenpass/rosenpass/issues/232>
+
+mod compare;
+mod increment;
+mod memcmp;
+mod xor;
+
+pub use compare::compare;
+pub use increment::increment;
+pub use memcmp::memcmp;
+pub use xor::xor;

constant-time/src/memcmp.rs

@@ -0,0 +1,110 @@
+/// compares two sclices of memory content and returns whether they are equal
+///
+/// ## Leaks
+/// If the two slices have differents lengths, the function will return immediately. This
+/// effectively leaks the information whether the slices have equal length or not. This is widely
+/// considered safe.
+///
+/// The execution time of the function grows approx. linear with the length of the input. This is
+/// considered safe.
+///
+/// ## Tests
+/// [`tests::memcmp_runs_in_constant_time`] runs a stasticial test that the equality of the two
+/// input parameters does not correlate with the run time.
+///
+/// For discussion on how to (further) ensure the constant-time execution of this function,
+/// see <https://github.com/rosenpass/rosenpass/issues/232>
+#[inline]
+pub fn memcmp(a: &[u8], b: &[u8]) -> bool {
+    a.len() == b.len()
+        && unsafe { memsec::memeq(a.as_ptr() as *const u8, b.as_ptr() as *const u8, a.len()) }
+}
+
+#[cfg(all(test, feature = "constant_time_tests"))]
+mod tests {
+    use super::*;
+    use rand::seq::SliceRandom;
+    use rand::thread_rng;
+    use std::time::Instant;
+
+    #[test]
+    /// tests whether [memcmp] actually runs in constant time
+    ///
+    /// This test function will run an equal amount of comparisons on two different sets of parameters:
+    /// - completely equal slices
+    /// - completely unequal slices.
+    /// All comparisons are executed in a randomized order. The test will fail if one of the
+    /// two sets is checked for equality significantly faster than the other set
+    /// (absolute correlation coefficient ≥ 0.01)
+    fn memcmp_runs_in_constant_time() {
+        // prepare data to compare
+        let n: usize = 1E6 as usize; // number of comparisons to run
+        let len = 1024; // length of each slice passed as parameters to the tested comparison function
+        let a1 = "a".repeat(len);
+        let a2 = a1.clone();
+        let b = "b".repeat(len);
+
+        let a1 = a1.as_bytes();
+        let a2 = a2.as_bytes();
+        let b = b.as_bytes();
+
+        // vector representing all timing tests
+        //
+        // Each element is a tuple of:
+        // 0: whether the test compared two equal slices
+        // 1: the duration needed for the comparison to run
+        let mut tests = (0..n)
+            .map(|i| (i < n / 2, std::time::Duration::ZERO))
+            .collect::<Vec<_>>();
+        tests.shuffle(&mut thread_rng());
+
+        // run comparisons / call function to test
+        for test in tests.iter_mut() {
+            let now = Instant::now();
+            if test.0 {
+                memcmp(a1, a2);
+            } else {
+                memcmp(a1, b);
+            }
+            test.1 = now.elapsed();
+            // println!("eq: {}, elapsed: {:.2?}", test.0, test.1);
+        }
+
+        // sort by execution time and calculate Pearson correlation coefficient
+        tests.sort_by_key(|v| v.1);
+        let tests = tests
+            .iter()
+            .map(|t| (if t.0 { 1_f64 } else { 0_f64 }, t.1.as_nanos() as f64))
+            .collect::<Vec<_>>();
+        // averages
+        let (avg_x, avg_y): (f64, f64) = (
+            tests.iter().map(|t| t.0).sum::<f64>() / n as f64,
+            tests.iter().map(|t| t.1).sum::<f64>() / n as f64,
+        );
+        assert!((avg_x - 0.5).abs() < 1E-12);
+        // standard deviations
+        let sd_x = 0.5;
+        let sd_y = (1_f64 / n as f64
+            * tests
+                .iter()
+                .map(|t| {
+                    let difference = t.1 - avg_y;
+                    difference * difference
+                })
+                .sum::<f64>())
+        .sqrt();
+        // covariance
+        let cv = 1_f64 / n as f64
+            * tests
+                .iter()
+                .map(|t| (t.0 - avg_x) * (t.1 - avg_y))
+                .sum::<f64>();
+        // Pearson correlation
+        let correlation = cv / (sd_x * sd_y);
+        println!("correlation: {:.6?}", correlation);
+        assert!(
+            correlation.abs() < 0.01,
+            "execution time correlates with result"
+        )
+    }
+}

constant-time/src/xor.rs

@@ -0,0 +1,34 @@
+use core::hint::black_box;
+use rosenpass_to::{with_destination, To};
+
+/// Xors the source into the destination
+///
+/// # Panics
+/// If source and destination are of different sizes.
+///
+/// # Leaks
+/// TODO: mention here if this function leaks any information, see
+/// <https://github.com/rosenpass/rosenpass/issues/232>
+///
+/// ## Tests
+/// For discussion on how to ensure the constant-time execution of this function, see
+/// <https://github.com/rosenpass/rosenpass/issues/232>
+///
+/// # Examples
+///
+/// ```
+/// use rosenpass_constant_time::xor;
+/// use rosenpass_to::To;
+/// assert_eq!(
+///     xor(b"world").to_this(|| b"hello".to_vec()),
+///     b"\x1f\n\x1e\x00\x0b");
+/// ```
+#[inline]
+pub fn xor(src: &[u8]) -> impl To<[u8], ()> + '_ {
+    with_destination(|dst: &mut [u8]| {
+        assert!(black_box(src.len()) == black_box(dst.len()));
+        for (dv, sv) in dst.iter_mut().zip(src.iter()) {
+            *black_box(dv) ^= black_box(*sv);
+        }
+    })
+}

doc/rosenpass.1

@@ -12,18 +12,18 @@
 .Sh DESCRIPTION
 .Nm
 performs cryptographic key exchanges that are secure against quantum-computers
-and outputs the keys.
-These keys can then be passed to various services such as wireguard or other
-vpn services as pre-shared-keys to achieve security against attackers with
+and then outputs the keys.
+These keys can then be passed to various services, such as wireguard or other
+vpn services, as pre-shared-keys to achieve security against attackers with
 quantum computers.
 .Pp
 This is a research project and quantum computers are not thought to become
-practical in less than ten years.
+practical in fewer than ten years.
 If you are not specifically tasked with developing post-quantum secure systems,
 you probably do not need this tool.
 .Ss COMMANDS
 .Bl -tag -width Ds
-.It Ar keygen private-key <file-path> public-key <file-path>
+.It Ar gen-keys --secret-key <file-path> --public-key <file-path>
 Generate a keypair to use in the exchange command later.
 Send the public-key file to your communication partner and keep the private-key
 file secret!
@@ -31,7 +31,7 @@ file secret!
 Start a process to exchange keys with the specified peers.
 You should specify at least one peer.
 .Pp
-It's
+Its
 .Ar OPTIONS
 are as follows:
 .Bl -tag -width Ds
@@ -39,7 +39,7 @@ are as follows:
 Instructs
 .Nm
 to listen on the specified interface and port.
-By default
+By default,
 .Nm
 will listen on all interfaces and select a random port.
 .It Ar verbose
@@ -91,9 +91,18 @@ This makes it possible to add peers entirely from
 .Sh SEE ALSO
 .Xr rp 1 ,
 .Xr wg 1
+.Rs
+.%A Karolin Varner
+.%A Benjamin Lipp
+.%A Wanja Zaeske
+.%A Lisa Schmidt
+.%D 2023
+.%T Rosenpass
+.%U https://rosenpass.eu/whitepaper.pdf
+.Re
 .Sh STANDARDS
-This tool is the reference implementation of the Rosenpass protocol, written
-by Karolin Varner, Benjamin Lipp, Wanja Zaeske, and Lisa Schmidt.
+This tool is the reference implementation of the Rosenpass protocol, as
+specified within the whitepaper referenced above.
 .Sh AUTHORS
 Rosenpass was created by Karolin Varner, Benjamin Lipp, Wanja Zaeske,
 Marei Peischl, Stephan Ajuvo, and Lisa Schmidt.

doc/rp.1

@@ -59,6 +59,10 @@ listening on the provided IP and port combination, allowing connections from
 .Sh EXIT STATUS
 .Ex -std
 .Sh EXAMPLES
+In this example, we will assume that the server has an interface bound to
+192.168.0.1, that accepts incoming connections on port 9999/UDP for Rosenpass
+and port 10000/UDP for WireGuard.
+.Pp
 To create a VPN connection, start by generating secret keys on both hosts.
 .Bd -literal -offset indent
 rp genkey server.rosenpass-secret

flake.lock

@@ -8,11 +8,11 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1686291735,
-        "narHash": "sha256-mpq2m6TN3ImqqUqA4u93NvkZu5vH//3spqjmPRbRlvA=",
+        "lastModified": 1699770036,
+        "narHash": "sha256-bZmI7ytPAYLpyFNgj5xirDkKuAniOkj1xHdv5aIJ5GM=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "6e6a94c4d0cac4821b6452fbae46609b89a8ddcf",
+        "rev": "81ab0b4f7ae9ebb57daa0edf119c4891806e4d3a",
         "type": "github"
       },
       "original": {
@@ -26,11 +26,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1685518550,
-        "narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=",
+        "lastModified": 1694529238,
+        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "a1720a10a6cfe8234c0e93907ffe81be440f4cef",
+        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
         "type": "github"
       },
       "original": {
@@ -46,11 +46,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1679567394,
-        "narHash": "sha256-ZvLuzPeARDLiQUt6zSZFGOs+HZmE+3g4QURc8mkBsfM=",
+        "lastModified": 1698420672,
+        "narHash": "sha256-/TdeHMPRjjdJub7p7+w55vyABrsJlt5QkznPYy55vKA=",
         "owner": "nix-community",
         "repo": "naersk",
-        "rev": "88cd22380154a2c36799fe8098888f0f59861a15",
+        "rev": "aeb58d5e8faead8980a807c840232697982d47b9",
         "type": "github"
       },
       "original": {
@@ -61,11 +61,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1686237827,
-        "narHash": "sha256-fAZB+Zkcmc+qlauiFnIH9+2qgwM0NO/ru5pWEw3tDow=",
+        "lastModified": 1698846319,
+        "narHash": "sha256-4jyW/dqFBVpWFnhl0nvP6EN4lP7/ZqPxYRjl6var0Oc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "81ed90058a851eb73be835c770e062c6938c8a9e",
+        "rev": "34bdaaf1f0b7fb6d9091472edc968ff10a8c2857",
         "type": "github"
       },
       "original": {
@@ -84,11 +84,11 @@
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1686239338,
-        "narHash": "sha256-c6Mm7UnDf3j3akY3YB3rELFA76QRbB8ttSBsh00LWi0=",
+        "lastModified": 1699715108,
+        "narHash": "sha256-yPozsobJU55gj+szgo4Lpcg1lHvGQYAT6Y4MrC80mWE=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "9c03aa1ac2e67051db83a85baf3cfee902e4dd84",
+        "rev": "5fcf5289e726785d20d3aa4d13d90a43ed248e83",
         "type": "github"
       },
       "original": {

flake.nix

@@ -29,6 +29,7 @@
       ]
         (system:
           let
+            scoped = (scope: scope.result);
             lib = nixpkgs.lib;
 
             # normal nixpkgs
@@ -55,15 +56,38 @@
             };
 
             # parsed Cargo.toml
-            cargoToml = builtins.fromTOML (builtins.readFile ./Cargo.toml);
+            cargoToml = builtins.fromTOML (builtins.readFile ./rosenpass/Cargo.toml);
 
             # source files relevant for rust
-            src = pkgs.lib.sourceByRegex ./. [
-              "Cargo\\.(toml|lock)"
-              "build.rs"
-              "(src|benches)(/.*\\.(rs|md))?"
-              "rp"
-            ];
+            src = scoped rec {
+              # File suffices to include
+              extensions = [
+                "lock"
+                "rs"
+                "toml"
+              ];
+              # Files to explicitly include
+              files = [
+                "to/README.md"
+              ];
+
+              src = ./.;
+              filter = (path: type: scoped rec {
+                inherit (lib) any id removePrefix hasSuffix;
+                anyof = (any id);
+
+                basename = baseNameOf (toString path);
+                relative = removePrefix (toString src + "/") (toString path);
+
+                result = anyof [
+                  (type == "directory")
+                  (any (ext: hasSuffix ".${ext}" basename) extensions)
+                  (any (file: file == relative) files)
+                ];
+              });
+
+              result = pkgs.lib.sources.cleanSourceWith { inherit src filter; };
+            };
 
             # builds a bin path for all dependencies for the `rp` shellscript
             rpBinPath = p: with p; lib.makeBinPath [
@@ -112,6 +136,9 @@
                   version = cargoToml.package.version;
                   inherit src;
 
+                  cargoBuildOptions = x: x ++ [ "-p" "rosenpass" ];
+                  cargoTestOptions = x: x ++ [ "-p" "rosenpass" ];
+
                   doCheck = true;
 
                   nativeBuildInputs = with pkgs; [
@@ -157,11 +184,6 @@
                     '';
                   };
 
-                  # liboqs requires quite a lot of stack memory, thus we adjust
-                  # the default stack size picked for new threads (which is used
-                  # by `cargo test`) to be _big enough_
-                  RUST_MIN_STACK = 8 * 1024 * 1024; # 8 MiB
-
                   # We want to build for a specific target...
                   CARGO_BUILD_TARGET = target;
 
@@ -269,7 +291,6 @@
               ];
               buildPhase = ''
                 export HOME=$(mktemp -d)
-                export OSFONTDIR="$(kpsewhich --var-value TEXMF)/fonts/{opentype/public/nunito,truetype/google/noto}"
                 latexmk -r tex/CI.rc
               '';
               installPhase = ''
@@ -290,7 +311,7 @@
           packages.proof-proverif = pkgs.stdenv.mkDerivation {
             name = "rosenpass-proverif-proof";
             version = "unstable";
-            src = pkgs.lib.sourceByRegex ./. [
+            src = pkgs.lib.sources.sourceByRegex ./. [
               "analyze.sh"
               "marzipan(/marzipan.awk)?"
               "analysis(/.*)?"
@@ -309,7 +330,6 @@
           #
           devShells.default = pkgs.mkShell {
             inherit (packages.proof-proverif) CRYPTOVERIF_LIB;
-            inherit (packages.rosenpass) RUST_MIN_STACK;
             inputsFrom = [ packages.default ];
             nativeBuildInputs = with pkgs; [
               cmake # override the fakecmake from the main step above
@@ -322,7 +342,6 @@
           };
           devShells.coverage = pkgs.mkShell {
             inputsFrom = [ packages.default ];
-            inherit (packages.rosenpass) RUST_MIN_STACK;
             nativeBuildInputs = with pkgs; [ inputs.fenix.packages.${system}.complete.toolchain cargo-llvm-cov ];
           };
 
@@ -330,7 +349,7 @@
           checks = {
             cargo-fmt = pkgs.runCommand "check-cargo-fmt"
               { inherit (self.devShells.${system}.default) nativeBuildInputs buildInputs; } ''
-              cargo fmt --manifest-path=${./.}/Cargo.toml --check && touch $out
+              cargo fmt --manifest-path=${./.}/Cargo.toml --check --all && touch $out
             '';
             nixpkgs-fmt = pkgs.runCommand "check-nixpkgs-fmt"
               { nativeBuildInputs = [ pkgs.nixpkgs-fmt ]; } ''

format_rust_code.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+
+# Parse command line options
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --mode)
+            mode="$2"
+            shift 2
+            ;;
+        *)
+            echo "Unknown option: $1"
+            exit 1
+            ;;
+    esac
+done
+
+# Check if mode is specified
+if [ -z "$mode" ]; then
+    echo "Please specify the mode using --mode option. Valid modes are 'check' and 'fix'."
+    exit 1
+fi
+
+# Find all Markdown files in the current directory and its subdirectories
+mapfile -t md_files < <(find . -type f -name "*.md")
+
+count=0
+# Iterate through each Markdown file
+for file in "${md_files[@]}"; do
+    # Use awk to extract Rust code blocks enclosed within triple backticks
+    rust_code_blocks=$(awk '/```rust/{flag=1; next}/```/{flag=0} flag' "$file")
+
+    # Count the number of Rust code blocks
+    num_fences=$(awk '/```rust/{f=1} f{if(/```/){f=0; count++}} END{print count}' "$file")
+
+    if [ -n "$rust_code_blocks" ]; then
+        echo "Processing Rust code in $file"
+        # Iterate through each Rust code block
+        for ((i=1; i <= num_fences ; i++)); do
+            # Extract individual Rust code block using awk
+            current_rust_block=$(awk -v i="$i" '/```rust/{f=1; if (++count == i) next} f&&/```/{f=0;next} f' "$file")
+            # Variable to check if we have added the main function
+            add_main=0  
+            # Check if the Rust code block is already inside a function
+            if ! echo "$current_rust_block" | grep -q "fn main()"; then
+                # If not, wrap it in a main function
+                current_rust_block=$'fn main() {\n'"$current_rust_block"$'\n}'
+                add_main=1
+            fi
+            if [ "$mode" == "check" ]; then
+                # Apply changes to the Rust code block
+                formatted_rust_code=$(echo "$current_rust_block" | rustfmt)
+                # Use rustfmt to format the Rust code block, remove first and last lines, and remove the first 4 spaces if added  main function
+                if [ "$add_main" == 1 ]; then
+                    formatted_rust_code=$(echo "$formatted_rust_code" | sed '1d;$d' | sed 's/^    //')
+                    current_rust_block=$(echo "$current_rust_block" | sed '1d;')
+                    current_rust_block=$(echo "$current_rust_block" | sed '$d')
+                fi
+                if [ "$formatted_rust_code" == "$current_rust_block" ]; then
+                    echo "No changes needed in Rust code block $i in $file"
+                else
+                    echo -e "\nChanges needed in Rust code block $i in $file:\n"
+                    echo "$formatted_rust_code"
+                    count=+1
+                fi
+
+            elif [ "$mode" == "fix" ]; then
+                # Replace current_rust_block with formatted_rust_code in the file
+                formatted_rust_code=$(echo "$current_rust_block" | rustfmt)
+                # Use rustfmt to format the Rust code block, remove first and last lines, and remove the first 4 spaces if added  main function
+                if [ "$add_main" == 1 ]; then
+                    formatted_rust_code=$(echo "$formatted_rust_code" | sed '1d;$d' | sed 's/^    //')
+                    current_rust_block=$(echo "$current_rust_block" | sed '1d;')
+                    current_rust_block=$(echo "$current_rust_block" | sed '$d')
+                fi
+                # Check if the formatted code is the same as the current Rust code block
+                if [ "$formatted_rust_code" == "$current_rust_block" ]; then
+                    echo "No changes needed in Rust code block $i in $file"
+                else
+                    echo "Formatting Rust code block $i in $file"
+                    # Replace current_rust_block with formatted_rust_code in the file
+                    # Use awk to find the line number of the pattern
+
+                    start_line=$(grep -n "^\`\`\`rust" "$file" | sed -n "${i}p" | cut -d: -f1)
+                    end_line=$(grep -n "^\`\`\`" "$file" | awk -F: -v start_line="$start_line" '$1 > start_line {print $1; exit;}')
+
+                    if [ -n "$start_line" ] && [ -n "$end_line" ]; then
+                        # Print lines before the Rust code block
+                        head -n "$((start_line - 1))" "$file"
+
+                        # Print the formatted Rust code block
+                        echo "\`\`\`rust"
+                        echo "$formatted_rust_code"
+                        echo "\`\`\`"
+
+                        # Print lines after the Rust code block
+                        tail -n +"$((end_line + 1))" "$file"
+                    else
+                        # Rust code block not found or end line not found
+                        cat "$file"
+                    fi > tmpfile && mv tmpfile "$file"
+
+                fi
+            else  
+                echo "Unknown mode: $mode. Valid modes are 'check' and 'fix'."
+                exit 1
+            fi
+        done
+    fi
+done
+
+# CI failure if changes are needed
+if [ $count -gt 0 ]; then
+    echo "CI failed: Changes needed in Rust code blocks."
+    exit 1
+fi

fuzz/.gitignore

@@ -0,0 +1,4 @@
+target
+corpus
+artifacts
+coverage

fuzz/Cargo.toml

@@ -0,0 +1,60 @@
+[package]
+name = "rosenpass-fuzzing"
+version = "0.0.1"
+publish = false
+edition = "2021"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+arbitrary = { workspace = true }
+libfuzzer-sys = { workspace = true }
+stacker = { workspace = true }
+rosenpass-secret-memory = { workspace = true }
+rosenpass-ciphers = { workspace = true }
+rosenpass-cipher-traits = { workspace = true }
+rosenpass-to = { workspace = true }
+rosenpass = { workspace = true }
+
+[[bin]]
+name = "fuzz_handle_msg"
+path = "fuzz_targets/handle_msg.rs"
+test = false
+doc = false
+
+[[bin]]
+name = "fuzz_blake2b"
+path = "fuzz_targets/blake2b.rs"
+test = false
+doc = false
+
+[[bin]]
+name = "fuzz_aead_enc_into"
+path = "fuzz_targets/aead_enc_into.rs"
+test = false
+doc = false
+
+[[bin]]
+name = "fuzz_mceliece_encaps"
+path = "fuzz_targets/mceliece_encaps.rs"
+test = false
+doc = false
+
+[[bin]]
+name = "fuzz_kyber_encaps"
+path = "fuzz_targets/kyber_encaps.rs"
+test = false
+doc = false
+
+[[bin]]
+name = "fuzz_box_secret_alloc"
+path = "fuzz_targets/box_secret_alloc.rs"
+test = false
+doc = false
+
+[[bin]]
+name = "fuzz_vec_secret_alloc"
+path = "fuzz_targets/vec_secret_alloc.rs"
+test = false
+doc = false

fuzz/fuzz_targets/aead_enc_into.rs

@@ -0,0 +1,29 @@
+#![no_main]
+extern crate arbitrary;
+extern crate rosenpass;
+
+use libfuzzer_sys::fuzz_target;
+
+use rosenpass_ciphers::aead;
+
+#[derive(arbitrary::Arbitrary, Debug)]
+pub struct Input {
+    pub key: [u8; 32],
+    pub nonce: [u8; 12],
+    pub ad: Box<[u8]>,
+    pub plaintext: Box<[u8]>,
+}
+
+fuzz_target!(|input: Input| {
+    let mut ciphertext: Vec<u8> = Vec::with_capacity(input.plaintext.len() + 16);
+    ciphertext.resize(input.plaintext.len() + 16, 0);
+
+    aead::encrypt(
+        ciphertext.as_mut_slice(),
+        &input.key,
+        &input.nonce,
+        &input.ad,
+        &input.plaintext,
+    )
+    .unwrap();
+});

fuzz/fuzz_targets/blake2b.rs

@@ -0,0 +1,20 @@
+#![no_main]
+extern crate arbitrary;
+extern crate rosenpass;
+
+use libfuzzer_sys::fuzz_target;
+
+use rosenpass_ciphers::subtle::blake2b;
+use rosenpass_to::To;
+
+#[derive(arbitrary::Arbitrary, Debug)]
+pub struct Blake2b {
+    pub key: [u8; 32],
+    pub data: Box<[u8]>,
+}
+
+fuzz_target!(|input: Blake2b| {
+    let mut out = [0u8; 32];
+
+    blake2b::hash(&input.key, &input.data).to(&mut out).unwrap();
+});

fuzz/fuzz_targets/box_secret_alloc.rs

@@ -0,0 +1,8 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use rosenpass_secret_memory::alloc::secret_box;
+
+fuzz_target!(|data: &[u8]| {
+    let _ = secret_box(data);
+});

fuzz/fuzz_targets/handle_msg.rs

@@ -0,0 +1,18 @@
+#![no_main]
+extern crate rosenpass;
+
+use libfuzzer_sys::fuzz_target;
+
+use rosenpass::protocol::CryptoServer;
+use rosenpass_secret_memory::Secret;
+
+fuzz_target!(|rx_buf: &[u8]| {
+    let sk = Secret::from_slice(&[0; 13568]);
+    let pk = Secret::from_slice(&[0; 524160]);
+
+    let mut cs = CryptoServer::new(sk, pk);
+    let mut tx_buf = [0; 10240];
+
+    // We expect errors while fuzzing therefore we do not check the result.
+    let _ = cs.handle_msg(rx_buf, &mut tx_buf);
+});

fuzz/fuzz_targets/kyber_encaps.rs

@@ -0,0 +1,20 @@
+#![no_main]
+extern crate arbitrary;
+extern crate rosenpass;
+
+use libfuzzer_sys::fuzz_target;
+
+use rosenpass_cipher_traits::Kem;
+use rosenpass_ciphers::kem::EphemeralKem;
+
+#[derive(arbitrary::Arbitrary, Debug)]
+pub struct Input {
+    pub pk: [u8; 800],
+}
+
+fuzz_target!(|input: Input| {
+    let mut ciphertext = [0u8; 768];
+    let mut shared_secret = [0u8; 32];
+
+    EphemeralKem::encaps(&mut shared_secret, &mut ciphertext, &input.pk).unwrap();
+});

fuzz/fuzz_targets/mceliece_encaps.rs

@@ -0,0 +1,15 @@
+#![no_main]
+extern crate rosenpass;
+
+use libfuzzer_sys::fuzz_target;
+
+use rosenpass_cipher_traits::Kem;
+use rosenpass_ciphers::kem::StaticKem;
+
+fuzz_target!(|input: [u8; StaticKem::PK_LEN]| {
+    let mut ciphertext = [0u8; 188];
+    let mut shared_secret = [0u8; 32];
+
+    // We expect errors while fuzzing therefore we do not check the result.
+    let _ = StaticKem::encaps(&mut shared_secret, &mut ciphertext, &input);
+});

fuzz/fuzz_targets/vec_secret_alloc.rs

@@ -0,0 +1,9 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use rosenpass_secret_memory::alloc::secret_vec;
+
+fuzz_target!(|data: &[u8]| {
+    let mut vec = secret_vec();
+    vec.extend_from_slice(data);
+});

oqs/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "rosenpass-oqs"
+authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+description = "Rosenpass internal bindings to liboqs"
+homepage = "https://rosenpass.eu/"
+repository = "https://github.com/rosenpass/rosenpass"
+readme = "readme.md"
+
+[dependencies]
+rosenpass-cipher-traits = { workspace = true }
+rosenpass-util = { workspace = true }
+oqs-sys = { workspace = true }
+paste = { workspace = true }

oqs/readme.md

@@ -0,0 +1,5 @@
+# Rosenpass internal liboqs bindings
+
+Rosenpass internal library providing bindings to liboqs.
+
+This is an internal library; not guarantee is made about its API at this point in time.

oqs/src/kem_macro.rs

@@ -0,0 +1,80 @@
+macro_rules! oqs_kem {
+    ($name:ident) => { ::paste::paste!{
+        mod [< $name:snake >] {
+            use rosenpass_cipher_traits::Kem;
+            use rosenpass_util::result::Guaranteed;
+
+            pub enum [< $name:camel >]  {}
+
+            /// # Panic & Safety
+            ///
+            /// This Trait impl calls unsafe [oqs_sys] functions, that write to byte
+            /// slices only identified using raw pointers. It must be ensured that the raw
+            /// pointers point into byte slices of sufficient length, to avoid UB through
+            /// overwriting of arbitrary data. This is ensured through assertions in the
+            /// implementation.
+            ///
+            /// __Note__: This requirement is stricter than necessary, it would suffice
+            /// to only check that the buffers are big enough, allowing them to be even
+            /// bigger. However, from a correctness point of view it does not make sense to
+            /// allow bigger buffers.
+            impl Kem for [< $name:camel >] {
+                type Error = ::std::convert::Infallible;
+
+                const SK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_secret_key >] as usize;
+                const PK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_public_key >] as usize;
+                const CT_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_ciphertext >] as usize;
+                const SHK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_shared_secret >] as usize;
+
+                fn keygen(sk: &mut [u8], pk: &mut [u8]) -> Guaranteed<()> {
+                    assert_eq!(sk.len(), Self::SK_LEN);
+                    assert_eq!(pk.len(), Self::PK_LEN);
+                    unsafe {
+                        oqs_call!(
+                            ::oqs_sys::kem::[< OQS_KEM _ $name:snake _ keypair >],
+                            pk.as_mut_ptr(),
+                            sk.as_mut_ptr()
+                        );
+                    }
+
+                    Ok(())
+                }
+
+                fn encaps(shk: &mut [u8], ct: &mut [u8], pk: &[u8]) -> Guaranteed<()> {
+                    assert_eq!(shk.len(), Self::SHK_LEN);
+                    assert_eq!(ct.len(), Self::CT_LEN);
+                    assert_eq!(pk.len(), Self::PK_LEN);
+                    unsafe {
+                        oqs_call!(
+                            ::oqs_sys::kem::[< OQS_KEM _ $name:snake _ encaps >],
+                            ct.as_mut_ptr(),
+                            shk.as_mut_ptr(),
+                            pk.as_ptr()
+                        );
+                    }
+
+                    Ok(())
+                }
+
+                fn decaps(shk: &mut [u8], sk: &[u8], ct: &[u8]) -> Guaranteed<()> {
+                    assert_eq!(shk.len(), Self::SHK_LEN);
+                    assert_eq!(sk.len(), Self::SK_LEN);
+                    assert_eq!(ct.len(), Self::CT_LEN);
+                    unsafe {
+                        oqs_call!(
+                            ::oqs_sys::kem::[< OQS_KEM _ $name:snake _ decaps >],
+                            shk.as_mut_ptr(),
+                            ct.as_ptr(),
+                            sk.as_ptr()
+                        );
+                    }
+
+                    Ok(())
+                }
+            }
+
+        }
+
+        pub use [< $name:snake >] :: [< $name:camel >];
+    }}
+}

oqs/src/lib.rs

@@ -0,0 +1,21 @@
+macro_rules! oqs_call {
+    ($name:path, $($args:expr),*) => {{
+        use oqs_sys::common::OQS_STATUS::*;
+
+        match $name($($args),*) {
+            OQS_SUCCESS => {}, // nop
+            OQS_EXTERNAL_LIB_ERROR_OPENSSL => {
+                panic!("OpenSSL error in liboqs' {}.", stringify!($name));
+            },
+            OQS_ERROR => {
+                panic!("Unknown error in liboqs' {}.", stringify!($name));
+            }
+        }
+    }};
+    ($name:ident) => { oqs_call!($name, ) };
+}
+
+#[macro_use]
+mod kem_macro;
+oqs_kem!(kyber_512);
+oqs_kem!(classic_mceliece_460896);

papers/tex/template-rosenpass.tex

@@ -177,7 +177,11 @@ version={4.0},
 		\titlehead{\centerline{\includegraphics[width=4cm]{RosenPass-Logo}}}
 		\title{\inserttitle}
 	}
-	\author{\csname insertauthor\endcsname}
+	\ifx\csname insertauthor\endcsname\relax
+	\author{}
+	\else
+	\author{\parbox{\linewidth}{\centering\insertauthor}}
+	\fi
 	\subject{\csname insertsubject\endcsname}
 	\date{\vspace{-1cm}}
 }

readme.md

@@ -71,6 +71,13 @@ Rosenpass is packaged for more and more distributions, maybe also for the distri
 
 [![Packaging status](https://repology.org/badge/vertical-allrepos/rosenpass.svg)](https://repology.org/project/rosenpass/versions)
 
+# Mirrors
+
+Don't want to use GitHub or only have an IPv6 connection? Rosenpass has set up two mirrors for this:
+
+- [NotABug](https://notabug.org/rosenpass/rosenpass)
+- [GitLab](https://gitlab.com/rosenpass/rosenpass/)
+
 # Supported by
 
 Funded through <a href="https://nlnet.nl/">NLNet</a> with financial support for the European Commission's <a href="https://nlnet.nl/assure">NGI Assure</a> program.

rosenpass/Cargo.toml

@@ -0,0 +1,44 @@
+[package]
+name = "rosenpass"
+version = "0.2.1"
+authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
+edition = "2021"
+license = "MIT OR Apache-2.0"
+description = "Build post-quantum-secure VPNs with WireGuard!"
+homepage = "https://rosenpass.eu/"
+repository = "https://github.com/rosenpass/rosenpass"
+readme = "readme.md"
+
+[[bench]]
+name = "handshake"
+harness = false
+
+[dependencies]
+rosenpass-util = { workspace = true }
+rosenpass-constant-time = { workspace = true }
+rosenpass-ciphers = { workspace = true }
+rosenpass-cipher-traits = { workspace = true }
+rosenpass-to = { workspace = true }
+rosenpass-secret-memory = { workspace = true }
+anyhow = { workspace = true }
+static_assertions = { workspace = true }
+memoffset = { workspace = true }
+thiserror = { workspace = true }
+paste = { workspace = true }
+log = { workspace = true }
+env_logger = { workspace = true }
+serde = { workspace = true }
+toml = { workspace = true }
+clap = { workspace = true }
+mio = { workspace = true }
+rand = { workspace = true }
+zerocopy = { workspace = true }
+home = { workspace = true }
+
+[build-dependencies]
+anyhow = { workspace = true }
+
+[dev-dependencies]
+criterion = { workspace = true }
+test_bin = { workspace = true }
+stacker = { workspace = true }

rosenpass/benches/handshake.rs

@@ -1,9 +1,8 @@
 use anyhow::Result;
-use rosenpass::{
-    pqkem::{EphemeralKEM, CCAKEM},
-    protocol::{CcaPk, CcaSk, CryptoServer, HandleMsgResult, MsgBuf, PeerPtr, SymKey},
-    sodium::sodium_init,
-};
+use rosenpass::protocol::{CryptoServer, HandleMsgResult, MsgBuf, PeerPtr, SPk, SSk, SymKey};
+
+use rosenpass_cipher_traits::Kem;
+use rosenpass_ciphers::kem::StaticKem;
 
 use criterion::{black_box, criterion_group, criterion_main, Criterion};
 
@@ -38,9 +37,9 @@ fn hs(ini: &mut CryptoServer, res: &mut CryptoServer) -> Result<()> {
     Ok(())
 }
 
-fn keygen() -> Result<(CcaSk, CcaPk)> {
-    let (mut sk, mut pk) = (CcaSk::zero(), CcaPk::zero());
-    CCAKEM::keygen(sk.secret_mut(), pk.secret_mut())?;
+fn keygen() -> Result<(SSk, SPk)> {
+    let (mut sk, mut pk) = (SSk::zero(), SPk::zero());
+    StaticKem::keygen(sk.secret_mut(), pk.secret_mut())?;
     Ok((sk, pk))
 }
 
@@ -57,16 +56,15 @@ fn make_server_pair() -> Result<(CryptoServer, CryptoServer)> {
 }
 
 fn criterion_benchmark(c: &mut Criterion) {
-    sodium_init().unwrap();
     let (mut a, mut b) = make_server_pair().unwrap();
     c.bench_function("cca_secret_alloc", |bench| {
         bench.iter(|| {
-            CcaSk::zero();
+            SSk::zero();
         })
     });
     c.bench_function("cca_public_alloc", |bench| {
         bench.iter(|| {
-            CcaPk::zero();
+            SPk::zero();
         })
     });
     c.bench_function("keygen", |bench| {

rosenpass/build.rs

@@ -21,17 +21,16 @@ fn generate_man() -> String {
     // This function is purposely stupid and redundant
 
     let man = render_man("mandoc", "./doc/rosenpass.1");
-    if man.is_ok() {
-        return man.unwrap();
+    if let Ok(man) = man {
+        return man;
     }
 
     let man = render_man("groff", "./doc/rosenpass.1");
-    if man.is_ok() {
-        return man.unwrap();
+    if let Ok(man) = man {
+        return man;
     }
 
-    // TODO: Link to online manual here
-    "Cannot render manual page\n".into()
+    "Cannot render manual page. Please visit https://rosenpass.eu/docs/manuals/\n".into()
 }
 
 fn man() {

rosenpass/readme.md

@@ -0,0 +1 @@
+../readme.md

rosenpass/src/app_server.rs

@@ -1,6 +1,10 @@
-use log::{error, info, warn};
+use anyhow::bail;
+
+use anyhow::Result;
+use log::{debug, error, info, warn};
 use mio::Interest;
 use mio::Token;
+use rosenpass_util::file::fopen_w;
 
 use std::cell::Cell;
 use std::io::Write;
@@ -16,16 +20,15 @@ use std::path::PathBuf;
 use std::process::Command;
 use std::process::Stdio;
 use std::slice;
+use std::thread;
 use std::time::Duration;
 
-use crate::util::fopen_w;
-use crate::RosenpassError;
 use crate::{
     config::Verbosity,
     protocol::{CryptoServer, MsgBuf, PeerPtr, SPk, SSk, SymKey, Timing},
-    util::{b64_writer, fmt_b64},
-    Result,
 };
+use rosenpass_util::attempt;
+use rosenpass_util::b64::{b64_writer, fmt_b64};
 
 const IPV4_ANY_ADDR: Ipv4Addr = Ipv4Addr::new(0, 0, 0, 0);
 const IPV6_ANY_ADDR: Ipv6Addr = Ipv6Addr::new(0, 0, 0, 0, 0, 0, 0, 0);
@@ -97,8 +100,8 @@ impl SocketPtr {
         &mut srv.sockets[self.0]
     }
 
-    pub fn send_to(&self, srv: &AppServer, buf: &[u8], addr: SocketAddr) -> Result<()> {
-        self.get(srv).send_to(&buf, addr)?;
+    pub fn send_to(&self, srv: &AppServer, buf: &[u8], addr: SocketAddr) -> anyhow::Result<()> {
+        self.get(srv).send_to(buf, addr)?;
         Ok(())
     }
 }
@@ -180,7 +183,7 @@ impl Endpoint {
     }
 
     /// Start endpoint discovery from a hostname
-    pub fn discovery_from_hostname(hostname: String) -> Result<Self> {
+    pub fn discovery_from_hostname(hostname: String) -> anyhow::Result<Self> {
         let host = HostPathDiscoveryEndpoint::lookup(hostname)?;
         Ok(Endpoint::Discovery(host))
     }
@@ -210,7 +213,7 @@ impl Endpoint {
         Some(Self::discovery_from_addresses(addrs))
     }
 
-    pub fn send(&self, srv: &AppServer, buf: &[u8]) -> Result<()> {
+    pub fn send(&self, srv: &AppServer, buf: &[u8]) -> anyhow::Result<()> {
         use Endpoint::*;
         match self {
             SocketBoundAddress { socket, addr } => socket.send_to(srv, buf, *addr),
@@ -269,7 +272,7 @@ impl HostPathDiscoveryEndpoint {
     }
 
     /// Lookup a hostname
-    pub fn lookup(hostname: String) -> Result<Self> {
+    pub fn lookup(hostname: String) -> anyhow::Result<Self> {
         Ok(Self {
             addresses: ToSocketAddrs::to_socket_addrs(&hostname)?.collect(),
             scouting_state: Cell::new((0, 0)),
@@ -290,16 +293,16 @@ impl HostPathDiscoveryEndpoint {
     /// Attempt to reach the host
     ///
     /// Will round-robin-try different socket-ip-combinations on each call.
-    pub fn send_scouting(&self, srv: &AppServer, buf: &[u8]) -> Result<()> {
+    pub fn send_scouting(&self, srv: &AppServer, buf: &[u8]) -> anyhow::Result<()> {
         let (addr_off, sock_off) = self.scouting_state.get();
 
-        let mut addrs = (&self.addresses)
+        let mut addrs = (self.addresses)
             .iter()
             .enumerate()
             .cycle()
             .skip(addr_off)
             .take(self.addresses.len());
-        let mut sockets = (&srv.sockets)
+        let mut sockets = (srv.sockets)
             .iter()
             .enumerate()
             .cycle()
@@ -329,19 +332,23 @@ impl HostPathDiscoveryEndpoint {
             }
         }
 
-        error!("Unable to send message: All sockets returned errors.");
-        return Err(RosenpassError::RuntimeError);
+        bail!("Unable to send message: All sockets returned errors.")
     }
 }
 
 impl AppServer {
-    pub fn new(sk: SSk, pk: SPk, addrs: Vec<SocketAddr>, verbosity: Verbosity) -> Result<Self> {
+    pub fn new(
+        sk: SSk,
+        pk: SPk,
+        addrs: Vec<SocketAddr>,
+        verbosity: Verbosity,
+    ) -> anyhow::Result<Self> {
         // setup mio
         let mio_poll = mio::Poll::new()?;
         let events = mio::Events::with_capacity(8);
 
         // bind each SocketAddr to a socket
-        let maybe_sockets: std::result::Result<Vec<_>, std::io::Error> =
+        let maybe_sockets: Result<Vec<_>, _> =
             addrs.into_iter().map(mio::net::UdpSocket::bind).collect();
         let mut sockets = maybe_sockets?;
 
@@ -408,8 +415,7 @@ impl AppServer {
         }
 
         if sockets.is_empty() {
-            error!("No sockets to listen on!");
-            return Err(RosenpassError::RuntimeError);
+            bail!("No sockets to listen on!")
         }
 
         // register all sockets to mio
@@ -443,7 +449,7 @@ impl AppServer {
         outfile: Option<PathBuf>,
         outwg: Option<WireguardOut>,
         hostname: Option<String>,
-    ) -> Result<AppPeerPtr> {
+    ) -> anyhow::Result<AppPeerPtr> {
         let PeerPtr(pn) = self.crypt.add_peer(psk, pk)?;
         assert!(pn == self.peers.len());
         let initial_endpoint = hostname
@@ -459,7 +465,7 @@ impl AppServer {
         Ok(AppPeerPtr(pn))
     }
 
-    pub fn listen_loop(&mut self) -> Result<()> {
+    pub fn listen_loop(&mut self) -> anyhow::Result<()> {
         const INIT_SLEEP: f64 = 0.01;
         const MAX_FAILURES: i32 = 10;
         let mut failure_cnt = 0;
@@ -480,11 +486,10 @@ impl AppServer {
             let sleep = INIT_SLEEP * 2.0f64.powf(f64::from(failure_cnt - 1));
             let tries_left = MAX_FAILURES - (failure_cnt - 1);
             error!(
-                "unexpected error after processing {} messages: {:?}",
+                "unexpected error after processing {} messages: {:?} {}",
                 msgs_processed,
                 err,
-                // TODO do we need backtraces?
-                // err.backtrace()
+                err.backtrace()
             );
             if tries_left > 0 {
                 error!("re-initializing networking in {sleep}! {tries_left} tries left.");
@@ -492,12 +497,11 @@ impl AppServer {
                 continue;
             }
 
-            error!("too many network failures");
-            return Err(RosenpassError::RuntimeError);
+            bail!("too many network failures");
         }
     }
 
-    pub fn event_loop(&mut self) -> Result<()> {
+    pub fn event_loop(&mut self) -> anyhow::Result<()> {
         let (mut rx, mut tx) = (MsgBuf::zero(), MsgBuf::zero());
 
         /// if socket address for peer is known, call closure
@@ -522,9 +526,11 @@ impl AppServer {
             use AppPollResult::*;
             use KeyOutputReason::*;
             match self.poll(&mut *rx)? {
+                #[allow(clippy::redundant_closure_call)]
                 SendInitiation(peer) => tx_maybe_with!(peer, || self
                     .crypt
                     .initiate_handshake(peer.lower(), &mut *tx))?,
+                #[allow(clippy::redundant_closure_call)]
                 SendRetransmission(peer) => tx_maybe_with!(peer, || self
                     .crypt
                     .retransmit_handshake(peer.lower(), &mut *tx))?,
@@ -546,9 +552,11 @@ impl AppServer {
                     match self.crypt.handle_msg(&rx[..len], &mut *tx) {
                         Err(ref e) => {
                             self.verbose().then(|| {
-                                error!(
-                                    "error processing incoming message from {:?}: {:?}",
-                                    endpoint, e
+                                info!(
+                                    "error processing incoming message from {:?}: {:?} {}",
+                                    endpoint,
+                                    e,
+                                    e.backtrace()
                                 );
                             });
                         }
@@ -576,7 +584,12 @@ impl AppServer {
         }
     }
 
-    pub fn output_key(&self, peer: AppPeerPtr, why: KeyOutputReason, key: &SymKey) -> Result<()> {
+    pub fn output_key(
+        &self,
+        peer: AppPeerPtr,
+        why: KeyOutputReason,
+        key: &SymKey,
+    ) -> anyhow::Result<()> {
         let peerid = peer.lower().get(&self.crypt).pidt()?;
         let ap = peer.get_app(self);
 
@@ -611,7 +624,7 @@ impl AppServer {
         }
 
         if let Some(owg) = ap.outwg.as_ref() {
-            let child = Command::new("wg")
+            let mut child = Command::new("wg")
                 .arg("set")
                 .arg(&owg.dev)
                 .arg("peer")
@@ -621,13 +634,27 @@ impl AppServer {
                 .stdin(Stdio::piped())
                 .args(&owg.extra_params)
                 .spawn()?;
-            b64_writer(child.stdin.unwrap()).write_all(key.secret())?;
+            b64_writer(child.stdin.take().unwrap()).write_all(key.secret())?;
+
+            thread::spawn(move || {
+                let status = child.wait();
+
+                if let Ok(status) = status {
+                    if status.success() {
+                        debug!("successfully passed psk to wg")
+                    } else {
+                        error!("could not pass psk to wg {:?}", status)
+                    }
+                } else {
+                    error!("wait failed: {:?}", status)
+                }
+            });
         }
 
         Ok(())
     }
 
-    pub fn poll(&mut self, rx_buf: &mut [u8]) -> Result<AppPollResult> {
+    pub fn poll(&mut self, rx_buf: &mut [u8]) -> anyhow::Result<AppPollResult> {
         use crate::protocol::PollResult as C;
         use AppPollResult as A;
         loop {
@@ -652,7 +679,7 @@ impl AppServer {
         &mut self,
         buf: &mut [u8],
         timeout: Timing,
-    ) -> Result<Option<(usize, Endpoint)>> {
+    ) -> anyhow::Result<Option<(usize, Endpoint)>> {
         let timeout = Duration::from_secs_f64(timeout);
 
         // if there is no time to wait on IO, well, then, lets not waste any time!

rosenpass/src/cli.rs

@@ -1,23 +1,61 @@
+use anyhow::{bail, ensure};
+use clap::{Parser, Subcommand};
+use rosenpass_cipher_traits::Kem;
+use rosenpass_ciphers::kem::StaticKem;
+use rosenpass_secret_memory::file::StoreSecret;
+use rosenpass_util::file::{LoadValue, LoadValueB64};
+use std::path::PathBuf;
+
 use crate::app_server;
 use crate::app_server::AppServer;
-use crate::util::{LoadValue, LoadValueB64};
-use crate::{
-    // app_server::{AppServer, LoadValue, LoadValueB64},
-    coloring::Secret,
-    pqkem::{StaticKEM, KEM},
-    protocol::{SPk, SSk, SymKey},
-    Result,
-    RosenpassError,
-};
-use clap::Parser;
-use log::error;
-use std::path::{Path, PathBuf};
+use crate::protocol::{SPk, SSk, SymKey};
 
 use super::config;
 
+/// struct holding all CLI arguments for `clap` crate to parse
 #[derive(Parser, Debug)]
 #[command(author, version, about, long_about)]
-pub enum Cli {
+pub struct CliArgs {
+    /// lowest log level to show – log messages at higher levels will be omitted
+    #[arg(long = "log-level", value_name = "LOG_LEVEL", group = "log-level")]
+    log_level: Option<log::LevelFilter>,
+
+    /// show verbose log output – sets log level to "debug"
+    #[arg(short, long, group = "log-level")]
+    verbose: bool,
+
+    /// show no log output – sets log level to "error"
+    #[arg(short, long, group = "log-level")]
+    quiet: bool,
+
+    #[command(subcommand)]
+    pub command: CliCommand,
+}
+
+impl CliArgs {
+    /// returns the log level filter set by CLI args
+    /// returns `None` if the user did not specify any log level filter via CLI
+    ///
+    /// NOTE: the clap feature of ["argument groups"](https://docs.rs/clap/latest/clap/_derive/_tutorial/chapter_3/index.html#argument-relations)
+    /// ensures that the user can not specify more than one of the possible log level arguments.
+    /// Note the `#[arg("group")]` in the [`CliArgs`] struct.
+    pub fn get_log_level(&self) -> Option<log::LevelFilter> {
+        if self.verbose {
+            return Some(log::LevelFilter::Info);
+        }
+        if self.quiet {
+            return Some(log::LevelFilter::Error);
+        }
+        if let Some(level_filter) = self.log_level {
+            return Some(level_filter);
+        }
+        None
+    }
+}
+
+/// represents a command specified via CLI
+#[derive(Subcommand, Debug)]
+pub enum CliCommand {
     /// Start Rosenpass in server mode and carry on with the key exchange
     ///
     /// This will parse the configuration file and perform the key exchange
@@ -90,6 +128,15 @@ pub enum Cli {
         force: bool,
     },
 
+    /// Deprecated - use gen-keys instead
+    #[allow(rustdoc::broken_intra_doc_links)]
+    #[allow(rustdoc::invalid_html_tags)]
+    Keygen {
+        // NOTE yes, the legacy keygen argument initially really accepted "privet-key", not "secret-key"!
+        /// public-key <PATH> private-key <PATH>
+        args: Vec<String>,
+    },
+
     /// Validate a configuration
     Validate { config_files: Vec<PathBuf> },
 
@@ -98,26 +145,66 @@ pub enum Cli {
     Man,
 }
 
-impl Cli {
-    pub fn run() -> Result<()> {
-        let cli = Self::parse();
-
-        use Cli::*;
-        match cli {
+impl CliCommand {
+    /// runs the command specified via CLI
+    ///
+    /// ## TODO
+    /// - This method consumes the [`CliCommand`] value. It might be wise to use a reference...
+    pub fn run(self) -> anyhow::Result<()> {
+        use CliCommand::*;
+        match self {
             Man => {
-                let _man_cmd = std::process::Command::new("man")
+                let man_cmd = std::process::Command::new("man")
                     .args(["1", "rosenpass"])
                     .status();
+
+                if !(man_cmd.is_ok() && man_cmd.unwrap().success()) {
+                    println!(include_str!(env!("ROSENPASS_MAN")));
+                }
             }
             GenConfig { config_file, force } => {
-                if !force && config_file.exists() {
-                    error!("config file {config_file:?} already exists");
-                    return Err(RosenpassError::RuntimeError);
-                }
+                ensure!(
+                    force || !config_file.exists(),
+                    "config file {config_file:?} already exists"
+                );
 
                 config::Rosenpass::example_config().store(config_file)?;
             }
 
+            // Deprecated - use gen-keys instead
+            Keygen { args } => {
+                log::warn!("The 'keygen' command is deprecated. Please use the 'gen-keys' command instead.");
+
+                let mut public_key: Option<PathBuf> = None;
+                let mut secret_key: Option<PathBuf> = None;
+
+                // Manual arg parsing, since clap wants to prefix flags with "--"
+                let mut args = args.into_iter();
+                loop {
+                    match (args.next().as_deref(), args.next()) {
+                        (Some("private-key"), Some(opt)) | (Some("secret-key"), Some(opt)) => {
+                            secret_key = Some(opt.into());
+                        }
+                        (Some("public-key"), Some(opt)) => {
+                            public_key = Some(opt.into());
+                        }
+                        (Some(flag), _) => {
+                            bail!("Unknown option `{}`", flag);
+                        }
+                        (_, _) => break,
+                    };
+                }
+
+                if secret_key.is_none() {
+                    bail!("private-key is required");
+                }
+                if public_key.is_none() {
+                    bail!("public-key is required");
+                }
+
+                generate_and_save_keypair(secret_key.unwrap(), public_key.unwrap())?;
+            }
+
             GenKeys {
                 config_file,
                 public_key,
@@ -127,52 +214,46 @@ impl Cli {
                 // figure out where the key file is specified, in the config file or directly as flag?
                 let (pkf, skf) = match (config_file, public_key, secret_key) {
                     (Some(config_file), _, _) => {
-                        if !config_file.exists() {
-                            error!("config file {config_file:?} does not exist");
-                            return Err(RosenpassError::RuntimeError);
-                        }
+                        ensure!(
+                            config_file.exists(),
+                            "config file {config_file:?} does not exist"
+                        );
 
                         let config = config::Rosenpass::load(config_file)?;
 
                         (config.public_key, config.secret_key)
                     }
                     (_, Some(pkf), Some(skf)) => (pkf, skf),
-                    _ => return Err(RosenpassError::ConfigError(
-                        "either a config-file or both public-key and secret-key file are required"
-                            .into(),
-                    )),
+                    _ => {
+                        bail!("either a config-file or both public-key and secret-key file are required")
+                    }
                 };
 
                 // check that we are not overriding something unintentionally
-                let mut problems = false;
+                let mut problems = vec![];
                 if !force && pkf.is_file() {
-                    problems = true;
-                    error!("public-key file {pkf:?} exist, refusing to overwrite it");
+                    problems.push(format!(
+                        "public-key file {pkf:?} exist, refusing to overwrite it"
+                    ));
                 }
                 if !force && skf.is_file() {
-                    problems = true;
-                    error!("secret-key file {skf:?} exist, refusing to overwrite it");
+                    problems.push(format!(
+                        "secret-key file {skf:?} exist, refusing to overwrite it"
+                    ));
                 }
-                if problems {
-                    return Err(RosenpassError::RuntimeError);
+                if !problems.is_empty() {
+                    bail!(problems.join("\n"));
                 }
 
                 // generate the keys and store them in files
-                let mut ssk = crate::protocol::SSk::random();
-                let mut spk = crate::protocol::SPk::random();
-
-                unsafe {
-                    StaticKEM::keygen(ssk.secret_mut(), spk.secret_mut())?;
-                    ssk.store_secret(skf)?;
-                    spk.store_secret(pkf)?;
-                }
+                generate_and_save_keypair(skf, pkf)?;
             }
 
             ExchangeConfig { config_file } => {
-                if !config_file.exists() {
-                    error!("config file '{config_file:?}' does not exist");
-                    return Err(RosenpassError::RuntimeError);
-                }
+                ensure!(
+                    config_file.exists(),
+                    "config file '{config_file:?}' does not exist"
+                );
 
                 let config = config::Rosenpass::load(config_file)?;
                 config.validate()?;
@@ -202,7 +283,7 @@ impl Cli {
                         Ok(config) => {
                             eprintln!("{file:?} is valid TOML and conforms to the expected schema");
                             match config.validate() {
-                                Ok(_) => eprintln!("{file:?} is passed all logical checks"),
+                                Ok(_) => eprintln!("{file:?} has passed all logical checks"),
                                 Err(_) => eprintln!("{file:?} contains logical errors"),
                             }
                         }
@@ -215,7 +296,7 @@ impl Cli {
         Ok(())
     }
 
-    fn event_loop(config: config::Rosenpass) -> Result<()> {
+    fn event_loop(config: config::Rosenpass) -> anyhow::Result<()> {
         // load own keys
         let sk = SSk::load(&config.secret_key)?;
         let pk = SPk::load(&config.public_key)?;
@@ -247,13 +328,11 @@ impl Cli {
     }
 }
 
-trait StoreSecret {
-    unsafe fn store_secret<P: AsRef<Path>>(&self, path: P) -> Result<()>;
-}
-
-impl<const N: usize> StoreSecret for Secret<N> {
-    unsafe fn store_secret<P: AsRef<Path>>(&self, path: P) -> Result<()> {
-        std::fs::write(path, self.secret())?;
-        Ok(())
-    }
+/// generate secret and public keys, store in files according to the paths passed as arguments
+fn generate_and_save_keypair(secret_key: PathBuf, public_key: PathBuf) -> anyhow::Result<()> {
+    let mut ssk = crate::protocol::SSk::random();
+    let mut spk = crate::protocol::SPk::random();
+    StaticKem::keygen(ssk.secret_mut(), spk.secret_mut())?;
+    ssk.store_secret(secret_key)?;
+    spk.store_secret(public_key)
 }

rosenpass/src/config.rs

@@ -1,3 +1,12 @@
+//! Configuration readable from a config file.
+//!
+//! Rosenpass supports reading its configuration from a TOML file. This module contains a struct
+//! [`Rosenpass`] which holds such a configuration.
+//!
+//! ## TODO
+//! - support `~` in <https://github.com/rosenpass/rosenpass/issues/237>
+//! - provide tooling to create config file from shell <https://github.com/rosenpass/rosenpass/issues/247>
+
 use std::{
     collections::HashSet,
     fs,
@@ -6,71 +15,134 @@ use std::{
     path::{Path, PathBuf},
 };
 
-use log::{error, warn};
+use anyhow::{bail, ensure};
+use rosenpass_util::file::fopen_w;
 use serde::{Deserialize, Serialize};
 
-use crate::{util::fopen_w, Result, RosenpassError};
-
 #[derive(Debug, Serialize, Deserialize)]
 pub struct Rosenpass {
+    /// path to the public key file
     pub public_key: PathBuf,
 
+    /// path to the secret key file
     pub secret_key: PathBuf,
 
+    /// list of [`SocketAddr`] to listen on
+    ///
+    /// Examples:
+    /// - `0.0.0.0:123`
     pub listen: Vec<SocketAddr>,
 
+    /// log verbosity
+    ///
+    /// This is subject to change. See [`Verbosity`] for details.
     #[serde(default)]
     pub verbosity: Verbosity,
+
+    /// list of peers
+    ///
+    /// See the [`RosenpassPeer`] type for more information and examples.
     pub peers: Vec<RosenpassPeer>,
 
+    /// path to the file which provided this configuration
+    ///
+    /// This item is of course not read from the TOML but is added by the algorithm that parses
+    /// the config file.
     #[serde(skip)]
     pub config_file_path: PathBuf,
 }
 
+/// ## TODO
+/// - replace this type with [`log::LevelFilter`], also see <https://github.com/rosenpass/rosenpass/pull/246>
 #[derive(Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub enum Verbosity {
     Quiet,
     Verbose,
 }
 
+/// ## TODO
+/// - examples
+/// - documentation
 #[derive(Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub struct RosenpassPeer {
+    /// path to the public key of the peer
     pub public_key: PathBuf,
+
+    /// ## TODO
+    /// - documentation
     pub endpoint: Option<String>,
+
+    /// path to the pre-shared key with the peer
+    ///
+    /// NOTE: this item can be skipped in the config if you do not use a pre-shared key with the peer
     pub pre_shared_key: Option<PathBuf>,
 
+    /// ## TODO
+    /// - documentation
     #[serde(default)]
     pub key_out: Option<PathBuf>,
 
-    // TODO make sure failure does not crash but is logged
-    #[serde(default)]
-    pub exchange_command: Vec<String>,
-
-    // TODO make this field only available on binary builds, not on library builds
+    /// ## TODO
+    /// - documentation
+    /// - make this field only available on binary builds, not on library builds <https://github.com/rosenpass/rosenpass/issues/249>
     #[serde(flatten)]
     pub wg: Option<WireGuard>,
 }
 
+/// ## TODO
+/// - documentation
 #[derive(Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub struct WireGuard {
+    /// ## TODO
+    /// - documentation
     pub device: String,
+
+    /// ## TODO
+    /// - documentation
     pub peer: String,
+
+    /// ## TODO
+    /// - documentation
+    #[serde(default)]
     pub extra_params: Vec<String>,
 }
 
 impl Rosenpass {
-    /// Load a config file from a file path
+    /// load configuration from a TOML file
     ///
-    /// no validation is conducted
-    pub fn load<P: AsRef<Path>>(p: P) -> Result<Self> {
+    /// NOTE: no validation is conducted, e.g. the paths specified in the configuration are not
+    /// checked whether they even exist.
+    ///
+    /// ## TODO
+    /// - consider using a different algorithm to determine home directory – the below one may
+    ///   behave unexpectedly on Windows
+    pub fn load<P: AsRef<Path>>(p: P) -> anyhow::Result<Self> {
+        // read file and deserialize
         let mut config: Self = toml::from_str(&fs::read_to_string(&p)?)?;
 
+        // resolve `~` (see https://github.com/rosenpass/rosenpass/issues/237)
+        use util::resolve_path_with_tilde;
+        resolve_path_with_tilde(&mut config.public_key);
+        resolve_path_with_tilde(&mut config.secret_key);
+        for peer in config.peers.iter_mut() {
+            resolve_path_with_tilde(&mut peer.public_key);
+            if let Some(ref mut psk) = &mut peer.pre_shared_key {
+                resolve_path_with_tilde(psk);
+            }
+            if let Some(ref mut ko) = &mut peer.key_out {
+                resolve_path_with_tilde(ko);
+            }
+        }
+
+        // add path to "self"
         config.config_file_path = p.as_ref().to_owned();
+
+        // return
         Ok(config)
     }
 
     /// Write a config to a file
-    pub fn store<P: AsRef<Path>>(&self, p: P) -> Result<()> {
+    pub fn store<P: AsRef<Path>>(&self, p: P) -> anyhow::Result<()> {
         let serialized_config =
             toml::to_string_pretty(&self).expect("unable to serialize the default config");
         fs::write(p, serialized_config)?;
@@ -78,7 +150,7 @@ impl Rosenpass {
     }
 
     /// Commit the configuration to where it came from, overwriting the original file
-    pub fn commit(&self) -> Result<()> {
+    pub fn commit(&self) -> anyhow::Result<()> {
         let mut f = fopen_w(&self.config_file_path)?;
         f.write_all(toml::to_string_pretty(&self)?.as_bytes())?;
 
@@ -86,40 +158,40 @@ impl Rosenpass {
     }
 
     /// Validate a configuration
-    pub fn validate(&self) -> Result<()> {
-        // check the public-key file exists
-        if !(self.public_key.is_file()) {
-            return Err(RosenpassError::ConfigError(format!(
-                "public-key file {:?} does not exist",
-                self.public_key
-            )));
-        }
+    ///
+    /// ## TODO
+    /// - check that files do not just exist but are also readable
+    /// - warn if neither out_key nor exchange_command of a peer is defined (v.i.)
+    pub fn validate(&self) -> anyhow::Result<()> {
+        // check the public key file exists
+        ensure!(
+            self.public_key.is_file(),
+            "could not find public-key file {:?}: no such file",
+            self.public_key
+        );
 
         // check the secret-key file exists
-        if !(self.secret_key.is_file()) {
-            return Err(RosenpassError::ConfigError(format!(
-                "secret-key file {:?} does not exist",
-                self.secret_key
-            )));
-        }
+        ensure!(
+            self.secret_key.is_file(),
+            "could not find secret-key file {:?}: no such file",
+            self.secret_key
+        );
 
         for (i, peer) in self.peers.iter().enumerate() {
             // check peer's public-key file exists
-            if !(peer.public_key.is_file()) {
-                return Err(RosenpassError::ConfigError(format!(
-                    "peer {i} public-key file {:?} does not exist",
-                    peer.public_key
-                )));
-            }
+            ensure!(
+                peer.public_key.is_file(),
+                "peer {i} public-key file {:?} does not exist",
+                peer.public_key
+            );
 
             // check endpoint is usable
             if let Some(addr) = peer.endpoint.as_ref() {
-                if !(addr.to_socket_addrs().is_ok()) {
-                    return Err(RosenpassError::ConfigError(format!(
-                        "peer {i} endpoint {} can not be parsed to a socket address",
-                        addr
-                    )));
-                }
+                ensure!(
+                    addr.to_socket_addrs().is_ok(),
+                    "peer {i} endpoint {} can not be parsed to a socket address",
+                    addr
+                );
             }
 
             // TODO warn if neither out_key nor exchange_command is defined
@@ -155,7 +227,7 @@ impl Rosenpass {
 
     /// from chaotic args
     /// Quest: the grammar is undecideable, what do we do here?
-    pub fn parse_args(args: Vec<String>) -> Result<Self> {
+    pub fn parse_args(args: Vec<String>) -> anyhow::Result<Self> {
         let mut config = Self::new("", "");
 
         #[derive(Debug, Hash, PartialEq, Eq)]
@@ -178,7 +250,6 @@ impl Rosenpass {
 
         // TODO idea: use config.peers.len() to give index of peer with conflicting argument
         use State::*;
-        let mut problem = false;
         let mut state = Own;
         let mut current_peer = None;
         let p_exists = "a peer should exist by now";
@@ -188,7 +259,9 @@ impl Rosenpass {
                 (Own, "public-key", None) => OwnPublicKey,
                 (Own, "secret-key", None) => OwnSecretKey,
                 (Own, "private-key", None) => {
-                    warn!("the private-key argument is deprecated, please use secret-key instead");
+                    log::warn!(
+                        "the private-key argument is deprecated, please use secret-key instead"
+                    );
                     OwnSecretKey
                 }
                 (Own, "listen", None) => OwnListen,
@@ -197,16 +270,14 @@ impl Rosenpass {
                     Own
                 }
                 (Own, "peer", None) => {
-                    if !(already_set.contains(&OwnPublicKey)) {
-                        return Err(RosenpassError::ConfigError(
-                            "public-key file must be set".into(),
-                        ));
-                    }
-                    if !(already_set.contains(&OwnSecretKey)) {
-                        return Err(RosenpassError::ConfigError(
-                            "secret-key file must be set".into(),
-                        ));
-                    }
+                    ensure!(
+                        already_set.contains(&OwnPublicKey),
+                        "public-key file must be set"
+                    );
+                    ensure!(
+                        already_set.contains(&OwnSecretKey),
+                        "secret-key file must be set"
+                    );
 
                     already_set.clear();
                     current_peer = Some(RosenpassPeer::default());
@@ -214,20 +285,18 @@ impl Rosenpass {
                     Peer
                 }
                 (OwnPublicKey, pk, None) => {
-                    if !(already_set.insert(OwnPublicKey)) {
-                        return Err(RosenpassError::ConfigError(
-                            "public-key was already set".into(),
-                        ));
-                    }
+                    ensure!(
+                        already_set.insert(OwnPublicKey),
+                        "public-key was already set"
+                    );
                     config.public_key = pk.into();
                     Own
                 }
                 (OwnSecretKey, sk, None) => {
-                    if !(already_set.insert(OwnSecretKey)) {
-                        return Err(RosenpassError::ConfigError(
-                            "secret-key was already set".into(),
-                        ));
-                    }
+                    ensure!(
+                        already_set.insert(OwnSecretKey),
+                        "secret-key was already set"
+                    );
                     config.secret_key = sk.into();
                     Own
                 }
@@ -255,45 +324,36 @@ impl Rosenpass {
                 (Peer, "outfile", Some(_)) => PeerOutfile,
                 (Peer, "wireguard", Some(_)) => PeerWireguardDev,
                 (PeerPublicKey, pk, Some(peer)) => {
-                    if !(already_set.insert(PeerPublicKey)) {
-                        return Err(RosenpassError::ConfigError(
-                            "public-key was already set".into(),
-                        ));
-                    }
+                    ensure!(
+                        already_set.insert(PeerPublicKey),
+                        "public-key was already set"
+                    );
                     peer.public_key = pk.into();
                     Peer
                 }
                 (PeerEndpoint, e, Some(peer)) => {
-                    if !already_set.insert(PeerEndpoint) {
-                        error!("endpoint was already set");
-                        problem = true;
-                    }
+                    ensure!(already_set.insert(PeerEndpoint), "endpoint was already set");
                     peer.endpoint = Some(e.to_owned());
                     Peer
                 }
                 (PeerPsk, psk, Some(peer)) => {
-                    if !already_set.insert(PeerEndpoint) {
-                        error!("peer psk was already set");
-                        problem = true;
-                    }
+                    ensure!(already_set.insert(PeerEndpoint), "peer psk was already set");
                     peer.pre_shared_key = Some(psk.into());
                     Peer
                 }
                 (PeerOutfile, of, Some(peer)) => {
-                    if !(already_set.insert(PeerOutfile)) {
-                        return Err(RosenpassError::ConfigError(
-                            "peer outfile was already set".into(),
-                        ));
-                    }
+                    ensure!(
+                        already_set.insert(PeerOutfile),
+                        "peer outfile was already set"
+                    );
                     peer.key_out = Some(of.into());
                     Peer
                 }
                 (PeerWireguardDev, dev, Some(peer)) => {
-                    if !(already_set.insert(PeerWireguardDev)) {
-                        return Err(RosenpassError::ConfigError(
-                            "peer wireguard-dev was already set".into(),
-                        ));
-                    }
+                    ensure!(
+                        already_set.insert(PeerWireguardDev),
+                        "peer wireguard-dev was already set"
+                    );
                     assert!(peer.wg.is_none());
                     peer.wg = Some(WireGuard {
                         device: dev.to_string(),
@@ -303,11 +363,10 @@ impl Rosenpass {
                     PeerWireguardPeer
                 }
                 (PeerWireguardPeer, p, Some(peer)) => {
-                    if !(already_set.insert(PeerWireguardPeer)) {
-                        return Err(RosenpassError::ConfigError(
-                            "peer wireguard-peer was already set".into(),
-                        ));
-                    }
+                    ensure!(
+                        already_set.insert(PeerWireguardPeer),
+                        "peer wireguard-peer was already set"
+                    );
                     peer.wg.as_mut().expect(wg_exists).peer = p.to_string();
                     PeerWireguardExtraArgs
                 }
@@ -322,16 +381,14 @@ impl Rosenpass {
 
                 // error cases
                 (Own, x, None) => {
-                    error!("unrecognised argument {x}");
-                    return Err(RosenpassError::RuntimeError);
+                    bail!("unrecognised argument {x}");
                 }
                 (Own | OwnPublicKey | OwnSecretKey | OwnListen, _, Some(_)) => {
                     panic!("current_peer is not None while in Own* state, this must never happen")
                 }
 
                 (State::Peer, arg, Some(_)) => {
-                    error!("unrecongnised argument {arg}");
-                    return Err(RosenpassError::RuntimeError);
+                    bail!("unrecongnised argument {arg}");
                 }
                 (
                     Peer
@@ -350,10 +407,6 @@ impl Rosenpass {
             };
         }
 
-        if problem {
-            return Err(RosenpassError::RuntimeError);
-        }
-
         if let Some(p) = current_peer {
             // TODO ensure peer is propagated with sufficient information
             config.peers.push(p);
@@ -367,28 +420,20 @@ impl Rosenpass {
     /// Generate an example configuration
     pub fn example_config() -> Self {
         let peer = RosenpassPeer {
-            public_key: "rp-peer-public-key".into(),
+            public_key: "/path/to/rp-peer-public-key".into(),
             endpoint: Some("my-peer.test:9999".into()),
-            exchange_command: [
-                "wg",
-                "set",
-                "wg0",
-                "peer",
-                "<PEER_ID>",
-                "preshared-key",
-                "/dev/stdin",
-            ]
-            .into_iter()
-            .map(|x| x.to_string())
-            .collect(),
-            key_out: Some("rp-key-out".into()),
-            pre_shared_key: None,
-            wg: None,
+            key_out: Some("/path/to/rp-key-out.txt".into()),
+            pre_shared_key: Some("additional pre shared key".into()),
+            wg: Some(WireGuard {
+                device: "wirgeguard device e.g. wg0".into(),
+                peer: "wireguard public key".into(),
+                extra_params: vec!["passed to".into(), "wg set".into()],
+            }),
         };
 
         Self {
-            public_key: "rp-public-key".into(),
-            secret_key: "rp-secret-key".into(),
+            public_key: "/path/to/rp-public-key".into(),
+            secret_key: "/path/to/rp-secret-key".into(),
             peers: vec![peer],
             ..Self::new("", "")
         }
@@ -408,7 +453,7 @@ mod test {
     use super::*;
 
     fn split_str(s: &str) -> Vec<String> {
-        s.split(" ").map(|s| s.to_string()).collect()
+        s.split(' ').map(|s| s.to_string()).collect()
     }
 
     #[test]
@@ -476,3 +521,67 @@ mod test {
         )
     }
 }
+
+pub mod util {
+    use std::path::PathBuf;
+    /// takes a path that can potentially start with a `~` and resolves that `~` to the user's home directory
+    ///
+    /// ## Example
+    /// ```
+    /// use rosenpass::config::util::resolve_path_with_tilde;
+    /// std::env::set_var("HOME","/home/dummy");
+    /// let mut path = std::path::PathBuf::from("~/foo.toml");
+    /// resolve_path_with_tilde(&mut path);
+    /// assert!(path == std::path::PathBuf::from("/home/dummy/foo.toml"));
+    /// ```
+    pub fn resolve_path_with_tilde(path: &mut PathBuf) {
+        if let Some(first_segment) = path.iter().next() {
+            if !path.has_root() && first_segment == "~" {
+                let home_dir = home::home_dir().unwrap_or_else(|| {
+                    log::error!("config file contains \"~\" but can not determine home diretory");
+                    std::process::exit(1);
+                });
+                let orig_path = path.clone();
+                path.clear();
+                path.push(home_dir);
+                for segment in orig_path.iter().skip(1) {
+                    path.push(segment);
+                }
+            }
+        }
+    }
+
+    #[cfg(test)]
+    mod test {
+        use super::*;
+        #[test]
+        fn test_resolve_path_with_tilde() {
+            let test = |path_str: &str, resolved: &str| {
+                let mut path = PathBuf::from(path_str);
+                resolve_path_with_tilde(&mut path);
+                assert!(
+                    path == PathBuf::from(resolved),
+                    "Path {:?} has been resolved to {:?} but should have been resolved to {:?}.",
+                    path_str,
+                    path,
+                    resolved
+                );
+            };
+            // set environment because otherwise the test result would depend on the system running this
+            std::env::set_var("USER", "dummy");
+            std::env::set_var("HOME", "/home/dummy");
+
+            // should resolve
+            test("~/foo.toml", "/home/dummy/foo.toml");
+            test("~//foo", "/home/dummy/foo");
+            test("~/../other_user/foo", "/home/dummy/../other_user/foo");
+
+            // should _not_ resolve
+            test("~foo/bar", "~foo/bar");
+            test(".~/foo", ".~/foo");
+            test("/~/foo.toml", "/~/foo.toml");
+            test(r"~\foo", r"~\foo");
+            test(r"C:\~\foo.toml", r"C:\~\foo.toml");
+        }
+    }
+}

rosenpass/src/hash_domains.rs

@@ -0,0 +1,46 @@
+//! Pseudo Random Functions (PRFs) with a tree-like label scheme which
+//! ensures their uniqueness
+
+use anyhow::Result;
+use rosenpass_ciphers::{hash_domain::HashDomain, KEY_LEN};
+
+// TODO Use labels that can serve as identifiers
+macro_rules! hash_domain_ns {
+    ($base:ident, $name:ident, $($lbl:expr),* ) => {
+        pub fn $name() -> Result<HashDomain> {
+            let t = $base()?;
+            $( let t = t.mix($lbl.as_bytes())?; )*
+            Ok(t)
+        }
+    }
+}
+
+macro_rules! hash_domain {
+    ($base:ident, $name:ident, $($lbl:expr),* ) => {
+        pub fn $name() -> Result<[u8; KEY_LEN]> {
+            let t = $base()?;
+            $( let t = t.mix($lbl.as_bytes())?; )*
+            Ok(t.into_value())
+        }
+    }
+}
+
+pub fn protocol() -> Result<HashDomain> {
+    HashDomain::zero().mix("Rosenpass v1 mceliece460896 Kyber512 ChaChaPoly1305 BLAKE2s".as_bytes())
+}
+
+hash_domain_ns!(protocol, mac, "mac");
+hash_domain_ns!(protocol, cookie, "cookie");
+hash_domain_ns!(protocol, peerid, "peer id");
+hash_domain_ns!(protocol, biscuit_ad, "biscuit additional data");
+hash_domain_ns!(protocol, ckinit, "chaining key init");
+hash_domain_ns!(protocol, _ckextract, "chaining key extract");
+
+hash_domain!(_ckextract, mix, "mix");
+hash_domain!(_ckextract, hs_enc, "handshake encryption");
+hash_domain!(_ckextract, ini_enc, "initiator handshake encryption");
+hash_domain!(_ckextract, res_enc, "responder handshake encryption");
+
+hash_domain_ns!(_ckextract, _user, "user");
+hash_domain_ns!(_user, _rp, "rosenpass.eu");
+hash_domain!(_rp, osk, "wireguard psk");

rosenpass/src/lib.rs

@@ -0,0 +1,14 @@
+pub mod app_server;
+pub mod cli;
+pub mod config;
+pub mod hash_domains;
+pub mod msgs;
+pub mod protocol;
+
+#[derive(thiserror::Error, Debug)]
+pub enum RosenpassError {
+    #[error("buffer size mismatch")]
+    BufferSizeMismatch,
+    #[error("invalid message type")]
+    InvalidMessageType(u8),
+}

rosenpass/src/main.rs

@@ -0,0 +1,36 @@
+use clap::Parser;
+use log::error;
+use rosenpass::cli::CliArgs;
+use std::process::exit;
+
+/// Catches errors, prints them through the logger, then exits
+pub fn main() {
+    // parse CLI arguments
+    let args = CliArgs::parse();
+
+    // init logging
+    {
+        let mut log_builder = env_logger::Builder::from_default_env(); // sets log level filter from environment (or defaults)
+        if let Some(level) = args.get_log_level() {
+            log::debug!("setting log level to {:?} (set via CLI parameter)", level);
+            log_builder.filter_level(level); // set log level filter from CLI args if available
+        }
+        log_builder.init();
+
+        // // check the effectiveness of the log level filter with the following lines:
+        // use log::{debug, error, info, trace, warn};
+        // trace!("trace dummy");
+        // debug!("debug dummy");
+        // info!("info dummy");
+        // warn!("warn dummy");
+        // error!("error dummy");
+    }
+
+    match args.command.run() {
+        Ok(_) => {}
+        Err(e) => {
+            error!("{e}");
+            exit(1);
+        }
+    }
+}

rosenpass/src/msgs.rs

@@ -0,0 +1,187 @@
+//! Data structures representing the messages going over the wire
+//!
+//! This module contains de-/serialization of the protocol's messages. Thats kind
+//! of a lie, since no actual ser/de happens. Instead, the structures offer views
+//! into mutable byte slices (`&mut [u8]`), allowing to modify the fields of an
+//! always serialized instance of the data in question. This is closely related
+//! to the concept of lenses in function programming; more on that here:
+//! [https://sinusoid.es/misc/lager/lenses.pdf](https://sinusoid.es/misc/lager/lenses.pdf)
+//! To achieve this we utilize the zerocopy library.
+
+use super::RosenpassError;
+use rosenpass_cipher_traits::Kem;
+use rosenpass_ciphers::kem::{EphemeralKem, StaticKem};
+use rosenpass_ciphers::{aead, xaead, KEY_LEN};
+use std::mem::size_of;
+use zerocopy::{AsBytes, FromBytes, FromZeroes};
+
+#[repr(packed)]
+#[derive(AsBytes, FromBytes, FromZeroes)]
+pub struct Envelope<M: AsBytes + FromBytes> {
+    /// [MsgType] of this message
+    pub msg_type: u8,
+    /// Reserved for future use
+    pub reserved: [u8; 3],
+    /// The actual Paylod
+    pub payload: M,
+    /// Message Authentication Code (mac) over all bytes until (exclusive)
+    /// `mac` itself
+    pub mac: [u8; 16],
+    /// Currently unused, TODO: do something with this
+    pub cookie: [u8; 16],
+}
+
+#[repr(packed)]
+#[derive(AsBytes, FromBytes, FromZeroes)]
+pub struct InitHello {
+    /// Randomly generated connection id
+    pub sidi: [u8; 4],
+    /// Kyber 512 Ephemeral Public Key
+    pub epki: [u8; EphemeralKem::PK_LEN],
+    /// Classic McEliece Ciphertext
+    pub sctr: [u8; StaticKem::CT_LEN],
+    /// Encryped: 16 byte hash of McEliece initiator static key
+    pub pidic: [u8; aead::TAG_LEN + 32],
+    /// Encrypted TAI64N Time Stamp (against replay attacks)
+    pub auth: [u8; aead::TAG_LEN],
+}
+
+#[repr(packed)]
+#[derive(AsBytes, FromBytes, FromZeroes)]
+pub struct RespHello {
+    /// Randomly generated connection id
+    pub sidr: [u8; 4],
+    /// Copied from InitHello
+    pub sidi: [u8; 4],
+    /// Kyber 512 Ephemeral Ciphertext
+    pub ecti: [u8; EphemeralKem::CT_LEN],
+    /// Classic McEliece Ciphertext
+    pub scti: [u8; StaticKem::CT_LEN],
+    /// Empty encrypted message (just an auth tag)
+    pub auth: [u8; aead::TAG_LEN],
+    /// Responders handshake state in encrypted form
+    pub biscuit: [u8; BISCUIT_CT_LEN],
+}
+
+#[repr(packed)]
+#[derive(AsBytes, FromBytes, FromZeroes)]
+pub struct InitConf {
+    /// Copied from InitHello
+    pub sidi: [u8; 4],
+    /// Copied from RespHello
+    pub sidr: [u8; 4],
+    /// Responders handshake state in encrypted form
+    pub biscuit: [u8; BISCUIT_CT_LEN],
+    /// Empty encrypted message (just an auth tag)
+    pub auth: [u8; aead::TAG_LEN],
+}
+
+#[repr(packed)]
+#[derive(AsBytes, FromBytes, FromZeroes)]
+pub struct EmptyData {
+    /// Copied from RespHello
+    pub sid: [u8; 4],
+    /// Nonce
+    pub ctr: [u8; 8],
+    /// Empty encrypted message (just an auth tag)
+    pub auth: [u8; aead::TAG_LEN],
+}
+
+#[repr(packed)]
+#[derive(AsBytes, FromBytes, FromZeroes)]
+pub struct Biscuit {
+    /// H(spki) – Ident ifies the initiator
+    pub pidi: [u8; KEY_LEN],
+    /// The biscuit number (replay protection)
+    pub biscuit_no: [u8; 12],
+    /// Chaining key
+    pub ck: [u8; KEY_LEN],
+}
+
+#[repr(packed)]
+#[derive(AsBytes, FromBytes, FromZeroes)]
+pub struct DataMsg {
+    pub dummy: [u8; 4],
+}
+
+#[repr(packed)]
+#[derive(AsBytes, FromBytes, FromZeroes)]
+pub struct CookieReply {
+    pub dummy: [u8; 4],
+}
+
+// Traits /////////////////////////////////////////////////////////////////////
+
+pub trait WireMsg: std::fmt::Debug {
+    const MSG_TYPE: MsgType;
+    const MSG_TYPE_U8: u8 = Self::MSG_TYPE as u8;
+    const BYTES: usize;
+}
+
+// Constants //////////////////////////////////////////////////////////////////
+
+pub const SESSION_ID_LEN: usize = 4;
+pub const BISCUIT_ID_LEN: usize = 12;
+
+pub const WIRE_ENVELOPE_LEN: usize = 1 + 3 + 16 + 16; // TODO verify this
+
+/// Size required to fit any message in binary form
+pub const MAX_MESSAGE_LEN: usize = 2500; // TODO fix this
+
+/// Recognized message types
+#[repr(u8)]
+#[derive(Hash, PartialEq, Eq, PartialOrd, Ord, Debug, Clone, Copy)]
+pub enum MsgType {
+    InitHello = 0x81,
+    RespHello = 0x82,
+    InitConf = 0x83,
+    EmptyData = 0x84,
+    DataMsg = 0x85,
+    CookieReply = 0x86,
+}
+
+impl TryFrom<u8> for MsgType {
+    type Error = RosenpassError;
+
+    fn try_from(value: u8) -> Result<Self, Self::Error> {
+        Ok(match value {
+            0x81 => MsgType::InitHello,
+            0x82 => MsgType::RespHello,
+            0x83 => MsgType::InitConf,
+            0x84 => MsgType::EmptyData,
+            0x85 => MsgType::DataMsg,
+            0x86 => MsgType::CookieReply,
+            _ => return Err(RosenpassError::InvalidMessageType(value)),
+        })
+    }
+}
+
+/// length in bytes of an unencrypted Biscuit (plain text)
+pub const BISCUIT_PT_LEN: usize = size_of::<Biscuit>();
+
+/// Length in bytes of an encrypted Biscuit (cipher text)
+pub const BISCUIT_CT_LEN: usize = BISCUIT_PT_LEN + xaead::NONCE_LEN + xaead::TAG_LEN;
+
+#[cfg(test)]
+mod test_constants {
+    use crate::msgs::{BISCUIT_CT_LEN, BISCUIT_PT_LEN};
+    use rosenpass_ciphers::{xaead, KEY_LEN};
+
+    #[test]
+    fn sodium_keysize() {
+        assert_eq!(KEY_LEN, 32);
+    }
+
+    #[test]
+    fn biscuit_pt_len() {
+        assert_eq!(BISCUIT_PT_LEN, 2 * KEY_LEN + 12);
+    }
+
+    #[test]
+    fn biscuit_ct_len() {
+        assert_eq!(
+            BISCUIT_CT_LEN,
+            BISCUIT_PT_LEN + xaead::NONCE_LEN + xaead::TAG_LEN
+        );
+    }
+}

rosenpass/tests/integration_test.rs

@@ -30,11 +30,8 @@ fn generate_keys() {
 
 fn find_udp_socket() -> u16 {
     for port in 1025..=u16::MAX {
-        match UdpSocket::bind(("127.0.0.1", port)) {
-            Ok(_) => {
-                return port;
-            }
-            _ => {}
+        if UdpSocket::bind(("127.0.0.1", port)).is_ok() {
+            return port;
         }
     }
     panic!("no free UDP port found");
@@ -54,9 +51,9 @@ fn check_exchange() {
     for (secret_key_path, pub_key_path) in secret_key_paths.iter().zip(public_key_paths.iter()) {
         let output = test_bin::get_test_bin(BIN)
             .args(["gen-keys", "--secret-key"])
-            .arg(&secret_key_path)
+            .arg(secret_key_path)
             .arg("--public-key")
-            .arg(&pub_key_path)
+            .arg(pub_key_path)
             .output()
             .expect("Failed to start {BIN}");
 

rp

@@ -197,7 +197,7 @@ exchange() {
         lip="${listen%:*}";
         lport="${listen/*:/}";
         if [[ "$lip" = "$lport" ]]; then
-          lip="[0::0]"
+          lip="[::]"
         fi
         shift;;
       -h | -help | --help | help) usage; return 0;;
@@ -209,15 +209,41 @@ exchange() {
     fatal "Needs at least one peer specified"
   fi
 
-  frag "
-    # Create the Wireguard interface
-    ip link add dev $(enquote "${dev}") type wireguard || true"
+  # os dependent setup
+  case "$OSTYPE" in
+    linux-*) # could be linux-gnu or linux-musl
+      frag "
+        # Create the WireGuard interface
+        ip link add dev $(enquote "${dev}") type wireguard || true"
 
-  cleanup "
-    ip link del dev $(enquote "${dev}") || true"
+      cleanup "
+        ip link del dev $(enquote "${dev}") || true"
 
-  frag "
-    ip link set dev $(enquote "${dev}") up"
+      frag "
+        ip link set dev $(enquote "${dev}") up"
+      ;;
+
+    freebsd*)
+      frag "
+        # load the WireGuard kernel module
+        kldload -n if_wg || fatal 'Cannot load if_wg kernel module'"
+
+      frag "
+        # Create the WireGuard interface
+        ifconfig wg create name $(enquote "${dev}") || true"
+
+      cleanup "
+        ifconfig $(enquote "${dev}") destroy || true"
+
+      frag "
+        ifconfig $(enquote "${dev}") up"
+      ;;
+
+    *)
+      fatal "Your system $OSTYPE is not yet supported. We are happy to receive patches to address this :)"
+      ;;
+
+  esac
 
   frag "
     # Deploy the classic wireguard private key
@@ -255,7 +281,7 @@ exchange() {
       local arg; arg="$1"; shift
       case "${arg}" in
         peer) set -- "peer" "$@"; break;; # Next peer
-        endpoint) ip="${1%:*}"; port="${1/*:/}"; shift;;
+        endpoint) ip="${1%:*}"; port="${1##*:}"; shift;;
         persistent-keepalive) keepalive="${1}"; shift;;
         allowed-ips) allowedips="${1}"; shift;;
         -h | -help | --help | help) usage; return 0;;
@@ -326,7 +352,9 @@ main() {
   verbose=0
   scriptdir="$(dirname "${script}")"
   gitdir="$(detect_git_dir)" || true
-  nixdir="$(readlink -f result/bin/rp | grep -Pio '^/nix/store/[^/]+(?=/bin/[^/]+)')" || true
+  if [[ -d /nix ]]; then
+    nixdir="$(readlink -f result/bin/rp | grep -Pio '^/nix/store/[^/]+(?=/bin/[^/]+)')" || true
+  fi
   binary="$(find_rosenpass_binary)"
 
   # Parse command

secret-memory/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "rosenpass-secret-memory"
+version = "0.1.0"
+authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
+edition = "2021"
+license = "MIT OR Apache-2.0"
+description = "Rosenpass internal utilities for storing secrets in memory"
+homepage = "https://rosenpass.eu/"
+repository = "https://github.com/rosenpass/rosenpass"
+readme = "readme.md"
+
+[dependencies]
+anyhow = { workspace = true }
+rosenpass-to = { workspace = true }
+rosenpass-util = { workspace = true }
+zeroize = { workspace = true }
+rand = { workspace = true }
+memsec = { workspace = true }
+allocator-api2 = { workspace = true }
+log = { workspace = true }
+
+[dev-dependencies]
+allocator-api2-tests = { workspace = true }

secret-memory/readme.md

@@ -0,0 +1,5 @@
+# Rosenpass secure memory library
+
+Rosenpass internal library providing utilities for securely storing secret data in memory.
+
+This is an internal library; not guarantee is made about its API at this point in time.

secret-memory/src/alloc/memsec.rs

@@ -0,0 +1,108 @@
+use std::fmt;
+use std::ptr::NonNull;
+
+use allocator_api2::alloc::{AllocError, Allocator, Layout};
+
+#[derive(Copy, Clone, Default)]
+struct MemsecAllocatorContents;
+
+/// Memory allocation using using the memsec crate
+#[derive(Copy, Clone, Default)]
+pub struct MemsecAllocator {
+    _dummy_private_data: MemsecAllocatorContents,
+}
+
+/// A box backed by the memsec allocator
+pub type MemsecBox<T> = allocator_api2::boxed::Box<T, MemsecAllocator>;
+
+/// A vector backed by the memsec allocator
+pub type MemsecVec<T> = allocator_api2::vec::Vec<T, MemsecAllocator>;
+
+pub fn memsec_box<T>(x: T) -> MemsecBox<T> {
+    MemsecBox::<T>::new_in(x, MemsecAllocator::new())
+}
+
+pub fn memsec_vec<T>() -> MemsecVec<T> {
+    MemsecVec::<T>::new_in(MemsecAllocator::new())
+}
+
+impl MemsecAllocator {
+    pub fn new() -> Self {
+        Self {
+            _dummy_private_data: MemsecAllocatorContents,
+        }
+    }
+}
+
+unsafe impl Allocator for MemsecAllocator {
+    fn allocate(&self, layout: Layout) -> Result<NonNull<[u8]>, AllocError> {
+        // Call memsec allocator
+        let mem: Option<NonNull<[u8]>> = unsafe { memsec::malloc_sized(layout.size()) };
+
+        // Unwrap the option
+        let Some(mem) = mem else {
+            log::error!("Allocation {layout:?} was requested but memsec returned a null pointer");
+            return Err(AllocError);
+        };
+
+        // Ensure the right alignment is used
+        let off = (mem.as_ptr() as *const u8).align_offset(layout.align());
+        if off != 0 {
+            log::error!("Allocation {layout:?} was requested but memsec returned allocation \
+                with offset {off} from the requested alignment. Memsec always allocates values \
+                at the end of a memory page for security reasons, custom alignments are not supported. \
+                You could try allocating an oversized value.");
+            unsafe { memsec::free(mem) };
+            return Err(AllocError);
+        };
+
+        Ok(mem)
+    }
+
+    unsafe fn deallocate(&self, ptr: NonNull<u8>, _layout: Layout) {
+        unsafe {
+            memsec::free(ptr);
+        }
+    }
+}
+
+impl fmt::Debug for MemsecAllocator {
+    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
+        fmt.write_str("<memsec based Rust allocator>")
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use allocator_api2_tests::make_test;
+
+    use super::*;
+
+    make_test! { test_sizes(MemsecAllocator::new()) }
+    make_test! { test_vec(MemsecAllocator::new()) }
+    make_test! { test_many_boxes(MemsecAllocator::new()) }
+
+    #[test]
+    fn memsec_allocation() {
+        let alloc = MemsecAllocator::new();
+        memsec_allocation_impl::<0>(&alloc);
+        memsec_allocation_impl::<7>(&alloc);
+        memsec_allocation_impl::<8>(&alloc);
+        memsec_allocation_impl::<64>(&alloc);
+        memsec_allocation_impl::<999>(&alloc);
+    }
+
+    fn memsec_allocation_impl<const N: usize>(alloc: &MemsecAllocator) {
+        let layout = Layout::new::<[u8; N]>();
+        let mem = alloc.allocate(layout).unwrap();
+
+        // https://libsodium.gitbook.io/doc/memory_management#guarded-heap-allocations
+        // promises us that allocated memory is initialized with the magic byte 0xDB
+        // and memsec promises to provide a reimplementation of the libsodium mechanism;
+        // it uses the magic value 0xD0 though
+        assert_eq!(unsafe { mem.as_ref() }, &[0xD0u8; N]);
+
+        let mem = NonNull::new(mem.as_ptr() as *mut u8).unwrap();
+        unsafe { alloc.deallocate(mem, layout) };
+    }
+}

secret-memory/src/alloc/mod.rs

@@ -0,0 +1,6 @@
+pub mod memsec;
+
+pub use crate::alloc::memsec::{
+    memsec_box as secret_box, memsec_vec as secret_vec, MemsecAllocator as SecretAllocator,
+    MemsecBox as SecretBox, MemsecVec as SecretVec,
+};

secret-memory/src/debug.rs

@@ -0,0 +1,20 @@
+use std::fmt;
+
+/// Writes the contents of an `&[u8]` as hexadecimal symbols to a [std::fmt::Formatter]
+pub fn debug_crypto_array(v: &[u8], fmt: &mut fmt::Formatter) -> fmt::Result {
+    fmt.write_str("[{}]=")?;
+    if v.len() > 64 {
+        for byte in &v[..32] {
+            std::fmt::LowerHex::fmt(byte, fmt)?;
+        }
+        fmt.write_str("…")?;
+        for byte in &v[v.len() - 32..] {
+            std::fmt::LowerHex::fmt(byte, fmt)?;
+        }
+    } else {
+        for byte in v {
+            std::fmt::LowerHex::fmt(byte, fmt)?;
+        }
+    }
+    Ok(())
+}

secret-memory/src/file.rs

@@ -0,0 +1,7 @@
+use std::path::Path;
+
+pub trait StoreSecret {
+    type Error;
+
+    fn store_secret<P: AsRef<Path>>(&self, path: P) -> Result<(), Self::Error>;
+}

secret-memory/src/lib.rs

@@ -0,0 +1,11 @@
+pub mod debug;
+pub mod file;
+pub mod rand;
+
+pub mod alloc;
+
+mod public;
+pub use crate::public::Public;
+
+mod secret;
+pub use crate::secret::Secret;

secret-memory/src/public.rs

@@ -0,0 +1,112 @@
+use crate::debug::debug_crypto_array;
+use rand::{Fill as Randomize, Rng};
+use rosenpass_to::{ops::copy_slice, To};
+use rosenpass_util::file::{fopen_r, LoadValue, ReadExactToEnd, StoreValue};
+use rosenpass_util::functional::mutating;
+use std::borrow::{Borrow, BorrowMut};
+use std::fmt;
+use std::ops::{Deref, DerefMut};
+use std::path::Path;
+
+/// Contains information in the form of a byte array that may be known to the
+/// public
+// TODO: We should get rid of the Public type; just use a normal value
+#[derive(Copy, Clone, Hash, PartialEq, Eq, PartialOrd, Ord)]
+#[repr(transparent)]
+pub struct Public<const N: usize> {
+    pub value: [u8; N],
+}
+
+impl<const N: usize> Public<N> {
+    /// Create a new [Public] from a byte slice
+    pub fn from_slice(value: &[u8]) -> Self {
+        copy_slice(value).to_this(Self::zero)
+    }
+
+    /// Create a new [Public] from a byte array
+    pub fn new(value: [u8; N]) -> Self {
+        Self { value }
+    }
+
+    /// Create a zero initialized [Public]
+    pub fn zero() -> Self {
+        Self { value: [0u8; N] }
+    }
+
+    /// Create a random initialized [Public]
+    pub fn random() -> Self {
+        mutating(Self::zero(), |r| r.randomize())
+    }
+
+    /// Randomize all bytes in an existing [Public]
+    pub fn randomize(&mut self) {
+        self.try_fill(&mut crate::rand::rng()).unwrap()
+    }
+}
+
+impl<const N: usize> Randomize for Public<N> {
+    fn try_fill<R: Rng + ?Sized>(&mut self, rng: &mut R) -> Result<(), rand::Error> {
+        self.value.try_fill(rng)
+    }
+}
+
+impl<const N: usize> fmt::Debug for Public<N> {
+    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
+        debug_crypto_array(&self.value, fmt)
+    }
+}
+
+impl<const N: usize> Deref for Public<N> {
+    type Target = [u8; N];
+
+    fn deref(&self) -> &[u8; N] {
+        &self.value
+    }
+}
+
+impl<const N: usize> DerefMut for Public<N> {
+    fn deref_mut(&mut self) -> &mut [u8; N] {
+        &mut self.value
+    }
+}
+
+impl<const N: usize> Borrow<[u8; N]> for Public<N> {
+    fn borrow(&self) -> &[u8; N] {
+        &self.value
+    }
+}
+impl<const N: usize> BorrowMut<[u8; N]> for Public<N> {
+    fn borrow_mut(&mut self) -> &mut [u8; N] {
+        &mut self.value
+    }
+}
+
+impl<const N: usize> Borrow<[u8]> for Public<N> {
+    fn borrow(&self) -> &[u8] {
+        &self.value
+    }
+}
+impl<const N: usize> BorrowMut<[u8]> for Public<N> {
+    fn borrow_mut(&mut self) -> &mut [u8] {
+        &mut self.value
+    }
+}
+
+impl<const N: usize> LoadValue for Public<N> {
+    type Error = anyhow::Error;
+
+    fn load<P: AsRef<Path>>(path: P) -> anyhow::Result<Self> {
+        let mut v = Self::random();
+        fopen_r(path)?.read_exact_to_end(&mut *v)?;
+        Ok(v)
+    }
+}
+
+impl<const N: usize> StoreValue for Public<N> {
+    type Error = anyhow::Error;
+
+    fn store<P: AsRef<Path>>(&self, path: P) -> anyhow::Result<()> {
+        std::fs::write(path, **self)?;
+        Ok(())
+    }
+}

secret-memory/src/rand.rs

@@ -0,0 +1,5 @@
+pub type Rng = rand::rngs::ThreadRng;
+
+pub fn rng() -> Rng {
+    rand::thread_rng()
+}

secret-memory/src/secret.rs

@@ -0,0 +1,321 @@
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::convert::TryInto;
+use std::fmt;
+use std::ops::{Deref, DerefMut};
+use std::path::Path;
+
+use anyhow::Context;
+use rand::{Fill as Randomize, Rng};
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
+use rosenpass_util::b64::b64_reader;
+use rosenpass_util::file::{fopen_r, LoadValue, LoadValueB64, ReadExactToEnd};
+use rosenpass_util::functional::mutating;
+
+use crate::alloc::{secret_box, SecretBox, SecretVec};
+use crate::file::StoreSecret;
+
+// This might become a problem in library usage; it's effectively a memory
+// leak which probably isn't a problem right now because most memory will
+// be reused…
+thread_local! {
+    static SECRET_CACHE: RefCell<SecretMemoryPool> = RefCell::new(SecretMemoryPool::new());
+}
+
+fn with_secret_memory_pool<Fn, R>(mut f: Fn) -> R
+where
+    Fn: FnMut(Option<&mut SecretMemoryPool>) -> R,
+{
+    // This acquires the SECRET_CACHE
+    SECRET_CACHE
+        .try_with(|cell| {
+            // And acquires the inner reference
+            cell.try_borrow_mut()
+                .as_deref_mut()
+                // To call the given function
+                .map(|pool| f(Some(pool)))
+                .ok()
+        })
+        .ok()
+        .flatten()
+        // Failing that, the given function is called with None
+        .unwrap_or_else(|| f(None))
+}
+
+// Wrapper around SecretBox that applies automatic zeroization
+#[derive(Debug)]
+struct ZeroizingSecretBox<T: Zeroize + ?Sized>(Option<SecretBox<T>>);
+
+impl<T: Zeroize> ZeroizingSecretBox<T> {
+    fn new(boxed: T) -> Self {
+        ZeroizingSecretBox(Some(secret_box(boxed)))
+    }
+}
+
+impl<T: Zeroize + ?Sized> ZeroizingSecretBox<T> {
+    fn from_secret_box(inner: SecretBox<T>) -> Self {
+        Self(Some(inner))
+    }
+
+    fn take(mut self) -> SecretBox<T> {
+        self.0.take().unwrap()
+    }
+}
+
+impl<T: Zeroize + ?Sized> ZeroizeOnDrop for ZeroizingSecretBox<T> {}
+impl<T: Zeroize + ?Sized> Zeroize for ZeroizingSecretBox<T> {
+    fn zeroize(&mut self) {
+        if let Some(inner) = &mut self.0 {
+            let inner: &mut SecretBox<T> = inner; // type annotation
+            inner.zeroize()
+        }
+    }
+}
+
+impl<T: Zeroize + ?Sized> Drop for ZeroizingSecretBox<T> {
+    fn drop(&mut self) {
+        self.zeroize()
+    }
+}
+
+impl<T: Zeroize + ?Sized> Deref for ZeroizingSecretBox<T> {
+    type Target = T;
+
+    fn deref(&self) -> &T {
+        self.0.as_ref().unwrap()
+    }
+}
+
+impl<T: Zeroize + ?Sized> DerefMut for ZeroizingSecretBox<T> {
+    fn deref_mut(&mut self) -> &mut T {
+        self.0.as_mut().unwrap()
+    }
+}
+
+/// Pool that stores secret memory allocations
+///
+/// Allocation of secret memory is expensive. Thus, this struct provides a
+/// pool of secret memory, readily available to yield protected, slices of
+/// memory.
+#[derive(Debug)] // TODO check on Debug derive, is that clever
+struct SecretMemoryPool {
+    pool: HashMap<usize, Vec<ZeroizingSecretBox<[u8]>>>,
+}
+
+impl SecretMemoryPool {
+    /// Create a new [SecretMemoryPool]
+    #[allow(clippy::new_without_default)]
+    pub fn new() -> Self {
+        Self {
+            pool: HashMap::new(),
+        }
+    }
+
+    /// Return secret back to the pool for future re-use
+    pub fn release<const N: usize>(&mut self, mut sec: ZeroizingSecretBox<[u8; N]>) {
+        sec.zeroize();
+
+        // This conversion sequence is weird but at least it guarantees
+        // that the heap allocation is preserved according to the docs
+        let sec: SecretVec<u8> = sec.take().into();
+        let sec: SecretBox<[u8]> = sec.into();
+
+        self.pool
+            .entry(N)
+            .or_default()
+            .push(ZeroizingSecretBox::from_secret_box(sec));
+    }
+
+    /// Take protected memory from the pool, allocating new one if no suitable
+    /// chunk is found in the inventory.
+    ///
+    /// The secret is guaranteed to be full of nullbytes
+    pub fn take<const N: usize>(&mut self) -> ZeroizingSecretBox<[u8; N]> {
+        let entry = self.pool.entry(N).or_default();
+        let inner = match entry.pop() {
+            None => secret_box([0u8; N]),
+            Some(sec) => sec.take().try_into().unwrap(),
+        };
+        ZeroizingSecretBox::from_secret_box(inner)
+    }
+}
+
+/// Storage for secret data
+pub struct Secret<const N: usize> {
+    storage: Option<ZeroizingSecretBox<[u8; N]>>,
+}
+
+impl<const N: usize> Secret<N> {
+    pub fn from_slice(slice: &[u8]) -> Self {
+        let mut new_self = Self::zero();
+        new_self.secret_mut().copy_from_slice(slice);
+        new_self
+    }
+
+    /// Returns a new [Secret] that is zero initialized
+    pub fn zero() -> Self {
+        // Using [SecretMemoryPool] here because this operation is expensive,
+        // yet it is used in hot loops
+        let buf = with_secret_memory_pool(|pool| {
+            pool.map(|p| p.take())
+                .unwrap_or_else(|| ZeroizingSecretBox::new([0u8; N]))
+        });
+
+        Self { storage: Some(buf) }
+    }
+
+    /// Returns a new [Secret] that is randomized
+    pub fn random() -> Self {
+        mutating(Self::zero(), |r| r.randomize())
+    }
+
+    /// Sets all data an existing secret to random bytes
+    pub fn randomize(&mut self) {
+        self.try_fill(&mut crate::rand::rng()).unwrap()
+    }
+
+    /// Borrows the data
+    pub fn secret(&self) -> &[u8; N] {
+        self.storage.as_ref().unwrap()
+    }
+
+    /// Borrows the data mutably
+    pub fn secret_mut(&mut self) -> &mut [u8; N] {
+        self.storage.as_mut().unwrap()
+    }
+}
+
+impl<const N: usize> Randomize for Secret<N> {
+    fn try_fill<R: Rng + ?Sized>(&mut self, rng: &mut R) -> Result<(), rand::Error> {
+        // Zeroize self first just to make sure the barriers from the zeroize create take
+        // effect to prevent the compiler from optimizing this away.
+        // We should at some point replace this with our own barriers.
+        self.zeroize();
+        self.secret_mut().try_fill(rng)
+    }
+}
+
+impl<const N: usize> ZeroizeOnDrop for Secret<N> {}
+impl<const N: usize> Zeroize for Secret<N> {
+    fn zeroize(&mut self) {
+        if let Some(inner) = &mut self.storage {
+            inner.zeroize()
+        }
+    }
+}
+
+impl<const N: usize> Drop for Secret<N> {
+    fn drop(&mut self) {
+        with_secret_memory_pool(|pool| {
+            if let Some((pool, secret)) = pool.zip(self.storage.take()) {
+                pool.release(secret);
+            }
+        });
+
+        // This should be unnecessary: The pool has one item – the inner secret – which
+        // zeroizes itself on drop. Calling it should not do any harm though…
+        self.zeroize()
+    }
+}
+
+impl<const N: usize> Clone for Secret<N> {
+    fn clone(&self) -> Self {
+        Self::from_slice(self.secret())
+    }
+}
+
+/// The Debug implementation of [Secret] does not reveal the secret data,
+/// instead a placeholder `<SECRET>` is used
+impl<const N: usize> fmt::Debug for Secret<N> {
+    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
+        fmt.write_str("<SECRET>")
+    }
+}
+
+impl<const N: usize> LoadValue for Secret<N> {
+    type Error = anyhow::Error;
+
+    fn load<P: AsRef<Path>>(path: P) -> anyhow::Result<Self> {
+        let mut v = Self::random();
+        let p = path.as_ref();
+        fopen_r(p)?
+            .read_exact_to_end(v.secret_mut())
+            .with_context(|| format!("Could not load file {p:?}"))?;
+        Ok(v)
+    }
+}
+
+impl<const N: usize> LoadValueB64 for Secret<N> {
+    type Error = anyhow::Error;
+
+    fn load_b64<P: AsRef<Path>>(path: P) -> anyhow::Result<Self> {
+        use std::io::Read;
+
+        let mut v = Self::random();
+        let p = path.as_ref();
+        // This might leave some fragments of the secret on the stack;
+        // in practice this is likely not a problem because the stack likely
+        // will be overwritten by something else soon but this is not exactly
+        // guaranteed. It would be possible to remedy this, but since the secret
+        // data will linger in the Linux page cache anyways with the current
+        // implementation, going to great length to erase the secret here is
+        // not worth it right now.
+        b64_reader(&mut fopen_r(p)?)
+            .read_exact(v.secret_mut())
+            .with_context(|| format!("Could not load base64 file {p:?}"))?;
+        Ok(v)
+    }
+}
+
+impl<const N: usize> StoreSecret for Secret<N> {
+    type Error = anyhow::Error;
+
+    fn store_secret<P: AsRef<Path>>(&self, path: P) -> anyhow::Result<()> {
+        std::fs::write(path, self.secret())?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+
+    /// check that we can alloc using the magic pool
+    #[test]
+    fn secret_memory_pool_take() {
+        const N: usize = 0x100;
+        let mut pool = SecretMemoryPool::new();
+        let secret: ZeroizingSecretBox<[u8; N]> = pool.take();
+        assert_eq!(secret.as_ref(), &[0; N]);
+    }
+
+    /// check that a secrete lives, even if its [SecretMemoryPool] is deleted
+    #[test]
+    fn secret_memory_pool_drop() {
+        const N: usize = 0x100;
+        let mut pool = SecretMemoryPool::new();
+        let secret: ZeroizingSecretBox<[u8; N]> = pool.take();
+        std::mem::drop(pool);
+        assert_eq!(secret.as_ref(), &[0; N]);
+    }
+
+    /// check that a secrete can be reborn, freshly initialized with zero
+    #[test]
+    fn secret_memory_pool_release() {
+        const N: usize = 1;
+        let mut pool = SecretMemoryPool::new();
+        let mut secret: ZeroizingSecretBox<[u8; N]> = pool.take();
+        let old_secret_ptr = secret.as_ref().as_ptr();
+
+        secret.as_mut()[0] = 0x13;
+        pool.release(secret);
+
+        // now check that we get the same ptr
+        let new_secret: ZeroizingSecretBox<[u8; N]> = pool.take();
+        assert_eq!(old_secret_ptr, new_secret.as_ref().as_ptr());
+
+        // and that the secret was zeroized
+        assert_eq!(new_secret.as_ref(), &[0; N]);
+    }
+}

src/coloring.rs

@@ -1,361 +0,0 @@
-//! Types types for dealing with (secret-) values
-//!
-//! These types use type level coloring to make accidential leackage of secrets extra hard. Both [Secret] and [Public] own their data, but the memory backing
-//! [Secret] is special:
-//! - as it is heap allocated, we can actively zeroize the memory before freeing it.
-//! - guard pages before and after each allocation trap accidential sequential reads that creep towards our secrets
-//! - the memory is mlocked, e.g. it is never swapped
-
-use crate::{
-    sodium::{rng, zeroize},
-    util::{cpy, mutating},
-};
-use lazy_static::lazy_static;
-use libsodium_sys as libsodium;
-use std::{
-    collections::HashMap,
-    convert::TryInto,
-    fmt,
-    ops::{Deref, DerefMut},
-    os::raw::c_void,
-    ptr::null_mut,
-    sync::Mutex,
-};
-
-// This might become a problem in library usage; it's effectively a memory
-// leak which probably isn't a problem right now because most memory will
-// be reused…
-lazy_static! {
-    static ref SECRET_CACHE: Mutex<SecretMemoryPool> = Mutex::new(SecretMemoryPool::new());
-}
-
-/// Pool that stores secret memory allocations
-///
-/// Allocation of secret memory is expensive. Thus, this struct provides a
-/// pool of secret memory, readily available to yield protected, slices of
-/// memory.
-///
-/// Further information about the protection in place can be found in in the
-/// [libsodium documentation](https://libsodium.gitbook.io/doc/memory_management#guarded-heap-allocations)
-#[derive(Debug)] // TODO check on Debug derive, is that clever
-pub struct SecretMemoryPool {
-    pool: HashMap<usize, Vec<*mut c_void>>,
-}
-
-impl SecretMemoryPool {
-    /// Create a new [SecretMemoryPool]
-    #[allow(clippy::new_without_default)]
-    pub fn new() -> Self {
-        let pool = HashMap::new();
-
-        Self { pool }
-    }
-
-    /// Return secrete back to the pool for future re-use
-    ///
-    /// This consumes the [Secret], but its memory is re-used.
-    pub fn release<const N: usize>(&mut self, mut s: Secret<N>) {
-        unsafe {
-            self.release_by_ref(&mut s);
-        }
-        std::mem::forget(s);
-    }
-
-    /// Return secret back to the pool for future re-use, by slice
-    ///
-    /// # Safety
-    ///
-    /// After calling this function on a [Secret], the secret must never be
-    /// used again for anything.
-    unsafe fn release_by_ref<const N: usize>(&mut self, s: &mut Secret<N>) {
-        s.zeroize();
-        let Secret { ptr: secret } = s;
-        // don't call Secret::drop, that could cause a double free
-        self.pool.entry(N).or_default().push(*secret);
-    }
-
-    /// Take protected memory from the pool, allocating new one if no suitable
-    /// chunk is found in the inventory.
-    ///
-    /// The secret is guaranteed to be full of nullbytes
-    ///
-    /// # Safety
-    ///
-    /// This function contains an unsafe call to [libsodium::sodium_malloc].
-    /// This call has no known safety invariants, thus nothing can go wrong™.
-    /// However, just like normal `malloc()` this can return a null ptr. Thus
-    /// the returned pointer is checked for null; causing the program to panic
-    /// if it is null.
-    pub fn take<const N: usize>(&mut self) -> Secret<N> {
-        let entry = self.pool.entry(N).or_default();
-        let secret = entry.pop().unwrap_or_else(|| {
-            let ptr = unsafe { libsodium::sodium_malloc(N) };
-            assert!(
-                !ptr.is_null(),
-                "libsodium::sodium_mallloc() returned a null ptr"
-            );
-            ptr
-        });
-
-        let mut s = Secret { ptr: secret };
-        s.zeroize();
-        s
-    }
-}
-
-impl Drop for SecretMemoryPool {
-    /// # Safety
-    ///
-    /// The drop implementation frees the contained elements using
-    /// [libsodium::sodium_free]. This is safe as long as every `*mut c_void`
-    /// contained was initialized with a call to [libsodium::sodium_malloc]
-    fn drop(&mut self) {
-        for ptr in self.pool.drain().flat_map(|(_, x)| x.into_iter()) {
-            unsafe {
-                libsodium::sodium_free(ptr);
-            }
-        }
-    }
-}
-
-/// # Safety
-///
-/// No safety implications are known, since the `*mut c_void` in
-/// is essentially used like a `&mut u8` [SecretMemoryPool].
-unsafe impl Send for SecretMemoryPool {}
-
-/// Store for a secret
-///
-/// Uses memory allocated with [libsodium::sodium_malloc],
-/// esentially can do the same things as `[u8; N].as_mut_ptr()`.
-pub struct Secret<const N: usize> {
-    ptr: *mut c_void,
-}
-
-impl<const N: usize> Clone for Secret<N> {
-    fn clone(&self) -> Self {
-        let mut new = Self::zero();
-        new.secret_mut().clone_from_slice(self.secret());
-        new
-    }
-}
-
-impl<const N: usize> Drop for Secret<N> {
-    fn drop(&mut self) {
-        self.zeroize();
-        // the invariant that the [Secret] is not used after the
-        // `release_by_ref` call is guaranteed, since this is a drop implementation
-        unsafe { SECRET_CACHE.lock().unwrap().release_by_ref(self) };
-        self.ptr = null_mut();
-    }
-}
-
-impl<const N: usize> Secret<N> {
-    pub fn from_slice(slice: &[u8]) -> Self {
-        let mut new_self = Self::zero();
-        new_self.secret_mut().copy_from_slice(slice);
-        new_self
-    }
-
-    /// Returns a new [Secret] that is zero initialized
-    pub fn zero() -> Self {
-        // Using [SecretMemoryPool] here because this operation is expensive,
-        // yet it is used in hot loops
-        let s = SECRET_CACHE.lock().unwrap().take();
-        assert_eq!(s.secret(), &[0u8; N]);
-        s
-    }
-
-    /// Returns a new [Secret] that is randomized
-    pub fn random() -> Self {
-        mutating(Self::zero(), |r| r.randomize())
-    }
-
-    /// Sets all data of an existing secret to null bytes
-    pub fn zeroize(&mut self) {
-        zeroize(self.secret_mut());
-    }
-
-    /// Sets all data an existing secret to random bytes
-    pub fn randomize(&mut self) {
-        rng(self.secret_mut());
-    }
-
-    /// Borrows the data
-    pub fn secret(&self) -> &[u8; N] {
-        // - calling `from_raw_parts` is safe, because `ptr` is initalized with
-        //   as `N` byte allocation from the creation of `Secret` onwards. `ptr`
-        //   stays valid over the full lifetime of `Secret`
-        //
-        // - calling uwnrap is safe, because we can guarantee that the slice has
-        //   exactly the required size `N` to create an array of `N` elements.
-        let ptr = self.ptr as *const u8;
-        let slice = unsafe { std::slice::from_raw_parts(ptr, N) };
-        slice.try_into().unwrap()
-    }
-
-    /// Borrows the data mutably
-    pub fn secret_mut(&mut self) -> &mut [u8; N] {
-        // the same safety argument as for `secret()` holds
-        let ptr = self.ptr as *mut u8;
-        let slice = unsafe { std::slice::from_raw_parts_mut(ptr, N) };
-        slice.try_into().unwrap()
-    }
-}
-
-/// The Debug implementation of [Secret] does not reveal the secret data,
-/// instead a placeholder `<SECRET>` is used
-impl<const N: usize> fmt::Debug for Secret<N> {
-    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
-        fmt.write_str("<SECRET>")
-    }
-}
-
-/// Contains information in the form of a byte array that may be known to the
-/// public
-// TODO: We should get rid of the Public type; just use a normal value
-#[derive(Copy, Clone, Hash, PartialEq, Eq, PartialOrd, Ord)]
-#[repr(transparent)]
-pub struct Public<const N: usize> {
-    pub value: [u8; N],
-}
-
-impl<const N: usize> Public<N> {
-    /// Create a new [Public] from a byte slice
-    pub fn from_slice(value: &[u8]) -> Self {
-        mutating(Self::zero(), |r| cpy(value, &mut r.value))
-    }
-
-    /// Create a new [Public] from a byte array
-    pub fn new(value: [u8; N]) -> Self {
-        Self { value }
-    }
-
-    /// Create a zero initialized [Public]
-    pub fn zero() -> Self {
-        Self { value: [0u8; N] }
-    }
-
-    /// Create a random initialized [Public]
-    pub fn random() -> Self {
-        mutating(Self::zero(), |r| r.randomize())
-    }
-
-    /// Randomize all bytes in an existing [Public]
-    pub fn randomize(&mut self) {
-        rng(&mut self.value);
-    }
-}
-
-/// Writes the contents of an `&[u8]` as hexadecimal symbols to a [std::fmt::Formatter]
-pub fn debug_crypto_array(v: &[u8], fmt: &mut fmt::Formatter) -> fmt::Result {
-    fmt.write_str("[{}]=")?;
-    if v.len() > 64 {
-        for byte in &v[..32] {
-            std::fmt::LowerHex::fmt(byte, fmt)?;
-        }
-        fmt.write_str("…")?;
-        for byte in &v[v.len() - 32..] {
-            std::fmt::LowerHex::fmt(byte, fmt)?;
-        }
-    } else {
-        for byte in v {
-            std::fmt::LowerHex::fmt(byte, fmt)?;
-        }
-    }
-    Ok(())
-}
-
-impl<const N: usize> fmt::Debug for Public<N> {
-    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
-        debug_crypto_array(&self.value, fmt)
-    }
-}
-
-impl<const N: usize> Deref for Public<N> {
-    type Target = [u8; N];
-
-    fn deref(&self) -> &[u8; N] {
-        &self.value
-    }
-}
-
-impl<const N: usize> DerefMut for Public<N> {
-    fn deref_mut(&mut self) -> &mut [u8; N] {
-        &mut self.value
-    }
-}
-
-#[cfg(test)]
-mod test {
-    use super::*;
-
-    /// https://libsodium.gitbook.io/doc/memory_management#guarded-heap-allocations
-    /// promises us that allocated memory is initialized with this magic byte
-    const SODIUM_MAGIC_BYTE: u8 = 0xdb;
-
-    /// must be called before any interaction with libsodium
-    fn init() {
-        unsafe { libsodium_sys::sodium_init() };
-    }
-
-    /// checks that whe can malloc with libsodium
-    #[test]
-    fn sodium_malloc() {
-        init();
-        const N: usize = 8;
-        let ptr = unsafe { libsodium_sys::sodium_malloc(N) };
-        let mem = unsafe { std::slice::from_raw_parts(ptr as *mut u8, N) };
-        assert_eq!(mem, &[SODIUM_MAGIC_BYTE; N])
-    }
-
-    /// checks that whe can free with libsodium
-    #[test]
-    fn sodium_free() {
-        init();
-        const N: usize = 8;
-        let ptr = unsafe { libsodium_sys::sodium_malloc(N) };
-        unsafe { libsodium_sys::sodium_free(ptr) }
-    }
-
-    /// check that we can alloc using the magic pool
-    #[test]
-    fn secret_memory_pool_take() {
-        init();
-        const N: usize = 0x100;
-        let mut pool = SecretMemoryPool::new();
-        let secret: Secret<N> = pool.take();
-        assert_eq!(secret.secret(), &[0; N]);
-    }
-
-    /// check that a secrete lives, even if its [SecretMemoryPool] is deleted
-    #[test]
-    fn secret_memory_pool_drop() {
-        init();
-        const N: usize = 0x100;
-        let mut pool = SecretMemoryPool::new();
-        let secret: Secret<N> = pool.take();
-        std::mem::drop(pool);
-        assert_eq!(secret.secret(), &[0; N]);
-    }
-
-    /// check that a secrete can be reborn, freshly initialized with zero
-    #[test]
-    fn secret_memory_pool_release() {
-        init();
-        const N: usize = 1;
-        let mut pool = SecretMemoryPool::new();
-        let mut secret: Secret<N> = pool.take();
-        let old_secret_ptr = secret.ptr;
-
-        secret.secret_mut()[0] = 0x13;
-        pool.release(secret);
-
-        // now check that we get the same ptr
-        let new_secret: Secret<N> = pool.take();
-        assert_eq!(old_secret_ptr, new_secret.ptr);
-
-        // and that the secret was zeroized
-        assert_eq!(new_secret.secret(), &[0; N]);
-    }
-}

src/labeled_prf.rs

@@ -1,48 +0,0 @@
-//! Pseudo Random Functions (PRFs) with a tree-like label scheme which
-//! ensures their uniqueness
-
-use {
-    crate::Result,
-    crate::{prftree::PrfTree, sodium::KEY_SIZE},
-};
-
-pub fn protocol() -> Result<PrfTree> {
-    PrfTree::zero().mix("Rosenpass v1 mceliece460896 Kyber512 ChaChaPoly1305 BLAKE2s".as_bytes())
-}
-
-// TODO Use labels that can serve as identifiers
-macro_rules! prflabel {
-    ($base:ident, $name:ident, $($lbl:expr),* ) => {
-        pub fn $name() -> Result<PrfTree> {
-            let t = $base()?;
-            $( let t = t.mix($lbl.as_bytes())?; )*
-            Ok(t)
-        }
-    }
-}
-
-prflabel!(protocol, mac, "mac");
-prflabel!(protocol, cookie, "cookie");
-prflabel!(protocol, peerid, "peer id");
-prflabel!(protocol, biscuit_ad, "biscuit additional data");
-prflabel!(protocol, ckinit, "chaining key init");
-prflabel!(protocol, _ckextract, "chaining key extract");
-
-macro_rules! prflabel_leaf {
-    ($base:ident, $name:ident, $($lbl:expr),* ) => {
-        pub fn $name() -> Result<[u8; KEY_SIZE]> {
-            let t = $base()?;
-            $( let t = t.mix($lbl.as_bytes())?; )*
-            Ok(t.into_value())
-        }
-    }
-}
-
-prflabel_leaf!(_ckextract, mix, "mix");
-prflabel_leaf!(_ckextract, hs_enc, "handshake encryption");
-prflabel_leaf!(_ckextract, ini_enc, "initiator handshake encryption");
-prflabel_leaf!(_ckextract, res_enc, "responder handshake encryption");
-
-prflabel!(_ckextract, _user, "user");
-prflabel!(_user, _rp, "rosenpass.eu");
-prflabel_leaf!(_rp, osk, "wireguard psk");

src/lib.rs

@@ -1,131 +0,0 @@
-use protocol::{HandshakeStateMachine, PeerId, PeerPtr, SessionId};
-
-#[macro_use]
-pub mod util;
-#[macro_use]
-pub mod sodium;
-pub mod coloring;
-#[rustfmt::skip]
-pub mod labeled_prf;
-pub mod app_server;
-pub mod cli;
-pub mod config;
-pub mod msgs;
-pub mod pqkem;
-pub mod prftree;
-pub mod protocol;
-
-#[derive(thiserror::Error, Debug)]
-pub enum RosenpassError {
-    #[error("error in OQS")]
-    Oqs,
-
-    #[error("error from external library while calling OQS")]
-    OqsExternalLib,
-
-    #[error("error while calling into libsodium")]
-    LibsodiumError(&'static str),
-
-    #[error("buffer size mismatch, required {required_size} but only found {actual_size}")]
-    BufferSizeMismatch {
-        required_size: usize,
-        actual_size: usize,
-    },
-
-    #[error("invalid message type")]
-    InvalidMessageType(u8),
-
-    #[error("peer id {0:?} already taken")]
-    PeerIdAlreadyTaken(PeerId),
-
-    #[error("session id {0:?} already taken")]
-    SessionIdAlreadyTaken(SessionId),
-
-    #[error("{0}")]
-    NotImplemented(&'static str),
-
-    #[error("{0}")]
-    ConfigError(String),
-
-    #[error("see last log messages")]
-    RuntimeError,
-
-    #[error("{0}")]
-    IoError(#[from] std::io::Error),
-
-    #[error("{0}")]
-    TomlDeserError(#[from] toml::de::Error),
-
-    #[error("{0}")]
-    TomlSerError(#[from] toml::ser::Error),
-
-    #[error("invalid session id {0:?} was used")]
-    InvalidSessionId(SessionId),
-
-    #[error("no session available")]
-    NoSession,
-    #[error("the peer {0:?} does not exist")]
-    NoSuchPeer(PeerPtr),
-
-    #[error("the peer id {0:?} does not exist")]
-    NoSuchPeerId(PeerId),
-
-    #[error("the session {0:?} does not exist")]
-    NoSuchSessionId(SessionId),
-
-    #[error("no current handshake with peer {0:?}")]
-    NoCurrentHs(PeerPtr),
-    // TODO implement Display for Peer/Session ptr?
-    #[error("message seal broken")]
-    SealBroken,
-
-    #[error("received empty message")]
-    EmptyMessage,
-
-    #[error("biscuit with invalid number")]
-    InvalidBiscuitNo,
-
-    #[error("got unexpected message")]
-    UnexpectedMessage {
-        session: SessionId,
-        expected: Option<HandshakeStateMachine>,
-        got: Option<HandshakeStateMachine>,
-    },
-
-    #[error("???")]
-    StaleNonce,
-}
-
-/// Rosenpass Result type
-pub type Result<T> = core::result::Result<T, RosenpassError>;
-
-impl RosenpassError {
-    /// Helper function to check a buffer size
-    fn check_buffer_size(required_size: usize, actual_size: usize) -> Result<()> {
-        if required_size != actual_size {
-            Err(Self::BufferSizeMismatch {
-                required_size,
-                actual_size,
-            })
-        } else {
-            Ok(())
-        }
-    }
-}
-
-/// Extension trait to attach function calls to foreign types.
-trait RosenpassMaybeError {
-    /// Checks whether something is an error or not
-    fn to_rg_error(&self) -> Result<()>;
-}
-
-impl RosenpassMaybeError for oqs_sys::common::OQS_STATUS {
-    fn to_rg_error(&self) -> Result<()> {
-        use oqs_sys::common::OQS_STATUS;
-        match self {
-            OQS_STATUS::OQS_SUCCESS => Ok(()),
-            OQS_STATUS::OQS_ERROR => Err(RosenpassError::Oqs),
-            OQS_STATUS::OQS_EXTERNAL_LIB_ERROR_OPENSSL => Err(RosenpassError::OqsExternalLib),
-        }
-    }
-}

src/lprf.rs

@@ -1,106 +0,0 @@
-//! The rosenpass protocol relies on a special type
-//! of hash function for most of its hashing or
-//! message authentication needs: an incrementable
-//! pseudo random function.
-//!
-//! This is a generalization of a PRF operating
-//! on a sequence of inputs instead of a single input.
-//!
-//! Like a Dec function the Iprf features efficient 
-//! incrementability.
-//!
-//! You can also think of an Iprf as a Dec function with
-//! a fixed size output.
-//!
-//! The idea behind a Iprf is that it can be efficiently
-//! constructed from an Dec function as well as a PRF.
-//!
-//! TODO Base the construction on a proper Dec function
-
-pub struct Iprf([u8; KEY_SIZE]);
-pub struct IprfBranch([u8; KEY_SIZE]);
-pub struct SecretIprf(Secret<KEY_SIZE>);
-pub struct SecretIprfBranch(Secret<KEY_SIZE>);
-
-pub fn prf_into(out: &mut [u8], key: &[u8], data: &[u8]) {
-    // TODO: The error handling with sodium is a scurge
-    hmac_into(out, key, data).unwrap()
-}
-
-pub fn prf(key: &[u8], data: &[u8]) -> [u8; KEY_SIZE]{
-    mutating([0u8; KEY_SIZE], |r| prf_into(r, key, data))
-}
-
-impl Iprf {
-    fn zero() -> Self {
-        Self([0u8; KEY_SIZE])
-    }
-
-    fn dup(self) -> IprfBranch {
-        IprfBranch(self.0)
-    }
-
-    // TODO: Protocol! Use domain separation to ensure that 
-    fn mix(self, v: &[u8]) -> Self {
-        Self(prf(&self.0, v))
-    }
-    
-    fn mix_secret<const N: usize>(self, v: Secret<N>) -> SecretIprf {
-        SecretIprf::prf_invoc(&self.0, v.secret())
-    }
-
-    fn into_value(self) -> [u8; KEY_SIZE] {
-        self.0
-    }
-
-    fn extract(self, v: &[u8], dst: &mut [u8]) {
-        prf_into(&self.0, v, dst)
-    }
-}
-
-impl IprfBranch {
-    fn mix(&self, v: &[u8]) -> Iprf {
-        Iprf(prf(self.0, v))
-    }
-
-    fn mix_secret<const N: usize>(&self, v: Secret<N>) -> SecretIprf {
-        SecretIprf::prf_incov(self.0, v.secret())
-    }
-}
-
-impl SecretIprf {
-    fn prf_invoc(k: &[u8], d: &[u8]) -> SecretIprf {
-        mutating(SecretIprf(Secret::zero()), |r|
-            prf_into(k, d, r.secret_mut()))
-    }
-
-    fn from_key(k: Secret<N>) -> SecretIprf {
-        Self(k)
-    }
-
-    fn mix(self, v: &[u8]) -> SecretIprf {
-        Self::prf_invoc(self.0.secret(), v)
-    }
-
-    fn mix_secret<const N: usize>(self, v: Secret<N>) -> SecretIprf {
-        Self::prf_invoc(self.0.secret(), v.secret())
-    }
-
-    fn into_secret(self) -> Secret<KEY_SIZE> {
-        self.0
-    }
-
-    fn into_secret_slice(self, v: &[u8], dst: &[u8]) {
-        prf_into(self.0.secret(), v, dst)
-    }
-}
-
-impl SecretIprfBranch {
-    fn mix(&self, v: &[u8]) -> SecretIprf {
-        SecretIprf::prf_invoc(self.0.secret(), v)
-    }
-
-    fn mix_secret<const N: usize>(&self, v: Secret<N>) -> SecretIprf {
-        SecretIprf::prf_invoc(self.0.secret(), v.secret())
-    }
-}

src/main.rs

@@ -1,15 +0,0 @@
-use log::error;
-use rosenpass::{cli::Cli, sodium::sodium_init};
-use std::process::exit;
-
-/// Catches errors, prints them through the logger, then exits
-pub fn main() {
-    env_logger::init();
-    match sodium_init().and_then(|()| Cli::run()) {
-        Ok(_) => {}
-        Err(e) => {
-            error!("{e}");
-            exit(1);
-        }
-    }
-}

src/msgs.rs

@@ -1,383 +0,0 @@
-//! Data structures representing the messages going over the wire
-//!
-//! This module contains de-/serialization of the protocol's messages. Thats kind
-//! of a lie, since no actual ser/de happens. Instead, the structures offer views
-//! into mutable byte slices (`&mut [u8]`), allowing to modify the fields of an
-//! always serialized instance of the data in question. This is closely related
-//! to the concept of lenses in function programming; more on that here:
-//! [https://sinusoid.es/misc/lager/lenses.pdf](https://sinusoid.es/misc/lager/lenses.pdf)
-//!
-//! # Example
-//!
-//! The following example uses the [`data_lense` macro](crate::data_lense) to create a lense that
-//! might be useful when dealing with UDP headers.
-//!
-//! ```
-//! use rosenpass::{data_lense, RosenpassError, msgs::LenseView};
-//! # fn main() -> Result<(), RosenpassError> {
-//!
-//! data_lense! {UdpDatagramHeader :=
-//!     source_port: 2,
-//!     dest_port: 2,
-//!     length: 2,
-//!     checksum: 2
-//! }
-//!
-//! let mut buf = [0u8; 8];
-//!
-//! // read-only lense, no check of size:
-//! let lense = UdpDatagramHeader(&buf);
-//! assert_eq!(lense.checksum(), &[0, 0]);
-//!
-//! // mutable lense, runtime check of size
-//! let mut lense = buf.as_mut().udp_datagram_header()?;
-//! lense.source_port_mut().copy_from_slice(&53u16.to_be_bytes()); // some DNS, anyone?
-//!
-//! // the original buffer is still available
-//! assert_eq!(buf, [0, 53, 0, 0, 0, 0, 0, 0]);
-//!
-//! // read-only lense, runtime check of size
-//! let lense = buf.as_ref().udp_datagram_header()?;
-//! assert_eq!(lense.source_port(), &[0, 53]);
-//! # Ok(())
-//! # }
-//! ```
-
-use super::RosenpassError;
-use crate::{pqkem::*, sodium};
-
-// Macro magic ////////////////////////////////////////////////////////////////
-
-/// A macro to create data lenses. Refer to the [`msgs` mod](crate::msgs) for
-/// an example and further elaboration
-// TODO implement TryFrom<[u8]> and From<[u8; Self::len()]>
-#[macro_export]
-macro_rules! data_lense(
-    // prefix          @ offset       ; optional meta    ; field name   : field length, ...
-    (token_muncher_ref @ $offset:expr ; $( $attr:meta )* ; $field:ident : $len:expr $(, $( $tail:tt )+ )?) =>  {
-        ::paste::paste!{
-
-        #[allow(rustdoc::broken_intra_doc_links)]
-        $( #[ $attr ] )*
-        ///
-        #[doc = data_lense!(maybe_docstring_link $len)]
-        /// bytes long
-        pub fn $field(&self) -> &__ContainerType::Output {
-            &self.0[$offset .. $offset + $len]
-        }
-
-        /// The bytes until the
-        #[doc = data_lense!(maybe_docstring_link Self::$field)]
-        /// field
-        pub fn [< until_ $field >](&self) -> &__ContainerType::Output {
-            &self.0[0 .. $offset]
-        }
-
-        // if the tail exits, consume it as well
-        $(
-        data_lense!{token_muncher_ref @ $offset + $len ; $( $tail )+ }
-        )?
-        }
-    };
-
-    // prefix          @ offset       ; optional meta    ; field name   : field length, ...
-    (token_muncher_mut @ $offset:expr ; $( $attr:meta )* ; $field:ident : $len:expr $(, $( $tail:tt )+ )?) =>  {
-        ::paste::paste!{
-
-        #[allow(rustdoc::broken_intra_doc_links)]
-        $( #[ $attr ] )*
-        ///
-        #[doc = data_lense!(maybe_docstring_link $len)]
-        /// bytes long
-        pub fn [< $field _mut >](&mut self) -> &mut __ContainerType::Output {
-            &mut self.0[$offset .. $offset + $len]
-        }
-
-        // if the tail exits, consume it as well
-        $(
-        data_lense!{token_muncher_mut @ $offset + $len ; $( $tail )+ }
-        )?
-        }
-    };
-
-    // switch that yields literals unchanged, but creates docstring links to
-    // constants
-    // TODO the doc string link doesn't work if $x is taken from a generic,
-    (maybe_docstring_link $x:literal) => (stringify!($x));
-    (maybe_docstring_link $x:expr) => (stringify!([$x]));
-
-    // struct name  < optional generics     >    := optional doc string      field name   : field length, ...
-    ($type:ident $( < $( $generic:ident ),+ > )? := $( $( #[ $attr:meta ] )* $field:ident : $len:expr ),+) => (::paste::paste!{
-
-        #[allow(rustdoc::broken_intra_doc_links)]
-        /// A data lense to manipulate byte slices.
-        ///
-        //// # Fields
-        ///
-        $(
-        /// - `
-        #[doc = stringify!($field)]
-        /// `:
-        #[doc = data_lense!(maybe_docstring_link $len)]
-        /// bytes
-        )+
-        pub struct $type<__ContainerType $(, $( $generic ),+ )? > (
-            __ContainerType,
-            // The phantom data is required, since all generics declared on a
-            // type need to be used on the type.
-            // https://doc.rust-lang.org/stable/error_codes/E0392.html
-            $( $( ::core::marker::PhantomData<$generic> ),+ )?
-        );
-
-        impl<__ContainerType $(, $( $generic: LenseView ),+ )? > $type<__ContainerType $(, $( $generic ),+ )? >{
-            $(
-            /// Size in bytes of the field `
-            #[doc = !($field)]
-            /// `
-            pub const fn [< $field _len >]() -> usize{
-                $len
-            }
-            )+
-
-            /// Verify that `len` is sufficiently long to hold [Self]
-            pub fn check_size(len: usize) -> Result<(), RosenpassError>{
-                let required_size = $( $len + )+ 0;
-                let actual_size = len;
-                if required_size < actual_size {
-                    Err(RosenpassError::BufferSizeMismatch {
-                        required_size,
-                        actual_size,
-                    })
-                }else{
-                    Ok(())
-                }
-            }
-        }
-
-        // read-only accessor functions
-        impl<'a, __ContainerType $(, $( $generic: LenseView ),+ )?> $type<&'a __ContainerType $(, $( $generic ),+ )?>
-        where
-            __ContainerType: std::ops::Index<std::ops::Range<usize>> + ?Sized,
-        {
-            data_lense!{token_muncher_ref @ 0 ; $( $( $attr )* ; $field : $len ),+ }
-
-            /// View into all bytes belonging to this Lense
-            pub fn all_bytes(&self) -> &__ContainerType::Output {
-                &self.0[0..Self::LEN]
-            }
-        }
-
-        // mutable accessor functions
-        impl<'a, __ContainerType $(, $( $generic: LenseView ),+ )?> $type<&'a mut __ContainerType $(, $( $generic ),+ )?>
-        where
-            __ContainerType: std::ops::IndexMut<std::ops::Range<usize>> + ?Sized,
-        {
-            data_lense!{token_muncher_ref @ 0 ; $( $( $attr )* ; $field : $len ),+ }
-            data_lense!{token_muncher_mut @ 0 ; $( $( $attr )* ; $field : $len ),+ }
-
-            /// View into all bytes belonging to this Lense
-            pub fn all_bytes(&self) -> &__ContainerType::Output {
-                &self.0[0..Self::LEN]
-            }
-
-            /// View into all bytes belonging to this Lense
-            pub fn all_bytes_mut(&mut self) -> &mut __ContainerType::Output {
-                &mut self.0[0..Self::LEN]
-            }
-        }
-
-        // lense trait, allowing us to know the implementing lenses size
-        impl<__ContainerType $(, $( $generic: LenseView ),+ )? > LenseView for $type<__ContainerType $(, $( $generic ),+ )? >{
-            /// Number of bytes required to store this type in binary format
-            const LEN: usize = $( $len + )+ 0;
-        }
-
-        /// Extension trait to allow checked creation of a lense over
-        /// some byte slice that contains a
-        #[doc = data_lense!(maybe_docstring_link $type)]
-        pub trait [< $type Ext >] {
-            type __ContainerType;
-
-            /// Create a lense to the byte slice
-            fn [< $type:snake >] $(< $($generic),* >)? (self) -> Result< $type<Self::__ContainerType, $( $($generic),+ )? >, RosenpassError>;
-        }
-
-        impl<'a> [< $type Ext >] for &'a [u8] {
-            type __ContainerType = &'a [u8];
-
-            fn [< $type:snake >] $(< $($generic),* >)? (self) -> Result< $type<Self::__ContainerType, $( $($generic),+ )? >, RosenpassError> {
-                Ok($type ( self, $( $( ::core::marker::PhantomData::<$generic>  ),+ )? ))
-            }
-        }
-
-        impl<'a> [< $type Ext >] for &'a mut [u8] {
-            type __ContainerType = &'a mut [u8];
-
-            fn [< $type:snake >] $(< $($generic),* >)? (self) -> Result< $type<Self::__ContainerType, $( $($generic),+ )? >, RosenpassError> {
-                Ok($type ( self, $( $( ::core::marker::PhantomData::<$generic>  ),+ )? ))
-            }
-        }
-    });
-);
-
-/// Common trait shared by all Lenses
-pub trait LenseView {
-    const LEN: usize;
-}
-
-data_lense! { Envelope<M> :=
-    /// [MsgType] of this message
-    msg_type: 1,
-    /// Reserved for future use
-    reserved: 3,
-    /// The actual Paylod
-    payload: M::LEN,
-    /// Message Authentication Code (mac) over all bytes until (exclusive)
-    /// `mac` itself
-    mac: sodium::MAC_SIZE,
-    /// Currently unused, TODO: do something with this
-    cookie: sodium::MAC_SIZE
-}
-
-data_lense! { InitHello :=
-    /// Randomly generated connection id
-    sidi: 4,
-    /// Kyber 512 Ephemeral Public Key
-    epki: EphemeralKEM::PK_LEN,
-    /// Classic McEliece Ciphertext
-    sctr: StaticKEM::CT_LEN,
-    /// Encryped: 16 byte hash of McEliece initiator static key
-    pidic: sodium::AEAD_TAG_LEN + 32,
-    /// Encrypted TAI64N Time Stamp (against replay attacks)
-    auth: sodium::AEAD_TAG_LEN
-}
-
-data_lense! { RespHello :=
-    /// Randomly generated connection id
-    sidr: 4,
-    /// Copied from InitHello
-    sidi: 4,
-    /// Kyber 512 Ephemeral Ciphertext
-    ecti: EphemeralKEM::CT_LEN,
-    /// Classic McEliece Ciphertext
-    scti: StaticKEM::CT_LEN,
-    /// Empty encrypted message (just an auth tag)
-    auth: sodium::AEAD_TAG_LEN,
-    /// Responders handshake state in encrypted form
-    biscuit: BISCUIT_CT_LEN
-}
-
-data_lense! { InitConf :=
-    /// Copied from InitHello
-    sidi: 4,
-    /// Copied from RespHello
-    sidr: 4,
-    /// Responders handshake state in encrypted form
-    biscuit: BISCUIT_CT_LEN,
-    /// Empty encrypted message (just an auth tag)
-    auth: sodium::AEAD_TAG_LEN
-}
-
-data_lense! { EmptyData :=
-    /// Copied from RespHello
-    sid: 4,
-    /// Nonce
-    ctr: 8,
-    /// Empty encrypted message (just an auth tag)
-    auth: sodium::AEAD_TAG_LEN
-}
-
-data_lense! { Biscuit :=
-    /// H(spki) – Ident ifies the initiator
-    pidi: sodium::KEY_SIZE,
-    /// The biscuit number (replay protection)
-    biscuit_no: 12,
-    /// Chaining key
-    ck: sodium::KEY_SIZE
-}
-
-data_lense! { DataMsg :=
-    dummy: 4
-}
-
-data_lense! { CookieReply :=
-    dummy: 4
-}
-
-// Traits /////////////////////////////////////////////////////////////////////
-
-pub trait WireMsg: std::fmt::Debug {
-    const MSG_TYPE: MsgType;
-    const MSG_TYPE_U8: u8 = Self::MSG_TYPE as u8;
-    const BYTES: usize;
-}
-
-// Constants //////////////////////////////////////////////////////////////////
-
-pub const SESSION_ID_LEN: usize = 4;
-pub const BISCUIT_ID_LEN: usize = 12;
-
-pub const WIRE_ENVELOPE_LEN: usize = 1 + 3 + 16 + 16; // TODO verify this
-
-/// Size required to fit any message in binary form
-pub const MAX_MESSAGE_LEN: usize = 2500; // TODO fix this
-
-/// Recognized message types
-#[repr(u8)]
-#[derive(Hash, PartialEq, Eq, PartialOrd, Ord, Debug, Clone, Copy)]
-pub enum MsgType {
-    InitHello = 0x81,
-    RespHello = 0x82,
-    InitConf = 0x83,
-    EmptyData = 0x84,
-    DataMsg = 0x85,
-    CookieReply = 0x86,
-}
-
-impl TryFrom<u8> for MsgType {
-    type Error = RosenpassError;
-
-    fn try_from(value: u8) -> Result<Self, Self::Error> {
-        Ok(match value {
-            0x81 => MsgType::InitHello,
-            0x82 => MsgType::RespHello,
-            0x83 => MsgType::InitConf,
-            0x84 => MsgType::EmptyData,
-            0x85 => MsgType::DataMsg,
-            0x86 => MsgType::CookieReply,
-            _ => return Err(RosenpassError::InvalidMessageType(value)),
-        })
-    }
-}
-
-/// length in bytes of an unencrypted Biscuit (plain text)
-pub const BISCUIT_PT_LEN: usize = Biscuit::<()>::LEN;
-
-/// Length in bytes of an encrypted Biscuit (cipher text)
-pub const BISCUIT_CT_LEN: usize = BISCUIT_PT_LEN + sodium::XAEAD_NONCE_LEN + sodium::XAEAD_TAG_LEN;
-
-#[cfg(test)]
-mod test_constants {
-    use crate::{
-        msgs::{BISCUIT_CT_LEN, BISCUIT_PT_LEN},
-        sodium,
-    };
-
-    #[test]
-    fn sodium_keysize() {
-        assert_eq!(sodium::KEY_SIZE, 32);
-    }
-
-    #[test]
-    fn biscuit_pt_len() {
-        assert_eq!(BISCUIT_PT_LEN, 2 * sodium::KEY_SIZE + 12);
-    }
-
-    #[test]
-    fn biscuit_ct_len() {
-        assert_eq!(
-            BISCUIT_CT_LEN,
-            BISCUIT_PT_LEN + sodium::XAEAD_NONCE_LEN + sodium::XAEAD_TAG_LEN
-        );
-    }
-}

src/pqkem.rs

@@ -1,168 +0,0 @@
-//! Traits and implementations for Key Encapsulation Mechanisms (KEMs)
-//!
-//! KEMs are the interface provided by almost all post-quantum
-//! secure key exchange mechanisms.
-//!
-//! Conceptually KEMs are akin to public-key encryption, but instead of encrypting
-//! arbitrary data, KEMs are limited to the transmission of keys, randomly chosen during
-//!
-//! encapsulation.
-//! The [KEM] Trait describes the basic API offered by a Key Encapsulation
-//! Mechanism. Two implementations for it are provided, [StaticKEM] and [EphemeralKEM].
-
-use crate::{RosenpassError, RosenpassMaybeError};
-
-/// Key Encapsulation Mechanism
-///
-/// The KEM interface defines three operations: Key generation, key encapsulation and key
-/// decapsulation.
-pub trait KEM {
-    /// Secrete Key length
-    const SK_LEN: usize;
-    /// Public Key length
-    const PK_LEN: usize;
-    /// Ciphertext length
-    const CT_LEN: usize;
-    /// Shared Secret length
-    const SHK_LEN: usize;
-
-    /// Generate a keypair consisting of secret key (`sk`) and public key (`pk`)
-    ///
-    /// `keygen() -> sk, pk`
-    fn keygen(sk: &mut [u8], pk: &mut [u8]) -> Result<(), RosenpassError>;
-
-    /// From a public key (`pk`), generate a shared key (`shk`, for local use)
-    /// and a cipher text (`ct`, to be sent to the owner of the `pk`).
-    ///
-    /// `encaps(pk) -> shk, ct`
-    fn encaps(shk: &mut [u8], ct: &mut [u8], pk: &[u8]) -> Result<(), RosenpassError>;
-
-    /// From a secret key (`sk`) and a cipher text (`ct`) derive a shared key
-    /// (`shk`)
-    ///
-    /// `decaps(sk, ct) -> shk`
-    fn decaps(shk: &mut [u8], sk: &[u8], ct: &[u8]) -> Result<(), RosenpassError>;
-}
-
-/// A KEM that is secure against Chosen Ciphertext Attacks (CCA).
-/// In the context of rosenpass this is used for static keys.
-/// Uses [Classic McEliece](https://classic.mceliece.org/) 460896 from liboqs.
-///
-/// Classic McEliece is chosen because of its high security margin and its small
-/// ciphertexts. The public keys are humongous, but (being static keys) the are never transmitted over
-/// the wire so this is not a big problem.
-pub struct StaticKEM;
-
-/// # Safety
-///
-/// This Trait impl calls unsafe [oqs_sys] functions, that write to byte
-/// slices only identified using raw pointers. It must be ensured that the raw
-/// pointers point into byte slices of sufficient length, to avoid UB through
-/// overwriting of arbitrary data. This is checked in the following code before
-/// the unsafe calls, and an early return with an Err occurs if the byte slice
-/// size does not match the required size.
-///
-/// __Note__: This requirement is stricter than necessary, it would suffice
-/// to only check that the buffers are big enough, allowing them to be even
-/// bigger. However, from a correctness point of view it does not make sense to
-/// allow bigger buffers.
-impl KEM for StaticKEM {
-    const SK_LEN: usize = oqs_sys::kem::OQS_KEM_classic_mceliece_460896_length_secret_key as usize;
-    const PK_LEN: usize = oqs_sys::kem::OQS_KEM_classic_mceliece_460896_length_public_key as usize;
-    const CT_LEN: usize = oqs_sys::kem::OQS_KEM_classic_mceliece_460896_length_ciphertext as usize;
-    const SHK_LEN: usize =
-        oqs_sys::kem::OQS_KEM_classic_mceliece_460896_length_shared_secret as usize;
-
-    fn keygen(sk: &mut [u8], pk: &mut [u8]) -> Result<(), RosenpassError> {
-        RosenpassError::check_buffer_size(sk.len(), Self::SK_LEN)?;
-        RosenpassError::check_buffer_size(pk.len(), Self::PK_LEN)?;
-        unsafe {
-            oqs_sys::kem::OQS_KEM_classic_mceliece_460896_keypair(pk.as_mut_ptr(), sk.as_mut_ptr())
-                .to_rg_error()
-        }
-    }
-
-    fn encaps(shk: &mut [u8], ct: &mut [u8], pk: &[u8]) -> Result<(), RosenpassError> {
-        RosenpassError::check_buffer_size(shk.len(), Self::SHK_LEN)?;
-        RosenpassError::check_buffer_size(ct.len(), Self::CT_LEN)?;
-        RosenpassError::check_buffer_size(pk.len(), Self::PK_LEN)?;
-        unsafe {
-            oqs_sys::kem::OQS_KEM_classic_mceliece_460896_encaps(
-                ct.as_mut_ptr(),
-                shk.as_mut_ptr(),
-                pk.as_ptr(),
-            )
-            .to_rg_error()
-        }
-    }
-
-    fn decaps(shk: &mut [u8], sk: &[u8], ct: &[u8]) -> Result<(), RosenpassError> {
-        RosenpassError::check_buffer_size(shk.len(), Self::SHK_LEN)?;
-        RosenpassError::check_buffer_size(sk.len(), Self::SK_LEN)?;
-        RosenpassError::check_buffer_size(ct.len(), Self::CT_LEN)?;
-        unsafe {
-            oqs_sys::kem::OQS_KEM_classic_mceliece_460896_decaps(
-                shk.as_mut_ptr(),
-                ct.as_ptr(),
-                sk.as_ptr(),
-            )
-            .to_rg_error()
-        }
-    }
-}
-
-/// Implements a KEM that is secure against Chosen Plaintext Attacks (CPA).
-/// In the context of rosenpass this is used for ephemeral keys.
-/// Currently the implementation uses
-/// [Kyber 512](https://openquantumsafe.org/liboqs/algorithms/kem/kyber) from liboqs.
-///
-/// This is being used for ephemeral keys; since these are use-once the first post quantum
-/// wireguard paper claimed that CPA security would be sufficient. Nonetheless we choose kyber
-/// which provides CCA security since there are no publicly vetted KEMs out there which provide
-/// only CPA security.
-pub struct EphemeralKEM;
-
-/// # Safety
-///
-/// This Trait impl calls unsafe [oqs_sys] functions, that write to byte
-/// slices only identified using raw pointers. It must be ensured that the raw
-/// pointers point into byte slices of sufficient length, to avoid UB through
-/// overwriting of arbitrary data. This is checked in the following code before
-/// the unsafe calls, and an early return with an Err occurs if the byte slice
-/// size does not match the required size.
-///
-/// __Note__: This requirement is stricter than necessary, it would suffice
-/// to only check that the buffers are big enough, allowing them to be even
-/// bigger. However, from a correctness point of view it does not make sense to
-/// allow bigger buffers.
-impl KEM for EphemeralKEM {
-    const SK_LEN: usize = oqs_sys::kem::OQS_KEM_kyber_512_length_secret_key as usize;
-    const PK_LEN: usize = oqs_sys::kem::OQS_KEM_kyber_512_length_public_key as usize;
-    const CT_LEN: usize = oqs_sys::kem::OQS_KEM_kyber_512_length_ciphertext as usize;
-    const SHK_LEN: usize = oqs_sys::kem::OQS_KEM_kyber_512_length_shared_secret as usize;
-    fn keygen(sk: &mut [u8], pk: &mut [u8]) -> Result<(), RosenpassError> {
-        RosenpassError::check_buffer_size(sk.len(), Self::SK_LEN)?;
-        RosenpassError::check_buffer_size(pk.len(), Self::PK_LEN)?;
-        unsafe {
-            oqs_sys::kem::OQS_KEM_kyber_512_keypair(pk.as_mut_ptr(), sk.as_mut_ptr()).to_rg_error()
-        }
-    }
-    fn encaps(shk: &mut [u8], ct: &mut [u8], pk: &[u8]) -> Result<(), RosenpassError> {
-        RosenpassError::check_buffer_size(shk.len(), Self::SHK_LEN)?;
-        RosenpassError::check_buffer_size(ct.len(), Self::CT_LEN)?;
-        RosenpassError::check_buffer_size(pk.len(), Self::PK_LEN)?;
-        unsafe {
-            oqs_sys::kem::OQS_KEM_kyber_512_encaps(ct.as_mut_ptr(), shk.as_mut_ptr(), pk.as_ptr())
-                .to_rg_error()
-        }
-    }
-    fn decaps(shk: &mut [u8], sk: &[u8], ct: &[u8]) -> Result<(), RosenpassError> {
-        RosenpassError::check_buffer_size(shk.len(), Self::SHK_LEN)?;
-        RosenpassError::check_buffer_size(sk.len(), Self::SK_LEN)?;
-        RosenpassError::check_buffer_size(ct.len(), Self::CT_LEN)?;
-        unsafe {
-            oqs_sys::kem::OQS_KEM_kyber_512_decaps(shk.as_mut_ptr(), ct.as_ptr(), sk.as_ptr())
-                .to_rg_error()
-        }
-    }
-}

src/prftree.rs

@@ -1,106 +0,0 @@
-//! Implementation of the tree-like structure used for the label derivation in [labeled_prf](crate::labeled_prf)
-use crate::{
-    coloring::Secret,
-    sodium::{hmac, hmac_into, KEY_SIZE},
-    Result,
-};
-
-// TODO Use a proper Dec interface
-#[derive(Clone, Debug)]
-pub struct PrfTree([u8; KEY_SIZE]);
-#[derive(Clone, Debug)]
-pub struct PrfTreeBranch([u8; KEY_SIZE]);
-#[derive(Clone, Debug)]
-pub struct SecretPrfTree(Secret<KEY_SIZE>);
-#[derive(Clone, Debug)]
-pub struct SecretPrfTreeBranch(Secret<KEY_SIZE>);
-
-impl PrfTree {
-    pub fn zero() -> Self {
-        Self([0u8; KEY_SIZE])
-    }
-
-    pub fn dup(self) -> PrfTreeBranch {
-        PrfTreeBranch(self.0)
-    }
-
-    pub fn into_secret_prf_tree(self) -> SecretPrfTree {
-        SecretPrfTree(Secret::from_slice(&self.0))
-    }
-
-    // TODO: Protocol! Use domain separation to ensure that
-    pub fn mix(self, v: &[u8]) -> Result<Self> {
-        Ok(Self(hmac(&self.0, v)?))
-    }
-
-    pub fn mix_secret<const N: usize>(self, v: Secret<N>) -> Result<SecretPrfTree> {
-        SecretPrfTree::prf_invoc(&self.0, v.secret())
-    }
-
-    pub fn into_value(self) -> [u8; KEY_SIZE] {
-        self.0
-    }
-}
-
-impl PrfTreeBranch {
-    pub fn mix(&self, v: &[u8]) -> Result<PrfTree> {
-        Ok(PrfTree(hmac(&self.0, v)?))
-    }
-
-    pub fn mix_secret<const N: usize>(&self, v: Secret<N>) -> Result<SecretPrfTree> {
-        SecretPrfTree::prf_invoc(&self.0, v.secret())
-    }
-}
-
-impl SecretPrfTree {
-    pub fn prf_invoc(k: &[u8], d: &[u8]) -> Result<SecretPrfTree> {
-        let mut r = SecretPrfTree(Secret::zero());
-        hmac_into(r.0.secret_mut(), k, d)?;
-        Ok(r)
-    }
-
-    pub fn zero() -> Self {
-        Self(Secret::zero())
-    }
-
-    pub fn dup(self) -> SecretPrfTreeBranch {
-        SecretPrfTreeBranch(self.0)
-    }
-
-    pub fn danger_from_secret(k: Secret<KEY_SIZE>) -> Self {
-        Self(k)
-    }
-
-    pub fn mix(self, v: &[u8]) -> Result<SecretPrfTree> {
-        Self::prf_invoc(self.0.secret(), v)
-    }
-
-    pub fn mix_secret<const N: usize>(self, v: Secret<N>) -> Result<SecretPrfTree> {
-        Self::prf_invoc(self.0.secret(), v.secret())
-    }
-
-    pub fn into_secret(self) -> Secret<KEY_SIZE> {
-        self.0
-    }
-
-    pub fn into_secret_slice(mut self, v: &[u8], dst: &[u8]) -> Result<()> {
-        hmac_into(self.0.secret_mut(), v, dst)
-    }
-}
-
-impl SecretPrfTreeBranch {
-    pub fn mix(&self, v: &[u8]) -> Result<SecretPrfTree> {
-        SecretPrfTree::prf_invoc(self.0.secret(), v)
-    }
-
-    pub fn mix_secret<const N: usize>(&self, v: Secret<N>) -> Result<SecretPrfTree> {
-        SecretPrfTree::prf_invoc(self.0.secret(), v.secret())
-    }
-
-    // TODO: This entire API is not very nice; we need this for biscuits, but
-    // it might be better to extract a special "biscuit"
-    // labeled subkey and reinitialize the chain with this
-    pub fn danger_into_secret(self) -> Secret<KEY_SIZE> {
-        self.0
-    }
-}

src/sodium.rs

@@ -1,291 +0,0 @@
-//! Bindings and helpers for accessing libsodium functions
-
-use crate::{util::*, Result, RosenpassError};
-use libsodium_sys as libsodium;
-use log::trace;
-use static_assertions::const_assert_eq;
-use std::os::raw::{c_ulonglong, c_void};
-use std::ptr::{null as nullptr, null_mut as nullptr_mut};
-
-pub const AEAD_TAG_LEN: usize = libsodium::crypto_aead_chacha20poly1305_IETF_ABYTES as usize;
-pub const AEAD_NONCE_LEN: usize = libsodium::crypto_aead_chacha20poly1305_IETF_NPUBBYTES as usize;
-pub const XAEAD_TAG_LEN: usize = libsodium::crypto_aead_xchacha20poly1305_ietf_ABYTES as usize;
-pub const XAEAD_NONCE_LEN: usize = libsodium::crypto_aead_xchacha20poly1305_IETF_NPUBBYTES as usize;
-pub const NONCE0: [u8; libsodium::crypto_aead_chacha20poly1305_IETF_NPUBBYTES as usize] =
-    [0u8; libsodium::crypto_aead_chacha20poly1305_IETF_NPUBBYTES as usize];
-pub const NOTHING: [u8; 0] = [0u8; 0];
-pub const KEY_SIZE: usize = 32;
-pub const MAC_SIZE: usize = 16;
-
-const_assert_eq!(
-    KEY_SIZE,
-    libsodium::crypto_aead_chacha20poly1305_IETF_KEYBYTES as usize
-);
-const_assert_eq!(KEY_SIZE, libsodium::crypto_generichash_BYTES as usize);
-
-macro_rules! sodium_call {
-    ($name:ident, $($args:expr),*) => { attempt!({
-        if unsafe{libsodium::$name($($args),*)} > -1 {
-            Ok(())
-        }else{
-            Err(RosenpassError::LibsodiumError(concat!("Error in libsodium's {}.", stringify!($name))))
-        }
-    })};
-    ($name:ident) => { sodium_call!($name, ) };
-}
-
-#[inline]
-pub fn sodium_init() -> Result<()> {
-    trace!("initializing libsodium");
-    sodium_call!(sodium_init)
-}
-
-#[inline]
-pub fn sodium_memcmp(a: &[u8], b: &[u8]) -> bool {
-    a.len() == b.len()
-        && unsafe {
-            let r = libsodium::sodium_memcmp(
-                a.as_ptr() as *const c_void,
-                b.as_ptr() as *const c_void,
-                a.len(),
-            );
-            r == 0
-        }
-}
-
-#[inline]
-pub fn sodium_bigint_cmp(a: &[u8], b: &[u8]) -> i32 {
-    assert!(a.len() == b.len());
-    unsafe { libsodium::sodium_compare(a.as_ptr(), b.as_ptr(), a.len()) }
-}
-
-#[inline]
-pub fn sodium_bigint_inc(v: &mut [u8]) {
-    unsafe {
-        libsodium::sodium_increment(v.as_mut_ptr(), v.len());
-    }
-}
-
-#[inline]
-pub fn rng(buf: &mut [u8]) {
-    unsafe { libsodium::randombytes_buf(buf.as_mut_ptr() as *mut c_void, buf.len()) };
-}
-
-#[inline]
-pub fn zeroize(buf: &mut [u8]) {
-    unsafe { libsodium::sodium_memzero(buf.as_mut_ptr() as *mut c_void, buf.len()) };
-}
-
-#[inline]
-pub fn aead_enc_into(
-    ciphertext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    plaintext: &[u8],
-) -> Result<()> {
-    assert!(ciphertext.len() == plaintext.len() + AEAD_TAG_LEN);
-    assert!(key.len() == libsodium::crypto_aead_chacha20poly1305_IETF_KEYBYTES as usize);
-    assert!(nonce.len() == libsodium::crypto_aead_chacha20poly1305_IETF_NPUBBYTES as usize);
-    let mut clen: u64 = 0;
-    sodium_call!(
-        crypto_aead_chacha20poly1305_ietf_encrypt,
-        ciphertext.as_mut_ptr(),
-        &mut clen,
-        plaintext.as_ptr(),
-        plaintext.len() as c_ulonglong,
-        ad.as_ptr(),
-        ad.len() as c_ulonglong,
-        nullptr(), // nsec is not used
-        nonce.as_ptr(),
-        key.as_ptr()
-    )?;
-    assert!(clen as usize == ciphertext.len());
-    Ok(())
-}
-
-#[inline]
-pub fn aead_dec_into(
-    plaintext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    ciphertext: &[u8],
-) -> Result<()> {
-    assert!(ciphertext.len() == plaintext.len() + AEAD_TAG_LEN);
-    assert!(key.len() == libsodium::crypto_aead_chacha20poly1305_IETF_KEYBYTES as usize);
-    assert!(nonce.len() == libsodium::crypto_aead_chacha20poly1305_IETF_NPUBBYTES as usize);
-    let mut mlen: u64 = 0;
-    sodium_call!(
-        crypto_aead_chacha20poly1305_ietf_decrypt,
-        plaintext.as_mut_ptr(),
-        &mut mlen as *mut c_ulonglong,
-        nullptr_mut(), // nsec is not used
-        ciphertext.as_ptr(),
-        ciphertext.len() as c_ulonglong,
-        ad.as_ptr(),
-        ad.len() as c_ulonglong,
-        nonce.as_ptr(),
-        key.as_ptr()
-    )?;
-    assert!(mlen as usize == plaintext.len());
-    Ok(())
-}
-
-#[inline]
-pub fn xaead_enc_into(
-    ciphertext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    plaintext: &[u8],
-) -> Result<()> {
-    assert!(ciphertext.len() == plaintext.len() + XAEAD_NONCE_LEN + XAEAD_TAG_LEN);
-    assert!(key.len() == libsodium::crypto_aead_xchacha20poly1305_IETF_KEYBYTES as usize);
-    let (n, ct) = ciphertext.split_at_mut(XAEAD_NONCE_LEN);
-    n.copy_from_slice(nonce);
-    let mut clen: u64 = 0;
-    sodium_call!(
-        crypto_aead_xchacha20poly1305_ietf_encrypt,
-        ct.as_mut_ptr(),
-        &mut clen,
-        plaintext.as_ptr(),
-        plaintext.len() as c_ulonglong,
-        ad.as_ptr(),
-        ad.len() as c_ulonglong,
-        nullptr(), // nsec is not used
-        nonce.as_ptr(),
-        key.as_ptr()
-    )?;
-    assert!(clen as usize == ct.len());
-    Ok(())
-}
-
-#[inline]
-pub fn xaead_dec_into(
-    plaintext: &mut [u8],
-    key: &[u8],
-    ad: &[u8],
-    ciphertext: &[u8],
-) -> Result<()> {
-    assert!(ciphertext.len() == plaintext.len() + XAEAD_NONCE_LEN + XAEAD_TAG_LEN);
-    assert!(key.len() == libsodium::crypto_aead_xchacha20poly1305_IETF_KEYBYTES as usize);
-    let (n, ct) = ciphertext.split_at(XAEAD_NONCE_LEN);
-    let mut mlen: u64 = 0;
-    sodium_call!(
-        crypto_aead_xchacha20poly1305_ietf_decrypt,
-        plaintext.as_mut_ptr(),
-        &mut mlen as *mut c_ulonglong,
-        nullptr_mut(), // nsec is not used
-        ct.as_ptr(),
-        ct.len() as c_ulonglong,
-        ad.as_ptr(),
-        ad.len() as c_ulonglong,
-        n.as_ptr(),
-        key.as_ptr()
-    )?;
-    assert!(mlen as usize == plaintext.len());
-    Ok(())
-}
-
-#[inline]
-fn blake2b_flexible(out: &mut [u8], key: &[u8], data: &[u8]) -> Result<()> {
-    const KEY_MIN: usize = libsodium::crypto_generichash_KEYBYTES_MIN as usize;
-    const KEY_MAX: usize = libsodium::crypto_generichash_KEYBYTES_MAX as usize;
-    const OUT_MIN: usize = libsodium::crypto_generichash_BYTES_MIN as usize;
-    const OUT_MAX: usize = libsodium::crypto_generichash_BYTES_MAX as usize;
-    assert!(key.is_empty() || (KEY_MIN <= key.len() && key.len() <= KEY_MAX));
-    assert!(OUT_MIN <= out.len() && out.len() <= OUT_MAX);
-    let kptr = match key.len() {
-        // NULL key
-        0 => nullptr(),
-        _ => key.as_ptr(),
-    };
-    sodium_call!(
-        crypto_generichash_blake2b,
-        out.as_mut_ptr(),
-        out.len(),
-        data.as_ptr(),
-        data.len() as c_ulonglong,
-        kptr,
-        key.len()
-    )
-}
-
-// TODO: Use proper streaming hash; for mix_hash too.
-#[inline]
-pub fn hash_into(out: &mut [u8], data: &[u8]) -> Result<()> {
-    assert!(out.len() == KEY_SIZE);
-    blake2b_flexible(out, &NOTHING, data)
-}
-
-#[inline]
-pub fn hash(data: &[u8]) -> Result<[u8; KEY_SIZE]> {
-    let mut r = [0u8; KEY_SIZE];
-    hash_into(&mut r, data)?;
-    Ok(r)
-}
-
-#[inline]
-pub fn mac_into(out: &mut [u8], key: &[u8], data: &[u8]) -> Result<()> {
-    assert!(out.len() == KEY_SIZE);
-    assert!(key.len() == KEY_SIZE);
-    blake2b_flexible(out, key, data)
-}
-
-#[inline]
-pub fn mac(key: &[u8], data: &[u8]) -> Result<[u8; KEY_SIZE]> {
-    let mut r = [0u8; KEY_SIZE];
-    mac_into(&mut r, key, data)?;
-    Ok(r)
-}
-
-#[inline]
-pub fn mac16(key: &[u8], data: &[u8]) -> Result<[u8; 16]> {
-    assert!(key.len() == KEY_SIZE);
-    let mut out = [0u8; 16];
-    blake2b_flexible(&mut out, key, data)?;
-    Ok(out)
-}
-
-#[inline]
-pub fn hmac_into(out: &mut [u8], key: &[u8], data: &[u8]) -> Result<()> {
-    // Not bothering with padding; the implementation
-    // uses appropriately sized keys.
-    if key.len() != KEY_SIZE {
-        return Err(crate::RosenpassError::BufferSizeMismatch {
-            required_size: KEY_SIZE,
-            actual_size: key.len(),
-        });
-    }
-
-    const IPAD: [u8; KEY_SIZE] = [0x36u8; KEY_SIZE];
-    let mut temp_key = [0u8; KEY_SIZE];
-    temp_key.copy_from_slice(key);
-    xor_into(&mut temp_key, &IPAD);
-    let outer_data = mac(&temp_key, data)?;
-
-    const OPAD: [u8; KEY_SIZE] = [0x5Cu8; KEY_SIZE];
-    temp_key.copy_from_slice(key);
-    xor_into(&mut temp_key, &OPAD);
-    mac_into(out, &temp_key, &outer_data)
-}
-
-#[inline]
-pub fn hmac(key: &[u8], data: &[u8]) -> Result<[u8; KEY_SIZE]> {
-    let mut r = [0u8; KEY_SIZE];
-    hmac_into(&mut r, key, data)?;
-    Ok(r)
-}
-
-// Choose a fully random u64
-pub fn rand_u64() -> u64 {
-    let mut buf = [0u8; 8];
-    rng(&mut buf);
-    u64::from_le_bytes(buf)
-}
-
-// Choose a random f64 in [0; 1] inclusive; quick and dirty
-pub fn rand_f64() -> f64 {
-    (rand_u64() as f64) / (u64::MAX as f64)
-}

src/util.rs

@@ -1,244 +0,0 @@
-//! Helper functions and macros
-use base64::{
-    display::Base64Display as B64Display, read::DecoderReader as B64Reader,
-    write::EncoderWriter as B64Writer,
-};
-use log::error;
-use std::{
-    borrow::{Borrow, BorrowMut},
-    cmp::min,
-    fs::{File, OpenOptions},
-    io::{Read, Write},
-    path::Path,
-    time::{Duration, Instant},
-};
-
-use crate::{
-    coloring::{Public, Secret},
-    Result,
-};
-
-#[inline]
-pub fn xor_into(a: &mut [u8], b: &[u8]) {
-    assert!(a.len() == b.len());
-    for (av, bv) in a.iter_mut().zip(b.iter()) {
-        *av ^= *bv;
-    }
-}
-
-/// Concatenate two byte arrays
-// TODO: Zeroize result?
-#[macro_export]
-macro_rules! cat {
-    ($len:expr; $($toks:expr),+) => {{
-        let mut buf = [0u8; $len];
-        let mut off = 0;
-        $({
-            let tok = $toks;
-            let tr = ::std::borrow::Borrow::<[u8]>::borrow(tok);
-            (&mut buf[off..(off + tr.len())]).copy_from_slice(tr);
-            off += tr.len();
-        })+
-        assert!(off == buf.len(), "Size mismatch in cat!()");
-        buf
-    }}
-}
-
-// TODO: consistent inout ordering
-pub fn cpy<T: BorrowMut<[u8]> + ?Sized, F: Borrow<[u8]> + ?Sized>(src: &F, dst: &mut T) {
-    dst.borrow_mut().copy_from_slice(src.borrow());
-}
-
-/// Copy from `src` to `dst`. If `src` and `dst` are not of equal length, copy as many bytes as possible.
-pub fn cpy_min<T: BorrowMut<[u8]> + ?Sized, F: Borrow<[u8]> + ?Sized>(src: &F, dst: &mut T) {
-    let src = src.borrow();
-    let dst = dst.borrow_mut();
-    let len = min(src.len(), dst.len());
-    dst[..len].copy_from_slice(&src[..len]);
-}
-
-/// Try block basically…returns a result and allows the use of the question mark operator inside
-#[macro_export]
-macro_rules! attempt {
-    ($block:expr) => {
-        (|| -> crate::Result<_> { $block })()
-    };
-}
-
-use base64::engine::general_purpose::GeneralPurpose as Base64Engine;
-const B64ENGINE: Base64Engine = base64::engine::general_purpose::STANDARD;
-
-pub fn fmt_b64<'a>(payload: &'a [u8]) -> B64Display<'a, 'static, Base64Engine> {
-    B64Display::<'a, 'static>::new(payload, &B64ENGINE)
-}
-
-pub fn b64_writer<W: Write>(w: W) -> B64Writer<'static, Base64Engine, W> {
-    B64Writer::new(w, &B64ENGINE)
-}
-
-pub fn b64_reader<R: Read>(r: R) -> B64Reader<'static, Base64Engine, R> {
-    B64Reader::new(r, &B64ENGINE)
-}
-
-// TODO remove this once std::cmp::max becomes const
-pub const fn max_usize(a: usize, b: usize) -> usize {
-    if a > b {
-        a
-    } else {
-        b
-    }
-}
-
-#[derive(Clone, Debug)]
-pub struct Timebase(Instant);
-
-impl Default for Timebase {
-    fn default() -> Self {
-        Self(Instant::now())
-    }
-}
-
-impl Timebase {
-    pub fn now(&self) -> f64 {
-        self.0.elapsed().as_secs_f64()
-    }
-
-    pub fn dur(&self, t: f64) -> Duration {
-        Duration::from_secs_f64(t)
-    }
-}
-
-pub fn mutating<T, F>(mut v: T, f: F) -> T
-where
-    F: Fn(&mut T),
-{
-    f(&mut v);
-    v
-}
-
-pub fn sideeffect<T, F>(v: T, f: F) -> T
-where
-    F: Fn(&T),
-{
-    f(&v);
-    v
-}
-
-/// load'n store
-
-/// Open a file writable
-pub fn fopen_w<P: AsRef<Path>>(path: P) -> Result<File> {
-    Ok(OpenOptions::new()
-        .read(false)
-        .write(true)
-        .create(true)
-        .truncate(true)
-        .open(path)?)
-}
-/// Open a file readable
-pub fn fopen_r<P: AsRef<Path>>(path: P) -> Result<File> {
-    Ok(OpenOptions::new()
-        .read(true)
-        .write(false)
-        .create(false)
-        .truncate(false)
-        .open(path)?)
-}
-
-pub trait ReadExactToEnd {
-    fn read_exact_to_end(&mut self, buf: &mut [u8]) -> Result<()>;
-}
-
-impl<R: Read> ReadExactToEnd for R {
-    fn read_exact_to_end(&mut self, buf: &mut [u8]) -> Result<()> {
-        let mut dummy = [0u8; 8];
-        self.read_exact(buf)?;
-        if self.read(&mut dummy)? != 0 {
-            error!("File too long!");
-            Err(crate::RosenpassError::RuntimeError)
-        } else {
-            Ok(())
-        }
-    }
-}
-
-pub trait LoadValue {
-    fn load<P: AsRef<Path>>(path: P) -> Result<Self>
-    where
-        Self: Sized;
-}
-
-pub trait LoadValueB64 {
-    fn load_b64<P: AsRef<Path>>(path: P) -> Result<Self>
-    where
-        Self: Sized;
-}
-
-trait StoreValue {
-    fn store<P: AsRef<Path>>(&self, path: P) -> Result<()>;
-}
-
-trait StoreSecret {
-    unsafe fn store_secret<P: AsRef<Path>>(&self, path: P) -> Result<()>;
-}
-
-impl<T: StoreValue> StoreSecret for T {
-    unsafe fn store_secret<P: AsRef<Path>>(&self, path: P) -> Result<()> {
-        self.store(path)
-    }
-}
-
-impl<const N: usize> LoadValue for Secret<N> {
-    fn load<P: AsRef<Path>>(path: P) -> Result<Self> {
-        let mut v = Self::random();
-        let p = path.as_ref();
-        fopen_r(p)?.read_exact_to_end(v.secret_mut()).map_err(|e| {
-            error!("Could not load file {p:?}");
-            e
-        })?;
-        Ok(v)
-    }
-}
-
-impl<const N: usize> LoadValueB64 for Secret<N> {
-    fn load_b64<P: AsRef<Path>>(path: P) -> Result<Self> {
-        let mut v = Self::random();
-        let p = path.as_ref();
-        // This might leave some fragments of the secret on the stack;
-        // in practice this is likely not a problem because the stack likely
-        // will be overwritten by something else soon but this is not exactly
-        // guaranteed. It would be possible to remedy this, but since the secret
-        // data will linger in the Linux page cache anyways with the current
-        // implementation, going to great length to erase the secret here is
-        // not worth it right now.
-        b64_reader(&mut fopen_r(p)?)
-            .read_exact(v.secret_mut())
-            .map_err(|e| {
-                error!("Could not load base64 file {p:?}");
-                e
-            })?;
-        Ok(v)
-    }
-}
-
-impl<const N: usize> StoreSecret for Secret<N> {
-    unsafe fn store_secret<P: AsRef<Path>>(&self, path: P) -> Result<()> {
-        std::fs::write(path, self.secret())?;
-        Ok(())
-    }
-}
-
-impl<const N: usize> LoadValue for Public<N> {
-    fn load<P: AsRef<Path>>(path: P) -> Result<Self> {
-        let mut v = Self::random();
-        fopen_r(path)?.read_exact_to_end(&mut *v)?;
-        Ok(v)
-    }
-}
-
-impl<const N: usize> StoreValue for Public<N> {
-    fn store<P: AsRef<Path>>(&self, path: P) -> Result<()> {
-        std::fs::write(path, **self)?;
-        Ok(())
-    }
-}

to/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "rosenpass-to"
+version = "0.1.0"
+authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
+edition = "2021"
+license = "MIT OR Apache-2.0"
+description = "Flexible destination parameters"
+homepage = "https://rosenpass.eu/"
+repository = "https://github.com/rosenpass/rosenpass"
+readme = "readme.md"
+
+[dev-dependencies]
+doc-comment = { workspace = true }

to/README.md

@@ -0,0 +1,510 @@
+# The To Crate – Patterns for dealing with destination parameters in rust functions
+
+<!-- The code blocks in this file double as tests. -->
+
+![crates.io](https://img.shields.io/crates/v/rosenpass-to.svg)
+![Libraries.io dependency status for latest release](https://img.shields.io/librariesio/release/cargo/rosenpass-to)
+
+The To Crate provides a pattern for declaring and dealing with destination parameters in rust functions. It improves over stock rust by providing an interface that allows the caller to choose whether to place the destination parameter first – through a `to(dest, copy(source))` function – or last – through a chained function `copy(source).to(dest)`.
+
+The crate provides chained functions to simplify allocating the destination parameter on the fly and it provides well defined patterns for dealing with error handling and destination parameters.
+
+For now this crate is experimental; patch releases are guaranteed not to contain any breaking changes, but minor releases may.
+
+```rust
+use rosenpass_to::ops::copy_array;
+use rosenpass_to::{to, with_destination, To};
+use std::ops::BitXorAssign;
+
+// Destination functions return some value that implements the To trait.
+// Unfortunately dealing with lifetimes is a bit more finicky than it would#
+// be without destination parameters
+fn xor_slice<'a, T>(src: &'a [T]) -> impl To<[T], ()> + 'a
+where
+    T: BitXorAssign + Clone,
+{
+    // Custom implementations of the to trait can be created, but the easiest
+    with_destination(move |dst: &mut [T]| {
+        assert!(src.len() == dst.len());
+        for (d, s) in dst.iter_mut().zip(src.iter()) {
+            *d ^= s.clone();
+        }
+    })
+}
+
+let flip0 = b"\xff\x00\x00\x00";
+let flip1 = b"\x00\xff\x00\x00";
+let flip01 = b"\xff\xff\x00\x00";
+
+// You can specify a destination by using the to method
+let mut dst = [0u8; 4];
+xor_slice(flip0).to(&mut dst);
+xor_slice(flip1).to(&mut dst);
+assert_eq!(&dst[..], &flip01[..]);
+
+// Or using the to function
+let mut dst = [0u8; 4];
+to(&mut dst, xor_slice(flip0));
+to(&mut dst, xor_slice(flip1));
+assert_eq!(&dst[..], &flip01[..]);
+
+// You can pass a function to generate the destination on the fly
+let dst = xor_slice(flip1).to_this(|| flip0.to_vec());
+assert_eq!(&dst[..], &flip01[..]);
+
+// If xor_slice used a return value that could be created using Default::default(),
+// you could just use `xor_slice(flip01).to_value()` to generate the destination
+// on the fly. Since [u8] is unsized, it can only be used for references.
+//
+// You can however use collect to specify the storage value explicitly.
+// This works for any type that implements Default::default() and BorrowMut<...> for
+// the destination value.
+
+// Collect in an array with a fixed size
+let dst = xor_slice(flip01).collect::<[u8; 4]>();
+assert_eq!(&dst[..], &flip01[..]);
+
+// The builtin function copy_array supports to_value() since its
+// destination parameter is a fixed size array, which can be allocated
+// using default()
+let dst: [u8; 4] = copy_array(flip01).to_value();
+assert_eq!(&dst, flip01);
+```
+
+The to crate really starts to shine when error handling (through result) is combined with destination parameters. See the tutorial below for details.
+
+## Motivation
+
+Destination parameters are often used when simply returning the value is undesirable or impossible.
+
+Using stock rust features, functions can declare destination parameters by accepting mutable references as arguments.
+This pattern introduces some shortcomings; developers have to make a call on whether to place destination parameters before or after source parameters and they have to enforce consistency across their codebase or accept inconsistencies, leading to hard-to-remember interfaces.
+
+Functions declared like this are more cumbersome to use when the destination parameter should be allocated on the fly.
+
+```rust
+use std::ops::BitXorAssign;
+
+fn xor_slice<T>(dst: &mut [T], src: &[T])
+where
+    T: BitXorAssign + Clone,
+{
+    assert!(src.len() == dst.len());
+    for (d, s) in dst.iter_mut().zip(src.iter()) {
+        *d ^= s.clone();
+    }
+}
+
+let flip0 = b"\xff\x00\x00\x00";
+let flip1 = b"\x00\xff\x00\x00";
+let flip01 = b"\xff\xff\x00\x00";
+
+// Copy a slice from src to dest; its unclear whether src or dest should come first
+let mut dst = [0u8; 4];
+xor_slice(&mut dst, flip0);
+xor_slice(&mut dst, flip1);
+assert_eq!(&dst[..], &flip01[..]);
+
+// The other examples can not be translated to use the standard rust pattern,
+// since using mutable references for destination parameters does not allow
+// for specifying the destination parameter on the right side or allocating
+// the destination parameter on the fly.
+```
+
+## Tutorial
+
+### Using a function with destination
+
+There are a couple of ways to use a function with destination:
+
+```rust
+use rosenpass_to::ops::{copy_array, copy_slice_least};
+use rosenpass_to::{to, To};
+
+let mut dst = b"           ".to_vec();
+
+// Using the to function to have data flowing from the right to the left,
+// performing something akin to a variable assignment
+to(&mut dst[..], copy_slice_least(b"Hello World"));
+assert_eq!(&dst[..], b"Hello World");
+
+// Using the to method to have information flowing from the left to the right
+copy_slice_least(b"This is fin").to(&mut dst[..]);
+assert_eq!(&dst[..], b"This is fin");
+
+// You can allocate the destination variable on the fly using `.to_this(...)`
+let tmp =
+    copy_slice_least(b"This is new---").to_this(|| b"This will be overwritten".to_owned());
+assert_eq!(&tmp[..], b"This is new---verwritten");
+
+// You can allocate the destination variable on the fly `.collect(..)` if it implements default
+let tmp = copy_slice_least(b"This is ad-hoc").collect::<[u8; 16]>();
+assert_eq!(&tmp[..], b"This is ad-hoc\0\0");
+
+// Finally, if the destination variable specified by the function implements default,
+// you can simply use `.to_value()` to allocate it on the fly.
+let tmp = copy_array(b"Fixed").to_value();
+assert_eq!(&tmp[..], b"Fixed");
+```
+
+### Builtin functions with destination
+
+The to crate provides basic functions with destination for copying data between slices and arrays.
+
+```rust
+use rosenpass_to::ops::{
+    copy_array, copy_slice, copy_slice_least, copy_slice_least_src, try_copy_slice,
+    try_copy_slice_least_src,
+};
+use rosenpass_to::{to, To};
+
+let mut dst = b"           ".to_vec();
+
+// Copy a slice, source and destination must match exactly
+to(&mut dst[..], copy_slice(b"Hello World"));
+assert_eq!(&dst[..], b"Hello World");
+
+// Copy a slice, destination must be at least as long as the destination
+to(&mut dst[4..], copy_slice_least_src(b"!!!"));
+assert_eq!(&dst[..], b"Hell!!!orld");
+
+// Copy a slice, copying as many bytes as possible
+to(
+    &mut dst[6..],
+    copy_slice_least(b"xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"),
+);
+assert_eq!(&dst[..], b"Hell!!xxxxx");
+
+// Copy a slice, will return None and abort if the sizes do not much
+assert_eq!(Some(()), to(&mut dst[..], try_copy_slice(b"Hello World")));
+assert_eq!(None, to(&mut dst[..], try_copy_slice(b"---")));
+assert_eq!(
+    None,
+    to(&mut dst[..], try_copy_slice(b"---------------------"))
+);
+assert_eq!(&dst[..], b"Hello World");
+
+// Copy a slice, will return None and abort if source is longer than destination
+assert_eq!(
+    Some(()),
+    to(&mut dst[4..], try_copy_slice_least_src(b"!!!"))
+);
+assert_eq!(
+    None,
+    to(
+        &mut dst[4..],
+        try_copy_slice_least_src(b"-------------------------")
+    )
+);
+assert_eq!(&dst[..], b"Hell!!!orld");
+
+// Copy fixed size arrays all at once
+let mut dst = [0u8; 5];
+to(&mut dst, copy_array(b"Hello"));
+assert_eq!(&dst, b"Hello");
+```
+
+### Declaring a function with destination
+
+The easiest way to declare a function with destination is to use the with_destination function.
+
+```rust
+use rosenpass_to::ops::copy_array;
+use rosenpass_to::{to, with_destination, To};
+
+/// Copy the given slice to the start of a vector, reusing its memory if possible
+fn copy_to_vec<'a, T>(src: &'a [T]) -> impl To<Vec<T>, ()> + 'a
+where
+    T: Clone,
+{
+    with_destination(move |dst: &mut Vec<T>| {
+        dst.clear();
+        dst.extend_from_slice(src);
+    })
+}
+
+let mut buf = copy_to_vec(b"Hello World, this is a long text.").to_value();
+assert_eq!(&buf[..], b"Hello World, this is a long text.");
+
+to(&mut buf, copy_to_vec(b"Avoids allocation"));
+assert_eq!(&buf[..], b"Avoids allocation");
+```
+
+This example also shows of some of the advantages of using To: The function gains a very slight allocate over using `.to_vec()` by reusing memory:
+
+```rust
+let mut buf = b"Hello World, this is a long text.".to_vec();
+buf = b"This allocates".to_vec(); // This uses memory allocation
+```
+
+The same pattern can be implemented without `to`, at the cost of being slightly more verbose
+
+```rust
+/// Copy the given slice to the start of a vector, reusing its memory if possible
+fn copy_to_vec<T>(dst: &mut Vec<T>, src: &[T])
+where
+    T: Clone,
+{
+    dst.clear();
+    dst.extend_from_slice(src);
+}
+
+let mut buf = Vec::default();
+copy_to_vec(&mut buf, b"Hello World, this is a long text.");
+assert_eq!(&buf[..], b"Hello World, this is a long text.");
+
+copy_to_vec(&mut buf, b"Avoids allocation");
+assert_eq!(&buf[..], b"Avoids allocation");
+```
+
+This usability enhancement might seem minor, but when many functions take destination parameters, manually allocating all of these can really become annoying.
+
+## Beside values: Functions with destination and return value
+
+Return values are supported, but `from_this()`, `to_value()`, and `collect()` cannot be used together with return values (unless they implement CondenseBeside – see the next section), since that would erase the return value.
+
+Alternative functions are returned, that return a `to::Beside` value, containing both the
+destination variable and the return value.
+
+```rust
+use rosenpass_to::{to, with_destination, Beside, To};
+use std::cmp::{max, min};
+
+/// Copy an array of floats and calculate the average
+pub fn copy_and_average<'a>(src: &'a [f64]) -> impl To<[f64], f64> + 'a {
+    with_destination(move |dst: &mut [f64]| {
+        assert!(src.len() == dst.len());
+        let mut sum = 0f64;
+        for (d, s) in dst.iter_mut().zip(src.iter()) {
+            *d = *s;
+            sum = sum + *d;
+        }
+        sum / (src.len() as f64)
+    })
+}
+
+let src = [12f64, 13f64, 14f64];
+
+// `.to()` and `to(...)` function as normal, but return the value now
+let mut dst = [0f64; 3];
+let avg = copy_and_average(&src).to(&mut dst);
+assert_eq!((&dst[..], avg), (&src[..], 13f64));
+
+let mut dst = [0f64; 3];
+let avg = to(&mut dst, copy_and_average(&src));
+assert_eq!((&dst[..], avg), (&src[..], 13f64));
+
+// Instead of .to_this, .to_value, or .collect variants returning a beside value have to be used
+
+let Beside(dst, avg) = copy_and_average(&src).to_this_beside(|| [0f64; 3]);
+assert_eq!((&dst[..], avg), (&src[..], 13f64));
+
+let Beside(dst, avg) = copy_and_average(&src).collect_beside::<[f64; 3]>();
+assert_eq!((&dst[..], avg), (&src[..], 13f64));
+
+// Beside values are simple named tuples
+
+let b = copy_and_average(&src).collect_beside::<[f64; 3]>();
+assert_eq!(b, Beside(dst, avg));
+
+// They can convert from and to tuples
+let b_tup = (dst, avg);
+assert_eq!(b, (dst, avg).into());
+assert_eq!(b, Beside::from(b_tup));
+
+// Simple accessors for the value and returned value are provided
+assert_eq!(&dst, b.dest());
+assert_eq!(&avg, b.ret());
+
+let mut tmp = b;
+*tmp.dest_mut() = [42f64; 3];
+*tmp.ret_mut() = 42f64;
+assert_eq!(tmp, Beside([42f64; 3], 42f64));
+```
+
+## Beside Condensation: Working with destinations and Optional or Result
+
+When Beside values contain a `()`, `Option<()>`, or `Result<(), Error>` return value, they expose a special method called `.condense()`; this method consumes the Beside value and condenses destination and return value into one value.
+
+```rust
+use rosenpass_to::Beside;
+use std::result::Result;
+
+assert_eq!((), Beside((), ()).condense());
+
+assert_eq!(42, Beside(42, ()).condense());
+assert_eq!(None, Beside(42, None).condense());
+
+let ok_unit = Result::<(), ()>::Ok(());
+assert_eq!(Ok(42), Beside(42, ok_unit).condense());
+
+let err_unit = Result::<(), ()>::Err(());
+assert_eq!(Err(()), Beside(42, err_unit).condense());
+```
+
+When condense is implemented for a type, `.to_this(|| ...)`, `.to_value()`, and `.collect::<...>()` on the `To` trait can be used even with a return value:
+
+```rust
+use rosenpass_to::ops::try_copy_slice;
+use rosenpass_to::To;
+
+let tmp = try_copy_slice(b"Hello World").collect::<[u8; 11]>();
+assert_eq!(tmp, Some(*b"Hello World"));
+
+let tmp = try_copy_slice(b"Hello World").collect::<[u8; 2]>();
+assert_eq!(tmp, None);
+
+let tmp = try_copy_slice(b"Hello World").to_this(|| [0u8; 11].to_vec());
+assert_eq!(tmp, Some(b"Hello World".to_vec()));
+
+let tmp = try_copy_slice(b"Hello World").to_this(|| [0u8; 2].to_vec());
+assert_eq!(tmp, None);
+```
+
+The same naturally also works for Results, but the example is a bit harder to motivate:
+
+```rust
+use rosenpass_to::{to, with_destination, To};
+use std::result::Result;
+
+#[derive(PartialEq, Eq, Debug, Default)]
+struct InvalidFloat;
+
+fn check_float(f: f64) -> Result<(), InvalidFloat> {
+    if f.is_normal() || f == 0.0 {
+        Ok(())
+    } else {
+        Err(InvalidFloat)
+    }
+}
+
+fn checked_add<'a>(src: f64) -> impl To<f64, Result<(), InvalidFloat>> + 'a {
+    with_destination(move |dst: &mut f64| {
+        check_float(src)?;
+        check_float(*dst)?;
+        *dst += src;
+        Ok(())
+    })
+}
+
+let mut tmp = 0.0;
+checked_add(14.0).to(&mut tmp).unwrap();
+checked_add(12.0).to(&mut tmp).unwrap();
+assert_eq!(tmp, 26.0);
+
+assert_eq!(Ok(78.0), checked_add(14.0).to_this(|| 64.0));
+assert_eq!(Ok(14.0), checked_add(14.0).to_value());
+assert_eq!(Ok(14.0), checked_add(14.0).collect());
+
+assert_eq!(Err(InvalidFloat), checked_add(f64::NAN).to_this(|| 64.0));
+assert_eq!(Err(InvalidFloat), checked_add(f64::INFINITY).to_value());
+```
+
+## Custom condensation
+
+Condensation is implemented through a trait called CondenseBeside ([local](CondenseBeside) | [docs.rs](https://docs.rs/to/latest/rosenpass-to/trait.CondenseBeside.html)). You can implement it for your own types.
+
+If you can not implement this trait because its for an external type (see [orphan rule](https://doc.rust-lang.org/book/ch10-02-traits.html#implementing-a-trait-on-a-type)), this crate welcomes contributions of new Condensation rules.
+
+```rust
+use rosenpass_to::ops::copy_slice;
+use rosenpass_to::{with_destination, Beside, CondenseBeside, To};
+
+#[derive(PartialEq, Eq, Debug, Default)]
+struct MyTuple<Left, Right>(Left, Right);
+
+impl<Val, Right> CondenseBeside<Val> for MyTuple<(), Right> {
+    type Condensed = MyTuple<Val, Right>;
+
+    fn condense(self, val: Val) -> MyTuple<Val, Right> {
+        let MyTuple((), right) = self;
+        MyTuple(val, right)
+    }
+}
+
+fn copy_slice_and_return_something<'a, T, U>(src: &'a [T], something: U) -> impl To<[T], U> + 'a
+where
+    T: Copy,
+    U: 'a,
+{
+    with_destination(move |dst: &mut [T]| {
+        copy_slice(src).to(dst);
+        something
+    })
+}
+
+let tmp = Beside(42, MyTuple((), 23)).condense();
+assert_eq!(tmp, MyTuple(42, 23));
+
+let tmp = copy_slice_and_return_something(b"23", MyTuple((), 42)).collect::<[u8; 2]>();
+assert_eq!(tmp, MyTuple(*b"23", 42));
+```
+
+## Manually implementing the To trait
+
+Using `with_destination(...)` is convenient, but since it uses closures it results in an type that can not be written down, which is why the `-> impl To<...>` pattern is used everywhere in this tutorial.
+
+Implementing the ToTrait manual is the right choice for library use cases.
+
+```rust
+use rosenpass_to::{to, with_destination, To};
+
+struct TryCopySliceSource<'a, T: Copy> {
+    src: &'a [T],
+}
+
+impl<'a, T: Copy> To<[T], Option<()>> for TryCopySliceSource<'a, T> {
+    fn to(self, dst: &mut [T]) -> Option<()> {
+        (self.src.len() == dst.len()).then(|| dst.copy_from_slice(self.src))
+    }
+}
+
+fn try_copy_slice<'a, T>(src: &'a [T]) -> TryCopySliceSource<'a, T>
+where
+    T: Copy,
+{
+    TryCopySliceSource { src }
+}
+
+let mut dst = try_copy_slice(b"Hello World")
+    .collect::<[u8; 11]>()
+    .unwrap();
+assert_eq!(&dst[..], b"Hello World");
+assert_eq!(None, to(&mut dst[..], try_copy_slice(b"---")));
+```
+
+## Methods with destination
+
+Destinations can also be used with methods. This example demonstrates using destinations in an extension trait for everything that implements `Borrow<[T]>` for any `T` and a concrete `To` trait implementation.
+
+```rust
+use rosenpass_to::{to, with_destination, To};
+use std::borrow::Borrow;
+
+struct TryCopySliceSource<'a, T: Copy> {
+    src: &'a [T],
+}
+
+impl<'a, T: Copy> To<[T], Option<()>> for TryCopySliceSource<'a, T> {
+    fn to(self, dst: &mut [T]) -> Option<()> {
+        (self.src.len() == dst.len()).then(|| dst.copy_from_slice(self.src))
+    }
+}
+
+trait TryCopySliceExt<'a, T: Copy> {
+    fn try_copy_slice(&'a self) -> TryCopySliceSource<'a, T>;
+}
+
+impl<'a, T: 'a + Copy, Ref: 'a + Borrow<[T]>> TryCopySliceExt<'a, T> for Ref {
+    fn try_copy_slice(&'a self) -> TryCopySliceSource<'a, T> {
+        TryCopySliceSource { src: self.borrow() }
+    }
+}
+
+let mut dst = b"Hello World"
+    .try_copy_slice()
+    .collect::<[u8; 11]>()
+    .unwrap();
+assert_eq!(&dst[..], b"Hello World");
+assert_eq!(None, to(&mut dst[..], b"---".try_copy_slice()));
+```

to/src/lib.rs

@@ -0,0 +1,14 @@
+#![doc = include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/README.md"))]
+
+#[cfg(doctest)]
+doc_comment::doctest!("../README.md");
+
+// Core implementation
+mod to;
+pub use crate::to::{
+    beside::Beside, condense::CondenseBeside, dst_coercion::DstCoercion, to_function::to,
+    to_trait::To, with_destination::with_destination,
+};
+
+// Example use cases
+pub mod ops;

to/src/ops.rs

@@ -0,0 +1,80 @@
+//! Functions with destination copying data between slices and arrays.
+
+use crate::{with_destination, To};
+
+/// Function with destination that copies data from
+/// origin into the destination.
+///
+/// # Panics
+///
+/// This function will panic if the two slices have different lengths.
+pub fn copy_slice<T>(origin: &[T]) -> impl To<[T], ()> + '_
+where
+    T: Copy,
+{
+    with_destination(|out: &mut [T]| out.copy_from_slice(origin))
+}
+
+/// Function with destination that copies all data from
+/// origin into the destination.
+///
+/// Destination may be longer than origin.
+///
+/// # Panics
+///
+/// This function will panic if destination is shorter than origin.
+pub fn copy_slice_least_src<T>(origin: &[T]) -> impl To<[T], ()> + '_
+where
+    T: Copy,
+{
+    with_destination(|out: &mut [T]| copy_slice(origin).to(&mut out[..origin.len()]))
+}
+
+/// Function with destination that copies as much data as possible from origin to the
+/// destination.
+///
+/// Copies as much data as is present in the shorter slice.
+pub fn copy_slice_least<T>(origin: &[T]) -> impl To<[T], ()> + '_
+where
+    T: Copy,
+{
+    with_destination(|out: &mut [T]| {
+        let len = std::cmp::min(origin.len(), out.len());
+        copy_slice(&origin[..len]).to(&mut out[..len])
+    })
+}
+
+/// Function with destination that attempts to copy data from origin into the destination.
+///
+/// Will return None if the slices are of different lengths.
+pub fn try_copy_slice<T>(origin: &[T]) -> impl To<[T], Option<()>> + '_
+where
+    T: Copy,
+{
+    with_destination(|out: &mut [T]| {
+        (origin.len() == out.len()).then(|| copy_slice(origin).to(out))
+    })
+}
+
+/// Function with destination that tries to copy all data from
+/// origin into the destination.
+///
+/// Destination may be longer than origin.
+///
+/// Will return None if the destination is shorter than origin.
+pub fn try_copy_slice_least_src<T>(origin: &[T]) -> impl To<[T], Option<()>> + '_
+where
+    T: Copy,
+{
+    with_destination(|out: &mut [T]| {
+        (origin.len() <= out.len()).then(|| copy_slice_least_src(origin).to(out))
+    })
+}
+
+/// Function with destination that copies all data between two array references.
+pub fn copy_array<T, const N: usize>(origin: &[T; N]) -> impl To<[T; N], ()> + '_
+where
+    T: Copy,
+{
+    with_destination(|out: &mut [T; N]| out.copy_from_slice(origin))
+}

to/src/to/beside.rs

@@ -0,0 +1,45 @@
+use crate::CondenseBeside;
+
+/// Named tuple holding the return value and the output from a function with destinations.
+#[derive(Debug, PartialEq, Eq, Default, PartialOrd, Ord, Copy, Clone)]
+pub struct Beside<Val, Ret>(pub Val, pub Ret);
+
+impl<Val, Ret> Beside<Val, Ret> {
+    pub fn dest(&self) -> &Val {
+        &self.0
+    }
+
+    pub fn ret(&self) -> &Ret {
+        &self.1
+    }
+
+    pub fn dest_mut(&mut self) -> &mut Val {
+        &mut self.0
+    }
+
+    pub fn ret_mut(&mut self) -> &mut Ret {
+        &mut self.1
+    }
+
+    /// Perform beside condensation. See [CondenseBeside]
+    pub fn condense(self) -> <Ret as CondenseBeside<Val>>::Condensed
+    where
+        Ret: CondenseBeside<Val>,
+    {
+        self.1.condense(self.0)
+    }
+}
+
+impl<Val, Ret> From<(Val, Ret)> for Beside<Val, Ret> {
+    fn from(tuple: (Val, Ret)) -> Self {
+        let (val, ret) = tuple;
+        Self(val, ret)
+    }
+}
+
+impl<Val, Ret> From<Beside<Val, Ret>> for (Val, Ret) {
+    fn from(beside: Beside<Val, Ret>) -> Self {
+        let Beside(val, ret) = beside;
+        (val, ret)
+    }
+}

to/src/to/condense.rs

@@ -0,0 +1,37 @@
+/// Beside condensation.
+///
+/// This trait can be used to enable the use of [to_this(|| ...)](crate::To::to_this),
+/// [to_value()](crate::To::to_value), and [collect::<...>()](crate::To::collect) with custom
+/// types.
+///
+/// The function [Beside::condense()](crate::Beside::condense) is a shorthand for using the
+/// condense trait.
+pub trait CondenseBeside<Val> {
+    type Condensed;
+
+    fn condense(self, ret: Val) -> Self::Condensed;
+}
+
+impl<Val> CondenseBeside<Val> for () {
+    type Condensed = Val;
+
+    fn condense(self, ret: Val) -> Val {
+        ret
+    }
+}
+
+impl<Val, Error> CondenseBeside<Val> for Result<(), Error> {
+    type Condensed = Result<Val, Error>;
+
+    fn condense(self, ret: Val) -> Result<Val, Error> {
+        self.map(|()| ret)
+    }
+}
+
+impl<Val> CondenseBeside<Val> for Option<()> {
+    type Condensed = Option<Val>;
+
+    fn condense(self, ret: Val) -> Option<Val> {
+        self.map(|()| ret)
+    }
+}

to/src/to/dst_coercion.rs

@@ -0,0 +1,17 @@
+/// Helper performing explicit unsized coercion.
+/// Used by the [to](crate::to()) function.
+pub trait DstCoercion<Dst: ?Sized> {
+    fn coerce_dest(&mut self) -> &mut Dst;
+}
+
+impl<T: ?Sized> DstCoercion<T> for T {
+    fn coerce_dest(&mut self) -> &mut T {
+        self
+    }
+}
+
+impl<T, const N: usize> DstCoercion<[T]> for [T; N] {
+    fn coerce_dest(&mut self) -> &mut [T] {
+        self
+    }
+}