fix(crypto): real Noise ee+es+se key agreement (forward secrecy) — part 1 of N3 - #64
Closed
gHashTag wants to merge 1 commit into
Closed
fix(crypto): real Noise ee+es+se key agreement (forward secrecy) — part 1 of N3#64gHashTag wants to merge 1 commit into
gHashTag wants to merge 1 commit into
Conversation
…rt 1 of N3 The handshake computed only ee + ss and passed `ss` in BOTH the es and se slots of combine_dh_shares (crypto.rs), so it had no forward secrecy and did not bind the ephemeral keys into the session — the "SIMPLIFIED Noise-XX" note admitted it. Fix: NoiseXX.ephemeral becomes a reusable StaticSecret (an EphemeralSecret is consumed by its first diffie_hellman, but we need it for both ee and es), and complete_initiator/responder now compute the real three shares: initiator: ee=e_i.e_r, es=e_i.s_r, se=s_i.e_r responder: ee=e_r.e_i, es=s_r.e_i (== e_i.s_r), se=e_r.s_i (== s_i.e_r) so both sides derive the same (ee, es, se). Verified: handshake_and_roundtrip and independent_handshakes_do_not_share_a_key pass (honest parties still agree on the key; a wrong role-order would fail these), full suite 103 passed. SCOPE: this is the forward-secrecy half of N3. It does NOT add identity authentication — the `noise_xx_resistant_to_mitm` scenario (a party handshaking directly against an attacker's static key) still needs allow-list gating (complete_* -> Result, reject a peer_static not matching the expected identity), which is an API change awaiting owner sign-off in the RFC (#63). N4 (HELLO MAC) and N5 (keystore) are also still open. Draft — needs crypto review. Refs #58, #63. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> phi^2 + phi^-2 = 3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First, verifiable, low-risk slice of the crypto fix (RFC #63). The handshake did ee+ss with
sspassed as both es and se — no forward secrecy. Now computes real ee/es/se (ephemeral changed to a reusable StaticSecret for the two DH ops). Verified: honest parties still derive the same key (handshake_and_roundtrip green), full suite 103 passed. NOT the whole fix: identity auth (allow-list gating, the actual MITM defense), N4, N5 still open per #63 and need owner decisions. Draft, needs crypto review. phi^2 + phi^-2 = 3