fix: Regression caused by benchmarks

CI keeps failing for external pull requests as GH's permission
model was not fully accounted for

.ci/boot_race/a.toml

@@ -3,11 +3,6 @@ secret_key = "rp-a-secret-key"
 listen = ["127.0.0.1:9999"]
 verbosity = "Verbose"
 
-[api]
-listen_path = []
-listen_fd = []
-stream_fd = []
-
 [[peers]]
 public_key = "rp-b-public-key"
 endpoint = "127.0.0.1:9998"

.ci/boot_race/b.toml

@@ -3,11 +3,6 @@ secret_key = "rp-b-secret-key"
 listen = ["127.0.0.1:9998"]
 verbosity = "Verbose"
 
-[api]
-listen_path = []
-listen_fd = []
-stream_fd = []
-
 [[peers]]
 public_key = "rp-a-public-key"
 endpoint = "127.0.0.1:9999"

.ci/gen-workflow-files.nu

@@ -32,9 +32,9 @@ let systems_map = {
   # aarch64-darwin
   # aarch64-linux
   
-  i686-linux: ubuntu-latest,
+  i686-linux: ubicloud-standard-2-ubuntu-2204,
   x86_64-darwin: macos-13,
-  x86_64-linux: ubuntu-latest
+  x86_64-linux: ubicloud-standard-2-ubuntu-2204
 }
 
 let targets = (get-attr-names ".#packages"
@@ -61,14 +61,13 @@ mut release_workflow = {
 
 let runner_setup = [
   {
-    uses: "actions/checkout@v3"
+    uses: "actions/checkout@v4"
   }
   {
-    uses: "cachix/install-nix-action@v22",
-    with: { nix_path: "nixpkgs=channel:nixos-unstable" }
+    uses: "cachix/install-nix-action@v30",
   }
   {
-    uses: "cachix/cachix-action@v12",
+    uses: "cachix/cachix-action@v15",
     with: {
       name: rosenpass,
       authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
@@ -154,7 +153,7 @@ for system in ($targets | columns) {
       }
       {
         name: Release,
-        uses: "softprops/action-gh-release@v1",
+        uses: "softprops/action-gh-release@v2",
         with: {
           draft: "${{ contains(github.ref_name, 'rc') }}",
           prerelease: "${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') }}",
@@ -182,7 +181,7 @@ $cachix_workflow.jobs = ($cachix_workflow.jobs | insert $"($system)---whitepaper
     }
     {
       name: "Deploy PDF artifacts",
-      uses: "peaceiris/actions-gh-pages@v3",
+      uses: "peaceiris/actions-gh-pages@v4",
       with: {
         github_token: "${{ secrets.GITHUB_TOKEN }}",
         publish_dir: result/,

.dockerignore

@@ -0,0 +1 @@
+.gitignore

.github/workflows/bench-primitives.yml

@@ -0,0 +1,103 @@
+name: rosenpass-ciphers - primitives - benchmark
+
+permissions:
+  contents: write
+
+on:
+  #pull_request:
+  push:
+
+env:
+  CARGO_TERM_COLOR: always
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  prim-benchmark:
+    strategy:
+      fail-fast: true
+      matrix:
+        system: ["x86_64-linux", "i686-linux"]
+
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # Install nix
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v27 # A popular action for installing Nix
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+
+      # Set up environment
+
+      - name: 🛠️ Prepare Benchmark Path
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BRANCH_NAME: ${{ github.ref_name   }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          case "$EVENT_NAME" in
+          "push")
+            echo "BENCH_PATH=branch/$BRANCH_NAME" >> $GITHUB_ENV
+            ;;
+          "pull_request")
+            echo "BENCH_PATH=pull/$PR_NUMBER" >> $GITHUB_ENV
+            ;;
+          *)
+            echo "don't know benchmark path for event of type $EVENT_NAME, aborting"
+            exit 1
+          esac
+
+      # Benchmarks ...
+
+      - name: 🏃🏻‍♀️ Benchmarks (using Nix as shell)
+        working-directory: ciphers
+        run: nix develop ".#devShells.${{ matrix.system }}.benchmarks" --command cargo bench -F bench --bench primitives --verbose -- --output-format bencher | tee ../bench-primitives.txt
+
+      - name: Extract benchmarks
+        uses: cryspen/benchmark-data-extract-transform@v2
+        with:
+          name: rosenpass-ciphers primitives benchmarks
+          tool: "cargo"
+          os: ${{ matrix.system }}
+          output-file-path: bench-primitives.txt
+          data-out-path: bench-primitives-os.json
+
+      - name: Fix up 'os' label in benchmark data
+        run: jq 'map(with_entries(.key |= if . == "os" then "operating system" else . end))' <bench-primitives-os.json >bench-primitives.json
+
+      - name: Upload benchmarks
+        uses: cryspen/benchmark-upload-and-plot-action@v3
+        with:
+          name: Crypto Primitives Benchmarks
+          group-by: "operating system,primitive,algorithm"
+          schema: "operating system,primitive,algorithm,implementation,operation,length"
+          input-data-path: bench-primitives.json
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          # NOTE: pushes to current repository
+          gh-repository: github.com/${{ github.repository }}
+          auto-push: true
+          fail-on-alert: true
+          base-path: benchmarks/
+
+  ciphers-primitives-bench-status:
+    if: ${{ always() }}
+    needs: [prim-benchmark]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Successful
+        if: ${{ !(contains(needs.*.result, 'failure')) }}
+        run: exit 0
+      - name: Failing
+        if: ${{ (contains(needs.*.result, 'failure')) }}
+        run: exit 1

.github/workflows/bench-protocol.yml

@@ -0,0 +1,90 @@
+name: rosenpass - protocol - benchmark
+
+permissions:
+  contents: write
+
+on:
+  #pull_request:
+  push:
+
+env:
+  CARGO_TERM_COLOR: always
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  proto-benchmark:
+    strategy:
+      fail-fast: true
+      matrix:
+        system: ["x86_64-linux", "i686-linux"]
+
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # Install nix
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v27 # A popular action for installing Nix
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+
+      # Set up environment
+
+      - name: 🛠️ Prepare Benchmark Path
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BRANCH_NAME: ${{ github.ref_name   }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          case "$EVENT_NAME" in
+          "push")
+            echo "BENCH_PATH=branch/$BRANCH_NAME" >> $GITHUB_ENV
+            ;;
+          "pull_request")
+            echo "BENCH_PATH=pull/$PR_NUMBER" >> $GITHUB_ENV
+            ;;
+          *)
+            echo "don't know benchmark path for event of type $EVENT_NAME, aborting"
+            exit 1
+          esac
+
+      # Benchmarks ...
+
+      - name: 🏃🏻‍♀️ Benchmarks
+        run: nix develop ".#devShells.${{ matrix.system }}.benchmarks" --command cargo bench -p rosenpass --bench trace_handshake -F trace_bench --verbose >bench-protocol.json
+
+      - name: Upload benchmarks
+        uses: cryspen/benchmark-upload-and-plot-action@v3
+        with:
+          name: Protocol Benchmarks
+          group-by: "operating system,architecture,protocol version,run time"
+          schema: "operating system,architecture,protocol version,run time,name"
+          input-data-path: bench-protocol.json
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          # NOTE: pushes to current repository
+          gh-repository: github.com/${{ github.repository }}
+          auto-push: true
+          fail-on-alert: true
+          base-path: benchmarks/
+
+  ciphers-protocol-bench-status:
+    if: ${{ always() }}
+    needs: [proto-benchmark]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Successful
+        if: ${{ !(contains(needs.*.result, 'failure')) }}
+        run: exit 0
+      - name: Failing
+        if: ${{ (contains(needs.*.result, 'failure')) }}
+        run: exit 1

.github/workflows/docker.yaml

@@ -0,0 +1,288 @@
+name: Build Docker Images
+
+# Run this job on all non-pull-request events,
+# or if Docker-related files are changed in a pull request.
+on:
+  push:
+    branches:
+      - "main"
+    tags:
+      - "v*"
+  pull_request:
+    paths:
+      - "docker/Dockerfile"
+      - ".github/workflows/docker.yaml"
+    branches:
+      - "main"
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  # --------------------------------
+  # 1. BUILD & TEST
+  # --------------------------------
+  build-and-test-rp:
+    strategy:
+      matrix:
+        arch: [amd64, arm64]
+    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build (no push) and Load
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/Dockerfile
+          # no pushing here, so we can test locally
+          push: false
+          # load the built image into the local Docker daemon on the runner
+          load: true
+          target: rosenpass
+          tags: rosenpass:test
+          platforms: linux/${{ matrix.arch }}
+      - name: Integration Test - Standalone Key Exchange
+        run: |
+          # Create separate workdirs
+          mkdir -p workdir-server workdir-client
+
+          # Create a Docker network
+          docker network create -d bridge rp
+
+          echo "=== GENERATE SERVER KEYS ==="
+          docker run --rm \
+            -v $PWD/workdir-server:/workdir \
+            rosenpass:test gen-keys \
+              --public-key=workdir/server-public \
+              --secret-key=workdir/server-secret
+
+          echo "=== GENERATE CLIENT KEYS ==="
+          docker run --rm \
+            -v $PWD/workdir-client:/workdir \
+            rosenpass:test gen-keys \
+              --public-key=workdir/client-public \
+              --secret-key=workdir/client-secret
+
+          echo "=== SHARE PUBLIC KEYS ==="
+          cp workdir-client/client-public workdir-server/client-public
+          cp workdir-server/server-public workdir-client/server-public
+
+          echo "=== START SERVER CONTAINER ==="
+          docker run -d --rm \
+            --name rpserver \
+            --network rp \
+            -v $PWD/workdir-server:/workdir \
+            rosenpass:test exchange \
+              private-key workdir/server-secret \
+              public-key  workdir/server-public \
+              listen 0.0.0.0:9999 \
+              peer public-key workdir/client-public \
+              outfile workdir/server-sharedkey
+
+          # Get the container IP of the server
+          SERVER_IP=$(docker inspect --format='{{.NetworkSettings.Networks.rp.IPAddress}}' rpserver)
+          echo "SERVER_IP=$SERVER_IP"
+
+          echo "=== START CLIENT CONTAINER ==="
+          docker run -d --rm \
+            --name rpclient \
+            --network rp \
+            -v $PWD/workdir-client:/workdir \
+            rosenpass:test exchange \
+              private-key workdir/client-secret \
+              public-key  workdir/client-public \
+              peer public-key workdir/server-public \
+              endpoint ${SERVER_IP}:9999 \
+              outfile workdir/client-sharedkey
+
+          echo "=== COMPARE SHARED KEYS ==="
+          echo "Waiting up to 30 seconds for the server to generate 'server-sharedkey'..."
+          for i in $(seq 1 30); do
+            if [ -f "workdir-server/server-sharedkey" ]; then
+              echo "server-sharedkey found!"
+              break
+            fi
+            sleep 1
+          done
+          sudo cmp workdir-server/server-sharedkey workdir-client/client-sharedkey
+
+          echo "Standalone Key Exchange test OK."
+  # --------------------------------
+  # 2. PUSH (only if tests pass)
+  # --------------------------------
+  docker-image-rp:
+    needs:
+      - build-and-test-rp
+    # Skip if this is not a PR. Then we want to push this image.
+    if: ${{ github.event_name != 'pull_request' }}
+    # Use a matrix to build for both AMD64 and ARM64
+    strategy:
+      matrix:
+        arch: [amd64, arm64]
+    # Switch the runner based on the architecture
+    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Docker meta
+        id: meta
+
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/rp
+          labels: |
+            maintainer=Karolin Varner <karo@cupdev.net>, wucke13 <wucke13@gmail.com>
+            org.opencontainers.image.authors=Karolin Varner <karo@cupdev.net>, wucke13 <wucke13@gmail.com>
+            org.opencontainers.image.title=Rosenpass
+            org.opencontainers.image.description=The rp command-line integrates Rosenpass and WireGuard to help you create a VPN
+            org.opencontainers.image.vendor=Rosenpass e.V.
+            org.opencontainers.image.licenses=MIT OR Apache-2.0
+            org.opencontainers.image.url=https://rosenpass.eu
+            org.opencontainers.image.documentation=https://rosenpass.eu/docs/
+            org.opencontainers.image.source=https://github.com/rosenpass/rosenpass
+
+      - name: Log in to registry
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/Dockerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          labels: ${{ steps.meta.outputs.labels }}
+          tags: ghcr.io/${{ github.repository_owner }}/rp
+          target: rp
+          platforms: linux/${{ matrix.arch }}
+          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
+
+      - name: Export digest
+        run: |
+          mkdir -p ${{ runner.temp }}/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-rp-${{ matrix.arch }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  docker-image-rosenpass:
+    needs:
+      - build-and-test-rp
+    # Skip if this is not a PR. Then we want to push this image.
+    if: ${{ github.event_name != 'pull_request' }}
+    # Use a matrix to build for both AMD64 and ARM64
+    strategy:
+      matrix:
+        arch: [amd64, arm64]
+    # Switch the runner based on the architecture
+    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/rosenpass
+          labels: |
+            maintainer=Karolin Varner <karo@cupdev.net>, wucke13 <wucke13@gmail.com>
+            org.opencontainers.image.authors=Karolin Varner <karo@cupdev.net>, wucke13 <wucke13@gmail.com>
+            org.opencontainers.image.title=Rosenpass
+            org.opencontainers.image.description=Reference implementation of the protocol rosenpass protocol
+            org.opencontainers.image.vendor=Rosenpass e.V.
+            org.opencontainers.image.licenses=MIT OR Apache-2.0
+            org.opencontainers.image.url=https://rosenpass.eu
+            org.opencontainers.image.documentation=https://rosenpass.eu/docs/
+            org.opencontainers.image.source=https://github.com/rosenpass/rosenpass
+
+      - name: Log in to registry
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/Dockerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          labels: ${{ steps.meta.outputs.labels }}
+          tags: ghcr.io/${{ github.repository_owner }}/rosenpass
+          target: rosenpass
+          platforms: linux/${{ matrix.arch }}
+          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
+
+      - name: Export digest
+        run: |
+          mkdir -p ${{ runner.temp }}/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-rosenpass-${{ matrix.arch }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge-digests:
+    runs-on: ubuntu-latest
+    needs:
+      - docker-image-rosenpass
+      - docker-image-rp
+    if: ${{ github.event_name != 'pull_request' }}
+    strategy:
+      matrix:
+        target: [rp, rosenpass]
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digests-${{ matrix.target }}-*
+          merge-multiple: true
+
+      - name: Log in to registry
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/${{ matrix.target }}
+          tags: |
+            type=edge,branch=main
+            type=sha,branch=main
+            type=semver,pattern={{version}}
+
+      - name: Create manifest list and push
+        working-directory: ${{ runner.temp }}/digests
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf 'ghcr.io/${{ github.repository_owner }}/${{ matrix.target }}@sha256:%s ' *)
+
+      - name: Inspect image
+        run: |
+          docker buildx imagetools inspect ghcr.io/${{ github.repository_owner }}/${{ matrix.target }}:${{ steps.meta.outputs.version }}

.github/workflows/manual-mac-pr.yaml

@@ -0,0 +1,19 @@
+name: PR Validation on Mac
+on:
+  workflow_dispatch:
+permissions:
+  checks: write
+  contents: write
+concurrency:
+  group: manual-mac-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  qc:
+    uses: ./.github/workflows/qc-mac.yaml
+    permissions:
+      checks: write
+      contents: read
+  nix:
+    uses: ./.github/workflows/nix-mac.yaml
+    permissions:
+      contents: write

.github/workflows/nix-mac.yaml

@@ -0,0 +1,114 @@
+name: Nix on Mac
+permissions:
+  contents: write
+on:
+  push:
+    branches:
+      - main
+  workflow_call:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  aarch64-darwin---default:
+    name: Build aarch64-darwin.default
+    runs-on:
+      - warp-macos-13-arm64-6x
+    needs:
+      - aarch64-darwin---rosenpass
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v30
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v15
+        with:
+          name: rosenpass
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Build
+        run: nix build .#packages.aarch64-darwin.default --print-build-logs
+  aarch64-darwin---release-package:
+    name: Build aarch64-darwin.release-package
+    runs-on:
+      - warp-macos-13-arm64-6x
+    needs:
+      - aarch64-darwin---rosenpass
+      - aarch64-darwin---rp
+      - aarch64-darwin---rosenpass-oci-image
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v30
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v15
+        with:
+          name: rosenpass
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Build
+        run: nix build .#packages.aarch64-darwin.release-package --print-build-logs
+  aarch64-darwin---rosenpass:
+    name: Build aarch64-darwin.rosenpass
+    runs-on:
+      - warp-macos-13-arm64-6x
+    needs: []
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v30
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v15
+        with:
+          name: rosenpass
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Build
+        run: nix build .#packages.aarch64-darwin.rosenpass --print-build-logs
+  aarch64-darwin---rp:
+    name: Build aarch64-darwin.rp
+    runs-on:
+      - warp-macos-13-arm64-6x
+    needs: []
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v30
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v15
+        with:
+          name: rosenpass
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Build
+        run: nix build .#packages.aarch64-darwin.rp --print-build-logs
+  aarch64-darwin---rosenpass-oci-image:
+    name: Build aarch64-darwin.rosenpass-oci-image
+    runs-on:
+      - warp-macos-13-arm64-6x
+    needs:
+      - aarch64-darwin---rosenpass
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v30
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v15
+        with:
+          name: rosenpass
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Build
+        run: nix build .#packages.aarch64-darwin.rosenpass-oci-image --print-build-logs
+  aarch64-darwin---check:
+    name: Run Nix checks on aarch64-darwin
+    runs-on:
+      - warp-macos-13-arm64-6x
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v30
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v15
+        with:
+          name: rosenpass
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Check
+        run: nix flake check . --print-build-logs

.github/workflows/nix.yaml

@@ -15,7 +15,7 @@ jobs:
   i686-linux---default:
     name: Build i686-linux.default
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     needs:
       - i686-linux---rosenpass
     steps:
@@ -32,7 +32,7 @@ jobs:
   i686-linux---rosenpass:
     name: Build i686-linux.rosenpass
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     needs: []
     steps:
       - uses: actions/checkout@v4
@@ -48,7 +48,7 @@ jobs:
   i686-linux---rosenpass-oci-image:
     name: Build i686-linux.rosenpass-oci-image
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     needs:
       - i686-linux---rosenpass
     steps:
@@ -65,107 +65,7 @@ jobs:
   i686-linux---check:
     name: Run Nix checks on i686-linux
     runs-on:
-      - ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v30
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-      - uses: cachix/cachix-action@v15
-        with:
-          name: rosenpass
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - name: Check
-        run: nix flake check . --print-build-logs
-  x86_64-darwin---default:
-    name: Build x86_64-darwin.default
-    runs-on:
-      - macos-13
-    needs:
-      - x86_64-darwin---rosenpass
-    steps:
-      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v30
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-      - uses: cachix/cachix-action@v15
-        with:
-          name: rosenpass
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - name: Build
-        run: nix build .#packages.x86_64-darwin.default --print-build-logs
-  x86_64-darwin---release-package:
-    name: Build x86_64-darwin.release-package
-    runs-on:
-      - macos-13
-    needs:
-      - x86_64-darwin---rosenpass
-      - x86_64-darwin---rp
-      - x86_64-darwin---rosenpass-oci-image
-    steps:
-      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v30
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-      - uses: cachix/cachix-action@v15
-        with:
-          name: rosenpass
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - name: Build
-        run: nix build .#packages.x86_64-darwin.release-package --print-build-logs
-  x86_64-darwin---rosenpass:
-    name: Build x86_64-darwin.rosenpass
-    runs-on:
-      - macos-13
-    needs: []
-    steps:
-      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v30
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-      - uses: cachix/cachix-action@v15
-        with:
-          name: rosenpass
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - name: Build
-        run: nix build .#packages.x86_64-darwin.rosenpass --print-build-logs
-  x86_64-darwin---rp:
-    name: Build x86_64-darwin.rp
-    runs-on:
-      - macos-13
-    needs: []
-    steps:
-      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v30
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-      - uses: cachix/cachix-action@v15
-        with:
-          name: rosenpass
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - name: Build
-        run: nix build .#packages.x86_64-darwin.rp --print-build-logs
-  x86_64-darwin---rosenpass-oci-image:
-    name: Build x86_64-darwin.rosenpass-oci-image
-    runs-on:
-      - macos-13
-    needs:
-      - x86_64-darwin---rosenpass
-    steps:
-      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v30
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-      - uses: cachix/cachix-action@v15
-        with:
-          name: rosenpass
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - name: Build
-        run: nix build .#packages.x86_64-darwin.rosenpass-oci-image --print-build-logs
-  x86_64-darwin---check:
-    name: Run Nix checks on x86_64-darwin
-    runs-on:
-      - macos-13
+      - ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - uses: cachix/install-nix-action@v30
@@ -180,7 +80,7 @@ jobs:
   x86_64-linux---default:
     name: Build x86_64-linux.default
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     needs:
       - x86_64-linux---rosenpass
     steps:
@@ -197,7 +97,7 @@ jobs:
   x86_64-linux---proof-proverif:
     name: Build x86_64-linux.proof-proverif
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     needs:
       - x86_64-linux---proverif-patched
     steps:
@@ -214,7 +114,7 @@ jobs:
   x86_64-linux---proverif-patched:
     name: Build x86_64-linux.proverif-patched
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     needs: []
     steps:
       - uses: actions/checkout@v4
@@ -230,7 +130,7 @@ jobs:
   x86_64-linux---release-package:
     name: Build x86_64-linux.release-package
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     needs:
       - x86_64-linux---rosenpass-static
       - x86_64-linux---rosenpass-static-oci-image
@@ -249,7 +149,7 @@ jobs:
   # aarch64-linux---release-package:
   #   name: Build aarch64-linux.release-package
   #   runs-on:
-  #     - ubuntu-latest
+  #     - ubicloud-standard-2-arm-ubuntu-2204
   #   needs:
   #     - aarch64-linux---rosenpass-oci-image
   #     - aarch64-linux---rosenpass
@@ -273,7 +173,7 @@ jobs:
   x86_64-linux---rosenpass:
     name: Build x86_64-linux.rosenpass
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     needs: []
     steps:
       - uses: actions/checkout@v4
@@ -289,12 +189,12 @@ jobs:
   aarch64-linux---rosenpass:
     name: Build aarch64-linux.rosenpass
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-arm-ubuntu-2204
     needs: []
     steps:
       - run: |
           DEBIAN_FRONTEND=noninteractive
-          sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi binfmt-support qemu-user-static
+          sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi-aarch64 binfmt-support qemu-user-static
       - uses: actions/checkout@v4
       - uses: cachix/install-nix-action@v30
         with:
@@ -310,12 +210,12 @@ jobs:
   aarch64-linux---rp:
     name: Build aarch64-linux.rp
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-arm-ubuntu-2204
     needs: []
     steps:
       - run: |
           DEBIAN_FRONTEND=noninteractive
-          sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi binfmt-support qemu-user-static
+          sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi-aarch64 binfmt-support qemu-user-static
       - uses: actions/checkout@v4
       - uses: cachix/install-nix-action@v30
         with:
@@ -331,7 +231,7 @@ jobs:
   x86_64-linux---rosenpass-oci-image:
     name: Build x86_64-linux.rosenpass-oci-image
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     needs:
       - x86_64-linux---rosenpass
     steps:
@@ -348,13 +248,13 @@ jobs:
   aarch64-linux---rosenpass-oci-image:
     name: Build aarch64-linux.rosenpass-oci-image
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-arm-ubuntu-2204
     needs:
       - aarch64-linux---rosenpass
     steps:
       - run: |
           DEBIAN_FRONTEND=noninteractive
-          sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi binfmt-support qemu-user-static
+          sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi-aarch64 binfmt-support qemu-user-static
       - uses: actions/checkout@v4
       - uses: cachix/install-nix-action@v30
         with:
@@ -370,7 +270,7 @@ jobs:
   x86_64-linux---rosenpass-static:
     name: Build x86_64-linux.rosenpass-static
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     needs: []
     steps:
       - uses: actions/checkout@v4
@@ -386,7 +286,7 @@ jobs:
   x86_64-linux---rp-static:
     name: Build x86_64-linux.rp-static
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     needs: []
     steps:
       - uses: actions/checkout@v4
@@ -402,7 +302,7 @@ jobs:
   x86_64-linux---rosenpass-static-oci-image:
     name: Build x86_64-linux.rosenpass-static-oci-image
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     needs:
       - x86_64-linux---rosenpass-static
     steps:
@@ -419,7 +319,7 @@ jobs:
   x86_64-linux---whitepaper:
     name: Build x86_64-linux.whitepaper
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     needs: []
     steps:
       - uses: actions/checkout@v4
@@ -435,7 +335,7 @@ jobs:
   x86_64-linux---check:
     name: Run Nix checks on x86_64-linux
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - uses: cachix/install-nix-action@v30
@@ -449,7 +349,7 @@ jobs:
         run: nix flake check . --print-build-logs
   x86_64-linux---whitepaper-upload:
     name: Upload whitepaper x86_64-linux
-    runs-on: ubuntu-latest
+    runs-on: ubicloud-standard-2-ubuntu-2204
     if: ${{ github.ref == 'refs/heads/main' }}
     steps:
       - uses: actions/checkout@v4

.github/workflows/qc-mac.yaml

@@ -0,0 +1,32 @@
+name: QC Mac
+on:
+  push:
+    branches: [main]
+  workflow_call:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  checks: write
+  contents: read
+
+jobs:
+  cargo-test-mac:
+    runs-on: warp-macos-13-arm64-6x
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+        # liboqs requires quite a lot of stack memory, thus we adjust
+        # the default stack size picked for new threads (which is used
+        # by `cargo test`) to be _big enough_. Setting it to 8 MiB
+      - run: RUST_MIN_STACK=8388608 cargo test --workspace --all-features

.github/workflows/qc.yaml

@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   prettier:
-    runs-on: ubuntu-latest
+    runs-on: ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - uses: actionsx/prettier@v3
@@ -23,22 +23,38 @@ jobs:
 
   shellcheck:
     name: Shellcheck
-    runs-on: ubuntu-latest
+    runs-on: ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master
 
   rustfmt:
-    name: Rust Format
-    runs-on: ubuntu-latest
+    name: Rust code formatting
+    runs-on: ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
-      - name: Run Rust Formatting Script
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+      - name: Install nightly toolchain
+        run: |
+          rustup toolchain install nightly
+          rustup override set nightly
+      - run: rustup component add rustfmt
+      - name: Run Cargo Fmt
+        run: cargo fmt --all --check
+      - name: Run Rust Markdown code block Formatting Script
         run: bash format_rust_code.sh --mode check
 
   cargo-bench:
-    runs-on: ubuntu-latest
+    runs-on: ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - uses: actions/cache@v4
@@ -57,7 +73,7 @@ jobs:
 
   mandoc:
     name: mandoc
-    runs-on: ubuntu-latest
+    runs-on: ubicloud-standard-2-ubuntu-2204
     steps:
       - name: Install mandoc
         run: sudo apt-get install -y mandoc
@@ -66,7 +82,7 @@ jobs:
         run: doc/check.sh doc/rp.1
 
   cargo-audit:
-    runs-on: ubuntu-latest
+    runs-on: ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - uses: actions-rs/audit-check@v1
@@ -74,7 +90,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
   cargo-clippy:
-    runs-on: ubuntu-latest
+    runs-on: ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - uses: actions/cache@v4
@@ -93,7 +109,7 @@ jobs:
           args: --all-features
 
   cargo-doc:
-    runs-on: ubuntu-latest
+    runs-on: ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - uses: actions/cache@v4
@@ -112,12 +128,7 @@ jobs:
       - run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --document-private-items
 
   cargo-test:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-13]
-        # - ubuntu is x86-64
-        # - macos-13 is also x86-64 architecture
+    runs-on: ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - uses: actions/cache@v4
@@ -136,7 +147,7 @@ jobs:
 
   cargo-test-nix-devshell-x86_64-linux:
     runs-on:
-      - ubuntu-latest
+      - ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - uses: actions/cache@v4
@@ -158,7 +169,7 @@ jobs:
       - run: nix develop --command cargo test --workspace --all-features
 
   cargo-fuzz:
-    runs-on: ubuntu-latest
+    runs-on: ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - uses: actions/cache@v4
@@ -173,7 +184,7 @@ jobs:
       - name: Install nightly toolchain
         run: |
           rustup toolchain install nightly
-          rustup default nightly
+          rustup override set nightly
       - name: Install cargo-fuzz
         run: cargo install cargo-fuzz
       - name: Run fuzzing
@@ -191,10 +202,24 @@ jobs:
           cargo fuzz run fuzz_vec_secret_alloc_memfdsec_mallocfb -- -max_total_time=5
 
   codecov:
-    runs-on: ubuntu-latest
+    runs-on: ubicloud-standard-2-ubuntu-2204
+    env:
+      RUSTUP_TOOLCHAIN: nightly
     steps:
       - uses: actions/checkout@v4
-      - run: rustup default nightly
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+      - name: Install nightly toolchain
+        run: |
+          rustup toolchain install nightly
+          rustup override set nightly
       - run: rustup component add llvm-tools-preview
       - run: |
           cargo install cargo-llvm-cov || true
@@ -208,5 +233,4 @@ jobs:
         with:
           files: ./target/grcov/lcov
           verbose: true
-        env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/regressions.yml

@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   multi-peer:
-    runs-on: ubuntu-latest
+    runs-on: ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - run: cargo build --bin rosenpass --release
@@ -25,7 +25,7 @@ jobs:
           [ $(ls -1 output/ate/out | wc -l) -eq 100 ]
 
   boot-race:
-    runs-on: ubuntu-latest
+    runs-on: ubicloud-standard-2-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - run: cargo build --bin rosenpass --release

.github/workflows/release.yaml

@@ -13,8 +13,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: cachix/install-nix-action@v30
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v15
         with:
           name: rosenpass
@@ -34,8 +32,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: cachix/install-nix-action@v30
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v15
         with:
           name: rosenpass
@@ -69,3 +65,24 @@ jobs:
           draft: ${{ contains(github.ref_name, 'rc') }}
           prerelease: ${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') }}
           files: result/*
+  linux-packages:
+    name: Build and upload DEB and RPM packages
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v30
+      - uses: cachix/cachix-action@v15
+        with:
+          name: rosenpass
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Build DEB & RPM package
+        run: |
+          mkdir packages
+          for f in $(nix build .#package-deb .#package-rpm --print-out-paths); do cp "$f" "packages/${f#*-}"; done
+      - name: Release
+        uses: softprops/action-gh-release@v2
+        with:
+          draft: ${{ contains(github.ref_name, 'rc') }}
+          prerelease: ${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') }}
+          files: |
+            packages/*

.github/workflows/supply-chain.yml

@@ -0,0 +1,95 @@
+name: Supply-Chain
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cargo-deny:
+    name: Deny dependencies with vulnerabilities or incompatible licenses
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: EmbarkStudios/cargo-deny-action@v2
+  cargo-supply-chain:
+    name: Supply Chain Report
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cache/cargo-supply-chain/
+          key: cargo-supply-chain-cache
+      - name: Install stable toolchain # Cargo-supply-chain is incompatible with older versions
+        run: |
+          rustup toolchain install stable
+          rustup default stable
+      - uses: actions/cache@v4
+        with:
+          path: ${{ runner.tool_cache }}/cargo-supply-chain
+          key: cargo-supply-chain-bin
+      - name: Add the tool cache directory to the search path
+        run: echo "${{ runner.tool_cache }}/cargo-supply-chain/bin" >> $GITHUB_PATH
+      - name: Ensure that the tool cache is populated with the cargo-supply-chain binary
+        run: cargo +stable install --root ${{ runner.tool_cache }}/cargo-supply-chain cargo-supply-chain
+      - name: Update data for cargo-supply-chain
+        run: cargo supply-chain update
+      - name: Generate cargo-supply-chain report about publishers
+        run: cargo supply-chain publishers
+      - name: Generate cargo-supply-chain report about crates
+        run: cargo supply-chain crates
+    # The setup for cargo-vet follows the recommendations in the cargo-vet documentation: https://mozilla.github.io/cargo-vet/configuring-ci.html
+  cargo-vet:
+    name: Vet Dependencies
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+          key: cargo-vet-cache
+      - name: Install stable toolchain # Since we are running/compiling cargo-vet, we should rely on the stable toolchain.
+        run: |
+          rustup toolchain install stable
+          rustup default stable
+      - uses: actions/cache@v4
+        with:
+          path: ${{ runner.tool_cache }}/cargo-vet
+          key: cargo-vet-bin
+      - name: Add the tool cache directory to the search path
+        run: echo "${{ runner.tool_cache }}/cargo-vet/bin" >> $GITHUB_PATH
+      - name: Ensure that the tool cache is populated with the cargo-vet binary
+        run: cargo +stable install --root ${{ runner.tool_cache }}/cargo-vet cargo-vet
+      - name: Regenerate vet exemptions for dependabot PRs
+        if: github.actor == 'dependabot[bot]' # Run only for Dependabot PRs
+        run: cargo vet regenerate exemptions
+      - name: Check for changes in case of dependabot PR
+        if: github.actor == 'dependabot[bot]' # Run only for Dependabot PRs
+        run: git diff --exit-code || echo "Changes detected, committing..."
+      - name: Commit and push changes for dependabot PRs
+        if: success() && github.actor == 'dependabot[bot]'
+        run: |
+          git fetch origin ${{ github.head_ref }}
+          git switch ${{ github.head_ref }}
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions@github.com"
+          git add supply-chain/*
+          git commit -m "Regenerate cargo vet exemptions"
+          git push origin ${{ github.head_ref }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Invoke cargo-vet
+        run: cargo vet --locked

.gitignore

@@ -25,3 +25,4 @@ _markdown_*
 .vscode
 
 /output
+.nixos-test-history

Cargo.toml

@@ -2,17 +2,17 @@
 resolver = "2"
 
 members = [
-    "rosenpass",
-    "cipher-traits",
-    "ciphers",
-    "util",
-    "constant-time",
-    "oqs",
-    "to",
-    "fuzz",
-    "secret-memory",
-    "rp",
-    "wireguard-broker",
+  "rosenpass",
+  "cipher-traits",
+  "ciphers",
+  "util",
+  "constant-time",
+  "oqs",
+  "to",
+  "fuzz",
+  "secret-memory",
+  "rp",
+  "wireguard-broker",
 ]
 
 default-members = ["rosenpass", "rp", "wireguard-broker"]
@@ -42,7 +42,7 @@ toml = "0.7.8"
 static_assertions = "1.1.0"
 allocator-api2 = "0.2.14"
 memsec = { git = "https://github.com/rosenpass/memsec.git", rev = "aceb9baee8aec6844125bd6612f92e9a281373df", features = [
-    "alloc_ext",
+  "alloc_ext",
 ] }
 rand = "0.8.5"
 typenum = "1.17.0"
@@ -55,26 +55,32 @@ arbitrary = { version = "1.4.1", features = ["derive"] }
 anyhow = { version = "1.0.95", features = ["backtrace", "std"] }
 mio = { version = "1.0.3", features = ["net", "os-poll"] }
 oqs-sys = { version = "0.9.1", default-features = false, features = [
-    'classic_mceliece',
-    'kyber',
+  'classic_mceliece',
+  'kyber',
 ] }
 blake2 = "0.10.6"
+sha3 = "0.10.8"
 chacha20poly1305 = { version = "0.10.1", default-features = false, features = [
-    "std",
-    "heapless",
+  "std",
+  "heapless",
 ] }
 zerocopy = { version = "0.7.35", features = ["derive"] }
-home = "0.5.9"
+home = "=0.5.9" # 5.11 requires rustc 1.81
 derive_builder = "0.20.1"
 tokio = { version = "1.42", features = ["macros", "rt-multi-thread"] }
 postcard = { version = "1.1.1", features = ["alloc"] }
 libcrux = { version = "0.0.2-pre.2" }
+libcrux-chacha20poly1305 = { version = "0.0.2-beta.3" }
+libcrux-ml-kem = { version = "0.0.2-beta.3" }
+libcrux-blake2 = { git = "https://github.com/cryspen/libcrux.git", rev = "10ce653e9476" }
+libcrux-test-utils = { git = "https://github.com/cryspen/libcrux.git", rev = "0ab6d2dd9c1f" }
 hex-literal = { version = "0.4.1" }
 hex = { version = "0.4.3" }
 heck = { version = "0.5.0" }
 libc = { version = "0.2" }
 uds = { git = "https://github.com/rosenpass/uds" }
 signal-hook = "0.3.17"
+lazy_static = "1.5"
 
 #Dev dependencies
 serial_test = "3.2.0"
@@ -82,12 +88,14 @@ tempfile = "3"
 stacker = "0.1.17"
 libfuzzer-sys = "0.4"
 test_bin = "0.4.0"
-criterion = "0.4.0"
+criterion = "0.5.1"
 allocator-api2-tests = "0.2.15"
 procspawn = { version = "1.0.1", features = ["test-support"] }
 
-
 #Broker dependencies (might need cleanup or changes)
 wireguard-uapi = { version = "3.0.0", features = ["xplatform"] }
 command-fds = "0.2.3"
 rustix = { version = "0.38.42", features = ["net", "fs", "process"] }
+futures = "0.3"
+futures-util = "0.3"
+x25519-dalek = "2"

cipher-traits/Cargo.toml

@@ -8,10 +8,13 @@ description = "Rosenpass internal traits for cryptographic primitives"
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77.0"
 
 [dependencies]
+thiserror = { workspace = true }
+rosenpass-to = { workspace = true }
 
 [dev-dependencies]
 rosenpass-oqs = { workspace = true }
 rosenpass-secret-memory = { workspace = true }
-anyhow = {workspace = true}
+anyhow = { workspace = true }

cipher-traits/src/algorithms.rs

@@ -0,0 +1,137 @@
+//! This module contains the traits for all the cryptographic algorithms used throughout Rosenpass.
+//! These traits are marker traits that signal intent. They can also be used for trait objects.
+
+/// Constants and trait for the Incorrect HMAC over Blake2b, with 256 key and hash length.
+pub mod keyed_hash_incorrect_hmac_blake2b {
+    use crate::primitives::keyed_hash::*;
+
+    // These constants describe how they are used here, not what the algorithm defines.
+
+    /// The key length used in [`KeyedHashIncorrectHmacBlake2b`].
+    pub const KEY_LEN: usize = 32;
+    /// The hash length used in [`KeyedHashIncorrectHmacBlake2b`].
+    pub const HASH_LEN: usize = 32;
+
+    /// A [`KeyedHash`] that is an incorrect HMAC over Blake2 (a custom Rosenpass construction)
+    pub trait KeyedHashIncorrectHmacBlake2b: KeyedHash<KEY_LEN, HASH_LEN> {}
+}
+
+/// Constants and trait for Blake2b, with 256 key and hash length.
+pub mod keyed_hash_blake2b {
+    use crate::primitives::keyed_hash::*;
+
+    // These constants describe how they are used here, not what the algorithm defines.
+
+    /// The key length used in [`KeyedHashBlake2b`].
+    pub const KEY_LEN: usize = 32;
+    /// The hash length used in [`KeyedHashBlake2b`].
+    pub const HASH_LEN: usize = 32;
+
+    /// A [`KeyedHash`] that is Blake2b
+    pub trait KeyedHashBlake2b: KeyedHash<KEY_LEN, HASH_LEN> {}
+}
+
+/// Constants and trait for SHAKE256, with 256 key and hash length.
+pub mod keyed_hash_shake256 {
+    use crate::primitives::keyed_hash::*;
+
+    // These constants describe how they are used here, not what the algorithm defines.
+
+    /// The key length used in [`KeyedHashShake256`].
+    pub const KEY_LEN: usize = 32;
+    /// The hash length used in [`KeyedHashShake256`].
+    pub const HASH_LEN: usize = 32;
+
+    /// A [`KeyedHash`] that is SHAKE256.
+    pub trait KeyedHashShake256: KeyedHash<KEY_LEN, HASH_LEN> {}
+}
+
+/// Constants and trait for the ChaCha20Poly1305 AEAD
+pub mod aead_chacha20poly1305 {
+    use crate::primitives::aead::*;
+
+    // See https://datatracker.ietf.org/doc/html/rfc7539#section-2.8
+
+    /// The key length used in [`AeadChaCha20Poly1305`].
+    pub const KEY_LEN: usize = 32;
+    /// The nonce length used in [`AeadChaCha20Poly1305`].
+    pub const NONCE_LEN: usize = 12;
+    /// The tag length used in [`AeadChaCha20Poly1305`].
+    pub const TAG_LEN: usize = 16;
+
+    /// An [`Aead`] that is ChaCha20Poly1305.
+    pub trait AeadChaCha20Poly1305: Aead<KEY_LEN, NONCE_LEN, TAG_LEN> {}
+}
+
+/// Constants and trait for the XChaCha20Poly1305 AEAD (i.e. ChaCha20Poly1305 with extended nonce
+/// lengths)
+pub mod aead_xchacha20poly1305 {
+    use crate::primitives::aead::*;
+
+    // See https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03
+
+    /// The key length used in [`AeadXChaCha20Poly1305`].
+    pub const KEY_LEN: usize = 32;
+    /// The nonce length used in [`AeadXChaCha20Poly1305`].
+    pub const NONCE_LEN: usize = 24;
+    /// The tag length used in [`AeadXChaCha20Poly1305`].
+    pub const TAG_LEN: usize = 16;
+
+    /// An [`Aead`] that is XChaCha20Poly1305.
+    pub trait AeadXChaCha20Poly1305: Aead<KEY_LEN, NONCE_LEN, TAG_LEN> {}
+}
+
+/// Constants and trait for the Kyber512 KEM
+pub mod kem_kyber512 {
+    use crate::primitives::kem::*;
+
+    // page 39 of https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.203.pdf
+    // (which is ml-kem instead of kyber, but it's the same)
+
+    /// The secret key length used in [`KemKyber512`].
+    pub const SK_LEN: usize = 1632;
+
+    /// The public key length used in [`KemKyber512`].
+    pub const PK_LEN: usize = 800;
+
+    /// The ciphertext length used in [`KemKyber512`].
+    pub const CT_LEN: usize = 768;
+
+    /// The shared key length used in [`KemKyber512`].
+    pub const SHK_LEN: usize = 32;
+
+    /// A [`Kem`] that is Kyber512.
+    pub trait KemKyber512: Kem<SK_LEN, PK_LEN, CT_LEN, SHK_LEN> {}
+}
+
+/// Constants and trait for the Classic McEliece 460896 KEM
+pub mod kem_classic_mceliece460896 {
+    use crate::primitives::kem::*;
+
+    // page 6 of https://classic.mceliece.org/mceliece-impl-20221023.pdf
+
+    /// The secret key length used in [`KemClassicMceliece460896`].
+    pub const SK_LEN: usize = 13608;
+
+    /// The public key length used in [`KemClassicMceliece460896`].
+    pub const PK_LEN: usize = 524160;
+
+    /// The ciphertext length used in [`KemClassicMceliece460896`].
+    pub const CT_LEN: usize = 156;
+
+    /// The shared key length used in [`KemClassicMceliece460896`].
+    pub const SHK_LEN: usize = 32;
+
+    /// A [`Kem`] that is ClassicMceliece460896.
+    pub trait KemClassicMceliece460896: Kem<SK_LEN, PK_LEN, CT_LEN, SHK_LEN> {}
+}
+
+pub use aead_chacha20poly1305::AeadChaCha20Poly1305;
+pub use aead_xchacha20poly1305::AeadXChaCha20Poly1305;
+
+pub use kem_classic_mceliece460896::KemClassicMceliece460896;
+pub use kem_kyber512::KemKyber512;
+
+pub use keyed_hash_blake2b::KeyedHashBlake2b;
+pub use keyed_hash_incorrect_hmac_blake2b::KeyedHashIncorrectHmacBlake2b;
+pub use keyed_hash_shake256::KeyedHashShake256;

cipher-traits/src/lib.rs

@@ -1,2 +1,5 @@
-mod kem;
-pub use kem::Kem;
+//! This trait contains traits, constants and wrappers that provid= the interface between Rosenpass
+//! as a consumer of cryptographic libraries and the implementations of cryptographic algorithms.
+
+pub mod algorithms;
+pub mod primitives;

cipher-traits/src/primitives.rs

@@ -0,0 +1,10 @@
+//! Traits for cryptographic primitives used in Rosenpass, specifically KEM, AEAD and keyed
+//! hashing.
+
+pub(crate) mod aead;
+pub(crate) mod kem;
+pub(crate) mod keyed_hash;
+
+pub use aead::{Aead, AeadWithNonceInCiphertext, Error as AeadError};
+pub use kem::{Error as KemError, Kem};
+pub use keyed_hash::*;

cipher-traits/src/primitives/aead.rs

@@ -0,0 +1,175 @@
+use rosenpass_to::{ops::copy_slice, To as _};
+use thiserror::Error;
+
+/// Models authenticated encryption with assiciated data (AEAD) functionality.
+///
+/// The methods of this trait take a `&self` argument as a receiver. This has two reasons:
+/// 1. It makes type inference a lot smoother
+/// 2. It allows to use the functionality through a trait object or having an enum that has
+///    variants for multiple options (like e.g. the `KeyedHash` enum in `rosenpass-ciphers`).
+///
+/// Since the caller needs an instance of the type to use the functionality, implementors are
+/// adviced to implement the [`Default`] trait where possible.
+///
+/// Example for encrypting a message with a specific [`Aead`] instance:
+/// ```
+/// use rosenpass_cipher_traits::primitives::Aead;
+///
+/// const KEY_LEN: usize = 32;
+/// const NONCE_LEN: usize = 12;
+/// const TAG_LEN: usize = 16;
+///
+/// fn encrypt_message_given_an_aead<AeadImpl>(
+///   aead: &AeadImpl,
+///   msg: &str,
+///   nonce: &[u8; NONCE_LEN],
+///   encrypted: &mut [u8]
+/// ) where AeadImpl: Aead<KEY_LEN, NONCE_LEN, TAG_LEN> {
+///   let key = [0u8; KEY_LEN]; // This is not a secure key!
+///   let ad = b""; // we don't need associated data here
+///   aead.encrypt(encrypted, &key, nonce, ad, msg.as_bytes()).unwrap();
+/// }
+/// ```
+///
+/// If only the type (but no instance) is available, then we can still encrypt, as long as the type
+/// also is [`Default`]:
+/// ```
+/// use rosenpass_cipher_traits::primitives::Aead;
+///
+/// const KEY_LEN: usize = 32;
+/// const NONCE_LEN: usize = 12;
+/// const TAG_LEN: usize = 16;
+///
+/// fn encrypt_message_without_aead<AeadImpl>(
+///   msg: &str,
+///   nonce: &[u8; NONCE_LEN],
+///   encrypted: &mut [u8]
+/// ) where AeadImpl: Default + Aead<KEY_LEN, NONCE_LEN, TAG_LEN> {
+///   let key = [0u8; KEY_LEN]; // This is not a secure key!
+///   let ad = b""; // we don't need associated data here
+///   AeadImpl::default().encrypt(encrypted, &key, nonce, ad, msg.as_bytes()).unwrap();
+/// }
+/// ```
+pub trait Aead<const KEY_LEN: usize, const NONCE_LEN: usize, const TAG_LEN: usize> {
+    const KEY_LEN: usize = KEY_LEN;
+    const NONCE_LEN: usize = NONCE_LEN;
+    const TAG_LEN: usize = TAG_LEN;
+
+    /// Encrypts `plaintext` using the given `key` and `nonce`, taking into account the additional
+    /// data `ad` and writes the result into `ciphertext`.
+    ///
+    /// `ciphertext` must be exactly `TAG_LEN` longer than `plaintext`.
+    fn encrypt(
+        &self,
+        ciphertext: &mut [u8],
+        key: &[u8; KEY_LEN],
+        nonce: &[u8; NONCE_LEN],
+        ad: &[u8],
+        plaintext: &[u8],
+    ) -> Result<(), Error>;
+
+    /// Decrypts `ciphertexttext` using the given `key` and `nonce`, taking into account the additional
+    /// data `ad` and writes the result into `plaintext`.
+    ///
+    /// `ciphertext` must be exactly `TAG_LEN` longer than `plaintext`.
+    fn decrypt(
+        &self,
+        plaintext: &mut [u8],
+        key: &[u8; KEY_LEN],
+        nonce: &[u8; NONCE_LEN],
+        ad: &[u8],
+        ciphertext: &[u8],
+    ) -> Result<(), Error>;
+}
+
+/// Provides an AEAD API where the nonce is part of the ciphertext.
+///
+/// The old xaead API had the ciphertext begin with the `nonce`. In order to not having to change
+/// the calling code too much, we add a wrapper trait that provides this API and implement it for
+/// all AEAD.
+pub trait AeadWithNonceInCiphertext<
+    const KEY_LEN: usize,
+    const NONCE_LEN: usize,
+    const TAG_LEN: usize,
+>: Aead<KEY_LEN, NONCE_LEN, TAG_LEN>
+{
+    /// Encrypts `plaintext` using the given `key` and `nonce`, taking into account the additional
+    /// data `ad` and writes the result into `ciphertext`.
+    ///
+    /// `ciphertext` must be exactly `TAG_LEN` + `NONCE_LEN` longer than `plaintext`.
+    fn encrypt_with_nonce_in_ctxt(
+        &self,
+        ciphertext: &mut [u8],
+        key: &[u8; KEY_LEN],
+        nonce: &[u8; NONCE_LEN],
+        ad: &[u8],
+        plaintext: &[u8],
+    ) -> Result<(), Error> {
+        // The comparison looks complicated, but we need to do it this way to prevent
+        // over/underflows.
+        if ciphertext.len() < NONCE_LEN + TAG_LEN
+            || ciphertext.len() - TAG_LEN - NONCE_LEN < plaintext.len()
+        {
+            return Err(Error::InvalidLengths);
+        }
+
+        let (n, rest) = ciphertext.split_at_mut(NONCE_LEN);
+        copy_slice(nonce).to(n);
+
+        self.encrypt(rest, key, nonce, ad, plaintext)
+    }
+
+    /// Decrypts `ciphertexttext` using the given `key` and `nonce`, taking into account the additional
+    /// data `ad` and writes the result into `plaintext`.
+    ///
+    /// `ciphertext` must be exactly `TAG_LEN` + `NONCE_LEN` longer than `plaintext`.
+    fn decrypt_with_nonce_in_ctxt(
+        &self,
+        plaintext: &mut [u8],
+        key: &[u8; KEY_LEN],
+        ad: &[u8],
+        ciphertext: &[u8],
+    ) -> Result<(), Error> {
+        // The comparison looks complicated, but we need to do it this way to prevent
+        // over/underflows.
+        if ciphertext.len() < NONCE_LEN + TAG_LEN
+            || ciphertext.len() - TAG_LEN - NONCE_LEN < plaintext.len()
+        {
+            return Err(Error::InvalidLengths);
+        }
+
+        let (nonce, rest) = ciphertext.split_at(NONCE_LEN);
+        // We know this should be the right length (we just split it), and everything else would be
+        // very unexpected.
+        let nonce = nonce.try_into().map_err(|_| Error::InternalError)?;
+
+        self.decrypt(plaintext, key, nonce, ad, rest)
+    }
+}
+
+impl<
+        const KEY_LEN: usize,
+        const NONCE_LEN: usize,
+        const TAG_LEN: usize,
+        T: Aead<KEY_LEN, NONCE_LEN, TAG_LEN>,
+    > AeadWithNonceInCiphertext<KEY_LEN, NONCE_LEN, TAG_LEN> for T
+{
+}
+
+/// The error returned by AEAD operations
+#[derive(Debug, Error)]
+pub enum Error {
+    /// An internal error occurred. This should never be happen and indicates an error in the
+    /// AEAD implementation.
+    #[error("internal error")]
+    InternalError,
+
+    /// Could not decrypt a message because the message is not a valid ciphertext for the given
+    /// key.
+    #[error("decryption error")]
+    DecryptError,
+
+    /// The provided buffers have the wrong lengths.
+    #[error("buffers have invalid length")]
+    InvalidLengths,
+}

cipher-traits/src/primitives/kem.rs

@@ -0,0 +1,212 @@
+//! Traits and implementations for Key Encapsulation Mechanisms (KEMs)
+//!
+//! KEMs are the interface provided by almost all post-quantum
+//! secure key exchange mechanisms.
+//!
+//! Conceptually KEMs are akin to public-key encryption, but instead of encrypting
+//! arbitrary data, KEMs are limited to the transmission of keys, randomly chosen during
+//! encapsulation.
+//!
+//! The [Kem] Trait describes the basic API offered by a Key Encapsulation
+//! Mechanism. Two implementations for it are provided:
+//! [Kyber512](../../rosenpass_oqs/kyber_512/enum.Kyber512.html) and
+//! [ClassicMceliece460896](../../rosenpass_oqs/classic_mceliece_460896/enum.ClassicMceliece460896.html).
+//!
+//! An example where Alice generates a keypair and gives her public key to Bob, for Bob to
+//! encapsulate a symmetric key and Alice to decapsulate it would look as follows.
+//! In the example, we are using Kyber512, but any KEM that correctly implements the [Kem]
+//! trait could be used as well.
+//!```rust
+//! use rosenpass_cipher_traits::primitives::Kem;
+//! use rosenpass_oqs::Kyber512;
+//! # use rosenpass_secret_memory::{secret_policy_use_only_malloc_secrets, Secret};
+//!
+//! type MyKem = Kyber512;
+//! secret_policy_use_only_malloc_secrets();
+//! let mut alice_sk: Secret<{ MyKem::SK_LEN }> = Secret::zero();
+//! let mut alice_pk: [u8; MyKem::PK_LEN] = [0; MyKem::PK_LEN];
+//! MyKem::default().keygen(alice_sk.secret_mut(), &mut alice_pk)?;
+//!
+//! let mut bob_shk: Secret<{ MyKem::SHK_LEN }> = Secret::zero();
+//! let mut bob_ct: [u8; MyKem::CT_LEN] = [0; MyKem::CT_LEN];
+//! MyKem::default().encaps(bob_shk.secret_mut(), &mut bob_ct, &mut alice_pk)?;
+//!
+//! let mut alice_shk: Secret<{ MyKem::SHK_LEN }> = Secret::zero();
+//! MyKem::default().decaps(alice_shk.secret_mut(), alice_sk.secret_mut(), &mut bob_ct)?;
+//!
+//! # assert_eq!(alice_shk.secret(), bob_shk.secret());
+//! # Ok::<(), anyhow::Error>(())
+//!```
+//!
+//! Implementing the [Kem]-trait for a KEM is easy. Mostly, you must format the KEM's
+//! keys, and ciphertext as `u8` slices. Below, we provide an example for how the trait can
+//! be implemented using a **HORRIBLY INSECURE** DummyKem that only uses static values for keys
+//! and ciphertexts as an example.  
+//!```rust
+//!# use rosenpass_cipher_traits::primitives::{Kem, KemError as Error};
+//!
+//! struct DummyKem {}
+//! impl Kem<1,1,1,1> for DummyKem {
+//!
+//!     // For this DummyKem, we will use a single `u8` for everything
+//!     const SK_LEN: usize = 1;
+//!     const PK_LEN: usize = 1;
+//!     const CT_LEN: usize = 1;
+//!     const SHK_LEN: usize = 1;
+//!
+//!     fn keygen(&self, sk: &mut [u8;1], pk: &mut [u8;1]) -> Result<(), Error> {
+//!         sk[0] = 42;
+//!         pk[0] = 21;
+//!         Ok(())
+//!     }
+//!
+//!     fn encaps(&self, shk: &mut [u8;1], ct: &mut [u8;1], pk: &[u8;1]) -> Result<(), Error> {
+//!         if pk[0] != 21 {
+//!             return Err(Error::InvalidArgument);
+//!         }
+//!         ct[0] = 7;
+//!         shk[0] = 17;
+//!         Ok(())
+//!     }
+//!
+//!     fn decaps(&self, shk: &mut [u8;1 ], sk: &[u8;1], ct: &[u8;1]) -> Result<(), Error> {
+//!         if sk[0] != 42 {
+//!             return Err(Error::InvalidArgument);
+//!         }
+//!         if ct[0] != 7 {
+//!             return Err(Error::InvalidArgument);
+//!         }
+//!         shk[0] = 17;
+//!         Ok(())
+//!     }
+//! }
+//!
+//! impl Default for DummyKem {
+//!     fn default() -> Self {
+//!         Self{}
+//!     }
+//! }
+//! # use rosenpass_secret_memory::{secret_policy_use_only_malloc_secrets, Secret};
+//! #
+//! # type MyKem = DummyKem;
+//! # secret_policy_use_only_malloc_secrets();
+//! # let mut alice_sk: Secret<{ MyKem::SK_LEN }> = Secret::zero();
+//! # let mut alice_pk: [u8; MyKem::PK_LEN] = [0; MyKem::PK_LEN];
+//! # MyKem::default().keygen(alice_sk.secret_mut(), &mut alice_pk)?;
+//!
+//! # let mut bob_shk: Secret<{ MyKem::SHK_LEN }> = Secret::zero();
+//! # let mut bob_ct: [u8; MyKem::CT_LEN] = [0; MyKem::CT_LEN];
+//! # MyKem::default().encaps(bob_shk.secret_mut(), &mut bob_ct, &mut alice_pk)?;
+//! #
+//! # let mut alice_shk: Secret<{ MyKem::SHK_LEN }> = Secret::zero();
+//! # MyKem::default().decaps(alice_shk.secret_mut(), alice_sk.secret_mut(), &mut bob_ct)?;
+//! #
+//! # assert_eq!(alice_shk.secret(), bob_shk.secret());
+//! #
+//! # Ok::<(), Error>(())
+//!```
+//!
+
+use thiserror::Error;
+
+/// Key Encapsulation Mechanism
+///
+/// The KEM interface defines three operations: Key generation, key encapsulation and key
+/// decapsulation. The parameters are made available as associated constants for convenience.
+///
+/// The methods of this trait take a `&self` argument as a receiver. This has two reasons:
+/// 1. It makes type inference a lot smoother
+/// 2. It allows to use the functionality through a trait object or having an enum that has
+///    variants for multiple options (like e.g. the `KeyedHash` enum in `rosenpass-ciphers`).
+///
+/// Since the caller needs an instance of the type to use the functionality, implementors are
+/// adviced to implement the [`Default`] trait where possible.
+///
+/// Example for encrypting a message with a specific [`Kem`] instance:
+/// ```
+/// use rosenpass_cipher_traits::primitives::Kem;
+///
+/// const SK_LEN: usize = 1632;
+/// const PK_LEN: usize = 800;
+/// const CT_LEN: usize = 768;
+/// const SHK_LEN: usize = 32;
+///
+/// fn encaps_given_a_kem<KemImpl>(
+///   kem: &KemImpl,
+///   pk: &[u8; PK_LEN],
+///   ct: &mut [u8; CT_LEN]
+/// )  -> [u8; SHK_LEN] where KemImpl: Kem<SK_LEN, PK_LEN, CT_LEN, SHK_LEN>{
+///   let mut shk = [0u8; SHK_LEN];
+///   kem.encaps(&mut shk, ct, pk).unwrap();
+///   shk
+/// }
+/// ```
+///
+/// If only the type (but no instance) is available, then we can still use the trait, as long as
+/// the type also is [`Default`]:
+/// ```
+/// use rosenpass_cipher_traits::primitives::Kem;
+///
+/// const SK_LEN: usize = 1632;
+/// const PK_LEN: usize = 800;
+/// const CT_LEN: usize = 768;
+/// const SHK_LEN: usize = 32;
+///
+/// fn encaps_without_kem<KemImpl>(
+///   pk: &[u8; PK_LEN],
+///   ct: &mut [u8; CT_LEN]
+/// ) -> [u8; SHK_LEN]
+/// where KemImpl: Default + Kem<SK_LEN, PK_LEN, CT_LEN, SHK_LEN> {
+///   let mut shk = [0u8; SHK_LEN];
+///   KemImpl::default().encaps(&mut shk, ct, pk).unwrap();
+///   shk
+/// }
+/// ```
+pub trait Kem<const SK_LEN: usize, const PK_LEN: usize, const CT_LEN: usize, const SHK_LEN: usize> {
+    /// The length of the secret (decapsulation) key.
+    const SK_LEN: usize = SK_LEN;
+
+    /// The length of the public (encapsulation) key.
+    const PK_LEN: usize = PK_LEN;
+
+    /// The length of the ciphertext.
+    const CT_LEN: usize = CT_LEN;
+
+    /// The legnth of the resulting shared key.
+    const SHK_LEN: usize = SHK_LEN;
+
+    /// Generate a keypair consisting of secret key (`sk`) and public key (`pk`)
+    ///
+    /// `keygen() -> sk, pk`
+    fn keygen(&self, sk: &mut [u8; SK_LEN], pk: &mut [u8; PK_LEN]) -> Result<(), Error>;
+
+    /// From a public key (`pk`), generate a shared key (`shk`, for local use)
+    /// and a cipher text (`ct`, to be sent to the owner of the `pk`).
+    ///
+    /// `encaps(pk) -> shk, ct`
+    fn encaps(
+        &self,
+        shk: &mut [u8; SHK_LEN],
+        ct: &mut [u8; CT_LEN],
+        pk: &[u8; PK_LEN],
+    ) -> Result<(), Error>;
+
+    /// From a secret key (`sk`) and a cipher text (`ct`) derive a shared key
+    /// (`shk`)
+    ///
+    /// `decaps(sk, ct) -> shk`
+    fn decaps(
+        &self,
+        shk: &mut [u8; SHK_LEN],
+        sk: &[u8; SK_LEN],
+        ct: &[u8; CT_LEN],
+    ) -> Result<(), Error>;
+}
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error("invalid argument")]
+    InvalidArgument,
+    #[error("internal error")]
+    InternalError,
+}

cipher-traits/src/primitives/keyed_hash.rs

@@ -0,0 +1,159 @@
+use std::marker::PhantomData;
+
+/// Models a keyed hash function using an associated function (i.e. without `&self` receiver).
+pub trait KeyedHash<const KEY_LEN: usize, const HASH_LEN: usize> {
+    /// The error type used to signal what went wrong.
+    type Error;
+
+    /// Performs a keyed hash using `key` and `data` and writes the output to `out`
+    fn keyed_hash(
+        key: &[u8; KEY_LEN],
+        data: &[u8],
+        out: &mut [u8; HASH_LEN],
+    ) -> Result<(), Self::Error>;
+}
+
+/// Models a keyed hash function using a method (i.e. with a `&self` receiver).
+///
+/// This makes type inference easier, but also requires having a [`KeyedHashInstance`] value,
+/// instead of just the [`KeyedHash`] type.
+pub trait KeyedHashInstance<const KEY_LEN: usize, const HASH_LEN: usize> {
+    /// The error type used to signal what went wrong.
+    type Error;
+
+    /// Performs a keyed hash using `key` and `data` and writes the output to `out`
+    fn keyed_hash(
+        &self,
+        key: &[u8; KEY_LEN],
+        data: &[u8],
+        out: &mut [u8; HASH_LEN],
+    ) -> Result<(), Self::Error>;
+}
+
+/// This is a helper to allow for type parameter inference when calling functions
+/// that need a [KeyedHash].
+///
+/// Really just binds the [KeyedHash] trait to a dummy variable, so the type of this dummy variable
+/// can be used for type inference. Less typing work.
+#[derive(Debug, PartialEq, Eq)]
+pub struct InferKeyedHash<Static, const KEY_LEN: usize, const HASH_LEN: usize>
+where
+    Static: KeyedHash<KEY_LEN, HASH_LEN>,
+{
+    pub _phantom_keyed_hasher: PhantomData<*const Static>,
+}
+
+impl<Static, const KEY_LEN: usize, const HASH_LEN: usize> InferKeyedHash<Static, KEY_LEN, HASH_LEN>
+where
+    Static: KeyedHash<KEY_LEN, HASH_LEN>,
+{
+    pub const KEY_LEN: usize = KEY_LEN;
+    pub const HASH_LEN: usize = HASH_LEN;
+
+    pub const fn new() -> Self {
+        Self {
+            _phantom_keyed_hasher: PhantomData,
+        }
+    }
+
+    /// This just forwards to [KeyedHash::keyed_hash] of the type parameter `Static`
+    fn keyed_hash_internal<'a>(
+        &self,
+        key: &'a [u8; KEY_LEN],
+        data: &'a [u8],
+        out: &mut [u8; HASH_LEN],
+    ) -> Result<(), Static::Error> {
+        Static::keyed_hash(key, data, out)
+    }
+
+    /// Returns the key length of the keyed hash function.
+    pub const fn key_len(self) -> usize {
+        Self::KEY_LEN
+    }
+
+    /// Returns the hash length of the keyed hash function.
+    pub const fn hash_len(self) -> usize {
+        Self::HASH_LEN
+    }
+}
+
+impl<const KEY_LEN: usize, const HASH_LEN: usize, Static: KeyedHash<KEY_LEN, HASH_LEN>>
+    KeyedHashInstance<KEY_LEN, HASH_LEN> for InferKeyedHash<Static, KEY_LEN, HASH_LEN>
+{
+    type Error = Static::Error;
+
+    fn keyed_hash(
+        &self,
+        key: &[u8; KEY_LEN],
+        data: &[u8],
+        out: &mut [u8; HASH_LEN],
+    ) -> Result<(), Static::Error> {
+        self.keyed_hash_internal(key, data, out)
+    }
+}
+
+// Helper traits /////////////////////////////////////////////
+
+impl<Static, const KEY_LEN: usize, const OUT_LEN: usize> Default
+    for InferKeyedHash<Static, KEY_LEN, OUT_LEN>
+where
+    Static: KeyedHash<KEY_LEN, OUT_LEN>,
+{
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl<Static, const KEY_LEN: usize, const OUT_LEN: usize> Clone
+    for InferKeyedHash<Static, KEY_LEN, OUT_LEN>
+where
+    Static: KeyedHash<KEY_LEN, OUT_LEN>,
+{
+    fn clone(&self) -> Self {
+        *self
+    }
+}
+
+impl<Static, const KEY_LEN: usize, const OUT_LEN: usize> Copy
+    for InferKeyedHash<Static, KEY_LEN, OUT_LEN>
+where
+    Static: KeyedHash<KEY_LEN, OUT_LEN>,
+{
+}
+
+use rosenpass_to::{with_destination, To};
+
+/// Extends the [`KeyedHash`] trait with a [`To`]-flavoured function.
+pub trait KeyedHashTo<const KEY_LEN: usize, const HASH_LEN: usize>:
+    KeyedHash<KEY_LEN, HASH_LEN>
+{
+    fn keyed_hash_to(
+        key: &[u8; KEY_LEN],
+        data: &[u8],
+    ) -> impl To<[u8; HASH_LEN], Result<(), Self::Error>> {
+        with_destination(|out| Self::keyed_hash(key, data, out))
+    }
+}
+
+impl<const KEY_LEN: usize, const HASH_LEN: usize, T: KeyedHash<KEY_LEN, HASH_LEN>>
+    KeyedHashTo<KEY_LEN, HASH_LEN> for T
+{
+}
+
+/// Extends the [`KeyedHashInstance`] trait with a [`To`]-flavoured function.
+pub trait KeyedHashInstanceTo<const KEY_LEN: usize, const HASH_LEN: usize>:
+    KeyedHashInstance<KEY_LEN, HASH_LEN>
+{
+    fn keyed_hash_to(
+        &self,
+        key: &[u8; KEY_LEN],
+        data: &[u8],
+    ) -> impl To<[u8; HASH_LEN], Result<(), Self::Error>> {
+        with_destination(|out| self.keyed_hash(key, data, out))
+    }
+}
+
+impl<const KEY_LEN: usize, const HASH_LEN: usize, T: KeyedHashInstance<KEY_LEN, HASH_LEN>>
+    KeyedHashInstanceTo<KEY_LEN, HASH_LEN> for T
+{
+}

ciphers/Cargo.toml

@@ -8,9 +8,42 @@ description = "Rosenpass internal ciphers and other cryptographic primitives use
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77.0"
 
 [features]
-experiment_libcrux = ["dep:libcrux"]
+# whether the types should be defined
+experiment_libcrux_define_blake2 = ["dep:libcrux-blake2", "dep:thiserror"]
+experiment_libcrux_define_kyber = ["dep:libcrux-ml-kem", "dep:rand"]
+experiment_libcrux_define_chachapoly = ["dep:libcrux-chacha20poly1305"]
+
+# whether the types should be used by default
+experiment_libcrux_blake2 = ["experiment_libcrux_define_blake2"]
+experiment_libcrux_kyber = ["experiment_libcrux_define_kyber"]
+experiment_libcrux_chachapoly = ["experiment_libcrux_define_chachapoly"]
+experiment_libcrux_chachapoly_test = [
+  "experiment_libcrux_define_chachapoly",
+  "dep:libcrux",
+]
+
+# shorthands
+experiment_libcrux_define_all = [
+  "experiment_libcrux_define_blake2",
+  "experiment_libcrux_define_chachapoly",
+  "experiment_libcrux_define_kyber",
+]
+experiment_libcrux_all = [
+  "experiment_libcrux_blake2",
+  "experiment_libcrux_chachapoly",
+  "experiment_libcrux_chachapoly_test",
+  "experiment_libcrux_kyber",
+]
+
+bench = ["experiment_libcrux_define_all"]
+
+[[bench]]
+name = "primitives"
+harness = false
+required-features = ["bench"]
 
 [dependencies]
 anyhow = { workspace = true }
@@ -19,8 +52,22 @@ rosenpass-constant-time = { workspace = true }
 rosenpass-secret-memory = { workspace = true }
 rosenpass-oqs = { workspace = true }
 rosenpass-util = { workspace = true }
+rosenpass-cipher-traits = { workspace = true }
 static_assertions = { workspace = true }
 zeroize = { workspace = true }
 chacha20poly1305 = { workspace = true }
 blake2 = { workspace = true }
+sha3 = { workspace = true }
+rand = { workspace = true, optional = true }
+thiserror = { workspace = true, optional = true }
+
+libcrux-chacha20poly1305 = { workspace = true, optional = true }
+libcrux-blake2 = { workspace = true, optional = true }
+libcrux-ml-kem = { workspace = true, optional = true, features = ["kyber"] }
+
+# this one is only used in testing, so it requires the `experiment_libcrux_chachapoly_test` feature.
 libcrux = { workspace = true, optional = true }
+
+[dev-dependencies]
+rand = { workspace = true }
+criterion = { workspace = true }

ciphers/benches/primitives.rs

@@ -0,0 +1,378 @@
+criterion::criterion_main!(keyed_hash::benches, aead::benches, kem::benches);
+
+fn benchid(base: KvPairs, last: KvPairs) -> String {
+    format!("{base},{last}")
+}
+
+#[derive(Clone, Copy, Debug)]
+struct KvPair<'a>(&'a str, &'a str);
+
+impl std::fmt::Display for KvPair<'_> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{k}={v}", k = self.0, v = self.1)
+    }
+}
+
+#[derive(Clone, Copy, Debug)]
+struct KvPairs<'a>(&'a [KvPair<'a>]);
+
+impl std::fmt::Display for KvPairs<'_> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self.0.len() {
+            0 => Ok(()),
+            1 => write!(f, "{}", &self.0[0]),
+            _ => {
+                let mut delim = "";
+                for pair in self.0 {
+                    write!(f, "{delim}{pair}")?;
+                    delim = ",";
+                }
+                Ok(())
+            }
+        }
+    }
+}
+
+mod kem {
+    criterion::criterion_group!(
+        benches,
+        bench_kyber512_libcrux,
+        bench_kyber512_oqs,
+        bench_classicmceliece460896_oqs
+    );
+
+    use criterion::Criterion;
+
+    fn bench_classicmceliece460896_oqs(c: &mut Criterion) {
+        template(
+            c,
+            "classicmceliece460896",
+            "oqs",
+            rosenpass_oqs::ClassicMceliece460896,
+        );
+    }
+
+    fn bench_kyber512_libcrux(c: &mut Criterion) {
+        template(
+            c,
+            "kyber512",
+            "libcrux",
+            rosenpass_ciphers::subtle::libcrux::kyber512::Kyber512,
+        );
+    }
+
+    fn bench_kyber512_oqs(c: &mut Criterion) {
+        template(c, "kyber512", "oqs", rosenpass_oqs::Kyber512);
+    }
+
+    use rosenpass_cipher_traits::primitives::Kem;
+
+    fn template<
+        const SK_LEN: usize,
+        const PK_LEN: usize,
+        const CT_LEN: usize,
+        const SHK_LEN: usize,
+        T: Kem<SK_LEN, PK_LEN, CT_LEN, SHK_LEN>,
+    >(
+        c: &mut Criterion,
+        alg_name: &str,
+        impl_name: &str,
+        scheme: T,
+    ) {
+        use super::{benchid, KvPair, KvPairs};
+
+        let base = [
+            KvPair("primitive", "kem"),
+            KvPair("algorithm", alg_name),
+            KvPair("implementation", impl_name),
+            KvPair("length", "-1"),
+        ];
+
+        let kem_benchid = |op| benchid(KvPairs(&base), KvPairs(&[KvPair("operation", op)]));
+
+        c.bench_function(&kem_benchid("keygen"), |bench| {
+            let mut sk = [0; SK_LEN];
+            let mut pk = [0; PK_LEN];
+
+            bench.iter(|| {
+                scheme.keygen(&mut sk, &mut pk).unwrap();
+            });
+        });
+
+        c.bench_function(&kem_benchid("encaps"), |bench| {
+            let mut sk = [0; SK_LEN];
+            let mut pk = [0; PK_LEN];
+            let mut ct = [0; CT_LEN];
+            let mut shk = [0; SHK_LEN];
+
+            scheme.keygen(&mut sk, &mut pk).unwrap();
+
+            bench.iter(|| {
+                scheme.encaps(&mut shk, &mut ct, &pk).unwrap();
+            });
+        });
+
+        c.bench_function(&kem_benchid("decaps"), |bench| {
+            let mut sk = [0; SK_LEN];
+            let mut pk = [0; PK_LEN];
+            let mut ct = [0; CT_LEN];
+            let mut shk = [0; SHK_LEN];
+            let mut shk2 = [0; SHK_LEN];
+
+            scheme.keygen(&mut sk, &mut pk).unwrap();
+            scheme.encaps(&mut shk, &mut ct, &pk).unwrap();
+
+            bench.iter(|| {
+                scheme.decaps(&mut shk2, &sk, &ct).unwrap();
+            });
+        });
+    }
+}
+mod aead {
+    criterion::criterion_group!(
+        benches,
+        bench_chachapoly_libcrux,
+        bench_chachapoly_rustcrypto,
+        bench_xchachapoly_rustcrypto,
+    );
+
+    use criterion::Criterion;
+
+    const KEY_LEN: usize = rosenpass_ciphers::Aead::KEY_LEN;
+    const TAG_LEN: usize = rosenpass_ciphers::Aead::TAG_LEN;
+
+    fn bench_xchachapoly_rustcrypto(c: &mut Criterion) {
+        template(
+            c,
+            "xchacha20poly1305",
+            "rustcrypto",
+            rosenpass_ciphers::subtle::rust_crypto::xchacha20poly1305_ietf::XChaCha20Poly1305,
+        );
+    }
+
+    fn bench_chachapoly_rustcrypto(c: &mut Criterion) {
+        template(
+            c,
+            "chacha20poly1305",
+            "rustcrypto",
+            rosenpass_ciphers::subtle::rust_crypto::chacha20poly1305_ietf::ChaCha20Poly1305,
+        );
+    }
+
+    fn bench_chachapoly_libcrux(c: &mut Criterion) {
+        template(
+            c,
+            "chacha20poly1305",
+            "libcrux",
+            rosenpass_ciphers::subtle::libcrux::chacha20poly1305_ietf::ChaCha20Poly1305,
+        );
+    }
+
+    use rosenpass_cipher_traits::primitives::Aead;
+
+    fn template<const NONCE_LEN: usize, T: Aead<KEY_LEN, NONCE_LEN, TAG_LEN>>(
+        c: &mut Criterion,
+        alg_name: &str,
+        impl_name: &str,
+        scheme: T,
+    ) {
+        use crate::{benchid, KvPair, KvPairs};
+
+        let base = [
+            KvPair("primitive", "aead"),
+            KvPair("algorithm", alg_name),
+            KvPair("implementation", impl_name),
+        ];
+        let aead_benchid = |op, len| {
+            benchid(
+                KvPairs(&base),
+                KvPairs(&[KvPair("operation", op), KvPair("length", len)]),
+            )
+        };
+
+        let key = [12; KEY_LEN];
+        let nonce = [23; NONCE_LEN];
+        let ad = [];
+
+        c.bench_function(&aead_benchid("encrypt", "0byte"), |bench| {
+            const DATA_LEN: usize = 0;
+
+            let ptxt = [];
+            let mut ctxt = [0; DATA_LEN + TAG_LEN];
+
+            bench.iter(|| {
+                scheme.encrypt(&mut ctxt, &key, &nonce, &ad, &ptxt).unwrap();
+            });
+        });
+
+        c.bench_function(&aead_benchid("decrypt", "0byte"), |bench| {
+            const DATA_LEN: usize = 0;
+
+            let ptxt = [];
+            let mut ctxt = [0; DATA_LEN + TAG_LEN];
+            let mut ptxt_out = [0u8; DATA_LEN];
+
+            scheme.encrypt(&mut ctxt, &key, &nonce, &ad, &ptxt).unwrap();
+
+            bench.iter(|| {
+                scheme
+                    .decrypt(&mut ptxt_out, &key, &nonce, &ad, &mut ctxt)
+                    .unwrap()
+            })
+        });
+
+        c.bench_function(&aead_benchid("encrypt", "32byte"), |bench| {
+            const DATA_LEN: usize = 32;
+
+            let ptxt = [34u8; DATA_LEN];
+            let mut ctxt = [0; DATA_LEN + TAG_LEN];
+
+            bench.iter(|| {
+                scheme.encrypt(&mut ctxt, &key, &nonce, &ad, &ptxt).unwrap();
+            });
+        });
+
+        c.bench_function(&aead_benchid("decrypt", "32byte"), |bench| {
+            const DATA_LEN: usize = 32;
+
+            let ptxt = [34u8; DATA_LEN];
+            let mut ctxt = [0; DATA_LEN + TAG_LEN];
+            let mut ptxt_out = [0u8; DATA_LEN];
+
+            scheme.encrypt(&mut ctxt, &key, &nonce, &ad, &ptxt).unwrap();
+
+            bench.iter(|| {
+                scheme
+                    .decrypt(&mut ptxt_out, &key, &nonce, &ad, &mut ctxt)
+                    .unwrap()
+            })
+        });
+
+        c.bench_function(&aead_benchid("encrypt", "1024byte"), |bench| {
+            const DATA_LEN: usize = 1024;
+
+            let ptxt = [34u8; DATA_LEN];
+            let mut ctxt = [0; DATA_LEN + TAG_LEN];
+
+            bench.iter(|| {
+                scheme.encrypt(&mut ctxt, &key, &nonce, &ad, &ptxt).unwrap();
+            });
+        });
+        c.bench_function(&aead_benchid("decrypt", "1024byte"), |bench| {
+            const DATA_LEN: usize = 1024;
+
+            let ptxt = [34u8; DATA_LEN];
+            let mut ctxt = [0; DATA_LEN + TAG_LEN];
+            let mut ptxt_out = [0u8; DATA_LEN];
+
+            scheme.encrypt(&mut ctxt, &key, &nonce, &ad, &ptxt).unwrap();
+
+            bench.iter(|| {
+                scheme
+                    .decrypt(&mut ptxt_out, &key, &nonce, &ad, &mut ctxt)
+                    .unwrap()
+            })
+        });
+    }
+}
+
+mod keyed_hash {
+    criterion::criterion_group!(
+        benches,
+        bench_blake2b_rustcrypto,
+        bench_blake2b_libcrux,
+        bench_shake256_rustcrypto,
+    );
+
+    const KEY_LEN: usize = 32;
+    const HASH_LEN: usize = 32;
+
+    use criterion::Criterion;
+
+    fn bench_shake256_rustcrypto(c: &mut Criterion) {
+        template(
+            c,
+            "shake256",
+            "rustcrypto",
+            &rosenpass_ciphers::subtle::rust_crypto::keyed_shake256::SHAKE256Core,
+        );
+    }
+
+    fn bench_blake2b_rustcrypto(c: &mut Criterion) {
+        template(
+            c,
+            "blake2b",
+            "rustcrypto",
+            &rosenpass_ciphers::subtle::rust_crypto::blake2b::Blake2b,
+        );
+    }
+
+    fn bench_blake2b_libcrux(c: &mut Criterion) {
+        template(
+            c,
+            "blake2b",
+            "libcrux",
+            &rosenpass_ciphers::subtle::libcrux::blake2b::Blake2b,
+        );
+    }
+
+    use rosenpass_cipher_traits::primitives::KeyedHash;
+
+    fn template<H: KeyedHash<KEY_LEN, HASH_LEN>>(
+        c: &mut Criterion,
+        alg_name: &str,
+        impl_name: &str,
+        _: &H,
+    ) where
+        H::Error: std::fmt::Debug,
+    {
+        use crate::{benchid, KvPair, KvPairs};
+
+        let key = [12u8; KEY_LEN];
+        let mut out = [0u8; HASH_LEN];
+
+        let base = [
+            KvPair("primitive", "keyedhash"),
+            KvPair("algorithm", alg_name),
+            KvPair("implementation", impl_name),
+            KvPair("operation", "hash"),
+        ];
+        let keyedhash_benchid = |len| benchid(KvPairs(&base), KvPairs(&[KvPair("length", len)]));
+
+        c.bench_function(&keyedhash_benchid("0byte"), |bench| {
+            let bytes = [];
+
+            bench.iter(|| {
+                H::keyed_hash(&key, &bytes, &mut out).unwrap();
+            })
+        })
+        .bench_function(&keyedhash_benchid("32byte"), |bench| {
+            let bytes = [34u8; 32];
+
+            bench.iter(|| {
+                H::keyed_hash(&key, &bytes, &mut out).unwrap();
+            })
+        })
+        .bench_function(&keyedhash_benchid("64byte"), |bench| {
+            let bytes = [34u8; 64];
+
+            bench.iter(|| {
+                H::keyed_hash(&key, &bytes, &mut out).unwrap();
+            })
+        })
+        .bench_function(&keyedhash_benchid("128byte"), |bench| {
+            let bytes = [34u8; 128];
+
+            bench.iter(|| {
+                H::keyed_hash(&key, &bytes, &mut out).unwrap();
+            })
+        })
+        .bench_function(&keyedhash_benchid("1024byte"), |bench| {
+            let bytes = [34u8; 1024];
+
+            bench.iter(|| {
+                H::keyed_hash(&key, &bytes, &mut out).unwrap();
+            })
+        });
+    }
+}

ciphers/src/hash_domain.rs

@@ -1,74 +1,75 @@
+//!
+//!```rust
+//! # use rosenpass_ciphers::hash_domain::{HashDomain, HashDomainNamespace, SecretHashDomain, SecretHashDomainNamespace};
+//! use rosenpass_ciphers::KeyedHash;
+//! use rosenpass_secret_memory::Secret;
+//! # rosenpass_secret_memory::secret_policy_use_only_malloc_secrets();
+//!
+//! const PROTOCOL_IDENTIFIER: &str = "MY_PROTOCOL:IDENTIFIER";
+//! // create use once hash domain for the protocol identifier
+//! let mut hash_domain = HashDomain::zero(KeyedHash::keyed_shake256());
+//! hash_domain = hash_domain.mix(PROTOCOL_IDENTIFIER.as_bytes())?;
+//! // upgrade to reusable hash domain
+//! let hash_domain_namespace: HashDomainNamespace = hash_domain.dup();
+//! // derive new key
+//! let key_identifier = "my_key_identifier";
+//! let key = hash_domain_namespace.mix(key_identifier.as_bytes())?.into_value();
+//! // derive a new key based on a secret
+//! const MY_SECRET_LEN: usize = 21;
+//! let my_secret_bytes = "my super duper secret".as_bytes();
+//! let my_secret: Secret<21> = Secret::from_slice("my super duper secret".as_bytes());
+//! let secret_hash_domain: SecretHashDomain = hash_domain_namespace.mix_secret(my_secret)?;
+//! // derive a new key based on the secret key
+//! let new_key_identifier = "my_new_key_identifier".as_bytes();
+//! let new_key = secret_hash_domain.mix(new_key_identifier)?.into_secret();
+//!
+//! # Ok::<(), anyhow::Error>(())
+//!```
+//!
+
 use anyhow::Result;
 use rosenpass_secret_memory::Secret;
-use rosenpass_to::To;
+use rosenpass_to::To as _;
 
-use crate::keyed_hash as hash;
+pub use crate::{KeyedHash, KEY_LEN};
 
-pub use hash::KEY_LEN;
-
-///
-///```rust
-/// # use rosenpass_ciphers::hash_domain::{HashDomain, HashDomainNamespace, SecretHashDomain, SecretHashDomainNamespace};
-/// use rosenpass_secret_memory::Secret;
-/// # rosenpass_secret_memory::secret_policy_use_only_malloc_secrets();
-///
-/// const PROTOCOL_IDENTIFIER: &str = "MY_PROTOCOL:IDENTIFIER";
-/// // create use once hash domain for the protocol identifier
-/// let mut hash_domain = HashDomain::zero();
-/// hash_domain = hash_domain.mix(PROTOCOL_IDENTIFIER.as_bytes())?;
-/// // upgrade to reusable hash domain
-/// let hash_domain_namespace: HashDomainNamespace = hash_domain.dup();
-/// // derive new key
-/// let key_identifier = "my_key_identifier";
-/// let key = hash_domain_namespace.mix(key_identifier.as_bytes())?.into_value();
-/// // derive a new key based on a secret
-/// const MY_SECRET_LEN: usize = 21;
-/// let my_secret_bytes = "my super duper secret".as_bytes();
-/// let my_secret: Secret<21> = Secret::from_slice("my super duper secret".as_bytes());
-/// let secret_hash_domain: SecretHashDomain = hash_domain_namespace.mix_secret(my_secret)?;
-/// // derive a new key based on the secret key
-/// let new_key_identifier = "my_new_key_identifier".as_bytes();
-/// let new_key = secret_hash_domain.mix(new_key_identifier)?.into_secret();
-///
-/// # Ok::<(), anyhow::Error>(())
-///```
-///
+use rosenpass_cipher_traits::primitives::KeyedHashInstanceTo;
 
 // TODO Use a proper Dec interface
 /// A use-once hash domain for a specified key that can be used directly.
 /// The key must consist of [KEY_LEN] many bytes. If the key must remain secret,
 /// use [SecretHashDomain] instead.
 #[derive(Clone, Debug)]
-pub struct HashDomain([u8; KEY_LEN]);
+pub struct HashDomain([u8; KEY_LEN], KeyedHash);
 /// A reusable hash domain for a namespace identified by the key.
 /// The key must consist of [KEY_LEN] many bytes. If the key must remain secret,
 /// use [SecretHashDomainNamespace] instead.
 #[derive(Clone, Debug)]
-pub struct HashDomainNamespace([u8; KEY_LEN]);
+pub struct HashDomainNamespace([u8; KEY_LEN], KeyedHash);
 /// A use-once hash domain for a specified key that can be used directly
 /// by wrapping it in [Secret]. The key must consist of [KEY_LEN] many bytes.
 #[derive(Clone, Debug)]
-pub struct SecretHashDomain(Secret<KEY_LEN>);
+pub struct SecretHashDomain(Secret<KEY_LEN>, KeyedHash);
 /// A reusable secure hash domain for a namespace identified by the key and that keeps the key secure
 /// by wrapping it in [Secret]. The key must consist of [KEY_LEN] many bytes.
 #[derive(Clone, Debug)]
-pub struct SecretHashDomainNamespace(Secret<KEY_LEN>);
+pub struct SecretHashDomainNamespace(Secret<KEY_LEN>, KeyedHash);
 
 impl HashDomain {
     /// Creates a nw [HashDomain] initialized with a all-zeros key.
-    pub fn zero() -> Self {
-        Self([0u8; KEY_LEN])
+    pub fn zero(choice: KeyedHash) -> Self {
+        Self([0u8; KEY_LEN], choice)
     }
 
     /// Turns this [HashDomain] into a [HashDomainNamespace], keeping the key.
     pub fn dup(self) -> HashDomainNamespace {
-        HashDomainNamespace(self.0)
+        HashDomainNamespace(self.0, self.1)
     }
 
     /// Turns this [HashDomain] into a [SecretHashDomain] by wrapping the key into a [Secret]
     /// and creating a new [SecretHashDomain] from it.
     pub fn turn_secret(self) -> SecretHashDomain {
-        SecretHashDomain(Secret::from_slice(&self.0))
+        SecretHashDomain(Secret::from_slice(&self.0), self.1)
     }
 
     // TODO: Protocol! Use domain separation to ensure that
@@ -77,14 +78,43 @@ impl HashDomain {
     /// as the `data` and uses the result as the key for the new [HashDomain].
     ///
     pub fn mix(self, v: &[u8]) -> Result<Self> {
-        Ok(Self(hash::hash(&self.0, v).collect::<[u8; KEY_LEN]>()?))
+        let mut new_key: [u8; KEY_LEN] = [0u8; KEY_LEN];
+        self.1.keyed_hash_to(&self.0, v).to(&mut new_key)?;
+        Ok(Self(new_key, self.1))
+    }
+
+    /// Version of [Self::mix] that accepts an iterator and mixes all values from the iterator into
+    /// this hash domain.
+    ///
+    /// # Examples
+    ///
+    /// ```rust
+    /// use rosenpass_ciphers::{hash_domain::HashDomain, KeyedHash};
+    ///
+    /// let hasher = HashDomain::zero(KeyedHash::keyed_shake256());
+    /// assert_eq!(
+    ///     hasher.clone().mix(b"Hello")?.mix(b"World")?.into_value(),
+    ///     hasher.clone().mix_many([b"Hello", b"World"])?.into_value()
+    /// );
+    ///
+    /// Ok::<(), anyhow::Error>(())
+    /// ```
+    pub fn mix_many<I, T>(mut self, it: I) -> Result<Self>
+    where
+        I: IntoIterator<Item = T>,
+        T: AsRef<[u8]>,
+    {
+        for e in it {
+            self = self.mix(e.as_ref())?;
+        }
+        Ok(self)
     }
 
     /// Creates a new [SecretHashDomain] by mixing in a new key `v`
     /// by calling [SecretHashDomain::invoke_primitive] with this
     /// [HashDomain]'s key as `k` and `v` as `d`.
     pub fn mix_secret<const N: usize>(self, v: Secret<N>) -> Result<SecretHashDomain> {
-        SecretHashDomain::invoke_primitive(&self.0, v.secret())
+        SecretHashDomain::invoke_primitive(&self.0, v.secret(), self.1)
     }
 
     /// Gets the key of this [HashDomain].
@@ -98,9 +128,9 @@ impl HashDomainNamespace {
     /// it evaluates [hash::hash] with the key of this HashDomainNamespace key as the key and `v`
     /// as the `data` and uses the result as the key for the new [HashDomain].
     pub fn mix(&self, v: &[u8]) -> Result<HashDomain> {
-        Ok(HashDomain(
-            hash::hash(&self.0, v).collect::<[u8; KEY_LEN]>()?,
-        ))
+        let mut new_key: [u8; KEY_LEN] = [0u8; KEY_LEN];
+        self.1.keyed_hash_to(&self.0, v).to(&mut new_key)?;
+        Ok(HashDomain(new_key, self.1.clone()))
     }
 
     /// Creates a new [SecretHashDomain] by mixing in a new key `v`
@@ -109,7 +139,7 @@ impl HashDomainNamespace {
     ///
     /// It requires that `v` consists of exactly [KEY_LEN] many bytes.
     pub fn mix_secret<const N: usize>(&self, v: Secret<N>) -> Result<SecretHashDomain> {
-        SecretHashDomain::invoke_primitive(&self.0, v.secret())
+        SecretHashDomain::invoke_primitive(&self.0, v.secret(), self.1.clone())
     }
 }
 
@@ -118,27 +148,35 @@ impl SecretHashDomain {
     /// [hash::hash] with `k` as the `key` and `d` s the `data`, and using the result
     /// as the content for the new [SecretHashDomain].
     /// Both `k` and `d` have to be exactly [KEY_LEN] bytes in length.
-    pub fn invoke_primitive(k: &[u8], d: &[u8]) -> Result<SecretHashDomain> {
-        let mut r = SecretHashDomain(Secret::zero());
-        hash::hash(k, d).to(r.0.secret_mut())?;
+    /// TODO: docu
+    pub fn invoke_primitive(
+        k: &[u8],
+        d: &[u8],
+        hash_choice: KeyedHash,
+    ) -> Result<SecretHashDomain> {
+        let mut new_secret_key = Secret::zero();
+        hash_choice
+            .keyed_hash_to(k.try_into()?, d)
+            .to(new_secret_key.secret_mut())?;
+        let r = SecretHashDomain(new_secret_key, hash_choice);
         Ok(r)
     }
 
     /// Creates a new [SecretHashDomain] that is initialized with an all zeros key.
-    pub fn zero() -> Self {
-        Self(Secret::zero())
+    pub fn zero(hash_choice: KeyedHash) -> Self {
+        Self(Secret::zero(), hash_choice)
     }
 
     /// Turns this [SecretHashDomain] into a [SecretHashDomainNamespace].
     pub fn dup(self) -> SecretHashDomainNamespace {
-        SecretHashDomainNamespace(self.0)
+        SecretHashDomainNamespace(self.0, self.1)
     }
 
     /// Creates a new [SecretHashDomain] from a [Secret] `k`.
     ///
     /// It requires that `k` consist of exactly [KEY_LEN] bytes.
-    pub fn danger_from_secret(k: Secret<KEY_LEN>) -> Self {
-        Self(k)
+    pub fn danger_from_secret(k: Secret<KEY_LEN>, hash_choice: KeyedHash) -> Self {
+        Self(k, hash_choice)
     }
 
     /// Creates a new [SecretHashDomain] by mixing in a new key `v`. Specifically,
@@ -147,7 +185,47 @@ impl SecretHashDomain {
     ///
     /// It requires that `v` consists of exactly [KEY_LEN] many bytes.
     pub fn mix(self, v: &[u8]) -> Result<SecretHashDomain> {
-        Self::invoke_primitive(self.0.secret(), v)
+        Self::invoke_primitive(self.0.secret(), v, self.1)
+    }
+
+    /// Version of [Self::mix] that accepts an iterator and mixes all values from the iterator into
+    /// this hash domain.
+    ///
+    /// # Examples
+    ///
+    /// ```rust
+    /// use rosenpass_ciphers::{hash_domain::HashDomain, KeyedHash};
+    ///
+    /// rosenpass_secret_memory::secret_policy_use_only_malloc_secrets();
+    ///
+    /// let hasher = HashDomain::zero(KeyedHash::keyed_shake256());
+    /// assert_eq!(
+    ///     hasher
+    ///         .clone()
+    ///         .turn_secret()
+    ///         .mix(b"Hello")?
+    ///         .mix(b"World")?
+    ///         .into_secret()
+    ///         .secret(),
+    ///     hasher
+    ///         .clone()
+    ///         .turn_secret()
+    ///         .mix_many([b"Hello", b"World"])?
+    ///         .into_secret()
+    ///         .secret(),
+    /// );
+
+    /// Ok::<(), anyhow::Error>(())
+    /// ```
+    pub fn mix_many<I, T>(mut self, it: I) -> Result<Self>
+    where
+        I: IntoIterator<Item = T>,
+        T: AsRef<[u8]>,
+    {
+        for e in it {
+            self = self.mix(e.as_ref())?;
+        }
+        Ok(self)
     }
 
     /// Creates a new [SecretHashDomain] by mixing in a new key `v`
@@ -156,21 +234,13 @@ impl SecretHashDomain {
     ///
     /// It requires that `v` consists of exactly [KEY_LEN] many bytes.
     pub fn mix_secret<const N: usize>(self, v: Secret<N>) -> Result<SecretHashDomain> {
-        Self::invoke_primitive(self.0.secret(), v.secret())
+        Self::invoke_primitive(self.0.secret(), v.secret(), self.1)
     }
 
     /// Get the secret key data from this [SecretHashDomain].
     pub fn into_secret(self) -> Secret<KEY_LEN> {
         self.0
     }
-
-    /// Evaluate [hash::hash] with this [SecretHashDomain]'s data as the `key` and
-    /// `dst` as the `data` and stores the result as the new data for this [SecretHashDomain].
-    ///
-    /// It requires that both `v` and `d` consist of exactly [KEY_LEN] many bytes.
-    pub fn into_secret_slice(mut self, v: &[u8], dst: &[u8]) -> Result<()> {
-        hash::hash(v, dst).to(self.0.secret_mut())
-    }
 }
 
 impl SecretHashDomainNamespace {
@@ -180,7 +250,7 @@ impl SecretHashDomainNamespace {
     ///
     /// It requires that `v` consists of exactly [KEY_LEN] many bytes.
     pub fn mix(&self, v: &[u8]) -> Result<SecretHashDomain> {
-        SecretHashDomain::invoke_primitive(self.0.secret(), v)
+        SecretHashDomain::invoke_primitive(self.0.secret(), v, self.1.clone())
     }
 
     /// Creates a new [SecretHashDomain] by mixing in a new key `v`
@@ -189,7 +259,7 @@ impl SecretHashDomainNamespace {
     ///
     /// It requires that `v` consists of exactly [KEY_LEN] many bytes.
     pub fn mix_secret<const N: usize>(&self, v: Secret<N>) -> Result<SecretHashDomain> {
-        SecretHashDomain::invoke_primitive(self.0.secret(), v.secret())
+        SecretHashDomain::invoke_primitive(self.0.secret(), v.secret(), self.1.clone())
     }
 
     // TODO: This entire API is not very nice; we need this for biscuits, but
@@ -199,4 +269,8 @@ impl SecretHashDomainNamespace {
     pub fn danger_into_secret(self) -> Secret<KEY_LEN> {
         self.0
     }
+
+    pub fn keyed_hash(&self) -> &KeyedHash {
+        &self.1
+    }
 }

ciphers/src/lib.rs

@@ -1,11 +1,12 @@
+use rosenpass_cipher_traits::primitives::Aead as AeadTrait;
 use static_assertions::const_assert;
 
 pub mod subtle;
 
 /// All keyed primitives in this crate use 32 byte keys
 pub const KEY_LEN: usize = 32;
-const_assert!(KEY_LEN == aead::KEY_LEN);
-const_assert!(KEY_LEN == xaead::KEY_LEN);
+const_assert!(KEY_LEN == Aead::KEY_LEN);
+const_assert!(KEY_LEN == XAead::KEY_LEN);
 const_assert!(KEY_LEN == hash_domain::KEY_LEN);
 
 /// Keyed hashing
@@ -13,41 +14,33 @@ const_assert!(KEY_LEN == hash_domain::KEY_LEN);
 /// This should only be used for implementation details; anything with relevance
 /// to the cryptographic protocol should use the facilities in [hash_domain], (though
 /// hash domain uses this module internally)
-pub mod keyed_hash {
-    pub use crate::subtle::incorrect_hmac_blake2b::{
-        hash, KEY_LEN, KEY_MAX, KEY_MIN, OUT_MAX, OUT_MIN,
-    };
-}
+pub use crate::subtle::keyed_hash::KeyedHash;
 
-/// Authenticated encryption with associated data
+/// Authenticated encryption with associated data (AEAD)
 /// Chacha20poly1305 is used.
-pub mod aead {
-    #[cfg(not(feature = "experiment_libcrux"))]
-    pub use crate::subtle::chacha20poly1305_ietf::{decrypt, encrypt, KEY_LEN, NONCE_LEN, TAG_LEN};
-    #[cfg(feature = "experiment_libcrux")]
-    pub use crate::subtle::chacha20poly1305_ietf_libcrux::{
-        decrypt, encrypt, KEY_LEN, NONCE_LEN, TAG_LEN,
-    };
-}
+#[cfg(feature = "experiment_libcrux_chachapoly")]
+pub use subtle::libcrux::chacha20poly1305_ietf::ChaCha20Poly1305 as Aead;
 
-/// Authenticated encryption with associated data with a constant nonce
+/// Authenticated encryption with associated data (AEAD)
+/// Chacha20poly1305 is used.
+#[cfg(not(feature = "experiment_libcrux_chachapoly"))]
+pub use crate::subtle::rust_crypto::chacha20poly1305_ietf::ChaCha20Poly1305 as Aead;
+
+/// Authenticated encryption with associated data with a extended-length nonce (XAEAD)
 /// XChacha20poly1305 is used.
-pub mod xaead {
-    pub use crate::subtle::xchacha20poly1305_ietf::{
-        decrypt, encrypt, KEY_LEN, NONCE_LEN, TAG_LEN,
-    };
-}
+pub use crate::subtle::rust_crypto::xchacha20poly1305_ietf::XChaCha20Poly1305 as XAead;
+
+/// Use Classic-McEcliece-460986 as the Static KEM.
+///
+/// See [rosenpass_oqs::ClassicMceliece460896] for more details.
+pub use rosenpass_oqs::ClassicMceliece460896 as StaticKem;
+
+/// Use Kyber-512 as the Static KEM
+///
+/// See [rosenpass_oqs::Kyber512] for more details.
+#[cfg(not(feature = "experiment_libcrux_kyber"))]
+pub use rosenpass_oqs::Kyber512 as EphemeralKem;
+#[cfg(feature = "experiment_libcrux_kyber")]
+pub use subtle::libcrux::kyber512::Kyber512 as EphemeralKem;
 
 pub mod hash_domain;
-
-/// This crate includes two key encapsulation mechanisms.
-/// Namely ClassicMceliece460896 (also referred to as `StaticKem` sometimes) and
-/// Kyber512 (also referred to as  `EphemeralKem` sometimes).
-///
-/// See [rosenpass_oqs::ClassicMceliece460896]
-/// and [rosenpass_oqs::Kyber512] for more details on the specific KEMS.
-///
-pub mod kem {
-    pub use rosenpass_oqs::ClassicMceliece460896 as StaticKem;
-    pub use rosenpass_oqs::Kyber512 as EphemeralKem;
-}

ciphers/src/subtle/blake2b.rs

@@ -1,65 +0,0 @@
-use zeroize::Zeroizing;
-
-use blake2::digest::crypto_common::generic_array::GenericArray;
-use blake2::digest::crypto_common::typenum::U32;
-use blake2::digest::crypto_common::KeySizeUser;
-use blake2::digest::{FixedOutput, Mac, OutputSizeUser};
-use blake2::Blake2bMac;
-
-use rosenpass_to::{ops::copy_slice, with_destination, To};
-use rosenpass_util::typenum2const;
-
-/// Specify that the used implementation of BLAKE2b is the MAC version of BLAKE2b
-/// with output and key length of 32 bytes (see [Blake2bMac]).
-type Impl = Blake2bMac<U32>;
-
-type KeyLen = <Impl as KeySizeUser>::KeySize;
-type OutLen = <Impl as OutputSizeUser>::OutputSize;
-
-/// The key length for BLAKE2b supported by this API. Currently 32 Bytes.
-const KEY_LEN: usize = typenum2const! { KeyLen };
-/// The output length for BLAKE2b supported by this API. Currently 32 Bytes.
-const OUT_LEN: usize = typenum2const! { OutLen };
-
-/// Minimal key length supported by this API.
-pub const KEY_MIN: usize = KEY_LEN;
-/// maximal key length supported by this API.
-pub const KEY_MAX: usize = KEY_LEN;
-/// minimal output length supported by this API.
-pub const OUT_MIN: usize = OUT_LEN;
-/// maximal output length supported by this API.
-pub const OUT_MAX: usize = OUT_LEN;
-
-/// Hashes the given `data` with the [Blake2bMac] hash function under the given `key`.
-/// The both the length of the output the length of the key 32 bytes (or 256 bits).  
-///
-/// # Examples
-///
-///```rust
-/// # use rosenpass_ciphers::subtle::blake2b::hash;
-/// use rosenpass_to::To;
-/// let zero_key: [u8; 32] = [0; 32];
-/// let data: [u8; 32] = [255; 32];
-/// // buffer for the hash output
-/// let mut hash_data: [u8; 32] = [0u8; 32];  
-///
-/// assert!(hash(&zero_key, &data).to(&mut hash_data).is_ok(), "Hashing has to return OK result");
-///```
-///
-#[inline]
-pub fn hash<'a>(key: &'a [u8], data: &'a [u8]) -> impl To<[u8], anyhow::Result<()>> + 'a {
-    with_destination(|out: &mut [u8]| {
-        let mut h = Impl::new_from_slice(key)?;
-        h.update(data);
-
-        // Jesus christ, blake2 crate, your usage of GenericArray might be nice and fancy
-        // but it introduces a ton of complexity. This cost me half an hour just to figure
-        // out the right way to use the imports while allowing for zeroization.
-        // An API based on slices might actually be simpler.
-        let mut tmp = Zeroizing::new([0u8; OUT_LEN]);
-        let tmp = GenericArray::from_mut_slice(tmp.as_mut());
-        h.finalize_into(tmp);
-        copy_slice(tmp.as_ref()).to(out);
-        Ok(())
-    })
-}

ciphers/src/subtle/chacha20poly1305_ietf.rs

@@ -1,99 +0,0 @@
-use rosenpass_to::ops::copy_slice;
-use rosenpass_to::To;
-use rosenpass_util::typenum2const;
-
-use chacha20poly1305::aead::generic_array::GenericArray;
-use chacha20poly1305::ChaCha20Poly1305 as AeadImpl;
-use chacha20poly1305::{AeadCore, AeadInPlace, KeyInit, KeySizeUser};
-
-/// The key length is 32 bytes or 256 bits.
-pub const KEY_LEN: usize = typenum2const! { <AeadImpl as KeySizeUser>::KeySize };
-/// The  MAC tag length is 16 bytes or 128 bits.
-pub const TAG_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::TagSize };
-/// The nonce length is 12 bytes or 96 bits.
-pub const NONCE_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::NonceSize };
-
-/// Encrypts using ChaCha20Poly1305 as implemented in [RustCrypto](https://github.com/RustCrypto/AEADs/tree/master/chacha20poly1305).
-/// `key` MUST be chosen (pseudo-)randomly and `nonce` MOST NOT be reused. The `key` slice MUST have
-/// a length of [KEY_LEN]. The `nonce` slice MUST have a length of [NONCE_LEN]. The last [TAG_LEN] bytes
-/// written in `ciphertext` are the tag guaranteeing integrity. `ciphertext` MUST have a capacity of
-/// `plaintext.len()` + [TAG_LEN].
-///
-/// # Examples
-///```rust
-/// # use rosenpass_ciphers::subtle::chacha20poly1305_ietf::{encrypt, TAG_LEN, KEY_LEN, NONCE_LEN};
-///
-/// const PLAINTEXT_LEN: usize = 43;
-/// let plaintext = "post-quantum cryptography is very important".as_bytes();
-/// assert_eq!(PLAINTEXT_LEN, plaintext.len());
-/// let key: &[u8] = &[0u8; KEY_LEN]; // THIS IS NOT A SECURE KEY
-/// let nonce: &[u8] = &[0u8; NONCE_LEN]; // THIS IS NOT A SECURE NONCE
-/// let additional_data: &[u8] = "the encrypted message is very important".as_bytes();
-/// let mut ciphertext_buffer = [0u8;PLAINTEXT_LEN + TAG_LEN];
-///
-/// let res: anyhow::Result<()> = encrypt(&mut ciphertext_buffer, key, nonce, additional_data, plaintext);
-/// assert!(res.is_ok());
-/// # let expected_ciphertext: &[u8] = &[239, 104, 148, 202, 120, 32, 77, 27, 246, 206, 226, 17,
-/// # 83, 78, 122, 116, 187, 123, 70, 199, 58, 130, 21, 1, 107, 230, 58, 77, 18, 152, 31, 159, 80,
-/// # 151, 72, 27, 236, 137, 60, 55, 180, 31, 71, 97, 199, 12, 60, 155, 70, 221, 225, 110, 132, 191,
-/// # 8, 114, 85, 4, 25];
-/// # assert_eq!(expected_ciphertext, &ciphertext_buffer);
-///```
-#[inline]
-pub fn encrypt(
-    ciphertext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    plaintext: &[u8],
-) -> anyhow::Result<()> {
-    let nonce = GenericArray::from_slice(nonce);
-    let (ct, mac) = ciphertext.split_at_mut(ciphertext.len() - TAG_LEN);
-    copy_slice(plaintext).to(ct);
-    let mac_value = AeadImpl::new_from_slice(key)?.encrypt_in_place_detached(nonce, ad, ct)?;
-    copy_slice(&mac_value[..]).to(mac);
-    Ok(())
-}
-
-/// Decrypts a `ciphertext` and verifies the integrity of the `ciphertext` and the additional data
-/// `ad`. using ChaCha20Poly1305 as implemented in [RustCrypto](https://github.com/RustCrypto/AEADs/tree/master/chacha20poly1305).
-///
-/// The `key` slice MUST have a length of [KEY_LEN]. The `nonce` slice MUST have a length of
-/// [NONCE_LEN]. The plaintext buffer must have a capacity of `ciphertext.len()` - [TAG_LEN].
-///
-/// # Examples
-///```rust
-/// # use rosenpass_ciphers::subtle::chacha20poly1305_ietf::{decrypt, TAG_LEN, KEY_LEN, NONCE_LEN};
-/// let ciphertext: &[u8] = &[239, 104, 148, 202, 120, 32, 77, 27, 246, 206, 226, 17,
-/// 83, 78, 122, 116, 187, 123, 70, 199, 58, 130, 21, 1, 107, 230, 58, 77, 18, 152, 31, 159, 80,
-/// 151, 72, 27, 236, 137, 60, 55, 180, 31, 71, 97, 199, 12, 60, 155, 70, 221, 225, 110, 132, 191,
-/// 8, 114, 85, 4, 25]; // this is the ciphertext generated by the example for the encryption
-/// const PLAINTEXT_LEN: usize = 43;
-/// assert_eq!(PLAINTEXT_LEN + TAG_LEN, ciphertext.len());
-///
-/// let key: &[u8] = &[0u8; KEY_LEN]; // THIS IS NOT A SECURE KEY
-/// let nonce: &[u8] = &[0u8; NONCE_LEN]; // THIS IS NOT A SECURE NONCE
-/// let additional_data: &[u8] = "the encrypted message is very important".as_bytes();
-/// let mut plaintext_buffer = [0u8; PLAINTEXT_LEN];
-///
-/// let res: anyhow::Result<()> = decrypt(&mut plaintext_buffer, key, nonce, additional_data, ciphertext);
-/// assert!(res.is_ok());
-/// let expected_plaintext = "post-quantum cryptography is very important".as_bytes();
-/// assert_eq!(expected_plaintext, plaintext_buffer);
-///
-///```
-#[inline]
-pub fn decrypt(
-    plaintext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    ciphertext: &[u8],
-) -> anyhow::Result<()> {
-    let nonce = GenericArray::from_slice(nonce);
-    let (ct, mac) = ciphertext.split_at(ciphertext.len() - TAG_LEN);
-    let tag = GenericArray::from_slice(mac);
-    copy_slice(ct).to(plaintext);
-    AeadImpl::new_from_slice(key)?.decrypt_in_place_detached(nonce, ad, plaintext, tag)?;
-    Ok(())
-}

ciphers/src/subtle/chacha20poly1305_ietf_libcrux.rs

@@ -1,117 +0,0 @@
-use rosenpass_to::ops::copy_slice;
-use rosenpass_to::To;
-
-use zeroize::Zeroize;
-
-/// The key length is 32 bytes or 256 bits.
-pub const KEY_LEN: usize = 32; // Grrrr! Libcrux, please provide me these constants.
-/// The  MAC tag length is 16 bytes or 128 bits.
-pub const TAG_LEN: usize = 16;
-/// The nonce length is 12 bytes or 96 bits.
-pub const NONCE_LEN: usize = 12;
-
-/// Encrypts using ChaCha20Poly1305 as implemented in [libcrux](https://github.com/cryspen/libcrux).
-/// Key and nonce MUST be chosen (pseudo-)randomly. The `key` slice MUST have a length of
-/// [KEY_LEN]. The `nonce` slice MUST have a length of [NONCE_LEN]. The last [TAG_LEN] bytes
-/// written in `ciphertext` are the tag guaranteeing integrity. `ciphertext` MUST have a capacity of
-/// `plaintext.len()` + [TAG_LEN].
-///  
-/// # Examples
-///```rust
-/// # use rosenpass_ciphers::subtle::chacha20poly1305_ietf_libcrux::{encrypt, TAG_LEN, KEY_LEN, NONCE_LEN};
-///
-/// const PLAINTEXT_LEN: usize = 43;
-/// let plaintext = "post-quantum cryptography is very important".as_bytes();
-/// assert_eq!(PLAINTEXT_LEN, plaintext.len());
-/// let key: &[u8] = &[0u8; KEY_LEN]; // THIS IS NOT A SECURE KEY
-/// let nonce: &[u8] = &[0u8; NONCE_LEN]; // THIS IS NOT A SECURE NONCE
-/// let additional_data: &[u8] = "the encrypted message is very important".as_bytes();
-/// let mut ciphertext_buffer = [0u8; PLAINTEXT_LEN + TAG_LEN];
-///
-/// let res: anyhow::Result<()> = encrypt(&mut ciphertext_buffer, key, nonce, additional_data, plaintext);
-/// assert!(res.is_ok());
-/// # let expected_ciphertext: &[u8] = &[239, 104, 148, 202, 120, 32, 77, 27, 246, 206, 226, 17,
-/// # 83, 78, 122, 116, 187, 123, 70, 199, 58, 130, 21, 1, 107, 230, 58, 77, 18, 152, 31, 159, 80,
-/// # 151, 72, 27, 236, 137, 60, 55, 180, 31, 71, 97, 199, 12, 60, 155, 70, 221, 225, 110, 132, 191,
-/// # 8, 114, 85, 4, 25];
-/// # assert_eq!(expected_ciphertext, &ciphertext_buffer);
-///```
-///
-#[inline]
-pub fn encrypt(
-    ciphertext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    plaintext: &[u8],
-) -> anyhow::Result<()> {
-    let (ciphertext, mac) = ciphertext.split_at_mut(ciphertext.len() - TAG_LEN);
-
-    use libcrux::aead as C;
-    let crux_key = C::Key::Chacha20Poly1305(C::Chacha20Key(key.try_into().unwrap()));
-    let crux_iv = C::Iv(nonce.try_into().unwrap());
-
-    copy_slice(plaintext).to(ciphertext);
-    let crux_tag = libcrux::aead::encrypt(&crux_key, ciphertext, crux_iv, ad).unwrap();
-    copy_slice(crux_tag.as_ref()).to(mac);
-
-    match crux_key {
-        C::Key::Chacha20Poly1305(mut k) => k.0.zeroize(),
-        _ => panic!(),
-    }
-
-    Ok(())
-}
-
-/// Decrypts a `ciphertext` and verifies the integrity of the `ciphertext` and the additional data
-/// `ad`. using ChaCha20Poly1305 as implemented in [libcrux](https://github.com/cryspen/libcrux).
-///
-/// The `key` slice MUST have a length of [KEY_LEN]. The `nonce` slice MUST have a length of
-/// [NONCE_LEN]. The plaintext buffer must have a capacity of `ciphertext.len()` - [TAG_LEN].
-///
-/// # Examples
-///```rust
-/// # use rosenpass_ciphers::subtle::chacha20poly1305_ietf_libcrux::{decrypt, TAG_LEN, KEY_LEN, NONCE_LEN};
-/// let ciphertext: &[u8] = &[239, 104, 148, 202, 120, 32, 77, 27, 246, 206, 226, 17,
-/// 83, 78, 122, 116, 187, 123, 70, 199, 58, 130, 21, 1, 107, 230, 58, 77, 18, 152, 31, 159, 80,
-/// 151, 72, 27, 236, 137, 60, 55, 180, 31, 71, 97, 199, 12, 60, 155, 70, 221, 225, 110, 132, 191,
-/// 8, 114, 85, 4, 25]; // this is the ciphertext generated by the example for the encryption
-/// const PLAINTEXT_LEN: usize = 43;
-/// assert_eq!(PLAINTEXT_LEN + TAG_LEN, ciphertext.len());
-///
-/// let key: &[u8] = &[0u8; KEY_LEN]; // THIS IS NOT A SECURE KEY
-/// let nonce: &[u8] = &[0u8; NONCE_LEN]; // THIS IS NOT A SECURE NONCE
-/// let additional_data: &[u8] = "the encrypted message is very important".as_bytes();
-/// let mut plaintext_buffer = [0u8; PLAINTEXT_LEN];
-///
-/// let res: anyhow::Result<()> = decrypt(&mut plaintext_buffer, key, nonce, additional_data, ciphertext);
-/// assert!(res.is_ok());
-/// let expected_plaintext = "post-quantum cryptography is very important".as_bytes();
-/// assert_eq!(expected_plaintext, plaintext_buffer);
-///
-///```
-#[inline]
-pub fn decrypt(
-    plaintext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
-    ad: &[u8],
-    ciphertext: &[u8],
-) -> anyhow::Result<()> {
-    let (ciphertext, mac) = ciphertext.split_at(ciphertext.len() - TAG_LEN);
-
-    use libcrux::aead as C;
-    let crux_key = C::Key::Chacha20Poly1305(C::Chacha20Key(key.try_into().unwrap()));
-    let crux_iv = C::Iv(nonce.try_into().unwrap());
-    let crux_tag = C::Tag::from_slice(mac).unwrap();
-
-    copy_slice(ciphertext).to(plaintext);
-    libcrux::aead::decrypt(&crux_key, plaintext, crux_iv, ad, &crux_tag).unwrap();
-
-    match crux_key {
-        C::Key::Chacha20Poly1305(mut k) => k.0.zeroize(),
-        _ => panic!(),
-    }
-
-    Ok(())
-}

ciphers/src/subtle/custom/incorrect_hmac_blake2b.rs

@@ -0,0 +1,79 @@
+use rosenpass_cipher_traits::{
+    algorithms::KeyedHashIncorrectHmacBlake2b,
+    primitives::{InferKeyedHash, KeyedHash, KeyedHashTo},
+};
+use rosenpass_constant_time::xor;
+use rosenpass_to::{ops::copy_slice, To};
+use zeroize::Zeroizing;
+
+#[cfg(not(feature = "experiment_libcrux_blake2"))]
+use crate::subtle::rust_crypto::blake2b::Blake2b;
+#[cfg(not(feature = "experiment_libcrux_blake2"))]
+use anyhow::Error;
+
+#[cfg(feature = "experiment_libcrux_blake2")]
+use crate::subtle::libcrux::blake2b::{Blake2b, Error};
+
+/// The key length, 32 bytes or 256 bits.
+pub const KEY_LEN: usize = 32;
+
+/// The hash length, 32 bytes or 256 bits.
+pub const HASH_LEN: usize = 32;
+
+/// This is a woefully incorrect implementation of hmac_blake2b.
+/// See <https://github.com/rosenpass/rosenpass/issues/68#issuecomment-1563612222>
+///
+/// It accepts 32 byte keys, exclusively.
+///
+/// This will be replaced, likely by Kekkac at some point soon.
+/// <https://github.com/rosenpass/rosenpass/pull/145>
+///
+/// # Examples
+///```rust
+/// # use rosenpass_ciphers::subtle::custom::incorrect_hmac_blake2b::IncorrectHmacBlake2bCore;
+/// use rosenpass_cipher_traits::primitives::KeyedHashTo;
+/// use rosenpass_to::To;
+/// let key: [u8; 32] = [0; 32];
+/// let data: [u8; 32] = [255; 32];
+/// // buffer for the hash output
+/// let mut hash_data: [u8; 32] = [0u8; 32];
+///
+/// assert!(IncorrectHmacBlake2bCore::keyed_hash_to(&key, &data).to(&mut hash_data).is_ok(), "Hashing has to return OK result");
+/// # let expected_hash: &[u8] = &[5, 152, 135, 141, 151, 106, 147, 8, 220, 95, 38, 66, 29, 33, 3,
+/// 104, 250, 114, 131, 119, 27, 56, 59, 44, 11, 67, 230, 113, 112, 20, 80, 103];
+/// # assert_eq!(hash_data, expected_hash);
+///```
+///
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct IncorrectHmacBlake2bCore;
+
+impl KeyedHash<KEY_LEN, HASH_LEN> for IncorrectHmacBlake2bCore {
+    type Error = Error;
+
+    fn keyed_hash(
+        key: &[u8; KEY_LEN],
+        data: &[u8],
+        out: &mut [u8; HASH_LEN],
+    ) -> Result<(), Self::Error> {
+        const IPAD: [u8; KEY_LEN] = [0x36u8; KEY_LEN];
+        const OPAD: [u8; KEY_LEN] = [0x5Cu8; KEY_LEN];
+
+        type Key = Zeroizing<[u8; KEY_LEN]>;
+        let mut tmp_key = Key::default();
+
+        copy_slice(key).to(tmp_key.as_mut());
+        xor(&IPAD).to(tmp_key.as_mut());
+        let mut outer_data = Key::default();
+        Blake2b::keyed_hash_to(&tmp_key, data).to(&mut outer_data)?;
+
+        copy_slice(key).to(tmp_key.as_mut());
+        xor(&OPAD).to(tmp_key.as_mut());
+        Blake2b::keyed_hash_to(&tmp_key, outer_data.as_ref()).to(out)?;
+
+        Ok(())
+    }
+}
+
+pub type IncorrectHmacBlake2b = InferKeyedHash<IncorrectHmacBlake2bCore, KEY_LEN, HASH_LEN>;
+
+impl KeyedHashIncorrectHmacBlake2b for IncorrectHmacBlake2bCore {}

ciphers/src/subtle/custom/mod.rs

@@ -0,0 +1,3 @@
+//! Own implementations of custom algorithms
+
+pub mod incorrect_hmac_blake2b;

ciphers/src/subtle/incorrect_hmac_blake2b.rs

@@ -1,67 +0,0 @@
-use anyhow::ensure;
-use zeroize::Zeroizing;
-
-use rosenpass_constant_time::xor;
-use rosenpass_to::{ops::copy_slice, with_destination, To};
-
-use crate::subtle::blake2b;
-
-/// The key length, 32 bytes or 256 bits.
-pub const KEY_LEN: usize = 32;
-/// The minimal key length, identical to [KEY_LEN]
-pub const KEY_MIN: usize = KEY_LEN;
-/// The maximal key length, identical to [KEY_LEN]
-pub const KEY_MAX: usize = KEY_LEN;
-/// The minimal output length, see [blake2b::OUT_MIN]
-pub const OUT_MIN: usize = blake2b::OUT_MIN;
-/// The maximal output length, see [blake2b::OUT_MAX]
-pub const OUT_MAX: usize = blake2b::OUT_MAX;
-
-/// This is a woefully incorrect implementation of hmac_blake2b.
-/// See <https://github.com/rosenpass/rosenpass/issues/68#issuecomment-1563612222>
-///
-/// It accepts 32 byte keys, exclusively.
-///
-/// This will be replaced, likely by Kekkac at some point soon.
-/// <https://github.com/rosenpass/rosenpass/pull/145>
-///
-/// # Examples
-///```rust
-/// # use rosenpass_ciphers::subtle::incorrect_hmac_blake2b::hash;
-/// use rosenpass_to::To;
-/// let key: [u8; 32] = [0; 32];
-/// let data: [u8; 32] = [255; 32];
-/// // buffer for the hash output
-/// let mut hash_data: [u8; 32] = [0u8; 32];
-///
-/// assert!(hash(&key, &data).to(&mut hash_data).is_ok(), "Hashing has to return OK result");
-/// # let expected_hash: &[u8] = &[5, 152, 135, 141, 151, 106, 147, 8, 220, 95, 38, 66, 29, 33, 3,
-/// 104, 250, 114, 131, 119, 27, 56, 59, 44, 11, 67, 230, 113, 112, 20, 80, 103];
-/// # assert_eq!(hash_data, expected_hash);
-///```
-///
-#[inline]
-pub fn hash<'a>(key: &'a [u8], data: &'a [u8]) -> impl To<[u8], anyhow::Result<()>> + 'a {
-    const IPAD: [u8; KEY_LEN] = [0x36u8; KEY_LEN];
-    const OPAD: [u8; KEY_LEN] = [0x5Cu8; KEY_LEN];
-
-    with_destination(|out: &mut [u8]| {
-        // Not bothering with padding; the implementation
-        // uses appropriately sized keys.
-        ensure!(key.len() == KEY_LEN);
-
-        type Key = Zeroizing<[u8; KEY_LEN]>;
-        let mut tmp_key = Key::default();
-
-        copy_slice(key).to(tmp_key.as_mut());
-        xor(&IPAD).to(tmp_key.as_mut());
-        let mut outer_data = Key::default();
-        blake2b::hash(tmp_key.as_ref(), data).to(outer_data.as_mut())?;
-
-        copy_slice(key).to(tmp_key.as_mut());
-        xor(&OPAD).to(tmp_key.as_mut());
-        blake2b::hash(tmp_key.as_ref(), outer_data.as_ref()).to(out)?;
-
-        Ok(())
-    })
-}

ciphers/src/subtle/keyed_hash.rs

@@ -0,0 +1,65 @@
+//! This module provides types that enabling choosing the keyed hash building block to be used at
+//! runtime (using enums) instead of at compile time (using generics).
+
+use anyhow::Result;
+use rosenpass_cipher_traits::primitives::KeyedHashInstance;
+use std::fmt::Display;
+
+use crate::subtle::{
+    custom::incorrect_hmac_blake2b::IncorrectHmacBlake2b, rust_crypto::keyed_shake256::SHAKE256_32,
+};
+
+/// Length of symmetric key throughout Rosenpass.
+pub const KEY_LEN: usize = 32;
+
+/// The hash is used as a symmetric key and should have the same length.
+pub const HASH_LEN: usize = KEY_LEN;
+
+/// Provides a way to pick which keyed hash to use at runtime.
+/// Implements [`KeyedHashInstance`] to allow hashing using the respective algorithm.
+#[derive(Debug, Eq, PartialEq, Clone)]
+pub enum KeyedHash {
+    /// A hasher backed by [`SHAKE256_32`].
+    KeyedShake256(SHAKE256_32),
+    /// A hasher backed by [`IncorrectHmacBlake2b`].
+    IncorrectHmacBlake2b(IncorrectHmacBlake2b),
+}
+
+impl KeyedHash {
+    /// Creates an [`KeyedHash`] backed by SHAKE256.
+    pub fn keyed_shake256() -> Self {
+        Self::KeyedShake256(Default::default())
+    }
+
+    /// Creates an [`KeyedHash`] backed by Blake2B.
+    pub fn incorrect_hmac_blake2b() -> Self {
+        Self::IncorrectHmacBlake2b(Default::default())
+    }
+}
+
+impl KeyedHashInstance<KEY_LEN, HASH_LEN> for KeyedHash {
+    type Error = anyhow::Error;
+
+    fn keyed_hash(
+        &self,
+        key: &[u8; KEY_LEN],
+        data: &[u8],
+        out: &mut [u8; HASH_LEN],
+    ) -> Result<(), Self::Error> {
+        match self {
+            Self::KeyedShake256(h) => h.keyed_hash(key, data, out)?,
+            Self::IncorrectHmacBlake2b(h) => h.keyed_hash(key, data, out)?,
+        };
+
+        Ok(())
+    }
+}
+
+impl Display for KeyedHash {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::KeyedShake256(_) => write!(f, "KeyedShake256_32"),
+            Self::IncorrectHmacBlake2b(_) => write!(f, "IncorrectHmacBlake2b"),
+        }
+    }
+}

ciphers/src/subtle/libcrux/blake2b.rs

@@ -0,0 +1,88 @@
+//! Implementation of the [`KeyedHashBlake2b`] trait based on the [`libcrux_blake2`] crate.
+
+use libcrux_blake2::Blake2bBuilder;
+
+use rosenpass_cipher_traits::algorithms::KeyedHashBlake2b;
+use rosenpass_cipher_traits::primitives::KeyedHash;
+
+pub use rosenpass_cipher_traits::algorithms::keyed_hash_blake2b::HASH_LEN;
+pub use rosenpass_cipher_traits::algorithms::keyed_hash_blake2b::KEY_LEN;
+
+/// Describles which error occurred
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    /// An unexpected internal error occurred. Should never be returned and points to a bug in the
+    /// implementation.
+    #[error("internal error")]
+    InternalError,
+
+    /// Indicates that the provided data was too long.
+    #[error("data is too long")]
+    DataTooLong,
+}
+
+/// Hasher for the given `data` with the Blake2b hash function.
+pub struct Blake2b;
+
+impl KeyedHash<KEY_LEN, HASH_LEN> for Blake2b {
+    type Error = Error;
+
+    fn keyed_hash(
+        key: &[u8; KEY_LEN],
+        data: &[u8],
+        out: &mut [u8; HASH_LEN],
+    ) -> Result<(), Self::Error> {
+        let mut h = Blake2bBuilder::new_keyed_const(key)
+            // this may fail if the key length is invalid, but 32 is fine
+            .map_err(|_| Error::InternalError)?
+            .build_const_digest_len()
+            .map_err(|_|
+            // this can only fail if the output length is invalid, but 32 is fine.
+            Error::InternalError)?;
+
+        h.update(data).map_err(|_| Error::DataTooLong)?;
+        h.finalize(out);
+
+        Ok(())
+    }
+}
+
+impl KeyedHashBlake2b for Blake2b {}
+
+#[cfg(test)]
+mod equivalence_tests {
+    use super::*;
+    use rand::RngCore;
+
+    #[test]
+    fn fuzz_equivalence_libcrux_old_new() {
+        let datas: [&[u8]; 3] = [
+            b"".as_slice(),
+            b"test".as_slice(),
+            b"abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd",
+        ];
+
+        let mut key = [0; KEY_LEN];
+        let mut rng = rand::thread_rng();
+
+        let mut hash_left = [0; 32];
+        let mut hash_right = [0; 32];
+
+        for data in datas {
+            for _ in 0..1000 {
+                rng.fill_bytes(&mut key);
+
+                crate::subtle::rust_crypto::blake2b::Blake2b::keyed_hash(
+                    &key,
+                    data,
+                    &mut hash_left,
+                )
+                .unwrap();
+                crate::subtle::libcrux::blake2b::Blake2b::keyed_hash(&key, data, &mut hash_right)
+                    .unwrap();
+
+                assert_eq!(hash_left, hash_right);
+            }
+        }
+    }
+}

ciphers/src/subtle/libcrux/chacha20poly1305_ietf.rs

@@ -0,0 +1,274 @@
+//! Implementation of the [`AeadChaCha20Poly1305`] trait based on the [`libcrux_chacha20poly1305`] crate.
+
+use rosenpass_cipher_traits::algorithms::AeadChaCha20Poly1305;
+use rosenpass_cipher_traits::primitives::{Aead, AeadError};
+
+pub use rosenpass_cipher_traits::algorithms::aead_chacha20poly1305::{KEY_LEN, NONCE_LEN, TAG_LEN};
+
+/// An implementation of the ChaCha20Poly1305 AEAD based on libcrux
+pub struct ChaCha20Poly1305;
+
+impl Aead<KEY_LEN, NONCE_LEN, TAG_LEN> for ChaCha20Poly1305 {
+    fn encrypt(
+        &self,
+        ciphertext: &mut [u8],
+        key: &[u8; KEY_LEN],
+        nonce: &[u8; NONCE_LEN],
+        ad: &[u8],
+        plaintext: &[u8],
+    ) -> Result<(), AeadError> {
+        let (ctxt, tag) = libcrux_chacha20poly1305::encrypt(key, plaintext, ciphertext, ad, nonce)
+            .map_err(|_| AeadError::InternalError)?;
+
+        // return an error of the destination buffer is longer than expected
+        // because the caller wouldn't know where the end is
+        if ctxt.len() + tag.len() != ciphertext.len() {
+            return Err(AeadError::InternalError);
+        }
+
+        Ok(())
+    }
+
+    fn decrypt(
+        &self,
+        plaintext: &mut [u8],
+        key: &[u8; KEY_LEN],
+        nonce: &[u8; NONCE_LEN],
+        ad: &[u8],
+        ciphertext: &[u8],
+    ) -> Result<(), AeadError> {
+        let ptxt = libcrux_chacha20poly1305::decrypt(key, plaintext, ciphertext, ad, nonce)
+            .map_err(|_| AeadError::DecryptError)?;
+
+        // return an error of the destination buffer is longer than expected
+        // because the caller wouldn't know where the end is
+        if ptxt.len() != plaintext.len() {
+            return Err(AeadError::DecryptError);
+        }
+
+        Ok(())
+    }
+}
+
+impl AeadChaCha20Poly1305 for ChaCha20Poly1305 {}
+
+/// The idea of these tests is to check that the above implemenatation behaves, by and large, the
+/// same as the one from the old libcrux and the one from RustCrypto. You can consider them janky,
+/// self-rolled property-based tests.
+#[cfg(test)]
+mod equivalence_tests {
+    use super::*;
+    use rand::RngCore;
+
+    #[test]
+    fn proptest_equivalence_libcrux_rustcrypto() {
+        use crate::subtle::rust_crypto::chacha20poly1305_ietf::ChaCha20Poly1305 as RustCryptoChaCha20Poly1305;
+        let ptxts: [&[u8]; 3] = [
+            b"".as_slice(),
+            b"test".as_slice(),
+            b"abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd",
+        ];
+        let mut key = [0; KEY_LEN];
+        let mut rng = rand::thread_rng();
+
+        let mut ctxt_left = [0; 64 + TAG_LEN];
+        let mut ctxt_right = [0; 64 + TAG_LEN];
+
+        let mut ptxt_left = [0; 64];
+        let mut ptxt_right = [0; 64];
+
+        let nonce = [0; NONCE_LEN];
+        let ad = b"";
+
+        for ptxt in ptxts {
+            for _ in 0..1000 {
+                rng.fill_bytes(&mut key);
+                let ctxt_left = &mut ctxt_left[..ptxt.len() + TAG_LEN];
+                let ctxt_right = &mut ctxt_right[..ptxt.len() + TAG_LEN];
+
+                let ptxt_left = &mut ptxt_left[..ptxt.len()];
+                let ptxt_right = &mut ptxt_right[..ptxt.len()];
+
+                RustCryptoChaCha20Poly1305
+                    .encrypt(ctxt_left, &key, &nonce, ad, ptxt)
+                    .unwrap();
+                ChaCha20Poly1305
+                    .encrypt(ctxt_right, &key, &nonce, ad, ptxt)
+                    .unwrap();
+
+                assert_eq!(ctxt_left, ctxt_right);
+
+                RustCryptoChaCha20Poly1305
+                    .decrypt(ptxt_left, &key, &nonce, ad, ctxt_left)
+                    .unwrap();
+                ChaCha20Poly1305
+                    .decrypt(ptxt_right, &key, &nonce, ad, ctxt_right)
+                    .unwrap();
+
+                assert_eq!(ptxt_left, ptxt);
+                assert_eq!(ptxt_right, ptxt);
+            }
+        }
+    }
+
+    #[test]
+    #[cfg(feature = "experiment_libcrux_chachapoly_test")]
+    fn proptest_equivalence_libcrux_old_new() {
+        let ptxts: [&[u8]; 3] = [
+            b"".as_slice(),
+            b"test".as_slice(),
+            b"abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd",
+        ];
+        let mut key = [0; KEY_LEN];
+        let mut rng = rand::thread_rng();
+
+        let mut ctxt_left = [0; 64 + TAG_LEN];
+        let mut ctxt_right = [0; 64 + TAG_LEN];
+
+        let mut ptxt_left = [0; 64];
+        let mut ptxt_right = [0; 64];
+
+        let nonce = [0; NONCE_LEN];
+        let ad = b"";
+
+        for ptxt in ptxts {
+            for _ in 0..1000 {
+                rng.fill_bytes(&mut key);
+                let ctxt_left = &mut ctxt_left[..ptxt.len() + TAG_LEN];
+                let ctxt_right = &mut ctxt_right[..ptxt.len() + TAG_LEN];
+
+                let ptxt_left = &mut ptxt_left[..ptxt.len()];
+                let ptxt_right = &mut ptxt_right[..ptxt.len()];
+
+                encrypt(ctxt_left, &key, &nonce, ad, ptxt).unwrap();
+                ChaCha20Poly1305
+                    .encrypt(ctxt_right, &key, &nonce, ad, ptxt)
+                    .unwrap();
+
+                assert_eq!(ctxt_left, ctxt_right);
+
+                decrypt(ptxt_left, &key, &nonce, ad, ctxt_left).unwrap();
+                ChaCha20Poly1305
+                    .decrypt(ptxt_right, &key, &nonce, ad, ctxt_right)
+                    .unwrap();
+
+                assert_eq!(ptxt_left, ptxt);
+                assert_eq!(ptxt_right, ptxt);
+            }
+        }
+
+        // The old libcrux functions:
+
+        // The functions below are from the old libcrux backend. I am keeping them around so we can
+        // check if they behave the same.
+        use rosenpass_to::ops::copy_slice;
+        use rosenpass_to::To;
+        use zeroize::Zeroize;
+
+        /// Encrypts using ChaCha20Poly1305 as implemented in [libcrux](https://github.com/cryspen/libcrux).
+        /// Key and nonce MUST be chosen (pseudo-)randomly. The `key` slice MUST have a length of
+        /// [KEY_LEN]. The `nonce` slice MUST have a length of [NONCE_LEN]. The last [TAG_LEN] bytes
+        /// written in `ciphertext` are the tag guaranteeing integrity. `ciphertext` MUST have a capacity of
+        /// `plaintext.len()` + [TAG_LEN].
+        ///  
+        /// # Examples
+        ///```rust
+        /// # use rosenpass_ciphers::subtle::chacha20poly1305_ietf_libcrux::{encrypt, TAG_LEN, KEY_LEN, NONCE_LEN};
+        ///
+        /// const PLAINTEXT_LEN: usize = 43;
+        /// let plaintext = "post-quantum cryptography is very important".as_bytes();
+        /// assert_eq!(PLAINTEXT_LEN, plaintext.len());
+        /// let key: &[u8] = &[0u8; KEY_LEN]; // THIS IS NOT A SECURE KEY
+        /// let nonce: &[u8] = &[0u8; NONCE_LEN]; // THIS IS NOT A SECURE NONCE
+        /// let additional_data: &[u8] = "the encrypted message is very important".as_bytes();
+        /// let mut ciphertext_buffer = [0u8; PLAINTEXT_LEN + TAG_LEN];
+        ///
+        /// let res: anyhow::Result<()> = encrypt(&mut ciphertext_buffer, key, nonce, additional_data, plaintext);
+        /// assert!(res.is_ok());
+        /// # let expected_ciphertext: &[u8] = &[239, 104, 148, 202, 120, 32, 77, 27, 246, 206, 226, 17,
+        /// # 83, 78, 122, 116, 187, 123, 70, 199, 58, 130, 21, 1, 107, 230, 58, 77, 18, 152, 31, 159, 80,
+        /// # 151, 72, 27, 236, 137, 60, 55, 180, 31, 71, 97, 199, 12, 60, 155, 70, 221, 225, 110, 132, 191,
+        /// # 8, 114, 85, 4, 25];
+        /// # assert_eq!(expected_ciphertext, &ciphertext_buffer);
+        ///```
+        ///
+        #[inline]
+        pub fn encrypt(
+            ciphertext: &mut [u8],
+            key: &[u8],
+            nonce: &[u8],
+            ad: &[u8],
+            plaintext: &[u8],
+        ) -> anyhow::Result<()> {
+            let (ciphertext, mac) = ciphertext.split_at_mut(ciphertext.len() - TAG_LEN);
+
+            use libcrux::aead as C;
+            let crux_key = C::Key::Chacha20Poly1305(C::Chacha20Key(key.try_into().unwrap()));
+            let crux_iv = C::Iv(nonce.try_into().unwrap());
+
+            copy_slice(plaintext).to(ciphertext);
+            let crux_tag = libcrux::aead::encrypt(&crux_key, ciphertext, crux_iv, ad).unwrap();
+            copy_slice(crux_tag.as_ref()).to(mac);
+
+            match crux_key {
+                C::Key::Chacha20Poly1305(mut k) => k.0.zeroize(),
+                _ => panic!(),
+            }
+
+            Ok(())
+        }
+
+        /// Decrypts a `ciphertext` and verifies the integrity of the `ciphertext` and the additional data
+        /// `ad`. using ChaCha20Poly1305 as implemented in [libcrux](https://github.com/cryspen/libcrux).
+        ///
+        /// The `key` slice MUST have a length of [KEY_LEN]. The `nonce` slice MUST have a length of
+        /// [NONCE_LEN]. The plaintext buffer must have a capacity of `ciphertext.len()` - [TAG_LEN].
+        ///
+        /// # Examples
+        ///```rust
+        /// # use rosenpass_ciphers::subtle::chacha20poly1305_ietf_libcrux::{decrypt, TAG_LEN, KEY_LEN, NONCE_LEN};
+        /// let ciphertext: &[u8] = &[239, 104, 148, 202, 120, 32, 77, 27, 246, 206, 226, 17,
+        /// 83, 78, 122, 116, 187, 123, 70, 199, 58, 130, 21, 1, 107, 230, 58, 77, 18, 152, 31, 159, 80,
+        /// 151, 72, 27, 236, 137, 60, 55, 180, 31, 71, 97, 199, 12, 60, 155, 70, 221, 225, 110, 132, 191,
+        /// 8, 114, 85, 4, 25]; // this is the ciphertext generated by the example for the encryption
+        /// const PLAINTEXT_LEN: usize = 43;
+        /// assert_eq!(PLAINTEXT_LEN + TAG_LEN, ciphertext.len());
+        ///
+        /// let key: &[u8] = &[0u8; KEY_LEN]; // THIS IS NOT A SECURE KEY
+        /// let nonce: &[u8] = &[0u8; NONCE_LEN]; // THIS IS NOT A SECURE NONCE
+        /// let additional_data: &[u8] = "the encrypted message is very important".as_bytes();
+        /// let mut plaintext_buffer = [0u8; PLAINTEXT_LEN];
+        ///
+        /// let res: anyhow::Result<()> = decrypt(&mut plaintext_buffer, key, nonce, additional_data, ciphertext);
+        /// assert!(res.is_ok());
+        /// let expected_plaintext = "post-quantum cryptography is very important".as_bytes();
+        /// assert_eq!(expected_plaintext, plaintext_buffer);
+        ///
+        ///```
+        #[inline]
+        pub fn decrypt(
+            plaintext: &mut [u8],
+            key: &[u8],
+            nonce: &[u8],
+            ad: &[u8],
+            ciphertext: &[u8],
+        ) -> anyhow::Result<()> {
+            let (ciphertext, mac) = ciphertext.split_at(ciphertext.len() - TAG_LEN);
+
+            use libcrux::aead as C;
+            let crux_key = C::Key::Chacha20Poly1305(C::Chacha20Key(key.try_into().unwrap()));
+            let crux_iv = C::Iv(nonce.try_into().unwrap());
+            let crux_tag = C::Tag::from_slice(mac).unwrap();
+
+            copy_slice(ciphertext).to(plaintext);
+            libcrux::aead::decrypt(&crux_key, plaintext, crux_iv, ad, &crux_tag).unwrap();
+
+            match crux_key {
+                C::Key::Chacha20Poly1305(mut k) => k.0.zeroize(),
+                _ => panic!(),
+            }
+
+            Ok(())
+        }
+    }
+}

ciphers/src/subtle/libcrux/kyber512.rs

@@ -0,0 +1,133 @@
+//! Implementation of the [`KemKyber512`] trait based on the [`libcrux_ml_kem`] crate.
+
+use libcrux_ml_kem::kyber512;
+use rand::RngCore;
+
+use rosenpass_cipher_traits::algorithms::KemKyber512;
+use rosenpass_cipher_traits::primitives::{Kem, KemError};
+
+pub use rosenpass_cipher_traits::algorithms::kem_kyber512::{CT_LEN, PK_LEN, SHK_LEN, SK_LEN};
+
+/// An implementation of the Kyber512 KEM based on libcrux
+pub struct Kyber512;
+
+impl Kem<SK_LEN, PK_LEN, CT_LEN, SHK_LEN> for Kyber512 {
+    fn keygen(&self, sk: &mut [u8; SK_LEN], pk: &mut [u8; PK_LEN]) -> Result<(), KemError> {
+        let mut randomness = [0u8; libcrux_ml_kem::KEY_GENERATION_SEED_SIZE];
+        rand::thread_rng().fill_bytes(&mut randomness);
+
+        let key_pair = kyber512::generate_key_pair(randomness);
+
+        let new_sk: &[u8; SK_LEN] = key_pair.sk();
+        let new_pk: &[u8; PK_LEN] = key_pair.pk();
+
+        sk.clone_from_slice(new_sk);
+        pk.clone_from_slice(new_pk);
+
+        Ok(())
+    }
+
+    fn encaps(
+        &self,
+        shk: &mut [u8; SHK_LEN],
+        ct: &mut [u8; CT_LEN],
+        pk: &[u8; PK_LEN],
+    ) -> Result<(), KemError> {
+        let mut randomness = [0u8; libcrux_ml_kem::SHARED_SECRET_SIZE];
+        rand::thread_rng().fill_bytes(&mut randomness);
+
+        let (new_ct, new_shk) = kyber512::encapsulate(&pk.into(), randomness);
+        let new_ct: &[u8; CT_LEN] = new_ct.as_slice();
+
+        shk.clone_from_slice(&new_shk);
+        ct.clone_from_slice(new_ct);
+
+        Ok(())
+    }
+
+    fn decaps(
+        &self,
+        shk: &mut [u8; SHK_LEN],
+        sk: &[u8; SK_LEN],
+        ct: &[u8; CT_LEN],
+    ) -> Result<(), KemError> {
+        let new_shk: [u8; SHK_LEN] = kyber512::decapsulate(&sk.into(), &ct.into());
+        shk.clone_from(&new_shk);
+        Ok(())
+    }
+}
+
+impl Default for Kyber512 {
+    fn default() -> Self {
+        Self
+    }
+}
+
+impl KemKyber512 for Kyber512 {}
+
+#[cfg(test)]
+mod equivalence_tests {
+    use super::*;
+
+    // Test that libcrux and OQS produce the same results
+    #[test]
+    fn proptest_equivalence_libcrux_oqs() {
+        use rosenpass_oqs::Kyber512 as OqsKyber512;
+
+        let (mut sk1, mut pk1) = ([0; SK_LEN], [0; PK_LEN]);
+        let (mut sk2, mut pk2) = ([0; SK_LEN], [0; PK_LEN]);
+
+        let mut ct_left = [0; CT_LEN];
+        let mut ct_right = [0; CT_LEN];
+
+        let mut shk_enc_left = [0; SHK_LEN];
+        let mut shk_enc_right = [0; SHK_LEN];
+
+        // naming schema: shk_dec_{encapsing lib}_{decapsing lib}
+        // should be the same if the encapsing lib was the same.
+        let mut shk_dec_left_left = [0; SHK_LEN];
+        let mut shk_dec_left_right = [0; SHK_LEN];
+        let mut shk_dec_right_left = [0; SHK_LEN];
+        let mut shk_dec_right_right = [0; SHK_LEN];
+
+        for _ in 0..1000 {
+            let sk1 = &mut sk1;
+            let pk1 = &mut pk1;
+            let sk2 = &mut sk2;
+            let pk2 = &mut pk2;
+
+            let ct_left = &mut ct_left;
+            let ct_right = &mut ct_right;
+
+            let shk_enc_left = &mut shk_enc_left;
+            let shk_enc_right = &mut shk_enc_right;
+
+            let shk_dec_left_left = &mut shk_dec_left_left;
+            let shk_dec_left_right = &mut shk_dec_left_right;
+            let shk_dec_right_left = &mut shk_dec_right_left;
+            let shk_dec_right_right = &mut shk_dec_right_right;
+
+            Kyber512.keygen(sk1, pk1).unwrap();
+            Kyber512.keygen(sk2, pk2).unwrap();
+
+            Kyber512.encaps(shk_enc_left, ct_left, pk2).unwrap();
+            OqsKyber512.encaps(shk_enc_right, ct_right, pk2).unwrap();
+
+            Kyber512.decaps(shk_dec_left_left, sk2, ct_left).unwrap();
+            Kyber512.decaps(shk_dec_right_left, sk2, ct_right).unwrap();
+
+            OqsKyber512
+                .decaps(shk_dec_left_right, sk2, ct_left)
+                .unwrap();
+            OqsKyber512
+                .decaps(shk_dec_right_right, sk2, ct_right)
+                .unwrap();
+
+            assert_eq!(shk_enc_left, shk_dec_left_left);
+            assert_eq!(shk_enc_left, shk_dec_left_right);
+
+            assert_eq!(shk_enc_right, shk_dec_right_left);
+            assert_eq!(shk_enc_right, shk_dec_right_right);
+        }
+    }
+}

ciphers/src/subtle/libcrux/mod.rs

@@ -0,0 +1,14 @@
+//! Implementations backed by libcrux, a verified crypto library.
+//!
+//! [Website](https://cryspen.com/libcrux/)
+//!
+//! [Github](https://github.com/cryspen/libcrux)
+
+#[cfg(feature = "experiment_libcrux_define_blake2")]
+pub mod blake2b;
+
+#[cfg(feature = "experiment_libcrux_define_chachapoly")]
+pub mod chacha20poly1305_ietf;
+
+#[cfg(feature = "experiment_libcrux_define_kyber")]
+pub mod kyber512;

ciphers/src/subtle/mod.rs

@@ -1,13 +1,16 @@
-/// This module provides the following cryptographic schemes:
-/// - [blake2b]: The blake2b hash function
-/// - [chacha20poly1305_ietf]: The Chacha20Poly1305 AEAD as implemented in [RustCrypto](https://crates.io/crates/chacha20poly1305) (only used when the feature `experiment_libcrux` is disabled).
-/// - [chacha20poly1305_ietf_libcrux]: The Chacha20Poly1305 AEAD as implemented in [libcrux](https://github.com/cryspen/libcrux) (only used when the feature `experiment_libcrux` is enabled).
-/// - [incorrect_hmac_blake2b]: An (incorrect) hmac based on [blake2b].
-/// - [xchacha20poly1305_ietf] The Chacha20Poly1305 AEAD as implemented in [RustCrypto](https://crates.io/crates/chacha20poly1305)
-pub mod blake2b;
-#[cfg(not(feature = "experiment_libcrux"))]
-pub mod chacha20poly1305_ietf;
-#[cfg(feature = "experiment_libcrux")]
-pub mod chacha20poly1305_ietf_libcrux;
-pub mod incorrect_hmac_blake2b;
-pub mod xchacha20poly1305_ietf;
+//! Contains the implementations of the crypto algorithms used throughout Rosenpass.
+
+pub mod keyed_hash;
+
+pub use custom::incorrect_hmac_blake2b;
+pub use rust_crypto::{blake2b, keyed_shake256};
+
+pub mod custom;
+pub mod rust_crypto;
+
+#[cfg(any(
+    feature = "experiment_libcrux_define_blake2",
+    feature = "experiment_libcrux_define_chachapoly",
+    feature = "experiment_libcrux_define_kyber",
+))]
+pub mod libcrux;

ciphers/src/subtle/rust_crypto/blake2b.rs

@@ -0,0 +1,44 @@
+use zeroize::Zeroizing;
+
+use blake2::digest::crypto_common::generic_array::GenericArray;
+use blake2::digest::crypto_common::typenum::U32;
+use blake2::digest::{FixedOutput, Mac};
+use blake2::Blake2bMac;
+
+use rosenpass_cipher_traits::primitives::KeyedHash;
+use rosenpass_to::{ops::copy_slice, To};
+
+pub use rosenpass_cipher_traits::algorithms::keyed_hash_blake2b::{HASH_LEN, KEY_LEN};
+
+/// Specify that the used implementation of BLAKE2b is the MAC version of BLAKE2b
+/// with output and key length of 32 bytes (see [Blake2bMac]).
+type Impl = Blake2bMac<U32>;
+
+/// Hashes the given `data` with the [Blake2bMac] hash function under the given `key`.
+/// The both the length of the output the length of the key 32 bytes (or 256 bits).  
+pub struct Blake2b;
+
+impl KeyedHash<KEY_LEN, HASH_LEN> for Blake2b {
+    type Error = anyhow::Error;
+
+    fn keyed_hash(
+        key: &[u8; KEY_LEN],
+        data: &[u8],
+        out: &mut [u8; HASH_LEN],
+    ) -> Result<(), Self::Error> {
+        let mut h = Impl::new_from_slice(key)?;
+        h.update(data);
+
+        // Jesus christ, blake2 crate, your usage of GenericArray might be nice and fancy,
+        // but it introduces a ton of complexity. This cost me half an hour just to figure
+        // out the right way to use the imports while allowing for zeroization.
+        // An API based on slices might actually be simpler.
+        let mut tmp = Zeroizing::new([0u8; HASH_LEN]);
+        let tmp = GenericArray::from_mut_slice(tmp.as_mut());
+        h.finalize_into(tmp);
+        copy_slice(tmp.as_ref()).to(out);
+        Ok(())
+    }
+}
+
+impl rosenpass_cipher_traits::algorithms::KeyedHashBlake2b for Blake2b {}

ciphers/src/subtle/rust_crypto/chacha20poly1305_ietf.rs

@@ -0,0 +1,79 @@
+use rosenpass_to::ops::copy_slice;
+use rosenpass_to::To;
+
+use rosenpass_cipher_traits::algorithms::AeadChaCha20Poly1305;
+use rosenpass_cipher_traits::primitives::{Aead, AeadError};
+
+use chacha20poly1305::aead::generic_array::GenericArray;
+use chacha20poly1305::ChaCha20Poly1305 as AeadImpl;
+use chacha20poly1305::{AeadInPlace, KeyInit};
+
+pub use rosenpass_cipher_traits::algorithms::aead_chacha20poly1305::{KEY_LEN, NONCE_LEN, TAG_LEN};
+
+/// Implements the [`Aead`] and [`AeadChaCha20Poly1305`] traits backed by the RustCrypto
+/// implementation.
+pub struct ChaCha20Poly1305;
+
+impl Aead<KEY_LEN, NONCE_LEN, TAG_LEN> for ChaCha20Poly1305 {
+    fn encrypt(
+        &self,
+        ciphertext: &mut [u8],
+        key: &[u8; KEY_LEN],
+        nonce: &[u8; NONCE_LEN],
+        ad: &[u8],
+        plaintext: &[u8],
+    ) -> Result<(), AeadError> {
+        // The comparison looks complicated, but we need to do it this way to prevent
+        // over/underflows.
+        if ciphertext.len() < TAG_LEN || ciphertext.len() - TAG_LEN < plaintext.len() {
+            return Err(AeadError::InvalidLengths);
+        }
+
+        let nonce = GenericArray::from_slice(nonce);
+        let (ct, mac) = ciphertext.split_at_mut(ciphertext.len() - TAG_LEN);
+        copy_slice(plaintext).to(ct);
+
+        // This only fails if the length is wrong, which really shouldn't happen and would
+        // constitute an internal error.
+        let encrypter = AeadImpl::new_from_slice(key).map_err(|_| AeadError::InternalError)?;
+
+        let mac_value = encrypter
+            .encrypt_in_place_detached(nonce, ad, ct)
+            .map_err(|_| AeadError::InternalError)?;
+        copy_slice(&mac_value[..]).to(mac);
+
+        Ok(())
+    }
+
+    fn decrypt(
+        &self,
+        plaintext: &mut [u8],
+        key: &[u8; KEY_LEN],
+        nonce: &[u8; NONCE_LEN],
+        ad: &[u8],
+        ciphertext: &[u8],
+    ) -> Result<(), AeadError> {
+        // The comparison looks complicated, but we need to do it this way to prevent
+        // over/underflows.
+        if ciphertext.len() < TAG_LEN || ciphertext.len() - TAG_LEN < plaintext.len() {
+            return Err(AeadError::InvalidLengths);
+        }
+
+        let nonce = GenericArray::from_slice(nonce);
+        let (ct, mac) = ciphertext.split_at(ciphertext.len() - TAG_LEN);
+        let tag = GenericArray::from_slice(mac);
+        copy_slice(ct).to(plaintext);
+
+        // This only fails if the length is wrong, which really shouldn't happen and would
+        // constitute an internal error.
+        let decrypter = AeadImpl::new_from_slice(key).map_err(|_| AeadError::InternalError)?;
+
+        decrypter
+            .decrypt_in_place_detached(nonce, ad, plaintext, tag)
+            .map_err(|_| AeadError::DecryptError)?;
+
+        Ok(())
+    }
+}
+
+impl AeadChaCha20Poly1305 for ChaCha20Poly1305 {}

ciphers/src/subtle/rust_crypto/keyed_shake256.rs

@@ -0,0 +1,117 @@
+use anyhow::ensure;
+use rosenpass_cipher_traits::primitives::{InferKeyedHash, KeyedHash};
+use sha3::digest::{ExtendableOutput, Update, XofReader};
+use sha3::Shake256;
+
+pub use rosenpass_cipher_traits::algorithms::keyed_hash_shake256::{HASH_LEN, KEY_LEN};
+
+/// An implementation of the [`KeyedHash`] trait backed by the RustCrypto implementation of SHAKE256.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SHAKE256Core<const KEY_LEN: usize, const HASH_LEN: usize>;
+
+impl<const KEY_LEN: usize, const HASH_LEN: usize> KeyedHash<KEY_LEN, HASH_LEN>
+    for SHAKE256Core<KEY_LEN, HASH_LEN>
+{
+    type Error = anyhow::Error;
+
+    /// Provides a keyed hash function based on SHAKE256. To work for the protocol, the output length
+    /// and key length are fixed to 32 bytes (also see [KEY_LEN] and [HASH_LEN]).
+    ///
+    /// Note that the SHAKE256 is designed for 64 bytes output length, which we truncate to 32 bytes
+    /// to work well with the overall protocol. Referring to Table 4 of FIPS 202, this offers the
+    /// same collision resistance as SHAKE128, but 256 bits of preimage resistance. We therefore
+    /// prefer a truncated SHAKE256 over SHAKE128.
+    ///
+    /// #Examples
+    /// ```rust
+    /// # use rosenpass_ciphers::subtle::rust_crypto::keyed_shake256::SHAKE256Core;
+    /// use rosenpass_cipher_traits::primitives::KeyedHash;
+    /// const KEY_LEN: usize = 32;
+    /// const HASH_LEN: usize = 32;
+    /// let key: [u8; 32] = [0; KEY_LEN];
+    /// let data: [u8; 32] = [255; 32]; // arbitrary data, could also be longer
+    /// // buffer for the hash output
+    /// let mut hash_data: [u8; 32] = [0u8; HASH_LEN];
+    ///
+    /// assert!(SHAKE256Core::<32, 32>::keyed_hash(&key, &data, &mut hash_data).is_ok(), "Hashing has to return OK result");
+    /// # let expected_hash: &[u8] = &[174, 4, 47, 188, 1, 228, 179, 246, 67, 43, 255, 94, 155, 11,
+    /// 187, 161, 38, 110, 217, 23, 4, 62, 172, 30, 218, 187, 249, 80, 171, 21, 145, 238];
+    /// # assert_eq!(hash_data, expected_hash);
+    /// ```
+    fn keyed_hash(
+        key: &[u8; KEY_LEN],
+        data: &[u8],
+        out: &mut [u8; HASH_LEN],
+    ) -> Result<(), Self::Error> {
+        // Since SHAKE256 is a XOF, we fix the output length manually to what is required for the
+        // protocol.
+        ensure!(out.len() == HASH_LEN);
+        // Not bothering with padding; the implementation
+        // uses appropriately sized keys.
+        ensure!(key.len() == KEY_LEN);
+        let mut shake256 = Shake256::default();
+        shake256.update(key);
+        shake256.update(data);
+
+        // Since we use domain separation extensively, related outputs of the truncated XOF
+        // are not a concern. This follows the NIST recommendations in Section A.2 of the FIPS 202
+        // standard, (pages 24/25, i.e., 32/33 in the PDF).
+        shake256.finalize_xof().read(out);
+        Ok(())
+    }
+}
+
+impl<const KEY_LEN: usize, const HASH_LEN: usize> SHAKE256Core<KEY_LEN, HASH_LEN> {
+    pub fn new() -> Self {
+        Self
+    }
+}
+
+impl<const KEY_LEN: usize, const HASH_LEN: usize> Default for SHAKE256Core<KEY_LEN, HASH_LEN> {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+/// This type provides the same functionality as [SHAKE256Core], but bound to an instance.
+/// In contrast to [SHAKE256Core], this allows for type interference and thus allows the user of the
+/// type to omit explicit type parameters when instantiating the type or using it.
+///
+/// The instantiation is based on the [InferKeyedHash] trait.
+///
+/// ```rust
+/// # use rosenpass_ciphers::subtle::rust_crypto::keyed_shake256::{SHAKE256};
+/// use rosenpass_cipher_traits::primitives::KeyedHashInstance;
+/// const KEY_LEN: usize = 32;
+/// const HASH_LEN: usize = 32;
+/// let key: [u8; KEY_LEN] = [0; KEY_LEN];
+/// let data: [u8; 32] = [255; 32]; // arbitrary data, could also be longer
+/// // buffer for the hash output
+/// let mut hash_data: [u8; 32] = [0u8; HASH_LEN];
+/// assert!(SHAKE256::new().keyed_hash(&key, &data, &mut hash_data).is_ok(), "Hashing has to return OK result");
+/// # let expected_hash: &[u8] = &[174, 4, 47, 188, 1, 228, 179, 246, 67, 43, 255, 94, 155, 11, 187,
+/// 161, 38, 110, 217, 23, 4, 62, 172, 30, 218, 187, 249, 80, 171, 21, 145, 238];
+/// # assert_eq!(hash_data, expected_hash);
+/// ```
+pub type SHAKE256<const KEY_LEN: usize, const HASH_LEN: usize> =
+    InferKeyedHash<SHAKE256Core<KEY_LEN, HASH_LEN>, KEY_LEN, HASH_LEN>;
+
+/// The SHAKE256_32 type is a specific instance of the [SHAKE256] type with the key length and hash
+/// length fixed to 32 bytes.
+///
+/// ```rust
+/// # use rosenpass_ciphers::subtle::keyed_shake256::{SHAKE256_32};
+/// use rosenpass_cipher_traits::primitives::KeyedHashInstance;
+/// const KEY_LEN: usize = 32;
+/// const HASH_LEN: usize = 32;
+/// let key: [u8; 32] = [0; KEY_LEN];
+/// let data: [u8; 32] = [255; 32]; // arbitrary data, could also be longer
+/// // buffer for the hash output
+/// let mut hash_data: [u8; 32] = [0u8; HASH_LEN];
+///
+/// assert!(SHAKE256_32::new().keyed_hash(&key, &data, &mut hash_data).is_ok(), "Hashing has to return OK result");
+/// # let expected_hash: &[u8] = &[174, 4, 47, 188, 1, 228, 179, 246, 67, 43, 255, 94, 155, 11, 187,
+/// 161, 38, 110, 217, 23, 4, 62, 172, 30, 218, 187, 249, 80, 171, 21, 145, 238];
+/// # assert_eq!(hash_data, expected_hash);
+/// ```
+pub type SHAKE256_32 = SHAKE256<32, 32>;

ciphers/src/subtle/rust_crypto/mod.rs

@@ -0,0 +1,7 @@
+//! Implementations backed by RustCrypto
+
+pub mod blake2b;
+pub mod keyed_shake256;
+
+pub mod chacha20poly1305_ietf;
+pub mod xchacha20poly1305_ietf;

ciphers/src/subtle/rust_crypto/xchacha20poly1305_ietf.rs

@@ -1,17 +1,82 @@
 use rosenpass_to::ops::copy_slice;
 use rosenpass_to::To;
-use rosenpass_util::typenum2const;
+
+use rosenpass_cipher_traits::algorithms::aead_xchacha20poly1305::AeadXChaCha20Poly1305;
+use rosenpass_cipher_traits::primitives::{Aead, AeadError, AeadWithNonceInCiphertext};
 
 use chacha20poly1305::aead::generic_array::GenericArray;
 use chacha20poly1305::XChaCha20Poly1305 as AeadImpl;
-use chacha20poly1305::{AeadCore, AeadInPlace, KeyInit, KeySizeUser};
+use chacha20poly1305::{AeadInPlace, KeyInit};
 
-/// The key length is 32 bytes or 256 bits.
-pub const KEY_LEN: usize = typenum2const! { <AeadImpl as KeySizeUser>::KeySize };
-/// The  MAC tag length is 16 bytes or 128 bits.
-pub const TAG_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::TagSize };
-/// The nonce length is 24 bytes or 192 bits.
-pub const NONCE_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::NonceSize };
+pub use rosenpass_cipher_traits::algorithms::aead_xchacha20poly1305::{
+    KEY_LEN, NONCE_LEN, TAG_LEN,
+};
+/// Implements the [`Aead`] and [`AeadXChaCha20Poly1305`] traits backed by the RustCrypto
+/// implementation.
+pub struct XChaCha20Poly1305;
+
+impl Aead<KEY_LEN, NONCE_LEN, TAG_LEN> for XChaCha20Poly1305 {
+    fn encrypt(
+        &self,
+        ciphertext: &mut [u8],
+        key: &[u8; KEY_LEN],
+        nonce: &[u8; NONCE_LEN],
+        ad: &[u8],
+        plaintext: &[u8],
+    ) -> Result<(), AeadError> {
+        // The comparison looks complicated, but we need to do it this way to prevent
+        // over/underflows.
+        if ciphertext.len() < TAG_LEN || ciphertext.len() - TAG_LEN < plaintext.len() {
+            return Err(AeadError::InvalidLengths);
+        }
+
+        let (ct, mac) = ciphertext.split_at_mut(ciphertext.len() - TAG_LEN);
+        copy_slice(plaintext).to(ct);
+
+        let nonce = GenericArray::from_slice(nonce);
+
+        // This only fails if the length is wrong, which really shouldn't happen and would
+        // constitute an internal error.
+        let encrypter = AeadImpl::new_from_slice(key).map_err(|_| AeadError::InternalError)?;
+
+        let mac_value = encrypter
+            .encrypt_in_place_detached(nonce, ad, ct)
+            .map_err(|_| AeadError::InternalError)?;
+        copy_slice(&mac_value[..]).to(mac);
+        Ok(())
+    }
+
+    fn decrypt(
+        &self,
+        plaintext: &mut [u8],
+        key: &[u8; KEY_LEN],
+        nonce: &[u8; NONCE_LEN],
+        ad: &[u8],
+        ciphertext: &[u8],
+    ) -> Result<(), AeadError> {
+        // The comparison looks complicated, but we need to do it this way to prevent
+        // over/underflows.
+        if ciphertext.len() < TAG_LEN || ciphertext.len() - TAG_LEN < plaintext.len() {
+            return Err(AeadError::InvalidLengths);
+        }
+
+        let (ct, mac) = ciphertext.split_at(ciphertext.len() - TAG_LEN);
+        let nonce = GenericArray::from_slice(nonce);
+        let tag = GenericArray::from_slice(mac);
+        copy_slice(ct).to(plaintext);
+
+        // This only fails if the length is wrong, which really shouldn't happen and would
+        // constitute an internal error.
+        let decrypter = AeadImpl::new_from_slice(key).map_err(|_| AeadError::InternalError)?;
+
+        decrypter
+            .decrypt_in_place_detached(nonce, ad, plaintext, tag)
+            .map_err(|_| AeadError::DecryptError)?;
+        Ok(())
+    }
+}
+
+impl AeadXChaCha20Poly1305 for XChaCha20Poly1305 {}
 
 /// Encrypts using XChaCha20Poly1305 as implemented in [RustCrypto](https://github.com/RustCrypto/AEADs/tree/master/chacha20poly1305).
 /// `key` and `nonce` MUST be chosen (pseudo-)randomly. The `key` slice MUST have a length of
@@ -23,12 +88,12 @@ pub const NONCE_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::NonceSize
 ///
 /// # Examples
 ///```rust
-/// # use rosenpass_ciphers::subtle::xchacha20poly1305_ietf::{encrypt, TAG_LEN, KEY_LEN, NONCE_LEN};
+/// # use rosenpass_ciphers::subtle::rust_crypto::xchacha20poly1305_ietf::{encrypt, TAG_LEN, KEY_LEN, NONCE_LEN};
 /// const PLAINTEXT_LEN: usize = 43;
 /// let plaintext = "post-quantum cryptography is very important".as_bytes();
 /// assert_eq!(PLAINTEXT_LEN, plaintext.len());
-/// let key: &[u8] = &[0u8; KEY_LEN]; // THIS IS NOT A SECURE KEY
-/// let nonce: &[u8] = &[0u8; NONCE_LEN]; // THIS IS NOT A SECURE NONCE
+/// let key: &[u8; KEY_LEN] = &[0u8; KEY_LEN]; // THIS IS NOT A SECURE KEY
+/// let nonce: &[u8; NONCE_LEN] = &[0u8; NONCE_LEN]; // THIS IS NOT A SECURE NONCE
 /// let additional_data: &[u8] = "the encrypted message is very important".as_bytes();
 /// let mut ciphertext_buffer = [0u8; NONCE_LEN + PLAINTEXT_LEN + TAG_LEN];
 ///
@@ -44,19 +109,14 @@ pub const NONCE_LEN: usize = typenum2const! { <AeadImpl as AeadCore>::NonceSize
 #[inline]
 pub fn encrypt(
     ciphertext: &mut [u8],
-    key: &[u8],
-    nonce: &[u8],
+    key: &[u8; KEY_LEN],
+    nonce: &[u8; NONCE_LEN],
     ad: &[u8],
     plaintext: &[u8],
 ) -> anyhow::Result<()> {
-    let nonce = GenericArray::from_slice(nonce);
-    let (n, ct_mac) = ciphertext.split_at_mut(NONCE_LEN);
-    let (ct, mac) = ct_mac.split_at_mut(ct_mac.len() - TAG_LEN);
-    copy_slice(nonce).to(n);
-    copy_slice(plaintext).to(ct);
-    let mac_value = AeadImpl::new_from_slice(key)?.encrypt_in_place_detached(nonce, ad, ct)?;
-    copy_slice(&mac_value[..]).to(mac);
-    Ok(())
+    XChaCha20Poly1305
+        .encrypt_with_nonce_in_ctxt(ciphertext, key, nonce, ad, plaintext)
+        .map_err(anyhow::Error::from)
 }
 
 /// Decrypts a `ciphertext` and verifies the integrity of the `ciphertext` and the additional data
@@ -71,7 +131,7 @@ pub fn encrypt(
 ///
 /// # Examples
 ///```rust
-/// # use rosenpass_ciphers::subtle::xchacha20poly1305_ietf::{decrypt, TAG_LEN, KEY_LEN, NONCE_LEN};
+/// # use rosenpass_ciphers::subtle::rust_crypto::xchacha20poly1305_ietf::{decrypt, TAG_LEN, KEY_LEN, NONCE_LEN};
 /// let ciphertext: &[u8] = &[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 /// # 0, 0, 0, 0, 8, 241, 229, 253, 200, 81, 248, 30, 183, 149, 134, 168, 149, 87, 109, 49, 159, 108,
 /// # 206, 89, 51, 232, 232, 197, 163, 253, 254, 208, 73, 76, 253, 13, 247, 162, 133, 184, 177, 44,
@@ -80,8 +140,8 @@ pub fn encrypt(
 /// const PLAINTEXT_LEN: usize = 43;
 /// assert_eq!(PLAINTEXT_LEN + TAG_LEN + NONCE_LEN, ciphertext.len());
 ///
-/// let key: &[u8] = &[0u8; KEY_LEN]; // THIS IS NOT A SECURE KEY
-/// let nonce: &[u8] = &[0u8; NONCE_LEN]; // THIS IS NOT A SECURE NONCE
+/// let key: &[u8; KEY_LEN] = &[0u8; KEY_LEN]; // THIS IS NOT A SECURE KEY
+/// let nonce: &[u8; NONCE_LEN] = &[0u8; NONCE_LEN]; // THIS IS NOT A SECURE NONCE
 /// let additional_data: &[u8] = "the encrypted message is very important".as_bytes();
 /// let mut plaintext_buffer = [0u8; PLAINTEXT_LEN];
 ///
@@ -94,15 +154,11 @@ pub fn encrypt(
 #[inline]
 pub fn decrypt(
     plaintext: &mut [u8],
-    key: &[u8],
+    key: &[u8; KEY_LEN],
     ad: &[u8],
     ciphertext: &[u8],
 ) -> anyhow::Result<()> {
-    let (n, ct_mac) = ciphertext.split_at(NONCE_LEN);
-    let (ct, mac) = ct_mac.split_at(ct_mac.len() - TAG_LEN);
-    let nonce = GenericArray::from_slice(n);
-    let tag = GenericArray::from_slice(mac);
-    copy_slice(ct).to(plaintext);
-    AeadImpl::new_from_slice(key)?.decrypt_in_place_detached(nonce, ad, plaintext, tag)?;
-    Ok(())
+    XChaCha20Poly1305
+        .decrypt_with_nonce_in_ctxt(plaintext, key, ad, ciphertext)
+        .map_err(anyhow::Error::from)
 }

constant-time/Cargo.toml

@@ -8,6 +8,7 @@ description = "Rosenpass internal utilities for constant time crypto implementat
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77.0"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -19,7 +20,7 @@ rosenpass-to = { workspace = true }
 memsec = { workspace = true }
 
 [dev-dependencies]
-rand = "0.8.5"
+rand = { workspace = true }
 
 [lints.rust]
 unexpected_cfgs = { level = "allow", check-cfg = ['cfg(coverage)'] }

constant-time/src/memcmp.rs

@@ -32,8 +32,11 @@ pub fn memcmp(a: &[u8], b: &[u8]) -> bool {
 /// For discussion on how to (further) ensure the constant-time execution of this function,
 /// see <https://github.com/rosenpass/rosenpass/issues/232>
 #[cfg(all(test, feature = "constant_time_tests"))]
+// Stopgap measure against https://github.com/rosenpass/rosenpass/issues/634
+#[cfg(not(all(target_os = "macos", target_arch = "aarch64")))]
 mod tests {
     use super::*;
+    use core::hint::black_box;
     use rand::seq::SliceRandom;
     use rand::thread_rng;
     use std::time::Instant;
@@ -50,14 +53,12 @@ mod tests {
     fn memcmp_runs_in_constant_time() {
         // prepare data to compare
         let n: usize = 1E6 as usize; // number of comparisons to run
-        let len = 1024; // length of each slice passed as parameters to the tested comparison function
-        let a1 = "a".repeat(len);
-        let a2 = a1.clone();
-        let b = "b".repeat(len);
+        const LEN: usize = 1024; // length of each slice passed as parameters to the tested comparison function
 
-        let a1 = a1.as_bytes();
-        let a2 = a2.as_bytes();
-        let b = b.as_bytes();
+        let a = [b'a'; LEN];
+        let b = [b'b'; LEN];
+
+        let mut tmp = [0u8; LEN];
 
         // vector representing all timing tests
         //
@@ -71,12 +72,14 @@ mod tests {
 
         // run comparisons / call function to test
         for test in tests.iter_mut() {
+            let src = match test.0 {
+                true => a,
+                false => b,
+            };
+            tmp.copy_from_slice(&src);
+
             let now = Instant::now();
-            if test.0 {
-                memcmp(a1, a2);
-            } else {
-                memcmp(a1, b);
-            }
+            memcmp(black_box(&a), black_box(&tmp));
             test.1 = now.elapsed();
             // println!("eq: {}, elapsed: {:.2?}", test.0, test.1);
         }
@@ -117,6 +120,6 @@ mod tests {
         assert!(
             correlation.abs() < 0.01,
             "execution time correlates with result"
-        );
+        )
     }
 }

deny.toml

@@ -0,0 +1,121 @@
+# The graph table configures how the dependency graph is constructed and thus
+# which crates the checks are performed against
+[graph]
+# If true, metadata will be collected with `--all-features`. Note that this can't
+# be toggled off if true, if you want to conditionally enable `--all-features` it
+# is recommended to pass `--all-features` on the cmd line instead
+all-features = true
+# If true, metadata will be collected with `--no-default-features`. The same
+# caveat with `all-features` applies
+no-default-features = false
+
+# The output table provides options for how/if diagnostics are outputted
+[output]
+# When outputting inclusion graphs in diagnostics that include features, this
+# option can be used to specify the depth at which feature edges will be added.
+# This option is included since the graphs can be quite large and the addition
+# of features from the crate(s) to all of the graph roots can be far too verbose.
+# This option can be overridden via `--feature-depth` on the cmd line
+feature-depth = 1
+
+# This section is considered when running `cargo deny check advisories`
+# More documentation for the advisories section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
+[advisories]
+# A list of advisory IDs to ignore. Note that ignored advisories will still
+# output a note when they are encountered.
+ignore = ["RUSTSEC-2024-0370", "RUSTSEC-2024-0436", "RUSTSEC-2023-0089"]
+# If this is true, then cargo deny will use the git executable to fetch advisory database.
+# If this is false, then it uses a built-in git library.
+# Setting this to true can be helpful if you have special authentication requirements that cargo-deny does not support.
+# See Git Authentication for more information about setting up git authentication.
+#git-fetch-with-cli = true
+
+# This section is considered when running `cargo deny check #licenses`
+# More documentation for the licenses section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
+[licenses]
+# List of explicitly allowed licenses
+# See https://spdx.org/licenses/ for list of possible licenses
+# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
+allow = [
+  "MIT",
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-3-Clause",
+  "ISC",
+]
+# The confidence threshold for detecting a license from license text.
+# The higher the value, the more closely the license text must be to the
+# canonical license text of a valid SPDX license file.
+# [possible values: any between 0.0 and 1.0].
+confidence-threshold = 0.8
+# Allow 1 or more licenses on a per-crate basis, so that particular licenses
+# aren't accepted for every possible crate as with the normal allow list
+exceptions = [
+  # Each entry is the crate and version constraint, and its specific allow
+  # list
+  { allow = ["Unicode-DFS-2016", "Unicode-3.0"], crate = "unicode-ident" },
+  { allow = ["NCSA"], crate = "libfuzzer-sys" },
+
+]
+
+[licenses.private]
+# If true, ignores workspace crates that aren't published, or are only
+# published to private registries.
+# To see how to mark a crate as unpublished (to the official registry),
+# visit https://doc.rust-lang.org/cargo/reference/manifest.html#the-publish-field.
+ignore = true
+
+# This section is considered when running `cargo deny check bans`.
+# More documentation about the 'bans' section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
+[bans]
+# Lint level for when multiple versions of the same crate are detected
+multiple-versions = "warn"
+# Lint level for when a crate version requirement is `*`
+wildcards = "allow"
+# The graph highlighting used when creating dotgraphs for crates
+# with multiple versions
+# * lowest-version - The path to the lowest versioned duplicate is highlighted
+# * simplest-path - The path to the version with the fewest edges is highlighted
+# * all - Both lowest-version and simplest-path are used
+highlight = "all"
+# The default lint level for `default` features for crates that are members of
+# the workspace that is being checked. This can be overridden by allowing/denying
+# `default` on a crate-by-crate basis if desired.
+workspace-default-features = "allow"
+# The default lint level for `default` features for external crates that are not
+# members of the workspace. This can be overridden by allowing/denying `default`
+# on a crate-by-crate basis if desired.
+external-default-features = "allow"
+# List of crates that are allowed. Use with care!
+allow = []
+# List of crates to deny
+deny = []
+
+skip-tree = []
+
+# This section is considered when running `cargo deny check sources`.
+# More documentation about the 'sources' section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
+[sources]
+# Lint level for what to happen when a crate from a crate registry that is not
+# in the allow list is encountered
+unknown-registry = "warn"
+# Lint level for what to happen when a crate from a git repository that is not
+# in the allow list is encountered
+unknown-git = "warn"
+# List of URLs for allowed crate registries. Defaults to the crates.io index
+# if not specified. If it is specified but empty, no registries are allowed.
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+# List of URLs for allowed Git repositories
+allow-git = ["git+https://github.com/rosenpass/memsec.git?branch=master"]
+
+[sources.allow-org]
+# github.com organizations to allow git sources for
+github = []
+# gitlab.com organizations to allow git sources for
+gitlab = []
+# bitbucket.org organizations to allow git sources for
+bitbucket = []

docker/Dockerfile

@@ -0,0 +1,45 @@
+# syntax=docker/dockerfile:1
+
+ARG BASE_IMAGE=debian:bookworm-slim
+
+# Stage 1: Base image with cargo-chef installed
+FROM rust:latest AS chef
+RUN cargo install cargo-chef
+# install software required for liboqs-rust
+RUN apt-get update && apt-get install -y clang cmake && rm -rf /var/lib/apt/lists/*
+
+# Stage 2: Prepare the cargo-chef recipe
+FROM chef AS planner
+WORKDIR /app
+COPY . .
+RUN cargo chef prepare --recipe-path recipe.json
+
+# Stage 3: Cache dependencies using the recipe
+FROM chef AS cacher
+WORKDIR /app
+COPY --from=planner /app/recipe.json recipe.json
+RUN cargo chef cook --release --recipe-path recipe.json
+
+# Stage 4: Build the application
+FROM cacher AS builder
+WORKDIR /app
+COPY . .
+RUN cargo build --release
+
+# Stage 5: Install runtime-dependencies in the base image
+FROM ${BASE_IMAGE} AS base_image_with_dependencies
+
+RUN apt-get update && apt-get install -y iproute2 && rm -rf /var/lib/apt/lists/*
+
+# Final Stage (rosenpass): Copy the rosenpass binary
+FROM base_image_with_dependencies AS rosenpass
+COPY --from=builder /app/target/release/rosenpass /usr/local/bin/rosenpass
+ENTRYPOINT [ "/usr/local/bin/rosenpass" ]
+
+# Final Stage (rp): Copy the rp binary
+FROM base_image_with_dependencies AS rp
+
+RUN apt-get update && apt-get install -y wireguard && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /app/target/release/rp /usr/local/bin/rp
+ENTRYPOINT [ "/usr/local/bin/rp" ]

docker/USAGE.md

@@ -0,0 +1,203 @@
+# Rosenpass in Docker
+
+Rosenpass provides post-quantum-secure key exchange for VPNs. It generates symmetric keys used by [WireGuard](https://www.wireguard.com/papers/wireguard.pdf) or other applications. The protocol enhances "Post-Quantum WireGuard" ([PQWG](https://eprint.iacr.org/2020/379)) with a cookie mechanism for better security against state disruption attacks.
+
+Prebuilt Docker images are available for easy deployment:
+
+- [`ghcr.io/rosenpass/rosenpass`](https://github.com/rosenpass/rosenpass/pkgs/container/rosenpass) – the core key exchange tool
+- [`ghcr.io/rosenpass/rp`](https://github.com/rosenpass/rosenpass/pkgs/container/rp) – a frontend for setting up WireGuard VPNs
+
+The entrypoint of the `rosenpass` image is the `rosenpass` executable, whose documentation can be found [here](https://rosenpass.eu/docs/rosenpass-tool/manuals/rp_manual/).  
+Similarly, the entrypoint of the `rp` image is the `rp` executable, with its documentation available [here](https://rosenpass.eu/docs/rosenpass-tool/manuals/rp1/).
+
+## Usage - Standalone Key Exchange
+
+The `ghcr.io/rosenpass/rosenpass` image can be used in a server-client setup to exchange quantum-secure shared keys.
+This setup uses rosenpass as a standalone application, without using any other component such as wireguard.
+What follows, is a simple setup for illustrative purposes.
+
+Create a docker network that is used to connect the containers:
+
+```bash
+docker network create -d bridge rp
+export NET=rp
+```
+
+Generate the server and client key pairs:
+
+```bash
+mkdir ./workdir-client ./workdir-server
+docker run -it --rm -v ./workdir-server:/workdir ghcr.io/rosenpass/rosenpass \
+    gen-keys --public-key=workdir/server-public --secret-key=workdir/server-secret
+docker run -it --rm -v ./workdir-client:/workdir ghcr.io/rosenpass/rosenpass \
+    gen-keys --public-key=workdir/client-public --secret-key=workdir/client-secret
+# share the public keys between client and server
+ cp workdir-client/client-public workdir-server/client-public
+ cp workdir-server/server-public workdir-client/server-public
+```
+
+Start the server container:
+
+```bash
+docker run  --name "rpserver" --network ${NET} \
+    -it --rm -v ./workdir-server:/workdir ghcr.io/rosenpass/rosenpass \
+    exchange \
+    private-key workdir/server-secret \
+    public-key  workdir/server-public \
+    listen 0.0.0.0:9999 \
+    peer public-key workdir/client-public \
+    outfile workdir/server-sharedkey
+```
+
+Find out the ip address of the server container:
+
+```bash
+EP="rpserver"
+EP=$(docker inspect --format '{{ .NetworkSettings.Networks.rp.IPAddress }}' $EP)
+```
+
+Run the client container and perform the key exchange:
+
+```bash
+docker run --name "rpclient"  --network ${NET} \
+    -it --rm -v ./workdir-client:/workdir ghcr.io/rosenpass/rosenpass \
+    exchange \
+    private-key workdir/client-secret \
+    public-key  workdir/client-public \
+    peer public-key workdir/server-public endpoint ${EP}:9999 \
+    outfile workdir/client-sharedkey
+```
+
+Now the containers will exchange shared keys and each put them into their respective outfile.
+
+Comparing the outfiles shows that these shared keys equal:
+
+```bash
+cmp workdir-server/server-sharedkey workdir-client/client-sharedkey
+```
+
+It is now possible to set add these keys as pre-shared keys within a wireguard interface.
+For example as the server,
+
+```bash
+PREKEY=$(cat workdir-server/server-sharedkey)
+wg set <server-interface> peer <client-peer-public-key> preshared-key <(echo "$PREKEY")
+```
+
+## Usage - Combined with wireguard
+
+The `ghcr.io/rosenpass/rp` image can be used to build a VPN with WireGuard and Rosenpass.
+In this example, we run two containers on the same system and connect them with a bridge network within the docker overlay network.
+
+Create the named docker network, to be able to connect the containers.
+
+Create a docker network that is used to connect the containers:
+
+```bash
+docker network create -d bridge rp
+export NET=rp
+```
+
+Generate the server and client secret keys and extract public keys.
+
+```bash
+mkdir -p ./workdir-server ./workdir-client
+
+# server
+docker run -it --rm -v ./workdir-server:/workdir ghcr.io/rosenpass/rp \
+    genkey workdir/server.rosenpass-secret
+docker run -it --rm -v ./workdir-server:/workdir ghcr.io/rosenpass/rp \
+    pubkey workdir/server.rosenpass-secret workdir/server.rosenpass-public
+
+# client
+docker run -it --rm -v ./workdir-client:/workdir ghcr.io/rosenpass/rp \
+    genkey workdir/client.rosenpass-secret
+docker run -it --rm -v ./workdir-client:/workdir ghcr.io/rosenpass/rp \
+    pubkey workdir/client.rosenpass-secret workdir/client.rosenpass-public
+
+# share the public keys between client and server
+cp -r workdir-client/client.rosenpass-public workdir-server/client.rosenpass-public
+cp -r workdir-server/server.rosenpass-public workdir-client/server.rosenpass-public
+```
+
+Start the server container.
+Note that the `NET_ADMIN` capability is neccessary, the rp command will create and manage wireguard interfaces.
+Also make sure the `wireguard` kernel module is loaded by the host. (`lsmod | grep wireguard`)
+
+```bash
+docker run  --name "rpserver" --network ${NET} -it -d --rm -v ./workdir-server:/workdir \
+    --cap-add=NET_ADMIN \
+    ghcr.io/rosenpass/rp \
+    exchange workdir/server.rosenpass-secret dev rosenpass0 \
+    listen 0.0.0.0:9999 peer workdir/client.rosenpass-public allowed-ips 10.0.0.0/8
+```
+
+Now find out the ip-address of the server container and then start the client container:
+
+```bash
+EP="rpserver"
+EP=$(docker inspect --format '{{ .NetworkSettings.Networks.rp.IPAddress }}' $EP)
+docker run --name "rpclient"  --network ${NET} -it -d --rm -v ./workdir-client:/workdir \
+    --cap-add=NET_ADMIN \
+    ghcr.io/rosenpass/rp \
+    exchange workdir/client.rosenpass-secret dev rosenpass1 \
+    peer workdir/server.rosenpass-public endpoint ${EP}:9999 allowed-ips 10.0.0.1
+```
+
+Inside the docker containers assign the IP addresses:
+
+```bash
+# server
+docker exec -it rpserver ip a add 10.0.0.1/24 dev rosenpass0
+
+# client
+docker exec -it rpclient ip a add 10.0.0.2/24 dev rosenpass1
+```
+
+Done! The two containers should now be connected through a wireguard VPN (Port 1000) with pre-shared keys exchanged by rosenpass (Port 9999).
+
+Now, test the connection by starting a shell inside the client container, and ping the server through the VPN:
+
+```bash
+# client
+docker exec -it rpclient bash
+apt update; apt install iputils-ping
+ping 10.0.0.1
+```
+
+The ping command should continuously show ping-logs:
+
+```
+PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
+64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.119 ms
+64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.132 ms
+64 bytes from 10.0.0.1: icmp_seq=3 ttl=64 time=0.394 ms
+...
+```
+
+While the ping is running, you may stop the server container, and verify that the ping-log halts. In another terminal do:
+
+```
+docker stop -t 1 rpserver
+```
+
+## Building the Docker Images Locally
+
+Clone the Rosenpass repository:
+
+```
+git clone https://github.com/rosenpass/rosenpass
+cd rosenpass
+```
+
+Build the rp image from the root of the repository as follows:
+
+```
+docker build -f docker/Dockerfile -t ghcr.io/rosenpass/rp --target rp .
+```
+
+Build the rosenpass image from the root of the repostiry with the following command:
+
+```
+docker build -f docker/Dockerfile -t ghcr.io/rosenpass/rosenpass --target rosenpass .
+```

flake.lock

@@ -1,26 +1,5 @@
 {
   "nodes": {
-    "fenix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "rust-analyzer-src": "rust-analyzer-src"
-      },
-      "locked": {
-        "lastModified": 1728282832,
-        "narHash": "sha256-I7AbcwGggf+CHqpyd/9PiAjpIBGTGx5woYHqtwxaV7I=",
-        "owner": "nix-community",
-        "repo": "fenix",
-        "rev": "1ec71be1f4b8f3105c5d38da339cb061fefc43f4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "fenix",
-        "type": "github"
-      }
-    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
@@ -39,6 +18,26 @@
         "type": "github"
       }
     },
+    "nix-vm-test": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1734355073,
+        "narHash": "sha256-FfdPOGy1zElTwKzjgIMp5K2D3gfPn6VWjVa4MJ9L1Tc=",
+        "owner": "numtide",
+        "repo": "nix-vm-test",
+        "rev": "5948de39a616f2261dbbf4b6f25cbe1cbefd788c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "nix-vm-test",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1728193676,
@@ -57,25 +56,30 @@
     },
     "root": {
       "inputs": {
-        "fenix": "fenix",
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
+        "nix-vm-test": "nix-vm-test",
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay",
+        "treefmt-nix": "treefmt-nix"
       }
     },
-    "rust-analyzer-src": {
-      "flake": false,
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1728249780,
-        "narHash": "sha256-J269DvCI5dzBmPrXhAAtj566qt0b22TJtF3TIK+tMsI=",
-        "owner": "rust-lang",
-        "repo": "rust-analyzer",
-        "rev": "2b750da1a1a2c1d2c70896108d7096089842d877",
+        "lastModified": 1744513456,
+        "narHash": "sha256-NLVluTmK8d01Iz+WyarQhwFcXpHEwU7m5hH3YQQFJS0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "730fd8e82799219754418483fabe1844262fd1e2",
         "type": "github"
       },
       "original": {
-        "owner": "rust-lang",
-        "ref": "nightly",
-        "repo": "rust-analyzer",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
         "type": "github"
       }
     },
@@ -93,6 +97,26 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1743748085,
+        "narHash": "sha256-uhjnlaVTWo5iD3LXics1rp9gaKgDRQj6660+gbUU3cE=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "815e4121d6a5d504c0f96e5be2dd7f871e4fd99d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -3,37 +3,51 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
     flake-utils.url = "github:numtide/flake-utils";
 
+    nix-vm-test.url = "github:numtide/nix-vm-test";
+    nix-vm-test.inputs.nixpkgs.follows = "nixpkgs";
+    nix-vm-test.inputs.flake-utils.follows = "flake-utils";
+
     # for rust nightly with llvm-tools-preview
-    fenix.url = "github:nix-community/fenix";
-    fenix.inputs.nixpkgs.follows = "nixpkgs";
+    rust-overlay.url = "github:oxalica/rust-overlay";
+    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
+
+    treefmt-nix.url = "github:numtide/treefmt-nix";
+    treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = { self, nixpkgs, flake-utils, ... }@inputs:
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+      nix-vm-test,
+      rust-overlay,
+      treefmt-nix,
+      ...
+    }@inputs:
     nixpkgs.lib.foldl (a: b: nixpkgs.lib.recursiveUpdate a b) { } [
 
-
       #
       ### Export the overlay.nix from this flake ###
       #
-      {
-        overlays.default = import ./overlay.nix;
-      }
-
+      { overlays.default = import ./overlay.nix; }
 
       #
       ### Actual Rosenpass Package and Docker Container Images ###
       #
-      (flake-utils.lib.eachSystem [
-        "x86_64-linux"
-        "aarch64-linux"
+      (flake-utils.lib.eachSystem
+        [
+          "x86_64-linux"
+          "aarch64-linux"
 
-        # unsuported best-effort
-        "i686-linux"
-        "x86_64-darwin"
-        "aarch64-darwin"
-        # "x86_64-windows"
-      ]
-        (system:
+          # unsuported best-effort
+          "i686-linux"
+          "x86_64-darwin"
+          "aarch64-darwin"
+          # "x86_64-windows"
+        ]
+        (
+          system:
           let
             # normal nixpkgs
             pkgs = import nixpkgs {
@@ -44,115 +58,159 @@
             };
           in
           {
-            packages = {
-              default = pkgs.rosenpass;
-              rosenpass = pkgs.rosenpass;
-              rosenpass-oci-image = pkgs.rosenpass-oci-image;
-              rp = pkgs.rp;
+            packages =
+              {
+                default = pkgs.rosenpass;
+                rosenpass = pkgs.rosenpass;
+                rosenpass-oci-image = pkgs.rosenpass-oci-image;
+                rp = pkgs.rp;
 
-              release-package = pkgs.release-package;
+                release-package = pkgs.release-package;
 
-              # for good measure, we also offer to cross compile to Linux on Arm
-              aarch64-linux-rosenpass-static =
-                pkgs.pkgsCross.aarch64-multiplatform.pkgsStatic.rosenpass;
-              aarch64-linux-rp-static = pkgs.pkgsCross.aarch64-multiplatform.pkgsStatic.rp;
-            }
-            //
-            # We only offer static builds for linux, as this is not supported on OS X
-            (nixpkgs.lib.attrsets.optionalAttrs pkgs.stdenv.isLinux {
-              rosenpass-static = pkgs.pkgsStatic.rosenpass;
-              rosenpass-static-oci-image = pkgs.pkgsStatic.rosenpass-oci-image;
-              rp-static = pkgs.pkgsStatic.rp;
-            });
+                # for good measure, we also offer to cross compile to Linux on Arm
+                aarch64-linux-rosenpass-static = pkgs.pkgsCross.aarch64-multiplatform.pkgsStatic.rosenpass;
+                aarch64-linux-rp-static = pkgs.pkgsCross.aarch64-multiplatform.pkgsStatic.rp;
+              }
+              //
+              # We only offer static builds for linux, as this is not supported on OS X
+              (nixpkgs.lib.attrsets.optionalAttrs pkgs.stdenv.isLinux {
+                rosenpass-static = pkgs.pkgsStatic.rosenpass;
+                rosenpass-static-oci-image = pkgs.pkgsStatic.rosenpass-oci-image;
+                rp-static = pkgs.pkgsStatic.rp;
+              });
           }
-        ))
-
+        )
+      )
 
       #
       ### Linux specifics ###
       #
-      (flake-utils.lib.eachSystem [ "x86_64-linux" "aarch64-linux" ] (system:
-        let
-          pkgs = import nixpkgs {
-            inherit system;
+      (flake-utils.lib.eachSystem
+        [
+          "x86_64-linux"
+          "aarch64-linux"
+          "i686-linux"
+        ]
+        (
+          system:
+          let
+            pkgs = import nixpkgs {
+              inherit system;
 
-            # apply our own overlay, overriding/inserting our packages as defined in ./pkgs
-            overlays = [ self.overlays.default ];
-          };
-        in
-        {
+              overlays = [
+                # apply our own overlay, overriding/inserting our packages as defined in ./pkgs
+                self.overlays.default
 
-          #
-          ### Reading materials ###
-          #
-          packages.whitepaper = pkgs.whitepaper;
+                nix-vm-test.overlays.default
 
-          #
-          ### Proof and Proof Tools ###
-          #
-          packages.proverif-patched = pkgs.proverif-patched;
-          packages.proof-proverif = pkgs.proof-proverif;
+                # apply rust-overlay to get specific versions of the rust toolchain for a MSRV check
+                (import rust-overlay)
+              ];
+            };
 
+            treefmtEval = treefmt-nix.lib.evalModule pkgs ./treefmt.nix;
+          in
+          {
+            packages.package-deb = pkgs.callPackage ./pkgs/package-deb.nix {
+              rosenpass = pkgs.pkgsStatic.rosenpass;
+            };
+            packages.package-rpm = pkgs.callPackage ./pkgs/package-rpm.nix {
+              rosenpass = pkgs.pkgsStatic.rosenpass;
+            };
 
-          #
-          ### Devshells ###
-          #
-          devShells.default = pkgs.mkShell {
-            inherit (pkgs.proof-proverif) CRYPTOVERIF_LIB;
-            inputsFrom = [ pkgs.rosenpass ];
-            nativeBuildInputs = with pkgs; [
-              cargo-release
-              clippy
-              rustfmt
-              nodePackages.prettier
-              nushell # for the .ci/gen-workflow-files.nu script
-              proverif-patched
-            ];
-          };
-          # TODO: Write this as a patched version of the default environment
-          devShells.fullEnv = pkgs.mkShell {
-            inherit (pkgs.proof-proverif) CRYPTOVERIF_LIB;
-            inputsFrom = [ pkgs.rosenpass ];
-            nativeBuildInputs = with pkgs; [
-              cargo-release
-              rustfmt
-              nodePackages.prettier
-              nushell # for the .ci/gen-workflow-files.nu script
-              proverif-patched
-              inputs.fenix.packages.${system}.complete.toolchain
-              pkgs.cargo-llvm-cov
-              pkgs.grcov
-            ];
-          };
-          devShells.coverage = pkgs.mkShell {
-            inputsFrom = [ pkgs.rosenpass ];
-            nativeBuildInputs = [
-              inputs.fenix.packages.${system}.complete.toolchain
-              pkgs.cargo-llvm-cov
-              pkgs.grcov
-            ];
-          };
+            #
+            ### Reading materials ###
+            #
+            packages.whitepaper = pkgs.whitepaper;
 
+            #
+            ### Proof and Proof Tools ###
+            #
+            packages.proverif-patched = pkgs.proverif-patched;
+            packages.proof-proverif = pkgs.proof-proverif;
 
-          checks = {
-            systemd-rosenpass = pkgs.testers.runNixOSTest ./tests/systemd/rosenpass.nix;
-            systemd-rp = pkgs.testers.runNixOSTest ./tests/systemd/rp.nix;
+            #
+            ### Devshells ###
+            #
+            devShells.default = pkgs.mkShell {
+              inherit (pkgs.proof-proverif) CRYPTOVERIF_LIB;
+              inputsFrom = [ pkgs.rosenpass ];
+              nativeBuildInputs = with pkgs; [
+                cargo-release
+                clippy
+                rustfmt
+                nodePackages.prettier
+                nushell # for the .ci/gen-workflow-files.nu script
+                proverif-patched
+              ];
+            };
+            # TODO: Write this as a patched version of the default environment
+            devShells.fullEnv = pkgs.mkShell {
+              inherit (pkgs.proof-proverif) CRYPTOVERIF_LIB;
+              inputsFrom = [ pkgs.rosenpass ];
+              nativeBuildInputs = with pkgs; [
+                cargo-audit
+                cargo-msrv
+                cargo-release
+                cargo-vet
+                rustfmt
+                nodePackages.prettier
+                nushell # for the .ci/gen-workflow-files.nu script
+                proverif-patched
+                pkgs.cargo-llvm-cov
+                pkgs.grcov
+                pkgs.rust-bin.stable.latest.complete
+              ];
+            };
+            devShells.coverage = pkgs.mkShell {
+              inputsFrom = [ pkgs.rosenpass ];
+              nativeBuildInputs = [
+                pkgs.cargo-llvm-cov
+                pkgs.grcov
+                pkgs.rustc.llvmPackages.llvm
+              ];
+              env = {
+                inherit (pkgs.cargo-llvm-cov) LLVM_COV LLVM_PROFDATA;
+              };
+            };
+            devShells.benchmarks = pkgs.mkShell {
+              inputsFrom = [ pkgs.rosenpass ];
+              nativeBuildInputs = with pkgs; [
+                cargo-release
+                clippy
+                rustfmt
+              ];
+            };
 
-            cargo-fmt = pkgs.runCommand "check-cargo-fmt"
-              { inherit (self.devShells.${system}.default) nativeBuildInputs buildInputs; } ''
-              cargo fmt --manifest-path=${./.}/Cargo.toml --check --all && touch $out
-            '';
-            nixpkgs-fmt = pkgs.runCommand "check-nixpkgs-fmt"
-              { nativeBuildInputs = [ pkgs.nixpkgs-fmt ]; } ''
-              nixpkgs-fmt --check ${./.} && touch $out
-            '';
-            prettier-check = pkgs.runCommand "check-with-prettier"
-              { nativeBuildInputs = [ pkgs.nodePackages.prettier ]; } ''
-              cd ${./.} && prettier --check . && touch $out
-            '';
-          };
+            checks =
+              {
+                systemd-rosenpass = pkgs.testers.runNixOSTest ./tests/systemd/rosenpass.nix;
+                systemd-rp = pkgs.testers.runNixOSTest ./tests/systemd/rp.nix;
+                formatting = treefmtEval.config.build.check self;
+                rosenpass-msrv-check =
+                  let
+                    rosenpassCargoToml = pkgs.lib.trivial.importTOML ./rosenpass/Cargo.toml;
 
-          formatter = pkgs.nixpkgs-fmt;
-        }))
+                    rustToolchain = pkgs.rust-bin.stable.${rosenpassCargoToml.package.rust-version}.default;
+                    rustPlatform = pkgs.makeRustPlatform {
+                      cargo = rustToolchain;
+                      rustc = rustToolchain;
+                    };
+                  in
+                  pkgs.rosenpass.override { inherit rustPlatform; };
+              }
+              // pkgs.lib.optionalAttrs (system == "x86_64-linux") (
+                import ./tests/legacy-distro-packaging.nix {
+                  inherit pkgs;
+                  rosenpass-deb = self.packages.${system}.package-deb;
+                  rosenpass-rpm = self.packages.${system}.package-rpm;
+                }
+              );
+
+            # for `nix fmt`
+            formatter = treefmtEval.config.build.wrapper;
+          }
+        )
+      )
     ];
 }

fuzz/Cargo.toml

@@ -3,9 +3,10 @@ name = "rosenpass-fuzzing"
 version = "0.0.1"
 publish = false
 edition = "2021"
+rust-version = "1.77.0"
 
 [features]
-experiment_libcrux = ["rosenpass-ciphers/experiment_libcrux"]
+experiment_libcrux = ["rosenpass-ciphers/experiment_libcrux_all"]
 
 [package.metadata]
 cargo-fuzz = true

fuzz/fuzz_targets/aead_enc_into.rs

@@ -4,7 +4,8 @@ extern crate rosenpass;
 
 use libfuzzer_sys::fuzz_target;
 
-use rosenpass_ciphers::aead;
+use rosenpass_cipher_traits::primitives::Aead as _;
+use rosenpass_ciphers::Aead;
 
 #[derive(arbitrary::Arbitrary, Debug)]
 pub struct Input {
@@ -17,7 +18,7 @@ pub struct Input {
 fuzz_target!(|input: Input| {
     let mut ciphertext = vec![0u8; input.plaintext.len() + 16];
 
-    aead::encrypt(
+    Aead.encrypt(
         ciphertext.as_mut_slice(),
         &input.key,
         &input.nonce,

fuzz/fuzz_targets/blake2b.rs

@@ -4,6 +4,7 @@ extern crate rosenpass;
 
 use libfuzzer_sys::fuzz_target;
 
+use rosenpass_cipher_traits::primitives::KeyedHashTo;
 use rosenpass_ciphers::subtle::blake2b;
 use rosenpass_to::To;
 
@@ -16,5 +17,7 @@ pub struct Blake2b {
 fuzz_target!(|input: Blake2b| {
     let mut out = [0u8; 32];
 
-    blake2b::hash(&input.key, &input.data).to(&mut out).unwrap();
+    blake2b::Blake2b::keyed_hash_to(&input.key, &input.data)
+        .to(&mut out)
+        .unwrap();
 });

fuzz/fuzz_targets/handle_msg.rs

@@ -4,8 +4,8 @@ extern crate rosenpass;
 use libfuzzer_sys::fuzz_target;
 
 use rosenpass::protocol::CryptoServer;
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::StaticKem;
+use rosenpass_cipher_traits::primitives::Kem;
+use rosenpass_ciphers::StaticKem;
 use rosenpass_secret_memory::policy::*;
 use rosenpass_secret_memory::{PublicBox, Secret};
 use std::sync::Once;

fuzz/fuzz_targets/kyber_encaps.rs

@@ -4,8 +4,8 @@ extern crate rosenpass;
 
 use libfuzzer_sys::fuzz_target;
 
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::EphemeralKem;
+use rosenpass_cipher_traits::primitives::Kem;
+use rosenpass_ciphers::EphemeralKem;
 
 #[derive(arbitrary::Arbitrary, Debug)]
 pub struct Input {
@@ -16,5 +16,7 @@ fuzz_target!(|input: Input| {
     let mut ciphertext = [0u8; EphemeralKem::CT_LEN];
     let mut shared_secret = [0u8; EphemeralKem::SHK_LEN];
 
-    EphemeralKem::encaps(&mut shared_secret, &mut ciphertext, &input.pk).unwrap();
+    EphemeralKem
+        .encaps(&mut shared_secret, &mut ciphertext, &input.pk)
+        .unwrap();
 });

fuzz/fuzz_targets/mceliece_encaps.rs

@@ -3,13 +3,13 @@ extern crate rosenpass;
 
 use libfuzzer_sys::fuzz_target;
 
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::StaticKem;
+use rosenpass_cipher_traits::primitives::Kem;
+use rosenpass_ciphers::StaticKem;
 
 fuzz_target!(|input: [u8; StaticKem::PK_LEN]| {
     let mut ciphertext = [0u8; StaticKem::CT_LEN];
     let mut shared_secret = [0u8; StaticKem::SHK_LEN];
 
     // We expect errors while fuzzing therefore we do not check the result.
-    let _ = StaticKem::encaps(&mut shared_secret, &mut ciphertext, &input);
+    let _ = StaticKem.encaps(&mut shared_secret, &mut ciphertext, &input);
 });

oqs/Cargo.toml

@@ -8,6 +8,7 @@ description = "Rosenpass internal bindings to liboqs"
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77.0"
 
 [dependencies]
 rosenpass-cipher-traits = { workspace = true }

oqs/src/kem_macro.rs

@@ -2,11 +2,10 @@
 
 /// Generate bindings to a liboqs-provided KEM
 macro_rules! oqs_kem {
-    ($name:ident) => { ::paste::paste!{
+    ($name:ident, $algo_trait:path) => { ::paste::paste!{
         #[doc = "Bindings for ::oqs_sys::kem::" [<"OQS_KEM" _ $name:snake>] "_*"]
         mod [< $name:snake >] {
-            use rosenpass_cipher_traits::Kem;
-            use rosenpass_util::result::Guaranteed;
+            use rosenpass_cipher_traits::primitives::{Kem, KemError};
 
             #[doc = "Bindings for ::oqs_sys::kem::" [<"OQS_KEM" _ $name:snake>] "_*"]
             #[doc = ""]
@@ -14,7 +13,7 @@ macro_rules! oqs_kem {
             #[doc = ""]
             #[doc = "```rust"]
             #[doc = "use std::borrow::{Borrow, BorrowMut};"]
-            #[doc = "use rosenpass_cipher_traits::Kem;"]
+            #[doc = "use rosenpass_cipher_traits::primitives::Kem;"]
             #[doc = "use rosenpass_oqs::" $name:camel " as MyKem;"]
             #[doc = "use rosenpass_secret_memory::{Secret, Public};"]
             #[doc = ""]
@@ -23,21 +22,26 @@ macro_rules! oqs_kem {
             #[doc = "// Recipient generates secret key, transfers pk to sender"]
             #[doc = "let mut sk = Secret::<{ MyKem::SK_LEN }>::zero();"]
             #[doc = "let mut pk = Public::<{ MyKem::PK_LEN }>::zero();"]
-            #[doc = "MyKem::keygen(sk.secret_mut(), pk.borrow_mut());"]
+            #[doc = "MyKem.keygen(sk.secret_mut(), &mut pk);"]
             #[doc = ""]
             #[doc = "// Sender generates ciphertext and local shared key, sends ciphertext to recipient"]
             #[doc = "let mut shk_enc = Secret::<{ MyKem::SHK_LEN }>::zero();"]
             #[doc = "let mut ct = Public::<{ MyKem::CT_LEN }>::zero();"]
-            #[doc = "MyKem::encaps(shk_enc.secret_mut(), ct.borrow_mut(), pk.borrow());"]
+            #[doc = "MyKem.encaps(shk_enc.secret_mut(), &mut ct, &pk);"]
             #[doc = ""]
             #[doc = "// Recipient decapsulates ciphertext"]
             #[doc = "let mut shk_dec = Secret::<{ MyKem::SHK_LEN }>::zero();"]
-            #[doc = "MyKem::decaps(shk_dec.secret_mut(), sk.secret(), ct.borrow());"]
+            #[doc = "MyKem.decaps(shk_dec.secret_mut(), sk.secret_mut(), &ct);"]
             #[doc = ""]
             #[doc = "// Both parties end up with the same shared key"]
-            #[doc = "assert!(rosenpass_constant_time::compare(shk_enc.secret_mut(), shk_dec.secret_mut()) == 0);"]
+            #[doc = "assert!(rosenpass_constant_time::compare(shk_enc.secret(), shk_dec.secret()) == 0);"]
             #[doc = "```"]
-            pub enum [< $name:camel >]  {}
+            pub struct [< $name:camel >];
+
+            pub const SK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_secret_key >] as usize;
+            pub const PK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_public_key >] as usize;
+            pub const CT_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_ciphertext >] as usize;
+            pub const SHK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_shared_secret >] as usize;
 
             /// # Panic & Safety
             ///
@@ -51,17 +55,8 @@ macro_rules! oqs_kem {
             /// to only check that the buffers are big enough, allowing them to be even
             /// bigger. However, from a correctness point of view it does not make sense to
             /// allow bigger buffers.
-            impl Kem for [< $name:camel >] {
-                type Error = ::std::convert::Infallible;
-
-                const SK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_secret_key >] as usize;
-                const PK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_public_key >] as usize;
-                const CT_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_ciphertext >] as usize;
-                const SHK_LEN: usize =  ::oqs_sys::kem::[<OQS_KEM _ $name:snake _ length_shared_secret >] as usize;
-
-                fn keygen(sk: &mut [u8], pk: &mut [u8]) -> Guaranteed<()> {
-                    assert_eq!(sk.len(), Self::SK_LEN);
-                    assert_eq!(pk.len(), Self::PK_LEN);
+            impl Kem<SK_LEN, PK_LEN, CT_LEN, SHK_LEN> for [< $name:camel >] {
+                fn keygen(&self, sk: &mut [u8; SK_LEN], pk: &mut [u8; PK_LEN]) -> Result<(), KemError> {
                     unsafe {
                         oqs_call!(
                             ::oqs_sys::kem::[< OQS_KEM _ $name:snake _ keypair >],
@@ -73,10 +68,7 @@ macro_rules! oqs_kem {
                     Ok(())
                 }
 
-                fn encaps(shk: &mut [u8], ct: &mut [u8], pk: &[u8]) -> Guaranteed<()> {
-                    assert_eq!(shk.len(), Self::SHK_LEN);
-                    assert_eq!(ct.len(), Self::CT_LEN);
-                    assert_eq!(pk.len(), Self::PK_LEN);
+                    fn encaps(&self, shk: &mut [u8; SHK_LEN], ct: &mut [u8; CT_LEN], pk: &[u8; PK_LEN]) -> Result<(), KemError> {
                     unsafe {
                         oqs_call!(
                             ::oqs_sys::kem::[< OQS_KEM _ $name:snake _ encaps >],
@@ -89,10 +81,7 @@ macro_rules! oqs_kem {
                     Ok(())
                 }
 
-                fn decaps(shk: &mut [u8], sk: &[u8], ct: &[u8]) -> Guaranteed<()> {
-                    assert_eq!(shk.len(), Self::SHK_LEN);
-                    assert_eq!(sk.len(), Self::SK_LEN);
-                    assert_eq!(ct.len(), Self::CT_LEN);
+                fn decaps(&self, shk: &mut [u8; SHK_LEN], sk: &[u8; SK_LEN], ct: &[u8; CT_LEN]) -> Result<(), KemError> {
                     unsafe {
                         oqs_call!(
                             ::oqs_sys::kem::[< OQS_KEM _ $name:snake _ decaps >],
@@ -105,9 +94,16 @@ macro_rules! oqs_kem {
                     Ok(())
                 }
             }
-
         }
 
+        impl Default for [< $name:camel >] {
+            fn default() -> Self {
+                Self
+            }
+        }
+
+        impl $algo_trait for [< $name:camel >] {}
+
         pub use [< $name:snake >] :: [< $name:camel >];
     }}
 }

oqs/src/lib.rs

@@ -22,5 +22,8 @@ macro_rules! oqs_call {
 
 #[macro_use]
 mod kem_macro;
-oqs_kem!(kyber_512);
-oqs_kem!(classic_mceliece_460896);
+oqs_kem!(kyber_512, rosenpass_cipher_traits::algorithms::KemKyber512);
+oqs_kem!(
+    classic_mceliece_460896,
+    rosenpass_cipher_traits::algorithms::KemClassicMceliece460896
+);

overlay.nix

@@ -1,6 +1,5 @@
 final: prev: {
 
-
   #
   ### Actual rosenpass software ###
   #
@@ -27,7 +26,10 @@ final: prev: {
       "marzipan(/marzipan.awk)?"
       "analysis(/.*)?"
     ];
-    nativeBuildInputs = [ final.proverif final.graphviz ];
+    nativeBuildInputs = [
+      final.proverif
+      final.graphviz
+    ];
     CRYPTOVERIF_LIB = final.proverif-patched + "/lib/cryptoverif.pvl";
     installPhase = ''
       mkdir -p $out

papers/references.bib

@@ -196,3 +196,13 @@ Vadim Lyubashevsky and John M. Schanck and Peter Schwabe and Gregor Seiler and D
     type = {NIST Post-Quantum Cryptography Selected Algorithm},
     url = {https://pq-crystals.org/kyber/}
 }
+
+
+@misc{SHAKE256,
+  author   = "National Institute of Standards and Technology",
+  title    = "FIPS PUB 202: SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions",
+  year     = {2015},
+  month    = {August},
+  doi      = {10.6028/NIST.FIPS.202}
+}
+

papers/tex/template-rosenpass.tex

@@ -2,6 +2,7 @@
 \usepackage{amssymb}
 \usepackage{mathtools}
 \usepackage{fontspec}
+\usepackage{dirtytalk}
 
 %font fallback
 \directlua{luaotfload.add_fallback

papers/whitepaper.md

@@ -8,13 +8,15 @@ author:
 - Lisa Schmidt = {Scientific Illustrator – \\url{mullana.de}}
 - Prabhpreet Dua
 abstract: |
-       Rosenpass is used to create post-quantum-secure VPNs. Rosenpass computes a shared key, WireGuard (WG) [@wg] uses the shared key to establish a secure connection. Rosenpass can also be used without WireGuard, deriving post-quantum-secure symmetric keys for another application. The Rosenpass protocol builds on “Post-quantum WireGuard” (PQWG) [@pqwg] and improves it by using a cookie mechanism to provide security against state disruption attacks.
+       Rosenpass is a post-quantum-secure authenticated key exchange protocol. Its main practical use case is creating post-quantum-secure VPNs by combining WireGuard and Rosenpass.
 
-       The WireGuard implementation enjoys great trust from the cryptography community and has excellent performance characteristics. To preserve these features, the Rosenpass application runs side-by-side with WireGuard and supplies a new post-quantum-secure pre-shared key (PSK) every two minutes. WireGuard itself still performs the pre-quantum-secure key exchange and transfers any transport data with no involvement from Rosenpass at all.
+       In this combination, Rosenpass generates a post-quantum-secure shared key every two minutes that is then used by WireGuard (WG) [@wg] to establish a secure connection. Rosenpass can also be used without WireGuard, providing post-quantum-secure symmetric keys for other applications, as long as the other application accepts a pre-shared key and provides cryptographic security based on the pre-shared key alone.
+
+       The Rosenpass protocol builds on “Post-quantum WireGuard” (PQWG) [@pqwg] and improves it by using a cookie mechanism to provide security against state disruption attacks. From a cryptographic perspective, Rosenpass can be thought of as a post-quantum secure variant of the Noise IK[@noise] key exchange. \say{Noise IK} means that the protocol makes both parties authenticate themselves, but that the initiator knows before the protocol starts which other party they are communicating with. There is no negotiation step where the responder communicates their identity to the initiator.
 
        The Rosenpass project consists of a protocol description, an implementation written in Rust, and a symbolic analysis of the protocol’s security using ProVerif [@proverif]. We are working on a cryptographic security proof using CryptoVerif [@cryptoverif].
 
-       This document is a guide for engineers and researchers implementing the protocol; a scientific paper discussing the security properties of Rosenpass is work in progress.
+       This document is a guide for engineers and researchers implementing the protocol.
 ---
 
 \enlargethispage{5mm}
@@ -31,10 +33,10 @@ abstract: |
 
 # Security
 
-Rosenpass inherits most security properties from Post-Quantum WireGuard (PQWG). The security properties mentioned here are covered by the symbolic analysis in the Rosenpass repository. 
+Rosenpass inherits most security properties from Post-Quantum WireGuard (PQWG). The security properties mentioned here are covered by the symbolic analysis in the Rosenpass repository.
 
 ## Secrecy
-Three key encapsulations using the keypairs `sski`/`spki`, `sskr`/`spkr`, and `eski`/`epki` provide secrecy (see Section \ref{variables} for an introduction of the variables). Their respective ciphertexts are called `scti`, `sctr`, and `ectr` and the resulting keys are called `spti`, `sptr`, `epti`. A single secure encapsulation is sufficient to provide secrecy. We use two different KEMs (Key Encapsulation Mechanisms; see section \ref{skem}): Kyber and Classic McEliece.
+Three key encapsulations using the keypairs `sski`/`spki`, `sskr`/`spkr`, and `eski`/`epki` provide secrecy (see Section \ref{variables} for an introduction of the variables). Their respective ciphertexts are called `scti`, `sctr`, and `ectr` and the resulting keys are called `spti`, `sptr`, `epti`. A single secure encapsulation is sufficient to provide secrecy. We use two different KEMs (Key Encapsulation Mechanisms; see Section \ref{skem}): Kyber and Classic McEliece.
 
 ## Authenticity
 
@@ -64,9 +66,12 @@ Note that while Rosenpass is secure against state disruption, using it does not
 All symmetric keys and hash values used in Rosenpass are 32 bytes long.
 
 
-### Hash
+### Hash {#hash}
 
-A keyed hash function with one 32-byte input, one variable-size input, and one 32-byte output. As keyed hash function we use the HMAC construction [@rfc_hmac] with BLAKE2s [@rfc_blake2] as the inner hash function.
+A keyed hash function with one 32-byte input, one variable-size input, and one 32-byte output. As keyed hash function we offer two options that can be configured on a peer-basis, with Blake2s being the default:
+
+1. the HMAC construction [@rfc_hmac] with BLAKE2s [@rfc_blake2] as the inner hash function.
+2. the SHAKE256 extendable output function (XOF) [@SHAKE256] truncated to a 32-byte output. The result is produced be concatenating the 32-byte input with the variable-size input in this order.
 
 ```pseudorust
 hash(key, data) -> key
@@ -151,16 +156,18 @@ Rosenpass uses two types of ID variables. See Figure \ref{img:HashingTree} for h
 
 The first lower-case character indicates whether the variable is a session ID (`sid`) or a peer ID (`pid`). The final character indicates the role using the characters `i`, `r`, `m`, or `t`, for `initiator`, `responder`, `mine`, or `theirs` respectively.
 
-### Symmetric Keys
-
-Rosenpass uses two symmetric key variables `psk` and `osk` in its interface, and maintains the entire handshake state in a variable called the chaining key.
+### Symmetric Keys {#symmetric-keys}
 
+Rosenpass uses two main symmetric key variables `psk` and `osk` in its interface, and maintains the entire handshake state in a variable called the chaining key.
 
 * `psk`: A pre-shared key that can be optionally supplied as input to Rosenpass.
-* `osk`: The output shared key, generated by Rosenpass and supplied to WireGuard for use as its pre-shared key.
-* `ck`: The chaining key.
+* `osk`: The output shared key, generated by Rosenpass. The main use case is to supply the key to WireGuard for use as its pre-shared key.
+* `ck`: The chaining key. This refers to various intermediate keys produced during the execution of the protocol, before the final `osk` is produced.
+
+We mix all key material (e.g. `psk`) into the chaining key and derive symmetric keys such as `osk` from it. We authenticate public values by mixing them into the chaining key; in particular, we include the entire protocol transcript in the chaining key, i.e., all values transmitted over the network.
+
+The protocol allows for multiple `osk`s to be generated; each of these keys is labeled with a domain separator to make sure different key usages are always given separate keys. The domain separator for using Rosenpass and WireGuard together is a token generated using the domain separator sequence `["rosenpass.eu", "wireguard psk"]` (see Fig. \ref{img:HashingTree}), as described in \ref{protocol-extension-wireguard-psk}. Third-parties using Rosenpass-keys for other purposes are asked to define their own protocol-extensions. Standard protocol extensions are described in \ref{protocol-extensions}.
 
-We mix all key material (e.g. `psk`) into the chaining key, and derive symmetric keys such as `osk` from it. We authenticate public values by mixing them into the chaining key; in particular, we include the entire protocol transcript in the chaining key, i.e., all values transmitted over the network.
 
 ## Hashes
 
@@ -172,20 +179,22 @@ Rosenpass uses a cryptographic hash function for multiple purposes:
 * Key derivation during and after the handshake
 * Computing the additional data for the biscuit encryption, to provide some privacy for its contents
 
+Recall from Section \ref{hash} that rosenpass supports using either BLAKE2s or SHAKE256 as hash function, which can be configured for each peer ID. However, as noted above, rosenpass uses a hash function to compute the peer ID and thus also to access the configuration for a peer ID. This is an issue when receiving an `InitHello`-message, because the correct hash function is not known when a responder receives this message and at the same the responders needs it in order to compute the peer ID and by that also identfy the hash function for that peer. The reference implementation resolves this issue by first trying to derive the peer ID using SHAKE256. If that does not work (i.e. leads to an AEAD decryption error), the reference implementation tries again with BLAKE2s. The reference implementation verifies that the hash function matches the one confgured for the peer. Similarly, if the correct peer ID is not cached when receiving an InitConf message, the reference implementation proceeds in the same manner.
+
 Using one hash function for multiple purposes can cause real-world security issues and even key recovery attacks [@oraclecloning]. We choose a tree-based domain separation scheme based on a keyed hash function – the previously introduced primitive `hash` – to make sure all our hash function calls can be seen as distinct.
 
 \setupimage{landscape,fullpage,label=img:HashingTree}
 ![Rosenpass Hashing Tree](graphics/rosenpass-wp-hashing-tree-rgb.svg)
 
-Each tree node $\circ{}$ in Figure 3 represents the application of the keyed hash function, using the previous chaining key value as first parameter. The root of the tree is the zero key. In level one, the `PROTOCOL` identifier is applied to the zero key to generate a label unique across cryptographic protocols (unless the same label is deliberately used elsewhere). In level two, purpose identifiers are applied to the protocol label to generate labels to use with each separate hash function application within the Rosenpass protocol. The following layers contain the inputs used in each separate usage of the hash function: Beneath the identifiers `"mac"`, `"cookie"`, `"peer id"`, and `"biscuit additional data"` are hash functions or message authentication codes with a small number of inputs. The second, third, and fourth column in Figure 3 cover the long sequential branch beneath the identifier `"chaining key init"` representing the entire protocol execution, one column for each message processed during the handshake. The leaves beneath `"chaining key extract"` in the left column represent pseudo-random labels for use when extracting values from the chaining key during the protocol execution. These values such as `mix >` appear as outputs in the left column, and then as inputs `< mix` in the other three columns.
+Each tree node $\circ{}$ in Figure \ref{img:HashingTree} represents the application of the keyed hash function, using the previous chaining key value as first parameter. The root of the tree is the zero key. In level one, the `PROTOCOL` identifier is applied to the zero key to generate a label unique across cryptographic protocols (unless the same label is deliberately used elsewhere). In level two, purpose identifiers are applied to the protocol label to generate labels to use with each separate hash function application within the Rosenpass protocol. The following layers contain the inputs used in each separate usage of the hash function: Beneath the identifiers `"mac"`, `"cookie"`, `"peer id"`, and `"biscuit additional data"` are hash functions or message authentication codes with a small number of inputs. The second, third, and fourth column in Figure \ref{img:HashingTree} cover the long sequential branch beneath the identifier `"chaining key init"` representing the entire protocol execution, one column for each message processed during the handshake. The leaves beneath `"chaining key extract"` in the left column represent pseudo-random labels for use when extracting values from the chaining key during the protocol execution. These values such as `mix >` appear as outputs in the left column, and then as inputs `< mix` in the other three columns.
 
-The protocol identifier is defined as follows:
+The protocol identifier depends on the hash function used with the respective peer is defined as follows if BLAKE2s [@rfc_blake2] is used:
 
 ```pseudorust
 PROTOCOL = "rosenpass 1 rosenpass.eu aead=chachapoly1305 hash=blake2s ekem=kyber512 skem=mceliece460896 xaead=xchachapoly1305"
 ```
 
-Since every tree node represents a sequence of `hash` calls, the node beneath `"handshake encryption"` called `hs_enc` can be written as follows:
+If SHAKE256 [@SHAKE256] is used, `blake2s` is replaced by `shake256` in `PROTOCOL`. Since every tree node represents a sequence of `hash` calls, the node beneath `"handshake encryption"` called `hs_enc` can be written as follows:
 
 ```pseudorust
 hs_enc = hash(hash(hash(0, PROTOCOL), "chaining key extract"), "handshake encryption")
@@ -233,6 +242,7 @@ For each peer, the server stores:
 * `psk` – The pre-shared key used with the peer
 * `spkt` – The peer's public key
 * `biscuit_used` – The `biscuit_no` from the last biscuit accepted for the peer as part of InitConf processing
+* `hash_function` – The hash function, SHAKE256 or BLAKE2s, used with the peer.
 
 ### Handshake State and Biscuits
 
@@ -283,7 +293,7 @@ fn lookup_session(sid);
 
 The protocol framework used by Rosenpass allows arbitrarily many different keys to be extracted using labels for each key. The `extract_key` function is used to derive protocol-internal keys, its labels are under the “chaining key extract” node in Figure \ref{img:HashingTree}. The export key function is used to export application keys.
 
-Third-party applications using the protocol are supposed to choose a unique label (e.g., their domain name) and use that as their own namespace for custom labels. The Rosenpass project itself uses the “rosenpass.eu” namespace.
+Third-party applications using the protocol are supposed to define a protocol extension (see \ref{protocol-extensions}) and choose a globally unique label, such as their domain name for custom labels of their own. The Rosenpass project itself uses the `["rosenpass.eu"]` namespace in the WireGuard PSK protocol extension (see \ref{protocol-extension-wireguard-psk}).
 
 Applications can cache or statically compile the pseudo-random label values into their binary to improve performance.
 
@@ -389,7 +399,7 @@ fn load_biscuit(nct) {
 
     // In December 2024, the InitConf retransmission mechanisim was redesigned
     // in a backwards-compatible way. See the changelog.
-    // 
+    //
     // -- 2024-11-30, Karolin Varner
     if (protocol_version!(< "0.3.0")) {
         // Ensure that the biscuit is used only once
@@ -415,6 +425,18 @@ fn enter_live() {
     txkr ← extract_key("responder payload encryption");
     txnm ← 0;
     txnt ← 0;
+
+    // Setup output keys for protocol extensions such as the
+    // WireGuard PSK protocol extension.
+    setup_osks();
+}
+```
+
+The final step `setup_osks()` can be defined by protocol extensions (see \ref{protocol-extensions}) to set up `osk`s for custom use cases. By default, the WireGuard PSK (see \ref{protocol-extension-wireguard-psk}) is active.
+
+```pseudorust
+fn setup_osks() {
+    ... // Defined by protocol extensions
 }
 ```
 
@@ -442,24 +464,24 @@ ICR5 and ICR6 perform biscuit replay protection using the biscuit number. This i
 
 ### Denial of Service Mitigation and Cookies
 
-Rosenpass derives its cookie-based DoS mitigation technique for a responder when receiving InitHello messages from Wireguard [@wg]. 
+Rosenpass derives its cookie-based DoS mitigation technique for a responder when receiving InitHello messages from Wireguard [@wg].
 
 When the responder is under load, it may choose to not process further InitHello handshake messages, but instead to respond with a cookie reply message (see Figure \ref{img:MessageTypes}).
 
-The sender of the exchange then uses this cookie in order to resend the message and have it accepted the following time by the reciever. 
+The sender of the exchange then uses this cookie in order to resend the message and have it accepted the following time by the reciever.
 
 For an initiator, Rosenpass ignores all messages when under load.
 
 #### Cookie Reply Message
 
-The cookie reply message is sent by the responder on receiving an InitHello message when under load. It consists of the `sidi` of the initiator, a random 24-byte bitstring `nonce` and encrypting `cookie_value` into a `cookie_encrypted` reply field which consists of the following:
+The cookie reply message is sent by the responder on receiving an InitHello message when under load. It consists of the `sidi` of the initiator, a random 24-byte bitstring `nonce` and encrypting `cookie_value` into a `cookie_encrypted` reply field, which consists of the following:
 
 ```pseudorust
 cookie_value = lhash("cookie-value", cookie_secret, initiator_host_info)[0..16]
 cookie_encrypted = XAEAD(lhash("cookie-key", spkm), nonce, cookie_value, mac_peer)
 ```
 
-where `cookie_secret` is a secret variable that changes every two minutes to a random value. `initiator_host_info` is used to identify the initiator host, and is implementation-specific for the client. This paramaters used to identify the host must be carefully chosen to ensure there is a unique mapping, especially when using IPv4 and IPv6 addresses to identify the host (such as taking care of IPv6 link-local addresses). `cookie_value` is a truncated 16 byte value from the above hash operation. `mac_peer` is the `mac` field of the peer's handshake message to which message is the reply.  
+where `cookie_secret` is a secret variable that changes every two minutes to a random value. Moreover, `lhash` is always instantiated with SHAKE256 when computing `cookie_value` for compatability reasons.  `initiator_host_info` is used to identify the initiator host, and is implementation-specific for the client. This paramaters used to identify the host must be carefully chosen to ensure there is a unique mapping, especially when using IPv4 and IPv6 addresses to identify the host (such as taking care of IPv6 link-local addresses). `cookie_value` is a truncated 16 byte value from the above hash operation. `mac_peer` is the `mac` field of the peer's handshake message to which message is the reply.
 
 #### Envelope `mac` Field
 
@@ -489,13 +511,13 @@ else {
 Here, `seconds_since_update(peer.cookie_value)` is the amount of time in seconds ellapsed since last cookie was received, and `COOKIE_WIRE_DATA` are the message contents of all bytes of the retransmitted message prior to the `cookie` field.
 
 The inititator can use an invalid value for the `cookie` value, when the responder is not under load, and the responder must ignore this value.
-However, when the responder is under load, it may reject InitHello messages with the invalid `cookie` value, and issue a cookie reply message. 
+However, when the responder is under load, it may reject InitHello messages with the invalid `cookie` value, and issue a cookie reply message.
 
 ### Conditions to trigger DoS Mechanism
 
 This whitepaper does not mandate any specific mechanism to detect responder contention (also mentioned as the under load condition) that would trigger use of the cookie mechanism.
 
-For the reference implemenation, Rosenpass has derived inspiration from the linux implementation of Wireguard.  This implementation suggests that the reciever keep track of the number of messages it is processing at a given time. 
+For the reference implemenation, Rosenpass has derived inspiration from the Linux implementation of Wireguard.  This implementation suggests that the reciever keep track of the number of messages it is processing at a given time.
 
 On receiving an incoming message, if the length of the message queue to be processed exceeds a threshold `MAX_QUEUED_INCOMING_HANDSHAKES_THRESHOLD`, the client is considered under load and its state is stored as under load. In addition, the timestamp of this instant when the client was last under load is stored. When recieving subsequent messages, if the client is still in an under load state, the client will check if the time ellpased since the client was last under load has exceeded `LAST_UNDER_LOAD_WINDOW` seconds. If this is the case, the client will update its state to normal operation, and process the message in a normal fashion.
 
@@ -514,25 +536,181 @@ The responder uses less complex form of the same mechanism: The responder never
 
 ### Interaction with cookie reply system
 
-The cookie reply system does not interfere with the retransmission logic discussed above. 
+The cookie reply system does not interfere with the retransmission logic discussed above.
 
 When the initator is under load, it will ignore processing any incoming messages.
 
-When a responder is under load and it receives an InitHello handshake message, the InitHello message will be discarded and a cookie reply message is sent. The initiator, then on the reciept of the cookie reply message, will store a decrypted `cookie_value` to set the `cookie` field to subsequently sent messages. As per the retransmission mechanism above, the initiator will send a retransmitted InitHello message with a valid `cookie` value appended. On receiving the retransmitted handshake message, the responder will validate the `cookie` value and resume with the handshake process. 
+When a responder is under load and it receives an InitHello handshake message, the InitHello message will be discarded and a cookie reply message is sent. The initiator, then on the reciept of the cookie reply message, will store a decrypted `cookie_value` to set the `cookie` field to subsequently sent messages. As per the retransmission mechanism above, the initiator will send a retransmitted InitHello message with a valid `cookie` value appended. On receiving the retransmitted handshake message, the responder will validate the `cookie` value and resume with the handshake process.
 
 When the responder is under load and it recieves an InitConf message, the message will be directly processed without checking the validity of the cookie field.
 
+# Protocol extensions {#protocol-extensions}
+
+The main extension point for the Rosenpass protocol is to generate `osk`s (speak output shared keys, see Sec. \ref{symmetric-keys}) for purposes other than using them to secure WireGuard. By default, the Rosenpass application generates keys for the WireGuard PSK (see \ref{protocol-extension-wireguard-psk}). It would not be impossible to use the keys generated for WireGuard in other use cases, but this might lead to attacks[@oraclecloning]. Specifying a custom protocol extension in practice just means settling on alternative domain separators (see Sec. \ref{symmetric-keys}, Fig. \ref{img:HashingTree}).
+
+## Using custom domain separators in the Rosenpass application
+
+The Rosenpass application supports protocol extensions to change the OSK domain separator without modification of the source code.
+
+The following example configuration file can be used to execute Rosenpass in outfile mode with custom domain separators.
+In this mode, the Rosenpass application will write keys to the file specified with `key_out` and send notifications when new keys are exchanged via standard out.
+This can be used to embed Rosenpass into third-party application.
+
+```toml
+# peer-a.toml
+public_key = "peer-a.pk"
+secret_key = "peer-a.sk"
+listen = ["[::1]:6789"]
+verbosity = "Verbose"
+
+[[peers]]
+public_key = "peer-b.pk"
+key_out = "peer-a.osk" # path to store the key
+osk_organization = "myorg.com"
+osk_label = ["My Custom Messenger app", "Backend VPN Example Subusecase"]
+```
+
+## Extension: WireGuard PSK {#protocol-extension-wireguard-psk}
+
+The WireGuard PSK protocol extension is active by default; this is the mode where Rosenpass is used to provide post-quantum security for WireGuard. Hybrid security (i.e. redundant pre-quantum and post-quantum security) is achieved because WireGuard provides pre-quantum security, with or without Rosenpass.
+
+This extension uses the `"rosenpass.eu"` namespace for user-labels and specifies a single additional user-label:
+
+* `["rosenpass.eu", "wireguard psk"]`
+
+The label's full domain separator is
+
+* `[PROTOCOL, "user", "rosenpass.eu", "wireguard psk"]`
+
+and can be seen in Figure \ref{img:HashingTree}.
+
+We require two extra per-peer configuration variables:
+
+* `wireguard_interface` — Name of a local network interface. Identifies local WireGuard interface we are supplying a PSK to.
+* `wireguard_peer` — A WireGuard public key. Identifies the particular WireGuard peer whose connection we are supplying PSKs for.
+
+When creating the WireGuard interface for use with Rosenpass, the PSK used by WireGuard must be initialized to a random value; otherwise, WireGuard can establish an insecure key before Rosenpass had a change to exchange its own key.
+
+```pseudorust
+fn on_wireguard_setup() {
+    // We use a random PSK to make sure the other side will never
+    // have a matching PSK when the WireGuard interface is created.
+    //
+    // Never use a fixed value here as this would lead to an attack!
+    let fake_wireguard_psk = random_key();
+
+    // How the interface is create
+    let wg_peer = WireGuard::setup_peer()
+        .public_key(wireguard_peer)
+        ... // Supply any custom peerconfiguration
+        .psk(fake_wireguard_psk);
+
+    // The random PSK must be supplied before the
+    // WireGuard interface comes up
+    WireGuard::setup_interface()
+        .name(wireguard_interface)
+        ... // Supply any custom configuration
+        .add_peer(wg_peer)
+        .create();
+}
+```
+
+Every time a key is successfully negotiated, we upload the key to WireGuard.
+For this protocol extension, the `setup_osks()` function is thus defined as:
+
+```pseudorust
+fn setup_osks() {
+    // Generate WireGuard OSK (output shared key) from Rosenpass'
+    // perspective, respectively the PSK (preshared key) from
+    // WireGuard's perspective
+    let wireguard_psk = export_key("rosenpass.eu", "wireguard psk");
+
+    /// Supply the PSK to WireGuard
+    WireGuard::get_interface(wireguard_interface)
+        .get_peer(wireguard_peer)
+        .set_psk(wireguard_psk);
+}
+```
+
+The Rosenpass protocol uses key renegotiation, just like WireGuard.
+If no new `osk` is produced within a set amount of time, the OSK generated by Rosenpass times out.
+In this case, the WireGuard PSK must be overwritten with a random key.
+This interaction is visualized in Figure \ref{img:ExtWireguardPSKHybridSecurity}.
+
+```pseudorust
+fn on_key_timeout() {
+    // Generate a random – deliberately invalid – WireGuard PSK.
+    // Never use a fixed value here as this would lead to an attack!
+    let fake_wireguard_psk = random_key();
+
+    // Securely erase the PSK currently used by WireGuard by
+    // overwriting it with the fake key we just generated.
+    WireGuard::get_interface(wireguard_interface)
+        .get_peer(wireguard_peer)
+        .set_psk(fake_wireguard_psk);
+}
+```
+
+\setupimage{label=img:ExtWireguardPSKHybridSecurity,fullpage}
+![Rosenpass + WireGuard: Hybrid Security](graphics/rosenpass-wireguard-hybrid-security.pdf)
+
 # Changelog
 
 ### 0.3.x
 
+#### 2025-06-24 – Specifying the `osk` used for WireGuard as a protocol extension
+
+\vspace{0.5em}
+
+Author: Karolin varner
+
+PR: [#664](https://github.com/rosenpass/rosenpass/pull/664)
+
+\vspace{0.5em}
+
+We introduce the concept of protocol extensions to make the option of using Rosenpass for purposes other than encrypting WireGuard more explicit. This captures the status-quo in a better way and does not constitute a functional change of the protocol.
+
+When we designed the Rosenpass protocol, we built it with support for alternative `osk`-labels in mind.
+This is why we specified the domain separator for the `osk` to be `[PROTOCOL, "user", "rosenpass.eu", "wireguard psk"]`.
+By choosing alternative values for the namespace (e.g. `"myorg.eu"` instead of `"rosenpass.eu`) and the label (e.g. `"MyApp Symmetric Encryption"`), the protocol could easily accommodate alternative usage scenarios.
+
+By introducing the concept of protocol extensions, we make this possibility explicit.
+
+1. Reworded the abstract to make it clearer that Rosenpass can be used for other purposes than to secure WireGuard
+2. Reworded Section Symmetric Keys, adding references to the new section on protocol extension
+3. Added a `setup_osks()` function in section Hashes, to make the reference to protocol extensions explicit
+4. Added a new section on protocol extensions and the standard extension for using Rosenpass with WireGuard
+5. Added a new graphic to showcase how Rosenpass and WireGuard interact
+5. Minor formatting and intra-document references fixes
+
+#### 2025-05-22 - SHAKE256 keyed hash
+\vspace{0.5em}
+
+Author: David Niehues
+
+PR: [#653](https://github.com/rosenpass/rosenpass/pull/653)
+
+\vspace{0.5em}
+
+We document the support for SHAKE256 with prepended key as an alternative to BLAKE2s with HMAC.
+
+Previously, BLAKE2s with HMAC was the only supported keyed hash function. Recently, SHAKE256 was added as an option. SHAKE256 is used as a keyed hash function by prepending the key to the variable-length data and then evaluating SHAKE256.
+In order to maintain compatablity without introducing an explcit version number in the protocol messages, SHAKE256 is truncated to 32 bytes. In the update to the whitepaper, we explain where and how SHAKE256 is used. That is:
+
+1. We explain that SHAKE256 or BLAKE2s can be configured to be used on a peer basis.
+2. We explain under which circumstances, the reference implementation tries both hash functions for messages in order to determine the correct hash function.
+3. We document that the cookie mechanism always uses SHAKE256.
+
+
 #### 2024-10-30 – InitConf retransmission updates
 
 \vspace{0.5em}
 
-Author: Karolin Varner  
-Issue: [#331](https://github.com/rosenpass/rosenpass/issues/331)  
-PR: [#513](https://github.com/rosenpass/rosenpass/pull/513)  
+Author: Karolin Varner
+
+Issue: [#331](https://github.com/rosenpass/rosenpass/issues/331)
+
+PR: [#513](https://github.com/rosenpass/rosenpass/pull/513)
 
 \vspace{0.5em}
 
@@ -550,7 +728,7 @@ By removing all retransmission handling code from the cryptographic protocol, we
         The responder does not need to do anything special to handle RespHello retransmission – if the RespHello package is lost, the initiator retransmits InitHello and the responder can generate another RespHello package from that. InitConf retransmission needs to be handled specifically in the responder code because accepting an InitConf retransmission would reset the live session including the nonce counter, which would cause nonce reuse. Implementations must detect the case that `biscuit_no = biscuit_used` in ICR5, skip execution of ICR6 and ICR7, and just transmit another EmptyData package to confirm that the initiator can stop transmitting InitConf.
     \end{quote}
 
-    by 
+    by
 
     \begin{quote}
         The responder uses less complex form of the same mechanism: The responder never retransmits RespHello, instead the responder generates a new RespHello message if InitHello is retransmitted. Responder confirmation messages of completed handshake (EmptyData) messages are retransmitted by storing the most recent InitConf messages (or their hashes) and caching the associated EmptyData messages. Through this cache, InitConf retransmission is detected and the associated EmptyData message is retransmitted.
@@ -573,7 +751,7 @@ By removing all retransmission handling code from the cryptographic protocol, we
         \begin{minted}{pseudorust}
         // In December 2024, the InitConf retransmission mechanisim was redesigned
         // in a backwards-compatible way. See the changelog.
-        // 
+        //
         // -- 2024-11-30, Karolin Varner
         if (protocol_version!(< "0.3.0")) {
             // Ensure that the biscuit is used only once
@@ -587,9 +765,11 @@ By removing all retransmission handling code from the cryptographic protocol, we
 
 \vspace{0.5em}
 
-Author: Prabhpreet Dua  
-Issue: [#137](https://github.com/rosenpass/rosenpass/issues/137)  
-PR: [#142](https://github.com/rosenpass/rosenpass/pull/142)  
+Author: Prabhpreet Dua
+
+Issue: [#137](https://github.com/rosenpass/rosenpass/issues/137)
+
+PR: [#142](https://github.com/rosenpass/rosenpass/pull/142)
 
 \vspace{0.5em}
 

pkgs/example.toml

@@ -0,0 +1,9 @@
+dev = "rp-example"
+ip = "fc00::1/64"
+listen = "[::]:51821"
+private_keys_dir = "/run/credentials/rp@example.service"
+verbose = true
+
+[[peers]]
+public_keys_dir = "/etc/rosenpass/example/peers/client"
+allowed_ips = "fc00::2"

pkgs/package-deb.nix

@@ -0,0 +1,34 @@
+{
+  runCommand,
+  dpkg,
+  rosenpass,
+}:
+
+let
+  inherit (rosenpass) version;
+in
+
+runCommand "rosenpass-${version}.deb" { } ''
+  mkdir -p packageroot/DEBIAN
+
+  cat << EOF > packageroot/DEBIAN/control
+  Package: rosenpass
+  Version: ${version}
+  Architecture: all
+  Maintainer: Jacek Galowicz <jacek@galowicz.de>
+  Depends:
+  Description: Post-quantum-secure VPN tool Rosenpass
+    Rosenpass is a post-quantum-secure VPN
+    that uses WireGuard to transport the actual data.
+  EOF
+
+
+  mkdir -p packageroot/usr/bin
+  install -m755 -t packageroot/usr/bin ${rosenpass}/bin/*
+
+  mkdir -p packageroot/etc/rosenpass
+  cp -r ${rosenpass}/lib/systemd packageroot/etc/
+  cp ${./example.toml} packageroot/etc/rosenpass/example.toml
+
+  ${dpkg}/bin/dpkg --build packageroot $out
+''

pkgs/package-rpm.nix

@@ -0,0 +1,60 @@
+{
+  lib,
+  system,
+  runCommand,
+  rosenpass,
+  rpm,
+}:
+
+let
+  splitVersion = lib.strings.splitString "-" rosenpass.version;
+  version = builtins.head splitVersion;
+  release = if builtins.length splitVersion != 2 then "release" else builtins.elemAt splitVersion 1;
+  arch = builtins.head (builtins.split "-" system);
+in
+
+runCommand "rosenpass-${version}.rpm" { } ''
+  mkdir -p rpmbuild/SPECS
+
+  cat << EOF > rpmbuild/SPECS/rosenpass.spec
+  Name:           rosenpass
+  Release:        ${release}
+  Version:        ${version}
+  Summary:        Post-quantum-secure VPN key exchange
+  License:        Apache-2.0
+
+  %description
+  Post-quantum-secure VPN tool Rosenpass
+  Rosenpass is a post-quantum-secure VPN
+  that uses WireGuard to transport the actual data.
+
+  %files
+  /usr/bin/rosenpass
+  /usr/bin/rp
+  /etc/systemd/system/rosenpass.target
+  /etc/systemd/system/rosenpass@.service
+  /etc/systemd/system/rp@.service
+  /etc/rosenpass/example.toml
+  EOF
+
+  buildroot=rpmbuild/BUILDROOT/rosenpass-${version}-${release}.${arch}
+  mkdir -p $buildroot/usr/bin
+  install -m755 -t $buildroot/usr/bin ${rosenpass}/bin/*
+
+  mkdir -p $buildroot/etc/rosenpass
+  cp -r ${rosenpass}/lib/systemd $buildroot/etc/
+  chmod -R 744 $buildroot/etc/systemd
+  cp ${./example.toml} $buildroot/etc/rosenpass/example.toml
+
+  export HOME=/build
+  mkdir -p /build/tmp
+  ls -R rpmbuild
+
+  ${rpm}/bin/rpmbuild \
+    -bb \
+    --dbpath=$HOME \
+    --define "_tmppath /build/tmp" \
+    rpmbuild/SPECS/rosenpass.spec
+
+  cp rpmbuild/RPMS/${arch}/rosenpass*.rpm $out
+''

pkgs/release-package.nix

@@ -1,21 +1,24 @@
-{ lib, stdenvNoCC, runCommandNoCC, pkgsStatic, rosenpass, rosenpass-oci-image, rp } @ args:
+{
+  lib,
+  stdenvNoCC,
+  runCommandNoCC,
+  pkgsStatic,
+  rosenpass,
+  rosenpass-oci-image,
+  rp,
+}@args:
 
 let
   version = rosenpass.version;
 
   # select static packages on Linux, default packages otherwise
-  package =
-    if stdenvNoCC.hostPlatform.isLinux then
-      pkgsStatic.rosenpass
-    else args.rosenpass;
-  rp =
-    if stdenvNoCC.hostPlatform.isLinux then
-      pkgsStatic.rp
-    else args.rp;
+  package = if stdenvNoCC.hostPlatform.isLinux then pkgsStatic.rosenpass else args.rosenpass;
+  rp = if stdenvNoCC.hostPlatform.isLinux then pkgsStatic.rp else args.rp;
   oci-image =
     if stdenvNoCC.hostPlatform.isLinux then
       pkgsStatic.rosenpass-oci-image
-    else args.rosenpass-oci-image;
+    else
+      args.rosenpass-oci-image;
 in
 runCommandNoCC "lace-result" { } ''
   mkdir {bin,$out}

pkgs/rosenpass-oci-image.nix

@@ -1,4 +1,8 @@
-{ dockerTools, buildEnv, rosenpass }:
+{
+  dockerTools,
+  buildEnv,
+  rosenpass,
+}:
 
 dockerTools.buildImage {
   name = rosenpass.name + "-oci";

pkgs/rosenpass.nix

@@ -1,4 +1,13 @@
-{ lib, stdenv, rustPlatform, cmake, mandoc, removeReferencesTo, bash, package ? "rosenpass" }:
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  cmake,
+  mandoc,
+  removeReferencesTo,
+  bash,
+  package ? "rosenpass",
+}:
 
 let
   # whether we want to build a statically linked binary
@@ -17,24 +26,30 @@ let
       "toml"
     ];
     # Files to explicitly include
-    files = [
-      "to/README.md"
-    ];
+    files = [ "to/README.md" ];
 
     src = ../.;
-    filter = (path: type: scoped rec {
-      inherit (lib) any id removePrefix hasSuffix;
-      anyof = (any id);
+    filter = (
+      path: type:
+      scoped rec {
+        inherit (lib)
+          any
+          id
+          removePrefix
+          hasSuffix
+          ;
+        anyof = (any id);
 
-      basename = baseNameOf (toString path);
-      relative = removePrefix (toString src + "/") (toString path);
+        basename = baseNameOf (toString path);
+        relative = removePrefix (toString src + "/") (toString path);
 
-      result = anyof [
-        (type == "directory")
-        (any (ext: hasSuffix ".${ext}" basename) extensions)
-        (any (file: file == relative) files)
-      ];
-    });
+        result = anyof [
+          (type == "directory")
+          (any (ext: hasSuffix ".${ext}" basename) extensions)
+          (any (file: file == relative) files)
+        ];
+      }
+    );
 
     result = lib.sources.cleanSourceWith { inherit src filter; };
   };
@@ -47,10 +62,14 @@ rustPlatform.buildRustPackage {
   version = cargoToml.package.version;
   inherit src;
 
-  cargoBuildOptions = [ "--package" package ];
-  cargoTestOptions = [ "--package" package ];
-
-  buildFeatures = [ "experiment_api" ];
+  cargoBuildOptions = [
+    "--package"
+    package
+  ];
+  cargoTestOptions = [
+    "--package"
+    package
+  ];
 
   doCheck = true;
 
@@ -59,6 +78,8 @@ rustPlatform.buildRustPackage {
     outputHashes = {
       "memsec-0.6.3" = "sha256-4ri+IEqLd77cLcul3lZrmpDKj4cwuYJ8oPRAiQNGeLw=";
       "uds-0.4.2" = "sha256-qlxr/iJt2AV4WryePIvqm/8/MK/iqtzegztNliR93W8=";
+      "libcrux-blake2-0.0.3-pre" = "sha256-0CLjuzwJqGooiODOHf5D8Hc8ClcG/XcGvVGyOVnLmJY=";
+      "libcrux-macros-0.0.3" = "sha256-Tb5uRirwhRhoFEK8uu1LvXl89h++40pxzZ+7kXe8RAI=";
     };
   };
 
@@ -82,7 +103,10 @@ rustPlatform.buildRustPackage {
 
   meta = {
     inherit (cargoToml.package) description homepage;
-    license = with lib.licenses; [ mit asl20 ];
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
     maintainers = [ lib.maintainers.wucke13 ];
     platforms = lib.platforms.all;
   };

pkgs/whitepaper.nix

@@ -1,13 +1,53 @@
-{ stdenvNoCC, texlive, ncurses, python3Packages, which }:
+{
+  stdenvNoCC,
+  texlive,
+  ncurses,
+  python3Packages,
+  which,
+}:
 
 let
-  customTexLiveSetup = (texlive.combine {
-    inherit (texlive) acmart amsfonts biber biblatex biblatex-software
-      biblatex-trad ccicons csquotes csvsimple doclicense eso-pic fancyvrb
-      fontspec gitinfo2 gobble ifmtarg koma-script latexmk lm lualatex-math
-      markdown mathtools minted noto nunito paralist pgf scheme-basic soul
-      unicode-math upquote xifthen xkeyval xurl;
-  });
+  customTexLiveSetup = (
+    texlive.combine {
+      inherit (texlive)
+        acmart
+        amsfonts
+        biber
+        biblatex
+        biblatex-software
+        biblatex-trad
+        ccicons
+        csquotes
+        csvsimple
+        doclicense
+        eso-pic
+        fancyvrb
+        fontspec
+        gitinfo2
+        gobble
+        ifmtarg
+        koma-script
+        latexmk
+        lm
+        lualatex-math
+        markdown
+        mathtools
+        minted
+        noto
+        nunito
+        paralist
+        pgf
+        scheme-basic
+        soul
+        unicode-math
+        upquote
+        xifthen
+        xkeyval
+        xurl
+        dirtytalk
+        ;
+    }
+  );
 in
 stdenvNoCC.mkDerivation {
   name = "whitepaper";

readme.md

@@ -14,7 +14,7 @@ This repository contains
 
 ## Getting started
 
-First, [install rosenpass](#Getting-Rosenpass). Then, check out the help functions of `rp` & `rosenpass`:
+First, [install rosenpass](#getting-rosenpass). Then, check out the help functions of `rp` & `rosenpass`:
 
 ```sh
 rp help
@@ -64,11 +64,7 @@ The analysis is implemented according to modern software engineering principles:
 The code uses a variety of optimizations to speed up analysis such as using secret functions to model trusted/malicious setup. We split the model into two separate entry points which can be analyzed in parallel. Each is much faster than both models combined.
 A wrapper script provides instant feedback about which queries execute as expected in color: A red cross if a query fails and a green check if it succeeds.
 
-[^liboqs]: https://openquantumsafe.org/liboqs/
-[^wg]: https://www.wireguard.com/
-[^pqwg]: https://eprint.iacr.org/2020/379
-[^pqwg-statedis]: Unless supplied with a pre-shared-key, but this defeats the purpose of a key exchange protocol
-[^wg-statedis]: https://lists.zx2c4.com/pipermail/wireguard/2021-August/006916.htmlA
+[^liboqs]: <https://openquantumsafe.org/liboqs/>
 
 # Getting Rosenpass
 
@@ -78,6 +74,56 @@ Rosenpass is packaged for more and more distributions, maybe also for the distri
 
 [![Packaging status](https://repology.org/badge/vertical-allrepos/rosenpass.svg)](https://repology.org/project/rosenpass/versions)
 
+## Docker Images
+
+Rosenpass is also available as prebuilt Docker images:
+
+- [`ghcr.io/rosenpass/rosenpass`](https://github.com/rosenpass/rosenpass/pkgs/container/rosenpass)
+- [`ghcr.io/rosenpass/rp`](https://github.com/rosenpass/rosenpass/pkgs/container/rp)
+
+For details on how to use these images, refer to the [Docker usage guide](docker/USAGE.md).
+
+## Benchmarks
+
+This repository contains facilities for benchmarking both the Rosenpass
+protocol code and the implementations of the cryptographic primitives used
+by it. The primitives are benchmarked using criterion. For the protocol code
+benchmarks we use a library for instrumenting the code such that events are
+written to a trace, which is then inspected after a run.
+
+Benchmarks are automatically run on CI. The measurements are visualized in the
+[Benchmark Dashboard].
+
+[Benchmark Dashboard]: https://rosenpass.github.io/rosenpass/benchmarks
+
+### Primitive Benchmarks
+
+There are benchmarks for the functions of the traits `Kem`, `Aead` and
+`KeyedHash`. They are run for all implementations in the `primitives`
+benchmark of `rosenpass-ciphers`. Run the benchmarks and view their results using
+
+```
+cargo bench -p rosenpass-ciphers --bench primitives -F bench
+```
+
+Note that the `bench` feature enables the inclusion of the libcrux-backed
+trait implementations in the module tree, but does not enable them
+as default.
+
+### Protocol Benchmarks
+
+The trace that is being written to lives in a new module
+`trace_bench` in the util crate. A basic benchmark that
+performs some minor statistical analysis of the trace can be run using
+
+```
+cargo bench -p rosenpass --bench trace_handshake -F trace_bench
+```
+
+This runs the benchmarks and prints the results in machine-readable JSON.
+
+---
+
 # Mirrors
 
 Don't want to use GitHub or only have an IPv6 connection? Rosenpass has set up two mirrors for this:

rosenpass/Cargo.toml

@@ -8,6 +8,7 @@ description = "Build post-quantum-secure VPNs with WireGuard!"
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77.0"
 
 [[bin]]
 name = "rosenpass"
@@ -28,7 +29,16 @@ required-features = ["experiment_api", "internal_testing"]
 
 [[test]]
 name = "gen-ipc-msg-types"
-required-features = ["experiment_api", "internal_testing", "internal_bin_gen_ipc_msg_types"]
+required-features = [
+  "experiment_api",
+  "internal_testing",
+  "internal_bin_gen_ipc_msg_types",
+]
+
+[[bench]]
+name = "trace_handshake"
+harness = false
+required-features = ["trace_bench"]
 
 [[bench]]
 name = "handshake"
@@ -67,6 +77,7 @@ command-fds = { workspace = true, optional = true }
 rustix = { workspace = true, optional = true }
 uds = { workspace = true, optional = true, features = ["mio_1xx"] }
 signal-hook = { workspace = true, optional = true }
+libcrux-test-utils = { workspace = true, optional = true }
 
 [build-dependencies]
 anyhow = { workspace = true }
@@ -81,20 +92,27 @@ tempfile = { workspace = true }
 rustix = { workspace = true }
 
 [features]
-default = []
+#default = ["experiment_libcrux_all"]
+experiment_cookie_dos_mitigation = []
 experiment_memfd_secret = ["rosenpass-wireguard-broker/experiment_memfd_secret"]
-experiment_libcrux = ["rosenpass-ciphers/experiment_libcrux"]
+experiment_libcrux_all = ["rosenpass-ciphers/experiment_libcrux_all"]
+experiment_libcrux_blake2 = ["rosenpass-ciphers/experiment_libcrux_blake2"]
+experiment_libcrux_chachapoly = [
+  "rosenpass-ciphers/experiment_libcrux_chachapoly",
+]
+experiment_libcrux_kyber = ["rosenpass-ciphers/experiment_libcrux_kyber"]
 experiment_api = [
-    "hex-literal",
-    "uds",
-    "command-fds",
-    "rustix",
-    "rosenpass-util/experiment_file_descriptor_passing",
-    "rosenpass-wireguard-broker/experiment_api",
+  "hex-literal",
+  "uds",
+  "command-fds",
+  "rustix",
+  "rosenpass-util/experiment_file_descriptor_passing",
+  "rosenpass-wireguard-broker/experiment_api",
 ]
 internal_signal_handling_for_coverage_reports = ["signal-hook"]
 internal_testing = []
 internal_bin_gen_ipc_msg_types = ["hex", "heck"]
+trace_bench = ["rosenpass-util/trace_bench", "dep:libcrux-test-utils"]
 
 [lints.rust]
 unexpected_cfgs = { level = "allow", check-cfg = ['cfg(coverage)'] }

rosenpass/benches/handshake.rs

@@ -1,13 +1,16 @@
-use anyhow::Result;
-use rosenpass::protocol::{CryptoServer, HandleMsgResult, MsgBuf, PeerPtr, SPk, SSk, SymKey};
 use std::ops::DerefMut;
 
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::StaticKem;
-
+use anyhow::Result;
 use criterion::{black_box, criterion_group, criterion_main, Criterion};
+
+use rosenpass_cipher_traits::primitives::Kem;
+use rosenpass_ciphers::StaticKem;
 use rosenpass_secret_memory::secret_policy_try_use_memfd_secrets;
 
+use rosenpass::protocol::basic_types::{MsgBuf, SPk, SSk, SymKey};
+use rosenpass::protocol::osk_domain_separator::OskDomainSeparator;
+use rosenpass::protocol::{CryptoServer, HandleMsgResult, PeerPtr, ProtocolVersion};
+
 fn handle(
     tx: &mut CryptoServer,
     msgb: &mut MsgBuf,
@@ -41,25 +44,43 @@ fn hs(ini: &mut CryptoServer, res: &mut CryptoServer) -> Result<()> {
 
 fn keygen() -> Result<(SSk, SPk)> {
     let (mut sk, mut pk) = (SSk::zero(), SPk::zero());
-    StaticKem::keygen(sk.secret_mut(), pk.deref_mut())?;
+    StaticKem.keygen(sk.secret_mut(), pk.deref_mut())?;
     Ok((sk, pk))
 }
 
-fn make_server_pair() -> Result<(CryptoServer, CryptoServer)> {
+fn make_server_pair(protocol_version: ProtocolVersion) -> Result<(CryptoServer, CryptoServer)> {
     let psk = SymKey::random();
     let ((ska, pka), (skb, pkb)) = (keygen()?, keygen()?);
     let (mut a, mut b) = (
         CryptoServer::new(ska, pka.clone()),
         CryptoServer::new(skb, pkb.clone()),
     );
-    a.add_peer(Some(psk.clone()), pkb)?;
-    b.add_peer(Some(psk), pka)?;
+    a.add_peer(
+        Some(psk.clone()),
+        pkb,
+        protocol_version.clone(),
+        OskDomainSeparator::default(),
+    )?;
+    b.add_peer(
+        Some(psk),
+        pka,
+        protocol_version,
+        OskDomainSeparator::default(),
+    )?;
     Ok((a, b))
 }
 
-fn criterion_benchmark(c: &mut Criterion) {
+fn criterion_benchmark_v02(c: &mut Criterion) {
+    criterion_benchmark(c, ProtocolVersion::V02)
+}
+
+fn criterion_benchmark_v03(c: &mut Criterion) {
+    criterion_benchmark(c, ProtocolVersion::V03)
+}
+
+fn criterion_benchmark(c: &mut Criterion, protocol_version: ProtocolVersion) {
     secret_policy_try_use_memfd_secrets();
-    let (mut a, mut b) = make_server_pair().unwrap();
+    let (mut a, mut b) = make_server_pair(protocol_version).unwrap();
     c.bench_function("cca_secret_alloc", |bench| {
         bench.iter(|| {
             SSk::zero();
@@ -82,5 +103,6 @@ fn criterion_benchmark(c: &mut Criterion) {
     });
 }
 
-criterion_group!(benches, criterion_benchmark);
-criterion_main!(benches);
+criterion_group!(benches_v02, criterion_benchmark_v02);
+criterion_group!(benches_v03, criterion_benchmark_v03);
+criterion_main!(benches_v02, benches_v03);

rosenpass/benches/trace_handshake.rs

@@ -0,0 +1,393 @@
+use std::io::{self, Write};
+use std::time::{Duration, Instant};
+use std::{collections::HashMap, hint::black_box, ops::DerefMut};
+
+use anyhow::Result;
+
+use libcrux_test_utils::tracing::{EventType, Trace as _};
+
+use rosenpass_cipher_traits::primitives::Kem;
+use rosenpass_ciphers::StaticKem;
+use rosenpass_secret_memory::secret_policy_try_use_memfd_secrets;
+use rosenpass_util::trace_bench::RpEventType;
+
+use rosenpass::protocol::basic_types::{MsgBuf, SPk, SSk, SymKey};
+use rosenpass::protocol::osk_domain_separator::OskDomainSeparator;
+use rosenpass::protocol::{CryptoServer, HandleMsgResult, PeerPtr, ProtocolVersion};
+
+const ITERATIONS: usize = 100;
+
+/// Performs a full protocol run by processing a message and recursing into handling that message,
+/// until no further response is produced. Returns the keys produce by the two parties.
+///
+/// Ensures that each party produces one of the two keys.
+fn handle(
+    tx: &mut CryptoServer,
+    msgb: &mut MsgBuf,
+    msgl: usize,
+    rx: &mut CryptoServer,
+    resb: &mut MsgBuf,
+) -> Result<(Option<SymKey>, Option<SymKey>)> {
+    let HandleMsgResult {
+        exchanged_with: xch,
+        resp,
+    } = rx.handle_msg(&msgb[..msgl], &mut **resb)?;
+
+    assert!(matches!(xch, None | Some(PeerPtr(0))));
+
+    let xch = xch.map(|p| rx.osk(p).unwrap());
+
+    let (rxk, txk) = resp
+        .map(|resl| handle(rx, resb, resl, tx, msgb))
+        .transpose()?
+        .unwrap_or((None, None));
+
+    assert!(rxk.is_none() || xch.is_none());
+
+    Ok((txk, rxk.or(xch)))
+}
+
+/// Performs the full handshake by calling `handle` with the correct values, based on just two
+/// `CryptoServer`s.
+///
+/// Ensures that both parties compute the same keys.
+fn hs(ini: &mut CryptoServer, res: &mut CryptoServer) -> Result<()> {
+    let (mut inib, mut resb) = (MsgBuf::zero(), MsgBuf::zero());
+    let sz = ini.initiate_handshake(PeerPtr(0), &mut *inib)?;
+    let (kini, kres) = handle(ini, &mut inib, sz, res, &mut resb)?;
+    assert!(kini.unwrap().secret() == kres.unwrap().secret());
+    Ok(())
+}
+
+/// Generates a new key pair.
+fn keygen() -> Result<(SSk, SPk)> {
+    let (mut sk, mut pk) = (SSk::zero(), SPk::zero());
+    StaticKem.keygen(sk.secret_mut(), pk.deref_mut())?;
+    Ok((sk, pk))
+}
+
+/// Creates two instanves of `CryptoServer`, generating key pairs for each.
+fn make_server_pair(protocol_version: ProtocolVersion) -> Result<(CryptoServer, CryptoServer)> {
+    let psk = SymKey::random();
+    let ((ska, pka), (skb, pkb)) = (keygen()?, keygen()?);
+    let (mut a, mut b) = (
+        CryptoServer::new(ska, pka.clone()),
+        CryptoServer::new(skb, pkb.clone()),
+    );
+    a.add_peer(
+        Some(psk.clone()),
+        pkb,
+        protocol_version.clone(),
+        OskDomainSeparator::default(),
+    )?;
+    b.add_peer(
+        Some(psk),
+        pka,
+        protocol_version,
+        OskDomainSeparator::default(),
+    )?;
+    Ok((a, b))
+}
+
+fn main() {
+    let trace = rosenpass_util::trace_bench::trace();
+
+    // Attempt to use memfd_secrets for storing sensitive key material
+    secret_policy_try_use_memfd_secrets();
+
+    // Run protocol for V02
+    let (mut a_v02, mut b_v02) = make_server_pair(ProtocolVersion::V02).unwrap();
+    for _ in 0..ITERATIONS {
+        hs(black_box(&mut a_v02), black_box(&mut b_v02)).unwrap();
+    }
+
+    // Emit a marker event to separate V02 and V03 trace sections
+    trace.emit_on_the_fly("start-hs-v03");
+
+    // Run protocol for V03
+    let (mut a_v03, mut b_v03) = make_server_pair(ProtocolVersion::V03).unwrap();
+    for _ in 0..ITERATIONS {
+        hs(black_box(&mut a_v03), black_box(&mut b_v03)).unwrap();
+    }
+
+    // Collect the trace events generated during the handshakes
+    let trace: Vec<_> = trace.clone().report();
+
+    // Split the trace into V02 and V03 sections based on the marker
+    let (trace_v02, trace_v03) = {
+        let cutoff = trace
+            .iter()
+            .position(|entry| entry.label == "start-hs-v03")
+            .unwrap();
+        // Exclude the marker itself from the V03 trace
+        let (v02, v03_with_marker) = trace.split_at(cutoff);
+        (v02, &v03_with_marker[1..])
+    };
+
+    // Perform statistical analysis on both trace sections and write results as JSON
+    write_json_arrays(
+        &mut std::io::stdout(), // Write to standard output
+        vec![
+            ("V02", statistical_analysis(trace_v02.to_vec())),
+            ("V03", statistical_analysis(trace_v03.to_vec())),
+        ],
+    )
+    .expect("error writing json data");
+}
+
+/// Performs a simple statistical analysis:
+/// - bins trace events by label
+/// - extracts durations of spamns
+/// - filters out empty bins
+/// - calculates aggregate statistics (mean, std dev)
+fn statistical_analysis(trace: Vec<RpEventType>) -> Vec<(&'static str, AggregateStat<Duration>)> {
+    bin_events(trace)
+        .into_iter()
+        .map(|(label, spans)| (label, extract_span_durations(label, spans.as_slice())))
+        .filter(|(_, durations)| !durations.is_empty())
+        .map(|(label, durations)| (label, AggregateStat::analyze_durations(&durations)))
+        .collect()
+}
+
+/// Takes an iterator of ("protocol_version", iterator_of_stats) pairs and writes them
+/// as a single flat JSON array to the provided writer.
+///
+/// # Arguments
+/// * `w` - The writer to output JSON to (e.g., stdout, file).
+/// * `item_groups` - An iterator producing tuples `(version, stats): (&'static str, II)`.
+///    Here `II` is itself an iterator producing `(label, agg_stat): (&'static str, AggregateStat<Duration>)`,
+///    where the label is the label of the span, e.g. "IHI2".
+///
+/// # Type Parameters
+/// * `W` - A type that implements `std::io::Write`.
+/// * `II` - An iterator type yielding (`&'static str`, `AggregateStat<Duration>`).
+fn write_json_arrays<W: Write, II: IntoIterator<Item = (&'static str, AggregateStat<Duration>)>>(
+    w: &mut W,
+    item_groups: impl IntoIterator<Item = (&'static str, II)>,
+) -> io::Result<()> {
+    // Flatten the groups into a single iterator of (protocol_version, label, stats)
+    let iter = item_groups.into_iter().flat_map(|(version, items)| {
+        items
+            .into_iter()
+            .map(move |(label, agg_stat)| (version, label, agg_stat))
+    });
+    let mut delim = ""; // Start with no delimiter
+
+    // Start the JSON array
+    write!(w, "[")?;
+
+    // Write the flattened statistics as JSON objects, separated by commas.
+    for (version, label, agg_stat) in iter {
+        write!(w, "{delim}")?; // Write delimiter (empty for first item, "," for subsequent)
+        agg_stat.write_json_ns(label, version, w)?; // Write the JSON object for the stat entry
+        delim = ","; // Set delimiter for the next iteration
+    }
+
+    // End the JSON array
+    write!(w, "]")
+}
+
+/// Used to group benchmark results in visualizations
+enum RunTimeGroup {
+    /// For particularly long operations.
+    Long,
+    /// Operations of moderate duration.
+    Medium,
+    /// Operations expected to complete under a millisecond.
+    BelowMillisec,
+    /// Very fast operations, likely under a microsecond.
+    BelowMicrosec,
+}
+
+impl std::fmt::Display for RunTimeGroup {
+    /// Used when writing the group information to JSON output.
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let txt = match self {
+            RunTimeGroup::Long => "long",
+            RunTimeGroup::Medium => "medium",
+            RunTimeGroup::BelowMillisec => "below 1ms",
+            RunTimeGroup::BelowMicrosec => "below 1us",
+        };
+        write!(f, "{txt}")
+    }
+}
+
+/// Maps specific internal timing labels (likely from rosenpass internals)
+/// to the broader SpanGroup categories.
+fn run_time_group(label: &str) -> RunTimeGroup {
+    match label {
+        // Explicitly categorized labels based on expected performance characteristics
+        "handle_init_hello" | "handle_resp_hello" | "RHI5" | "IHR5" => RunTimeGroup::Long,
+        "RHR1" | "IHI2" | "ICR6" => RunTimeGroup::BelowMicrosec,
+        "RHI6" | "ICI7" | "ICR7" | "RHR3" | "ICR3" | "IHR8" | "ICI4" | "RHI3" | "RHI4" | "RHR4"
+        | "RHR7" | "ICI3" | "IHI3" | "IHI8" | "ICR2" | "ICR4" | "IHR4" | "IHR6" | "IHI4"
+        | "RHI7" => RunTimeGroup::BelowMillisec,
+        // Default protocol_version for any other labels
+        _ => RunTimeGroup::Medium,
+    }
+}
+
+/// Used temporarily within `extract_span_durations` to track open spans
+/// and calculated durations.
+#[derive(Debug, Clone)]
+enum StatEntry {
+    /// Represents an unmatched SpanOpen event with its timestamp.
+    Start(Instant),
+    /// Represents a completed span with its calculated duration.
+    Duration(Duration),
+}
+
+/// Takes a flat list of events and organizes them into a HashMap where keys
+/// are event labels and values are vectors of events with that label.
+fn bin_events(events: Vec<RpEventType>) -> HashMap<&'static str, Vec<RpEventType>> {
+    let mut spans = HashMap::<_, Vec<_>>::new();
+    for event in events {
+        // Get the vector for the event's label, or create a new one
+        let spans_for_label = spans.entry(event.label).or_default();
+        // Add the event to the vector
+        spans_for_label.push(event);
+    }
+    spans
+}
+
+/// Processes a list of events (assumed to be for the same label), matching
+/// `SpanOpen` and `SpanClose` events to calculate the duration of each span.
+/// It handles potentially interleaved spans correctly.
+fn extract_span_durations(label: &str, events: &[RpEventType]) -> Vec<Duration> {
+    let mut processing_list: Vec<StatEntry> = vec![]; // List to track open spans and final durations
+
+    for entry in events {
+        match &entry.ty {
+            EventType::SpanOpen => {
+                // Record the start time of a new span
+                processing_list.push(StatEntry::Start(entry.at));
+            }
+            EventType::SpanClose => {
+                // Find the most recent unmatched 'Start' entry
+                let start_index = processing_list
+                    .iter()
+                    .rposition(|span| matches!(span, StatEntry::Start(_))); // Find last Start
+
+                match start_index {
+                    Some(index) => {
+                        // Retrieve the start time
+                        let start_time = match processing_list[index] {
+                            StatEntry::Start(t) => t,
+                            _ => unreachable!(), // Should always be Start based on rposition logic
+                        };
+                        // Calculate duration and replace the 'Start' entry with 'Duration'
+                        processing_list[index] = StatEntry::Duration(entry.at - start_time);
+                    }
+                    None => {
+                        // This should not happen with well-formed traces
+                        eprintln!(
+                            "Warning: Found SpanClose without a matching SpanOpen for label '{}': {:?}",
+                            label, entry
+                        );
+                    }
+                }
+            }
+            EventType::OnTheFly => {
+                // Ignore OnTheFly events for duration calculation
+            }
+        }
+    }
+
+    // Collect all calculated durations, reporting any unmatched starts
+    processing_list
+        .into_iter()
+        .filter_map(|span| match span {
+            StatEntry::Start(at) => {
+                // Report error if a span was opened but never closed
+                eprintln!(
+                    "Warning: Unmatched SpanOpen at {:?} for label '{}'",
+                    at, label
+                );
+                None // Discard unmatched starts
+            }
+            StatEntry::Duration(dur) => Some(dur), // Keep calculated durations
+        })
+        .collect()
+}
+
+/// Stores the mean, standard deviation, relative standard deviation (sd/mean),
+/// and the number of samples used for calculation.
+#[derive(Debug)]
+struct AggregateStat<T> {
+    /// Average duration.
+    mean_duration: T,
+    /// Standard deviation of durations.
+    sd_duration: T,
+    /// Standard deviation as a percentage of the mean.
+    sd_by_mean: String,
+    /// Number of duration measurements.
+    sample_size: usize,
+}
+
+impl AggregateStat<Duration> {
+    /// Calculates mean, variance, and standard deviation for a slice of Durations.
+    fn analyze_durations(durations: &[Duration]) -> Self {
+        let sample_size = durations.len();
+        assert!(sample_size > 0, "Cannot analyze empty duration slice");
+
+        // Calculate the sum of durations
+        let sum: Duration = durations.iter().sum();
+        // Calculate the mean duration
+        let mean = sum / (sample_size as u32);
+
+        // Calculate mean in nanoseconds, adding 1 to avoid potential division by zero later
+        // (though highly unlikely with realistic durations)
+        let mean_ns = mean.as_nanos().saturating_add(1);
+
+        // Calculate variance (sum of squared differences from the mean) / N
+        let variance = durations
+            .iter()
+            .map(Duration::as_nanos)
+            .map(|d_ns| d_ns.abs_diff(mean_ns).pow(2)) // (duration_ns - mean_ns)^2
+            .sum::<u128>() // Sum of squares
+            / (sample_size as u128); // Divide by sample size
+
+        // Calculate standard deviation (sqrt of variance)
+        let sd_ns = (variance as f64).sqrt() as u128;
+        let sd = Duration::from_nanos(sd_ns as u64); // Convert back to Duration
+
+        // Calculate relative standard deviation (sd / mean) as a percentage string
+        let sd_rel_permille = (10000 * sd_ns).checked_div(mean_ns).unwrap_or(0); // Calculate sd/mean * 10000
+        let sd_rel_formatted = format!("{}.{:02}%", sd_rel_permille / 100, sd_rel_permille % 100);
+
+        AggregateStat {
+            mean_duration: mean,
+            sd_duration: sd,
+            sd_by_mean: sd_rel_formatted,
+            sample_size,
+        }
+    }
+
+    /// Writes the statistics as a JSON object to the provided writer.
+    /// Includes metadata like label, protocol_version, OS, architecture, and run time group.
+    ///
+    /// # Arguments
+    /// * `label` - The specific benchmark/span label.
+    /// * `protocol_version` - Version of the protocol that is benchmarked.
+    /// * `w` - The output writer (must implement `std::io::Write`).
+    fn write_json_ns(
+        &self,
+        label: &str,
+        protocol_version: &str,
+        w: &mut impl io::Write,
+    ) -> io::Result<()> {
+        // Format the JSON string using measured values and environment constants
+        writeln!(
+            w,
+            r#"{{"name":"{name}", "unit":"ns/iter", "value":"{value}", "range":"± {range}", "protocol version":"{protocol_version}", "sample size":"{sample_size}", "operating system":"{os}", "architecture":"{arch}", "run time":"{run_time}"}}"#,
+            name = label,                          // Benchmark name
+            value = self.mean_duration.as_nanos(), // Mean duration in nanoseconds
+            range = self.sd_duration.as_nanos(),   // Standard deviation in nanoseconds
+            sample_size = self.sample_size,        // Number of samples
+            os = std::env::consts::OS,             // Operating system
+            arch = std::env::consts::ARCH,         // CPU architecture
+            run_time = run_time_group(label),      // Run time group category (long, medium, etc.)
+            protocol_version = protocol_version // Overall protocol_version (e.g., protocol version)
+        )
+    }
+}

rosenpass/src/api/api_handler.rs

@@ -158,10 +158,10 @@ where
             );
 
             // Actually read the secrets
-            let mut sk = crate::protocol::SSk::zero();
+            let mut sk = crate::protocol::basic_types::SSk::zero();
             sk_io.read_exact_til_end(sk.secret_mut()).einvalid_req()?;
 
-            let mut pk = crate::protocol::SPk::zero();
+            let mut pk = crate::protocol::basic_types::SPk::zero();
             pk_io.read_exact_til_end(pk.borrow_mut()).einvalid_req()?;
 
             // Retrieve the construction site

rosenpass/src/api/config.rs

@@ -8,6 +8,7 @@ use crate::app_server::AppServer;
 
 /// Configuration options for the Rosenpass API
 #[derive(Debug, Serialize, Deserialize, Default, Clone, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
 pub struct ApiConfig {
     /// Where in the file-system to create the unix socket the rosenpass API will be listening for
     /// connections on

rosenpass/src/app_server.rs

@@ -1,55 +1,34 @@
-/// This contains the bulk of the rosenpass server IO handling code whereas
-/// the actual cryptographic code lives in the [crate::protocol] module
-use anyhow::bail;
+//! This contains the bulk of the rosenpass server IO handling code whereas
+//! the actual cryptographic code lives in the [crate::protocol] module
 
-use anyhow::Context;
-use anyhow::Result;
+use std::collections::{HashMap, VecDeque};
+use std::io::{stdout, ErrorKind, Write};
+use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV4, SocketAddrV6, ToSocketAddrs};
+use std::time::{Duration, Instant};
+use std::{cell::Cell, fmt::Debug, io, path::PathBuf, slice};
+
+use anyhow::{bail, Context, Result};
 use derive_builder::Builder;
 use log::{error, info, warn};
-use mio::Interest;
-use mio::Token;
-use rosenpass_secret_memory::Public;
-use rosenpass_secret_memory::Secret;
-use rosenpass_util::build::ConstructionSite;
-use rosenpass_util::file::StoreValueB64;
-use rosenpass_util::functional::run;
-use rosenpass_util::functional::ApplyExt;
-use rosenpass_util::io::IoResultKindHintExt;
-use rosenpass_util::io::SubstituteForIoErrorKindExt;
-use rosenpass_util::option::SomeExt;
-use rosenpass_util::result::OkExt;
-use rosenpass_wireguard_broker::WireguardBrokerMio;
-use rosenpass_wireguard_broker::{WireguardBrokerCfg, WG_KEY_LEN};
+use mio::{Interest, Token};
 use zerocopy::AsBytes;
 
-use std::cell::Cell;
-
-use std::collections::HashMap;
-use std::collections::VecDeque;
-use std::fmt::Debug;
-use std::io;
-use std::io::stdout;
-use std::io::ErrorKind;
-use std::io::Write;
-use std::net::Ipv4Addr;
-use std::net::Ipv6Addr;
-use std::net::SocketAddr;
-use std::net::SocketAddrV4;
-use std::net::SocketAddrV6;
-use std::net::ToSocketAddrs;
-use std::path::PathBuf;
-use std::slice;
-use std::time::Duration;
-use std::time::Instant;
-
-use crate::protocol::BuildCryptoServer;
-use crate::protocol::HostIdentification;
-use crate::{
-    config::Verbosity,
-    protocol::{CryptoServer, MsgBuf, PeerPtr, SPk, SSk, SymKey, Timing},
-};
 use rosenpass_util::attempt;
-use rosenpass_util::b64::B64Display;
+use rosenpass_util::functional::{run, ApplyExt};
+use rosenpass_util::io::{IoResultKindHintExt, SubstituteForIoErrorKindExt};
+use rosenpass_util::{
+    b64::B64Display, build::ConstructionSite, file::StoreValueB64, option::SomeExt, result::OkExt,
+};
+
+use rosenpass_secret_memory::{Public, Secret};
+use rosenpass_wireguard_broker::{WireguardBrokerCfg, WireguardBrokerMio, WG_KEY_LEN};
+
+use crate::config::{ProtocolVersion, Verbosity};
+
+use crate::protocol::basic_types::{MsgBuf, SPk, SSk, SymKey};
+use crate::protocol::osk_domain_separator::OskDomainSeparator;
+use crate::protocol::timing::Timing;
+use crate::protocol::{BuildCryptoServer, CryptoServer, HostIdentification, PeerPtr};
 
 /// The maximum size of a base64 encoded symmetric key (estimate)
 pub const MAX_B64_KEY_SIZE: usize = 32 * 5 / 3;
@@ -332,7 +311,7 @@ pub struct AppServer {
     ///
     /// Because the API supports initializing the server with a keypair
     /// and CryptoServer needs to be initialized with a keypair, the struct
-    /// struct is wrapped in a ConstructionSite
+    /// is wrapped in a ConstructionSite
     pub crypto_site: ConstructionSite<BuildCryptoServer, CryptoServer>,
     /// The UDP sockets used to send and receive protocol messages
     pub sockets: Vec<mio::net::UdpSocket>,
@@ -1035,6 +1014,7 @@ impl AppServer {
     /// # Examples
     ///
     /// See [Self::new].
+    #[allow(clippy::too_many_arguments)]
     pub fn add_peer(
         &mut self,
         psk: Option<SymKey>,
@@ -1042,11 +1022,17 @@ impl AppServer {
         outfile: Option<PathBuf>,
         broker_peer: Option<BrokerPeer>,
         hostname: Option<String>,
+        protocol_version: ProtocolVersion,
+        osk_domain_separator: OskDomainSeparator,
     ) -> anyhow::Result<AppPeerPtr> {
         let PeerPtr(pn) = match &mut self.crypto_site {
             ConstructionSite::Void => bail!("Crypto server construction site is void"),
-            ConstructionSite::Builder(builder) => builder.add_peer(psk, pk),
-            ConstructionSite::Product(srv) => srv.add_peer(psk, pk)?,
+            ConstructionSite::Builder(builder) => {
+                builder.add_peer(psk, pk, protocol_version, osk_domain_separator)
+            }
+            ConstructionSite::Product(srv) => {
+                srv.add_peer(psk, pk, protocol_version.into(), osk_domain_separator)?
+            }
         };
         assert!(pn == self.peers.len());
 
@@ -1262,7 +1248,7 @@ impl AppServer {
     }
 
     /// Used as a helper by [Self::event_loop_without_error_handling] when
-    /// a new output key has been echanged
+    /// a new output key has been exchanged
     pub fn output_key(
         &mut self,
         peer: AppPeerPtr,
@@ -1335,7 +1321,7 @@ impl AppServer {
                     break A::SendRetransmission(AppPeerPtr(no))
                 }
                 Some(C::Sleep(timeout)) => timeout, // No event from crypto-server, do IO
-                None => crate::protocol::UNENDING,  // Crypto server is uninitialized, do IO
+                None => crate::protocol::timing::UNENDING, // Crypto server is uninitialized, do IO
             };
 
             // Perform IO (look for a message)

rosenpass/src/bin/gen-ipc-msg-types.rs

@@ -1,6 +1,7 @@
 use anyhow::{Context, Result};
 use heck::ToShoutySnakeCase;
 
+use rosenpass_ciphers::subtle::keyed_hash::KeyedHash;
 use rosenpass_ciphers::{hash_domain::HashDomain, KEY_LEN};
 
 /// Recursively calculate a concrete hash value for an API message type
@@ -12,12 +13,12 @@ fn calculate_hash_value(hd: HashDomain, values: &[&str]) -> Result<[u8; KEY_LEN]
 }
 
 /// Print a hash literal for pasting into the Rosenpass source code
-fn print_literal(path: &[&str]) -> Result<()> {
-    let val = calculate_hash_value(HashDomain::zero(), path)?;
+fn print_literal(path: &[&str], shake_or_blake: KeyedHash) -> Result<()> {
+    let val = calculate_hash_value(HashDomain::zero(shake_or_blake.clone()), path)?;
     let (last, prefix) = path.split_last().context("developer error!")?;
     let var_name = last.to_shouty_snake_case();
 
-    print!("// hash domain hash of: ");
+    print!("// hash domain hash with hash {} of: ", shake_or_blake);
     for n in prefix.iter() {
         print!("{n} -> ");
     }
@@ -51,24 +52,24 @@ impl Tree {
         }
     }
 
-    fn gen_code_inner(&self, prefix: &[&str]) -> Result<()> {
+    fn gen_code_inner(&self, prefix: &[&str], shake_or_blake: KeyedHash) -> Result<()> {
         let mut path = prefix.to_owned();
         path.push(self.name());
 
         match self {
             Self::Branch(_, ref children) => {
                 for c in children.iter() {
-                    c.gen_code_inner(&path)?
+                    c.gen_code_inner(&path, shake_or_blake.clone())?
                 }
             }
-            Self::Leaf(_) => print_literal(&path)?,
+            Self::Leaf(_) => print_literal(&path, shake_or_blake)?,
         };
 
         Ok(())
     }
 
-    fn gen_code(&self) -> Result<()> {
-        self.gen_code_inner(&[])
+    fn gen_code(&self, shake_or_blake: KeyedHash) -> Result<()> {
+        self.gen_code_inner(&[], shake_or_blake)
     }
 }
 
@@ -93,5 +94,7 @@ fn main() -> Result<()> {
 
     println!("type RawMsgType = u128;");
     println!();
-    tree.gen_code()
+    tree.gen_code(KeyedHash::keyed_shake256())?;
+    println!();
+    tree.gen_code(KeyedHash::incorrect_hmac_blake2b())
 }

rosenpass/src/cli.rs

@@ -5,8 +5,8 @@
 
 use anyhow::{bail, ensure, Context};
 use clap::{Parser, Subcommand};
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::StaticKem;
+use rosenpass_cipher_traits::primitives::Kem;
+use rosenpass_ciphers::StaticKem;
 use rosenpass_secret_memory::file::StoreSecret;
 use rosenpass_util::file::{LoadValue, LoadValueB64, StoreValue};
 use rosenpass_wireguard_broker::brokers::native_unix::{
@@ -17,7 +17,7 @@ use std::path::PathBuf;
 
 use crate::app_server::AppServerTest;
 use crate::app_server::{AppServer, BrokerPeer};
-use crate::protocol::{SPk, SSk, SymKey};
+use crate::protocol::basic_types::{SPk, SSk, SymKey};
 
 use super::config;
 
@@ -490,6 +490,8 @@ impl CliArgs {
                 cfg_peer.key_out,
                 broker_peer,
                 cfg_peer.endpoint.clone(),
+                cfg_peer.protocol_version.into(),
+                cfg_peer.osk_domain_separator.try_into()?,
             )?;
         }
 
@@ -606,9 +608,9 @@ impl CliArgs {
 
 /// generate secret and public keys, store in files according to the paths passed as arguments
 pub fn generate_and_save_keypair(secret_key: PathBuf, public_key: PathBuf) -> anyhow::Result<()> {
-    let mut ssk = crate::protocol::SSk::random();
-    let mut spk = crate::protocol::SPk::random();
-    StaticKem::keygen(ssk.secret_mut(), spk.deref_mut())?;
+    let mut ssk = crate::protocol::basic_types::SSk::random();
+    let mut spk = crate::protocol::basic_types::SPk::random();
+    StaticKem.keygen(ssk.secret_mut(), spk.deref_mut())?;
     ssk.store_secret(secret_key)?;
     spk.store(public_key)
 }

rosenpass/src/config.rs

@@ -7,20 +7,19 @@
 //! - TODO: support `~` in <https://github.com/rosenpass/rosenpass/issues/237>
 //! - TODO: provide tooling to create config file from shell <https://github.com/rosenpass/rosenpass/issues/247>
 
-use crate::protocol::{SPk, SSk};
-use rosenpass_util::file::LoadValue;
-use std::{
-    collections::HashSet,
-    fs,
-    io::Write,
-    net::{Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV4, SocketAddrV6, ToSocketAddrs},
-    path::{Path, PathBuf},
-};
+use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV4, SocketAddrV6, ToSocketAddrs};
+use std::path::{Path, PathBuf};
+use std::{collections::HashSet, fs, io::Write};
 
 use anyhow::{bail, ensure};
-use rosenpass_util::file::{fopen_w, Visibility};
+
 use serde::{Deserialize, Serialize};
 
+use rosenpass_util::file::{fopen_w, LoadValue, Visibility};
+
+use crate::protocol::basic_types::{SPk, SSk};
+use crate::protocol::osk_domain_separator::OskDomainSeparator;
+
 use crate::app_server::AppServer;
 
 #[cfg(feature = "experiment_api")]
@@ -36,6 +35,7 @@ fn empty_api_config() -> crate::api::config::ApiConfig {
 ///
 /// i.e. configuration for the `rosenpass exchange` and `rosenpass exchange-config` commands
 #[derive(Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
 pub struct Rosenpass {
     // TODO: Raise error if secret key or public key alone is set during deserialization
     // SEE: https://github.com/serde-rs/serde/issues/2793
@@ -77,6 +77,7 @@ pub struct Rosenpass {
 
 /// Public key and secret key locations.
 #[derive(Debug, Deserialize, Serialize, PartialEq, Eq, Clone)]
+#[serde(deny_unknown_fields)]
 pub struct Keypair {
     /// path to the public key file
     pub public_key: PathBuf,
@@ -104,13 +105,24 @@ impl Keypair {
 ///
 /// - TODO: replace this type with [`log::LevelFilter`], also see <https://github.com/rosenpass/rosenpass/pull/246>
 #[derive(Debug, PartialEq, Eq, Serialize, Deserialize, Copy, Clone)]
+#[serde(deny_unknown_fields)]
 pub enum Verbosity {
     Quiet,
     Verbose,
 }
 
+/// The protocol version to be used by a peer.
+#[derive(Debug, PartialEq, Eq, Serialize, Deserialize, Copy, Clone, Default)]
+#[serde(deny_unknown_fields)]
+pub enum ProtocolVersion {
+    #[default]
+    V02,
+    V03,
+}
+
 /// Configuration data for a single Rosenpass peer
 #[derive(Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct RosenpassPeer {
     /// path to the public key of the peer
     pub public_key: PathBuf,
@@ -138,10 +150,82 @@ pub struct RosenpassPeer {
     /// Information for supplying exchanged keys directly to WireGuard
     #[serde(flatten)]
     pub wg: Option<WireGuard>,
+
+    #[serde(default)]
+    /// The protocol version to use for the exchange
+    pub protocol_version: ProtocolVersion,
+
+    /// Allows using a custom domain separator
+    #[serde(flatten)]
+    pub osk_domain_separator: RosenpassPeerOskDomainSeparator,
+}
+
+/// Configuration for [crate::protocol::osk_domain_separator::OskDomainSeparator]
+///
+/// Refer to its documentation for more information and examples of how to use this.
+#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct RosenpassPeerOskDomainSeparator {
+    /// If Rosenpass is used for purposes other then securing WireGuard,
+    /// a custom domain separator and domain separator must be specified.
+    ///
+    /// Use `osk_organization` to indicate the organization who specifies the use case
+    /// and `osk_label` for a specific purpose within that organization.
+    ///
+    /// ```toml
+    /// [[peer]]
+    /// public_key = "my_public_key"
+    /// ...
+    /// osk_organization = "myorg.com"
+    /// osk_label = ["My Custom Messenger app"]
+    /// ```
+    pub osk_organization: Option<String>,
+    // If Rosenpass is used for purposes other then securing WireGuard,
+    /// a custom domain separator and domain separator must be specified.
+    ///
+    /// Use `osk_organization` to indicate the organization who specifies the use case
+    /// and `osk_label` for a specific purpose within that organization.
+    ///
+    /// ```toml
+    /// [[peer]]
+    /// public_key = "my_public_key"
+    /// ...
+    /// osk_namespace = "myorg.com"
+    /// osk_label = ["My Custom Messenger app"]
+    /// ```
+    pub osk_label: Option<Vec<String>>,
+}
+
+impl RosenpassPeerOskDomainSeparator {
+    pub fn org_and_label(&self) -> anyhow::Result<Option<(&String, &Vec<String>)>> {
+        match (&self.osk_organization, &self.osk_label) {
+            (None, None) => Ok(None),
+            (Some(org), Some(label)) => Ok(Some((&org, &label))),
+            (Some(_), None) => bail!("Specified osk_organization but not osk_label in config file. You need to specify both, or none."),
+            (None, Some(_)) =>  bail!("Specified osk_label but not osk_organization in config file. You need to specify both, or none."),
+        }
+    }
+
+    pub fn validate(&self) -> anyhow::Result<()> {
+        let _org_and_label: Option<(_, _)> = self.org_and_label()?;
+        Ok(())
+    }
+}
+
+impl TryFrom<RosenpassPeerOskDomainSeparator> for OskDomainSeparator {
+    type Error = anyhow::Error;
+
+    fn try_from(val: RosenpassPeerOskDomainSeparator) -> anyhow::Result<Self> {
+        match val.org_and_label()? {
+            None => Ok(OskDomainSeparator::default()),
+            Some((org, label)) => Ok(OskDomainSeparator::custom_utf8(org, label)),
+        }
+    }
 }
 
 /// Information for supplying exchanged keys directly to WireGuard
 #[derive(Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct WireGuard {
     /// Name of the WireGuard interface to supply with pre-shared keys generated by the Rosenpass
     /// key exchange
@@ -325,6 +409,10 @@ impl Rosenpass {
                     );
                 }
             }
+
+            if let Err(e) = peer.osk_domain_separator.validate() {
+                bail!("Invalid OSK domain separation configuration for peer {i}: {e}");
+            }
         }
 
         Ok(())
@@ -770,6 +858,53 @@ mod test {
         Ok(())
     }
 
+    #[test]
+    fn test_protocol_version() {
+        let mut rosenpass = Rosenpass::empty();
+        let mut peer_v_02 = RosenpassPeer::default();
+        peer_v_02.protocol_version = ProtocolVersion::V02;
+        rosenpass.peers.push(peer_v_02);
+        let mut peer_v_03 = RosenpassPeer::default();
+        peer_v_03.protocol_version = ProtocolVersion::V03;
+        rosenpass.peers.push(peer_v_03);
+        #[cfg(feature = "experiment_api")]
+        {
+            rosenpass.api.listen_fd = vec![];
+            rosenpass.api.listen_path = vec![];
+            rosenpass.api.stream_fd = vec![];
+        }
+        #[cfg(feature = "experiment_api")]
+        let expected_toml = r#"listen = []
+          verbosity = "Quiet"
+          
+          [api]
+          listen_fd = []
+          listen_path = []
+          stream_fd = []
+
+          [[peers]]
+          protocol_version = "V02"
+          public_key = ""
+
+          [[peers]]
+          protocol_version = "V03"
+          public_key = ""
+          "#;
+        #[cfg(not(feature = "experiment_api"))]
+        let expected_toml = r#"listen = []
+          verbosity = "Quiet"
+
+          [[peers]]
+          protocol_version = "V02"
+          public_key = ""
+
+          [[peers]]
+          protocol_version = "V03"
+          public_key = ""
+          "#;
+        assert_toml_round(rosenpass, expected_toml).unwrap()
+    }
+
     #[test]
     fn test_cli_parse_multiple_peers() {
         let args = split_str(

rosenpass/src/hash_domains.rs

@@ -13,6 +13,8 @@
 //! use rosenpass::{hash_domain, hash_domain_ns};
 //! use rosenpass::hash_domains::protocol;
 //!
+//! use rosenpass_ciphers::subtle::keyed_hash::KeyedHash;
+//!
 //! // Declaring a custom hash domain
 //! hash_domain_ns!(protocol, custom_domain, "my custom hash domain label");
 //!
@@ -26,15 +28,18 @@
 //! hash_domain!(domain_separators, sep1, "1");
 //! hash_domain!(domain_separators, sep2, "2");
 //!
+//! // We use the SHAKE256 hash function for this example
+//! let hash_choice = KeyedHash::keyed_shake256();
+//!
 //! // Generating values under hasher1 with both domain separators
-//! let h1 = hasher1()?.mix(b"some data")?.dup();
-//! let h1v1 = h1.mix(&sep1()?)?.mix(b"More data")?.into_value();
-//! let h1v2 = h1.mix(&sep2()?)?.mix(b"More data")?.into_value();
+//! let h1 = hasher1(hash_choice.clone())?.mix(b"some data")?.dup();
+//! let h1v1 = h1.mix(&sep1(hash_choice.clone())?)?.mix(b"More data")?.into_value();
+//! let h1v2 = h1.mix(&sep2(hash_choice.clone())?)?.mix(b"More data")?.into_value();
 //!
 //! // Generating values under hasher2 with both domain separators
-//! let h2 = hasher2()?.mix(b"some data")?.dup();
-//! let h2v1 = h2.mix(&sep1()?)?.mix(b"More data")?.into_value();
-//! let h2v2 = h2.mix(&sep2()?)?.mix(b"More data")?.into_value();
+//! let h2 = hasher2(hash_choice.clone())?.mix(b"some data")?.dup();
+//! let h2v1 = h2.mix(&sep1(hash_choice.clone())?)?.mix(b"More data")?.into_value();
+//! let h2v2 = h2.mix(&sep2(hash_choice.clone())?)?.mix(b"More data")?.into_value();
 //!
 //! // All of the domain separators are now different, random strings
 //! let values = [h1v1, h1v2, h2v1, h2v2];
@@ -49,6 +54,7 @@
 
 use anyhow::Result;
 use rosenpass_ciphers::hash_domain::HashDomain;
+use rosenpass_ciphers::subtle::keyed_hash::KeyedHash;
 
 /// Declare a hash function
 ///
@@ -62,8 +68,8 @@ use rosenpass_ciphers::hash_domain::HashDomain;
 macro_rules! hash_domain_ns {
     ($(#[$($attrss:tt)*])* $base:ident, $name:ident, $($lbl:expr),+ ) => {
         $(#[$($attrss)*])*
-        pub fn $name() -> ::anyhow::Result<::rosenpass_ciphers::hash_domain::HashDomain> {
-            let t = $base()?;
+        pub fn $name(hash_choice: KeyedHash) -> ::anyhow::Result<::rosenpass_ciphers::hash_domain::HashDomain> {
+            let t = $base(hash_choice)?;
             $( let t = t.mix($lbl.as_bytes())?; )*
             Ok(t)
         }
@@ -81,8 +87,8 @@ macro_rules! hash_domain_ns {
 macro_rules! hash_domain {
     ($(#[$($attrss:tt)*])* $base:ident, $name:ident, $($lbl:expr),+ ) => {
         $(#[$($attrss)*])*
-        pub fn $name() -> ::anyhow::Result<[u8; ::rosenpass_ciphers::KEY_LEN]> {
-            let t = $base()?;
+        pub fn $name(hash_choice: KeyedHash) -> ::anyhow::Result<[u8; ::rosenpass_ciphers::KEY_LEN]> {
+            let t = $base(hash_choice)?;
             $( let t = t.mix($lbl.as_bytes())?; )*
             Ok(t.into_value())
         }
@@ -94,15 +100,22 @@ macro_rules! hash_domain {
 /// This serves as a global [domain separator](https://en.wikipedia.org/wiki/Domain_separation)
 /// used in various places in the rosenpass protocol.
 ///
-/// This is generally used to create further hash-domains for specific purposes. See
+/// This is generally used to create further hash-domains for specific purposes. Depending on
+/// the used hash function, the protocol string is different.
 ///
 /// # Examples
 ///
 /// See the source file for details about how this is used concretely.
 ///
 /// See the [module](self) documentation on how to use the hash domains in general
-pub fn protocol() -> Result<HashDomain> {
-    HashDomain::zero().mix("Rosenpass v1 mceliece460896 Kyber512 ChaChaPoly1305 BLAKE2s".as_bytes())
+pub fn protocol(hash_choice: KeyedHash) -> Result<HashDomain> {
+    // Depending on the hash function, we use different protocol strings
+    match hash_choice {
+        KeyedHash::KeyedShake256(_) => HashDomain::zero(hash_choice)
+            .mix("Rosenpass v1 mceliece460896 Kyber512 ChaChaPoly1305 SHAKE256".as_bytes()),
+        KeyedHash::IncorrectHmacBlake2b(_) => HashDomain::zero(hash_choice)
+            .mix("Rosenpass v1 mceliece460896 Kyber512 ChaChaPoly1305 BLAKE2s".as_bytes()),
+    }
 }
 
 hash_domain_ns!(
@@ -282,25 +295,21 @@ hash_domain_ns!(
     /// We do recommend that third parties base their specific domain separators
     /// on a internet domain and/or mix in much more specific information.
     ///
-    /// We only really use this to derive a output key for wireguard; see [osk].
-    ///
     /// See [_ckextract].
     ///
     /// # Examples
     ///
     /// See the [module](self) documentation on how to use the hash domains in general.
-    _ckextract, _user, "user");
+    _ckextract, cke_user, "user");
 hash_domain_ns!(
     /// Chaining key domain separator for any rosenpass specific purposes.
     ///
-    /// We only really use this to derive a output key for wireguard; see [osk].
-    ///
     /// See [_ckextract].
     ///
     /// # Examples
     ///
     /// See the [module](self) documentation on how to use the hash domains in general.
-    _user, _rp, "rosenpass.eu");
+    cke_user, cke_user_rosenpass, "rosenpass.eu");
 hash_domain!(
     /// Chaining key domain separator for deriving the key sent to WireGuard.
     ///
@@ -312,4 +321,4 @@ hash_domain!(
     /// Check out its source code!
     ///
     /// See the [module](self) documentation on how to use the hash domains in general.
-    _rp, osk, "wireguard psk");
+    cke_user_rosenpass, ext_wireguard_psk_osk, "wireguard psk");

rosenpass/src/msgs.rs

@@ -9,13 +9,12 @@
 //! To achieve this we utilize the zerocopy library.
 //!
 use std::mem::size_of;
-use std::u8;
 use zerocopy::{AsBytes, FromBytes, FromZeroes};
 
 use super::RosenpassError;
-use rosenpass_cipher_traits::Kem;
-use rosenpass_ciphers::kem::{EphemeralKem, StaticKem};
-use rosenpass_ciphers::{aead, xaead, KEY_LEN};
+use rosenpass_cipher_traits::primitives::{Aead as _, Kem};
+use rosenpass_ciphers::{Aead, XAead, KEY_LEN};
+use rosenpass_ciphers::{EphemeralKem, StaticKem};
 
 /// Length of a session ID such as [InitHello::sidi]
 pub const SESSION_ID_LEN: usize = 4;
@@ -32,7 +31,7 @@ pub const MAX_MESSAGE_LEN: usize = 2500; // TODO fix this
 pub const BISCUIT_PT_LEN: usize = size_of::<Biscuit>();
 
 /// Length in bytes of an encrypted Biscuit (cipher text)
-pub const BISCUIT_CT_LEN: usize = BISCUIT_PT_LEN + xaead::NONCE_LEN + xaead::TAG_LEN;
+pub const BISCUIT_CT_LEN: usize = BISCUIT_PT_LEN + XAead::NONCE_LEN + XAead::TAG_LEN;
 
 /// Size of the field [Envelope::mac]
 pub const MAC_SIZE: usize = 16;
@@ -136,9 +135,9 @@ pub struct InitHello {
     /// Classic McEliece Ciphertext
     pub sctr: [u8; StaticKem::CT_LEN],
     /// Encryped: 16 byte hash of McEliece initiator static key
-    pub pidic: [u8; aead::TAG_LEN + 32],
+    pub pidic: [u8; Aead::TAG_LEN + 32],
     /// Encrypted TAI64N Time Stamp (against replay attacks)
-    pub auth: [u8; aead::TAG_LEN],
+    pub auth: [u8; Aead::TAG_LEN],
 }
 
 /// This is the second message sent by the responder to the initiator
@@ -187,7 +186,7 @@ pub struct RespHello {
     /// Classic McEliece Ciphertext
     pub scti: [u8; StaticKem::CT_LEN],
     /// Empty encrypted message (just an auth tag)
-    pub auth: [u8; aead::TAG_LEN],
+    pub auth: [u8; Aead::TAG_LEN],
     /// Responders handshake state in encrypted form
     pub biscuit: [u8; BISCUIT_CT_LEN],
 }
@@ -236,7 +235,7 @@ pub struct InitConf {
     /// Responders handshake state in encrypted form
     pub biscuit: [u8; BISCUIT_CT_LEN],
     /// Empty encrypted message (just an auth tag)
-    pub auth: [u8; aead::TAG_LEN],
+    pub auth: [u8; Aead::TAG_LEN],
 }
 
 /// This is the fourth message sent by the initiator to the responder
@@ -292,7 +291,7 @@ pub struct EmptyData {
     /// Nonce
     pub ctr: [u8; 8],
     /// Empty encrypted message (just an auth tag)
-    pub auth: [u8; aead::TAG_LEN],
+    pub auth: [u8; Aead::TAG_LEN],
 }
 
 /// Cookie encrypted and sent to the initiator by the responder in [RespHello]
@@ -346,7 +345,7 @@ pub struct CookieReplyInner {
     /// Session ID of the sender (initiator)
     pub sid: [u8; 4],
     /// Encrypted cookie with authenticated initiator `mac`
-    pub cookie_encrypted: [u8; xaead::NONCE_LEN + COOKIE_SIZE + xaead::TAG_LEN],
+    pub cookie_encrypted: [u8; XAead::NONCE_LEN + COOKIE_SIZE + XAead::TAG_LEN],
 }
 
 /// Specialized message for use in the cookie mechanism.
@@ -437,7 +436,8 @@ impl From<MsgType> for u8 {
 #[cfg(test)]
 mod test_constants {
     use crate::msgs::{BISCUIT_CT_LEN, BISCUIT_PT_LEN};
-    use rosenpass_ciphers::{xaead, KEY_LEN};
+    use rosenpass_cipher_traits::primitives::Aead as _;
+    use rosenpass_ciphers::{XAead, KEY_LEN};
 
     #[test]
     fn sodium_keysize() {
@@ -453,7 +453,7 @@ mod test_constants {
     fn biscuit_ct_len() {
         assert_eq!(
             BISCUIT_CT_LEN,
-            BISCUIT_PT_LEN + xaead::NONCE_LEN + xaead::TAG_LEN
+            BISCUIT_PT_LEN + XAead::NONCE_LEN + XAead::TAG_LEN
         );
     }
 }

rosenpass/src/protocol/basic_types.rs

@@ -0,0 +1,38 @@
+//! Key types and other fundamental types used in the Rosenpass protocol
+
+use rosenpass_cipher_traits::primitives::{Aead, Kem};
+use rosenpass_ciphers::{EphemeralKem, StaticKem, XAead, KEY_LEN};
+use rosenpass_secret_memory::{Public, PublicBox, Secret};
+
+use crate::msgs::{BISCUIT_ID_LEN, MAX_MESSAGE_LEN, SESSION_ID_LEN};
+
+/// Static public key
+///
+/// Using [PublicBox] instead of [Public] because Classic McEliece keys are very large.
+pub type SPk = PublicBox<{ StaticKem::PK_LEN }>;
+/// Static secret key
+pub type SSk = Secret<{ StaticKem::SK_LEN }>;
+/// Ephemeral public key
+pub type EPk = Public<{ EphemeralKem::PK_LEN }>;
+pub type ESk = Secret<{ EphemeralKem::SK_LEN }>;
+
+/// Symmetric key
+pub type SymKey = Secret<KEY_LEN>;
+/// Variant of [SymKey] for use cases where the value is public
+pub type PublicSymKey = [u8; 32];
+
+/// Peer ID (derived from the public key, see the hash derivations in the [whitepaper](https://rosenpass.eu/whitepaper.pdf))
+pub type PeerId = Public<KEY_LEN>;
+/// Session ID
+pub type SessionId = Public<SESSION_ID_LEN>;
+/// Biscuit ID
+pub type BiscuitId = Public<BISCUIT_ID_LEN>;
+
+/// Nonce for use with random-nonce AEAD
+pub type XAEADNonce = Public<{ XAead::NONCE_LEN }>;
+
+/// Buffer capably of holding any Rosenpass protocol message
+pub type MsgBuf = Public<MAX_MESSAGE_LEN>;
+
+/// Server-local peer number; this is just the index in [super::CryptoServer::peers]
+pub type PeerNo = usize;

rosenpass/src/protocol/build_crypto_server.rs

@@ -1,11 +1,13 @@
-use rosenpass_util::{
-    build::Build,
-    mem::{DiscardResultExt, SwapWithDefaultExt},
-    result::ensure_or,
-};
 use thiserror::Error;
 
-use super::{CryptoServer, PeerPtr, SPk, SSk, SymKey};
+use rosenpass_util::mem::{DiscardResultExt, SwapWithDefaultExt};
+use rosenpass_util::{build::Build, result::ensure_or};
+
+use crate::config::ProtocolVersion;
+
+use super::basic_types::{SPk, SSk, SymKey};
+use super::osk_domain_separator::OskDomainSeparator;
+use super::{CryptoServer, PeerPtr};
 
 #[derive(Debug, Clone)]
 /// A pair of matching public/secret keys used to launch the crypto server.
@@ -47,7 +49,8 @@ impl Keypair {
     /// # Example
     ///
     /// ```rust
-    /// use rosenpass::protocol::{Keypair, SSk, SPk};
+    /// use rosenpass::protocol::basic_types::{SSk, SPk};
+    /// use rosenpass::protocol::Keypair;
     ///
     /// // We have to define the security policy before using Secrets.
     /// use rosenpass_secret_memory::secret_policy_use_only_malloc_secrets;
@@ -66,12 +69,13 @@ impl Keypair {
 
     /// Creates a new "empty" key pair. All bytes are initialized to zero.
     ///
-    /// See [SSk:zero()][crate::protocol::SSk::zero] and [SPk:zero()][crate::protocol::SPk::zero], respectively.
+    /// See [SSk:zero()][SSk::zero] and [SPk:zero()][SPk::zero], respectively.
     ///
     /// # Example
     ///
     /// ```rust
-    /// use rosenpass::protocol::{Keypair, SSk, SPk};
+    /// use rosenpass::protocol::basic_types::{SSk, SPk};
+    /// use rosenpass::protocol::Keypair;
     ///
     /// // We have to define the security policy before using Secrets.
     /// use rosenpass_secret_memory::secret_policy_use_only_malloc_secrets;
@@ -90,7 +94,7 @@ impl Keypair {
 
     /// Creates a new (securely-)random key pair. The mechanism is described in [rosenpass_secret_memory::Secret].
     ///
-    /// See [SSk:random()][crate::protocol::SSk::random] and [SPk:random()][crate::protocol::SPk::random], respectively.
+    /// See [SSk:random()][SSk::random] and [SPk:random()][SPk::random], respectively.
     pub fn random() -> Self {
         Self::new(SSk::random(), SPk::random())
     }
@@ -127,7 +131,7 @@ pub struct MissingKeypair;
 ///
 /// There are multiple ways of creating a crypto server:
 ///
-/// 1. Provide the key pair at initialization time (using [CryptoServer::new][crate::protocol::CryptoServer::new])
+/// 1. Provide the key pair at initialization time (using [CryptoServer::new][CryptoServer::new])
 /// 2. Provide the key pair at a later time (using [BuildCryptoServer::empty])
 ///
 /// With BuildCryptoServer, you can gradually configure parameters as they become available.
@@ -145,18 +149,23 @@ pub struct MissingKeypair;
 ///
 /// ```rust
 /// use rosenpass_util::build::Build;
-/// use rosenpass::protocol::{BuildCryptoServer, Keypair, PeerParams, SPk, SymKey};
+/// use rosenpass_secret_memory::secret_policy_use_only_malloc_secrets;
+///
+/// use rosenpass::config::ProtocolVersion;
+///
+/// use rosenpass::protocol::basic_types::{SPk, SymKey};
+/// use rosenpass::protocol::{BuildCryptoServer, Keypair, PeerParams};
+/// use rosenpass::protocol::osk_domain_separator::OskDomainSeparator;
 ///
 /// // We have to define the security policy before using Secrets.
-/// use rosenpass_secret_memory::secret_policy_use_only_malloc_secrets;
 /// secret_policy_use_only_malloc_secrets();
 ///
 /// let keypair = Keypair::random();
-/// let peer1 = PeerParams { psk: Some(SymKey::random()), pk: SPk::random() };
-/// let peer2 = PeerParams { psk: None, pk: SPk::random() };
+/// let peer1 = PeerParams { psk: Some(SymKey::random()), pk: SPk::random(), protocol_version: ProtocolVersion::V02, osk_domain_separator: OskDomainSeparator::default() };
+/// let peer2 = PeerParams { psk: None, pk: SPk::random(), protocol_version: ProtocolVersion::V02, osk_domain_separator: OskDomainSeparator::default() };
 ///
 /// let mut builder = BuildCryptoServer::new(Some(keypair.clone()), vec![peer1]);
-/// builder.add_peer(peer2.psk.clone(), peer2.pk);
+/// builder.add_peer(peer2.psk.clone(), peer2.pk, ProtocolVersion::V02, OskDomainSeparator::default());
 ///
 /// let server = builder.build().expect("build failed");
 /// assert_eq!(server.peers.len(), 2);
@@ -186,8 +195,17 @@ impl Build<CryptoServer> for BuildCryptoServer {
 
         let mut srv = CryptoServer::new(sk, pk);
 
-        for (idx, PeerParams { psk, pk }) in self.peers.into_iter().enumerate() {
-            let PeerPtr(idx2) = srv.add_peer(psk, pk)?;
+        for (idx, params) in self.peers.into_iter().enumerate() {
+            let PeerParams {
+                psk,
+                pk,
+                protocol_version,
+                osk_domain_separator,
+            } = params;
+
+            let PeerPtr(idx2) =
+                srv.add_peer(psk, pk, protocol_version.into(), osk_domain_separator)?;
+
             assert!(idx == idx2, "Peer id changed during CryptoServer construction from {idx} to {idx2}. This is a developer error.")
         }
 
@@ -196,18 +214,21 @@ impl Build<CryptoServer> for BuildCryptoServer {
 }
 
 #[derive(Debug)]
-/// Cryptographic key(s) identifying the connected [peer][crate::protocol::Peer] ("client")
+/// Cryptographic key(s) identifying the connected [peer][super::Peer] ("client")
 /// for a given session that is being managed by the crypto server.
 ///
-/// Each peer must be identified by a [public key (SPk)][crate::protocol::SPk].
-/// Optionally, a [symmetric key (SymKey)][crate::protocol::SymKey]
+/// Each peer must be identified by a [public key (SPk)][SPk].
+/// Optionally, a [symmetric key (SymKey)][SymKey]
 /// can be provided when setting up the connection.
-/// For more information on the intended usage and security considerations, see [Peer::psk][crate::protocol::Peer::psk] and [Peer::spkt][crate::protocol::Peer::spkt].
+/// For more information on the intended usage and security considerations, see [Peer::psk][super::Peer::psk] and [Peer::spkt][super::Peer::spkt].
 pub struct PeerParams {
     /// Pre-shared (symmetric) encryption keys that should be used with this peer.
     pub psk: Option<SymKey>,
     /// Public key identifying the peer.
     pub pk: SPk,
+    /// The used protocol version.
+    pub protocol_version: ProtocolVersion,
+    pub osk_domain_separator: OskDomainSeparator,
 }
 
 impl BuildCryptoServer {
@@ -305,13 +326,17 @@ impl BuildCryptoServer {
     /// Adding peers to an existing builder:
     ///
     /// ```rust
+    /// use rosenpass::config::ProtocolVersion;
+    ///
+    /// use rosenpass_util::build::Build;
+    /// use rosenpass::protocol::basic_types::{SymKey, SPk};
+    /// use rosenpass::protocol::{BuildCryptoServer, Keypair};
+    /// use rosenpass::protocol::osk_domain_separator::OskDomainSeparator;
+    ///
     /// // We have to define the security policy before using Secrets.
     /// use rosenpass_secret_memory::secret_policy_use_only_malloc_secrets;
     /// secret_policy_use_only_malloc_secrets();
     ///
-    /// use rosenpass_util::build::Build;
-    /// use rosenpass::protocol::{BuildCryptoServer, Keypair, SymKey, SPk};
-    ///
     /// // Deferred initialization: Create builder first, add some peers later
     /// let keypair_option = Some(Keypair::random());
     /// let mut builder = BuildCryptoServer::new(keypair_option, Vec::new());
@@ -323,7 +348,7 @@ impl BuildCryptoServer {
     /// // Now we've found a peer that should be added to the configuration
     /// let pre_shared_key = SymKey::random();
     /// let public_key = SPk::random();
-    /// builder.with_added_peer(Some(pre_shared_key.clone()), public_key.clone());
+    /// builder.with_added_peer(Some(pre_shared_key.clone()), public_key.clone(), ProtocolVersion::V02, OskDomainSeparator::default());
     ///
     /// // New server instances will then start with the peer being registered already
     /// let server = builder.build().expect("build failed");
@@ -333,16 +358,33 @@ impl BuildCryptoServer {
     /// assert_eq!(peer.spkt, public_key);
     /// assert_eq!(peer_psk.secret(), pre_shared_key.secret());
     /// ```
-    pub fn with_added_peer(&mut self, psk: Option<SymKey>, pk: SPk) -> &mut Self {
+    pub fn with_added_peer(
+        &mut self,
+        psk: Option<SymKey>,
+        pk: SPk,
+        protocol_version: ProtocolVersion,
+        osk_domain_separator: OskDomainSeparator,
+    ) -> &mut Self {
         // TODO: Check here already whether peer was already added
-        self.peers.push(PeerParams { psk, pk });
+        self.peers.push(PeerParams {
+            psk,
+            pk,
+            protocol_version,
+            osk_domain_separator,
+        });
         self
     }
 
     /// Add a new entry to the list of registered peers, with or without a pre-shared key.
-    pub fn add_peer(&mut self, psk: Option<SymKey>, pk: SPk) -> PeerPtr {
+    pub fn add_peer(
+        &mut self,
+        psk: Option<SymKey>,
+        pk: SPk,
+        protocol_version: ProtocolVersion,
+        osk_domain_separator: OskDomainSeparator,
+    ) -> PeerPtr {
         let id = PeerPtr(self.peers.len());
-        self.with_added_peer(psk, pk);
+        self.with_added_peer(psk, pk, protocol_version, osk_domain_separator);
         id
     }
 
@@ -355,17 +397,23 @@ impl BuildCryptoServer {
     ///  Extracting the server configuration from a builder:
     ///
     /// ```rust
-    /// // We have to define the security policy before using Secrets.
-    /// use rosenpass_secret_memory::secret_policy_use_only_malloc_secrets;
-    /// secret_policy_use_only_malloc_secrets();
-    ///
     /// use rosenpass_util::build::Build;
-    /// use rosenpass::protocol::{BuildCryptoServer, Keypair, SymKey, SPk};
+    /// use rosenpass_secret_memory::secret_policy_use_only_malloc_secrets;
+    ///
+    /// use rosenpass::config::ProtocolVersion;
+    /// use rosenpass::hash_domains::protocol;
+    ///
+    /// use rosenpass::protocol::basic_types::{SymKey, SPk};
+    /// use rosenpass::protocol::{BuildCryptoServer, Keypair};
+    /// use rosenpass::protocol::osk_domain_separator::OskDomainSeparator;
+    ///
+    /// // We have to define the security policy before using Secrets.
+    /// secret_policy_use_only_malloc_secrets();
     ///
     /// let keypair = Keypair::random();
     /// let peer_pk = SPk::random();
     /// let mut builder = BuildCryptoServer::new(Some(keypair.clone()), vec![]);
-    /// builder.add_peer(None, peer_pk);
+    /// builder.add_peer(None, peer_pk, ProtocolVersion::V02, OskDomainSeparator::default());
     ///
     /// // Extract configuration parameters from the decomissioned builder
     /// let (keypair_option, peers) = builder.take_parts();

rosenpass/src/protocol/constants.rs

@@ -0,0 +1,64 @@
+//! Constants and configuration values used in the rosenpass core protocol
+
+use crate::msgs::MAC_SIZE;
+
+use super::timing::Timing;
+
+/// Time after which the responder attempts to rekey the session
+///
+/// From the wireguard paper: rekey every two minutes,
+/// discard the key if no rekey is achieved within three
+pub const REKEY_AFTER_TIME_RESPONDER: Timing = 120.0;
+/// Time after which the initiator attempts to rekey the session.
+///
+/// This happens ten seconds after [REKEY_AFTER_TIME_RESPONDER], so
+/// parties would usually switch roles after every handshake.
+///
+/// From the wireguard paper: rekey every two minutes,
+/// discard the key if no rekey is achieved within three
+pub const REKEY_AFTER_TIME_INITIATOR: Timing = 130.0;
+/// Time after which either party rejects the current key.
+///
+/// At this point a new key should have been negotiated.
+///
+/// Rejection happens 50-60 seconds after key renegotiation
+/// to allow for a graceful handover.
+/// From the wireguard paper: rekey every two minutes,
+/// discard the key if no rekey is achieved within three
+pub const REJECT_AFTER_TIME: Timing = 180.0;
+
+/// The length of the `cookie_secret` in the [whitepaper](https://rosenpass.eu/whitepaper.pdf)
+pub const COOKIE_SECRET_LEN: usize = MAC_SIZE;
+/// The life time of the `cookie_secret` in the [whitepaper](https://rosenpass.eu/whitepaper.pdf)
+pub const COOKIE_SECRET_EPOCH: Timing = 120.0;
+
+/// Length of a cookie value (see info about the cookie mechanism in the [whitepaper](https://rosenpass.eu/whitepaper.pdf))
+pub const COOKIE_VALUE_LEN: usize = MAC_SIZE;
+/// Time after which to delete a cookie, as the initiator, for a certain peer (see info about the cookie mechanism in the [whitepaper](https://rosenpass.eu/whitepaper.pdf))
+pub const PEER_COOKIE_VALUE_EPOCH: Timing = 120.0;
+
+/// Seconds until the biscuit key is changed; we issue biscuits
+/// using one biscuit key for one epoch and store the biscuit for
+/// decryption for a second epoch
+///
+/// The biscuit mechanism is used to make sure the responder is stateless in our protocol.
+pub const BISCUIT_EPOCH: Timing = 300.0;
+
+/// The initiator opportunistically retransmits their messages; it applies an increasing delay
+/// between each retreansmission. This is the factor by which the delay grows after each
+/// retransmission.
+pub const RETRANSMIT_DELAY_GROWTH: Timing = 2.0;
+/// The initiator opportunistically retransmits their messages; it applies an increasing delay
+/// between each retreansmission. This is the initial delay between retransmissions.
+pub const RETRANSMIT_DELAY_BEGIN: Timing = 0.5;
+/// The initiator opportunistically retransmits their messages; it applies an increasing delay
+/// between each retreansmission. This is the maximum delay between retransmissions.
+pub const RETRANSMIT_DELAY_END: Timing = 10.0;
+/// The initiator opportunistically retransmits their messages; it applies an increasing delay
+/// between each retreansmission. This is the jitter (randomness) applied to the retransmission
+/// delay.
+pub const RETRANSMIT_DELAY_JITTER: Timing = 0.5;
+
+/// This is the maximum delay that can separate two events for us to consider the events to have
+/// happened at the same time.
+pub const EVENT_GRACE: Timing = 0.0025;

rosenpass/src/protocol/cookies.rs

@@ -0,0 +1,98 @@
+//! Cryptographic key management for cookies and biscuits used in the protocol
+//!
+//! Cookies in general are conceptually similar to browser cookies;
+//! i.e. mechanisms to store information in the party connected to via network.
+//!
+//! In our case specifically we refer to any mechanisms in the Rosenpass protocol
+//! where a peer stores some information in the other party that is cryptographically
+//! protected using a temporary, randomly generated key. This file contains the mechanisms
+//! used to store the secret keys.
+//!
+//! We have two cookie-mechanisms in particular:
+//!
+//! - Rosenpass "biscuits" — the mechanism used to make sure the Rosenpass protocol is stateless
+//!   with respect to the responder
+//! - WireGuard's cookie mechanism to enable proof of IP ownership; Rosenpass has experimental
+//!   support for this mechanism
+//!
+//! The CookieStore type is also used to store cookie secrets sent from the responder to the
+//! initiator. This is a bad design and we should separate out this functionality.
+//!
+//! TODO: CookieStore should not be used for cookie secrets sent from responder to initiator.
+//! TODO: Move cookie lifetime management functionality into here
+
+use rosenpass_ciphers::KEY_LEN;
+use rosenpass_secret_memory::Secret;
+
+use super::{constants::COOKIE_SECRET_LEN, timing::Timing};
+
+/// Container for storing cookie secrets like [BiscuitKey] or [CookieSecret].
+///
+/// This is really just a secret key and a time stamp of creation. Concrete
+/// usages (such as for the biscuit key) impose a time limit about how long
+/// a key can be used and the time of creation is used to impose that time limit.
+///
+/// # Examples
+///
+/// ```
+/// use rosenpass_util::time::Timebase;
+/// use rosenpass::protocol::{timing::BCE, basic_types::SymKey, cookies::CookieStore};
+///
+/// rosenpass_secret_memory::secret_policy_try_use_memfd_secrets();
+///
+/// let fixed_secret = SymKey::random();
+/// let timebase = Timebase::default();
+///
+/// let mut store = CookieStore::<32>::new();
+/// assert_ne!(store.value.secret(), SymKey::zero().secret());
+/// assert_eq!(store.created_at, BCE);
+///
+/// let time_before_call = timebase.now();
+/// store.update(&timebase, fixed_secret.secret());
+/// assert_eq!(store.value.secret(), fixed_secret.secret());
+/// assert!(store.created_at < timebase.now());
+/// assert!(store.created_at > time_before_call);
+///
+/// // Same as new()
+/// store.erase();
+/// assert_ne!(store.value.secret(), SymKey::zero().secret());
+/// assert_eq!(store.created_at, BCE);
+///
+/// let secret_before_call = store.value.clone();
+/// let time_before_call = timebase.now();
+/// store.randomize(&timebase);
+/// assert_ne!(store.value.secret(), secret_before_call.secret());
+/// assert!(store.created_at < timebase.now());
+/// assert!(store.created_at > time_before_call);
+/// ```
+#[derive(Debug)]
+pub struct CookieStore<const N: usize> {
+    /// Time of creation of the secret key
+    pub created_at: Timing,
+    /// The secret key
+    pub value: Secret<N>,
+}
+
+/// Stores cookie secret, which is used to create a rotating the cookie value
+///
+/// Concrete value is in [super::CryptoServer::cookie_secrets].
+///
+/// The pointer type is [super::ServerCookieSecretPtr].
+pub type CookieSecret = CookieStore<COOKIE_SECRET_LEN>;
+
+/// Storage for our biscuit keys.
+///
+/// The biscuit keys encrypt what we call "biscuits".
+/// These biscuits contain the responder state for a particular handshake. By moving
+/// state into these biscuits, we make sure the responder is stateless.
+///
+/// A Biscuit is like a fancy cookie. To avoid state disruption attacks,
+/// the responder doesn't store state. Instead the state is stored in a
+/// Biscuit, that is encrypted using the [BiscuitKey] which is only known to
+/// the Responder. Thus secrecy of the Responder state is not violated, still
+/// the responder can avoid storing this state.
+///
+/// Concrete value is in [super::CryptoServer::biscuit_keys].
+///
+/// The pointer type is [super::BiscuitKeyPtr].
+pub type BiscuitKey = CookieStore<KEY_LEN>;

rosenpass/src/protocol/index.rs

@@ -0,0 +1,45 @@
+//! Quick lookup of values in [super::CryptoServer]
+
+use std::collections::HashMap;
+
+use super::basic_types::{PeerId, PeerNo, SessionId};
+use super::KnownResponseHash;
+
+/// Maps various keys to peer (numbers).
+///
+/// See:
+/// - [super::CryptoServer::index]
+/// - [super::CryptoServer::peers]
+/// - [PeerNo]
+/// - [super::PeerPtr]
+/// - [super::Peer]
+pub type PeerIndex = HashMap<PeerIndexKey, PeerNo>;
+
+/// We maintain various indices in [super::CryptoServer::index], mapping some key to a particular
+/// [PeerNo], i.e. to an index in [super::CryptoServer::peers]. These are the possible index key.
+#[derive(Hash, PartialEq, Eq, PartialOrd, Ord, Debug)]
+pub enum PeerIndexKey {
+    /// Lookup of a particular peer given the [PeerId], i.e. a value derived from the peers public
+    /// key as created by [super::CryptoServer::pidm] or [super::Peer::pidt].
+    ///
+    /// The peer id is used by the initiator to tell the responder about its identity in
+    /// [crate::msgs::InitHello].
+    ///
+    /// See also the pointer types [super::PeerPtr].
+    Peer(PeerId),
+    /// Lookup of a particular session id.
+    ///
+    /// This is used to look up both established sessions (see
+    /// [super::CryptoServer::lookup_session]) and ongoing handshakes (see [super::CryptoServer::lookup_handshake]).
+    ///
+    /// Lookup of a peer to get an established session or a handshake is sufficient, because a peer
+    /// contains a limited number of sessions and handshakes ([super::Peer::session] and [super::Peer::handshake] respectively).
+    ///
+    /// See also the pointer types [super::IniHsPtr] and [super::SessionPtr].
+    Sid(SessionId),
+    /// Lookup of a cached response ([crate::msgs::Envelope]<[crate::msgs::EmptyData]>) to an [crate::msgs::InitConf] (i.e.
+    /// [crate::msgs::Envelope]<[crate::msgs::InitConf]>) message.
+    ///
+    /// See [super::KnownInitConfResponsePtr] on how this value is maintained.
+    KnownInitConfResponse(KnownResponseHash),
+}

rosenpass/src/protocol/mod.rs

@@ -24,24 +24,28 @@
 //!
 //! ```
 //! use std::ops::DerefMut;
+//!
 //! use rosenpass_secret_memory::policy::*;
-//! use rosenpass_cipher_traits::Kem;
-//! use rosenpass_ciphers::kem::StaticKem;
-//! use rosenpass::{
-//!     protocol::{SSk, SPk, MsgBuf, PeerPtr, CryptoServer, SymKey},
-//! };
+//! use rosenpass_cipher_traits::primitives::Kem;
+//! use rosenpass_ciphers::StaticKem;
+//!
+//! use rosenpass::protocol::basic_types::{SSk, SPk, MsgBuf, SymKey};
+//! use rosenpass::protocol::{PeerPtr, CryptoServer};
+//! use rosenpass::protocol::osk_domain_separator::OskDomainSeparator;
+//!
 //! # fn main() -> anyhow::Result<()> {
 //! // Set security policy for storing secrets
 //!
+//! use rosenpass::protocol::ProtocolVersion;
 //! secret_policy_try_use_memfd_secrets();
 //!
 //! // initialize secret and public key for peer a ...
 //! let (mut peer_a_sk, mut peer_a_pk) = (SSk::zero(), SPk::zero());
-//! StaticKem::keygen(peer_a_sk.secret_mut(), peer_a_pk.deref_mut())?;
+//! StaticKem.keygen(peer_a_sk.secret_mut(), peer_a_pk.deref_mut())?;
 //!
 //! // ... and for peer b
 //! let (mut peer_b_sk, mut peer_b_pk) = (SSk::zero(), SPk::zero());
-//! StaticKem::keygen(peer_b_sk.secret_mut(), peer_b_pk.deref_mut())?;
+//! StaticKem.keygen(peer_b_sk.secret_mut(), peer_b_pk.deref_mut())?;
 //!
 //! // initialize server and a pre-shared key
 //! let psk = SymKey::random();
@@ -49,8 +53,8 @@
 //! let mut b = CryptoServer::new(peer_b_sk, peer_b_pk.clone());
 //!
 //! // introduce peers to each other
-//! a.add_peer(Some(psk.clone()), peer_b_pk)?;
-//! b.add_peer(Some(psk), peer_a_pk)?;
+//! a.add_peer(Some(psk.clone()), peer_b_pk, ProtocolVersion::V03, OskDomainSeparator::default())?;
+//! b.add_peer(Some(psk), peer_a_pk, ProtocolVersion::V03, OskDomainSeparator::default())?;
 //!
 //! // declare buffers for message exchange
 //! let (mut a_buf, mut b_buf) = (MsgBuf::zero(), MsgBuf::zero());
@@ -75,8 +79,20 @@
 //! ```
 
 mod build_crypto_server;
+pub use build_crypto_server::*;
+
+pub mod basic_types;
+pub mod constants;
+pub mod cookies;
+pub mod index;
+pub mod osk_domain_separator;
+pub mod testutils;
+pub mod timing;
+pub mod zerocopy;
+
 #[allow(clippy::module_inception)]
 mod protocol;
-
-pub use build_crypto_server::*;
 pub use protocol::*;
+
+#[cfg(test)]
+mod test;

rosenpass/src/protocol/osk_domain_separator.rs

@@ -0,0 +1,91 @@
+//! Management of domain separators for the OSK (output key) in the rosenpass protocol
+//!
+//! The domain separator is there to ensure that keys are bound to the purpose they are used for.
+//!
+//! See the whitepaper section on protocol extensions for more details on how this is used.
+//!
+//! # See also
+//!
+//! - [crate::protocol::Peer]
+//! - [crate::protocol::CryptoServer::add_peer]
+//! - [crate::protocol::CryptoServer::osk]
+//!
+//! # Examples
+//!
+//! There are some basic examples of using custom domain separators in the examples of
+//! [super::CryptoServer::poll]. Look for the test function `test_osk_label_mismatch()`
+//! in particular.
+
+use rosenpass_ciphers::subtle::keyed_hash::KeyedHash;
+use rosenpass_util::result::OkExt;
+
+use crate::hash_domains;
+
+use super::basic_types::PublicSymKey;
+
+/// The OSK (output shared key) domain separator to use for a specific peer
+///
+#[derive(Clone, PartialEq, Eq, Debug, PartialOrd, Ord, Default)]
+pub enum OskDomainSeparator {
+    /// By default we use the domain separator that indicates that the resulting keys
+    /// are used by WireGuard to establish a connection
+    #[default]
+    ExtensionWireguardPsk,
+    /// Used for user-defined domain separators
+    Custom {
+        /// A globally unique string identifying the vendor or group who defines this domain
+        /// separator (we use our domain ourselves – "rosenpass.eu")
+        namespace: Vec<u8>,
+        /// Any custom labels within that namespace. Could be descriptive prose.
+        labels: Vec<Vec<u8>>,
+    },
+}
+
+impl OskDomainSeparator {
+    /// Construct [OskDomainSeparator::ExtensionWireguardPsk]
+    pub fn for_wireguard_psk() -> Self {
+        Self::ExtensionWireguardPsk
+    }
+
+    /// Construct [OskDomainSeparator::Custom] from strings
+    pub fn custom_utf8<I, T>(namespace: &str, label: I) -> Self
+    where
+        I: IntoIterator<Item = T>,
+        T: AsRef<str>,
+    {
+        let namespace = namespace.as_bytes().to_owned();
+        let labels = label
+            .into_iter()
+            .map(|e| e.as_ref().as_bytes().to_owned())
+            .collect::<Vec<_>>();
+        Self::Custom { namespace, labels }
+    }
+
+    /// Variant of [Self::custom_utf8] that takes just one label (instead of a sequence)
+    pub fn custom_utf8_single_label(namespace: &str, label: &str) -> Self {
+        Self::custom_utf8(namespace, std::iter::once(label))
+    }
+
+    /// The domain separator is not just an encoded string, it instead uses
+    /// [rosenpass_ciphers::hash_domain::HashDomain], starting from [hash_domains::cke_user].
+    ///
+    /// This means, that the domain separator is really a sequence of multiple different domain
+    /// separators, each of which is allowed to be quite long. This is very useful as it allows
+    /// users to avoid specifying complex, prosaic domain separators. To ensure that this does not
+    /// force us create extra overhead when the protocol is executed, this sequence of strings is
+    /// compressed into a single, fixed-length hash of all the inputs. This hash could be created
+    /// at program startup and cached.
+    ///
+    /// This function generates this fixed-length hash.
+    pub fn compress_with(&self, hash_choice: KeyedHash) -> anyhow::Result<PublicSymKey> {
+        use OskDomainSeparator as O;
+        match &self {
+            O::ExtensionWireguardPsk => hash_domains::ext_wireguard_psk_osk(hash_choice),
+            O::Custom { namespace, labels } => hash_domains::cke_user(hash_choice)?
+                .mix(namespace)?
+                .mix_many(labels)?
+                .into_value()
+                .ok(),
+        }
+    }
+}

rosenpass/src/protocol/test.rs

@@ -0,0 +1,703 @@
+use std::{borrow::BorrowMut, fmt::Display, net::SocketAddrV4, ops::DerefMut};
+
+use anyhow::{Context, Result};
+use serial_test::serial;
+use zerocopy::{AsBytes, FromBytes, FromZeroes};
+
+use rosenpass_cipher_traits::primitives::Kem;
+use rosenpass_ciphers::StaticKem;
+use rosenpass_secret_memory::Public;
+use rosenpass_util::mem::DiscardResultExt;
+
+use crate::msgs::{EmptyData, Envelope, InitConf, InitHello, MsgType, RespHello, MAX_MESSAGE_LEN};
+
+use super::basic_types::{MsgBuf, SPk, SSk, SymKey};
+use super::constants::REKEY_AFTER_TIME_RESPONDER;
+use super::osk_domain_separator::OskDomainSeparator;
+use super::zerocopy::{truncating_cast_into, truncating_cast_into_nomut};
+use super::{
+    CryptoServer, HandleMsgResult, HostIdentification, KnownInitConfResponsePtr, PeerPtr,
+    PollResult, ProtocolVersion,
+};
+
+struct VecHostIdentifier(Vec<u8>);
+
+impl HostIdentification for VecHostIdentifier {
+    fn encode(&self) -> &[u8] {
+        &self.0
+    }
+}
+
+impl Display for VecHostIdentifier {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{:?}", self.0)
+    }
+}
+
+impl From<Vec<u8>> for VecHostIdentifier {
+    fn from(v: Vec<u8>) -> Self {
+        VecHostIdentifier(v)
+    }
+}
+
+fn setup_logging() {
+    use std::io::Write;
+    let mut log_builder = env_logger::Builder::from_default_env(); // sets log level filter from environment (or defaults)
+    log_builder.filter_level(log::LevelFilter::Info);
+    log_builder.format_timestamp_nanos();
+    log_builder.format(|buf, record| {
+        let ts_format = buf.timestamp_nanos().to_string();
+        writeln!(buf, "{}: {}", &ts_format[14..], record.args())
+    });
+
+    let _ = log_builder.try_init();
+}
+
+#[test]
+#[serial]
+fn handles_incorrect_size_messages_v02() {
+    handles_incorrect_size_messages(ProtocolVersion::V02)
+}
+
+#[test]
+#[serial]
+fn handles_incorrect_size_messages_v03() {
+    handles_incorrect_size_messages(ProtocolVersion::V03)
+}
+
+/// Ensure that the protocol implementation can deal with truncated
+/// messages and with overlong messages.
+///
+/// This test performs a complete handshake between two randomly generated
+/// servers; instead of delivering the message correctly at first messages
+/// of length zero through about 1.2 times the correct message size are delivered.
+///
+/// Producing an error is expected on each of these messages.
+///
+/// Finally the correct message is delivered and the same process
+/// starts again in the other direction.
+///
+/// Through all this, the handshake should still successfully terminate;
+/// i.e. an exchanged key must be produced in both servers.
+fn handles_incorrect_size_messages(protocol_version: ProtocolVersion) {
+    setup_logging();
+    rosenpass_secret_memory::secret_policy_try_use_memfd_secrets();
+    stacker::grow(8 * 1024 * 1024, || {
+        const OVERSIZED_MESSAGE: usize = ((MAX_MESSAGE_LEN as f32) * 1.2) as usize;
+        type MsgBufPlus = Public<OVERSIZED_MESSAGE>;
+
+        const PEER0: PeerPtr = PeerPtr(0);
+
+        let (mut me, mut they) = make_server_pair(protocol_version).unwrap();
+        let (mut msgbuf, mut resbuf) = (MsgBufPlus::zero(), MsgBufPlus::zero());
+
+        // Process the entire handshake
+        let mut msglen = Some(me.initiate_handshake(PEER0, &mut *resbuf).unwrap());
+        while let Some(l) = msglen {
+            std::mem::swap(&mut me, &mut they);
+            std::mem::swap(&mut msgbuf, &mut resbuf);
+            msglen = test_incorrect_sizes_for_msg(&mut me, &*msgbuf, l, &mut *resbuf);
+        }
+
+        assert_eq!(
+            me.osk(PEER0).unwrap().secret(),
+            they.osk(PEER0).unwrap().secret()
+        );
+    });
+}
+
+/// Used in handles_incorrect_size_messages() to first deliver many truncated
+/// and overlong messages, finally the correct message is delivered and the response
+/// returned.
+fn test_incorrect_sizes_for_msg(
+    srv: &mut CryptoServer,
+    msgbuf: &[u8],
+    msglen: usize,
+    resbuf: &mut [u8],
+) -> Option<usize> {
+    resbuf.fill(0);
+
+    for l in 0..(((msglen as f32) * 1.2) as usize) {
+        if l == msglen {
+            continue;
+        }
+
+        let res = srv.handle_msg(&msgbuf[..l], resbuf);
+        assert!(res.is_err()); // handle_msg should raise an error
+        assert!(!resbuf.iter().any(|x| *x != 0)); // resbuf should not have been changed
+    }
+
+    // Apply the proper handle_msg operation
+    srv.handle_msg(&msgbuf[..msglen], resbuf).unwrap().resp
+}
+
+fn keygen() -> Result<(SSk, SPk)> {
+    // TODO: Copied from the benchmark; deduplicate
+    let (mut sk, mut pk) = (SSk::zero(), SPk::zero());
+    StaticKem.keygen(sk.secret_mut(), pk.deref_mut())?;
+    Ok((sk, pk))
+}
+
+fn make_server_pair(protocol_version: ProtocolVersion) -> Result<(CryptoServer, CryptoServer)> {
+    // TODO: Copied from the benchmark; deduplicate
+    let psk = SymKey::random();
+    let ((ska, pka), (skb, pkb)) = (keygen()?, keygen()?);
+    let (mut a, mut b) = (
+        CryptoServer::new(ska, pka.clone()),
+        CryptoServer::new(skb, pkb.clone()),
+    );
+    a.add_peer(
+        Some(psk.clone()),
+        pkb,
+        protocol_version.clone(),
+        OskDomainSeparator::default(),
+    )?;
+    b.add_peer(
+        Some(psk),
+        pka,
+        protocol_version,
+        OskDomainSeparator::default(),
+    )?;
+    Ok((a, b))
+}
+
+#[test]
+#[serial]
+fn test_regular_exchange_v02() {
+    test_regular_exchange(ProtocolVersion::V02)
+}
+
+#[test]
+#[serial]
+fn test_regular_exchange_v03() {
+    test_regular_exchange(ProtocolVersion::V03)
+}
+
+fn test_regular_exchange(protocol_version: ProtocolVersion) {
+    setup_logging();
+    rosenpass_secret_memory::secret_policy_try_use_memfd_secrets();
+    stacker::grow(8 * 1024 * 1024, || {
+        type MsgBufPlus = Public<MAX_MESSAGE_LEN>;
+        let (mut a, mut b) = make_server_pair(protocol_version).unwrap();
+
+        let mut a_to_b_buf = MsgBufPlus::zero();
+        let mut b_to_a_buf = MsgBufPlus::zero();
+
+        let ip_a: SocketAddrV4 = "127.0.0.1:8080".parse().unwrap();
+        let mut ip_addr_port_a = ip_a.ip().octets().to_vec();
+        ip_addr_port_a.extend_from_slice(&ip_a.port().to_be_bytes());
+
+        let _ip_b: SocketAddrV4 = "127.0.0.1:8081".parse().unwrap();
+
+        let init_hello_len = a.initiate_handshake(PeerPtr(0), &mut *a_to_b_buf).unwrap();
+
+        let init_msg_type: MsgType = a_to_b_buf.value[0].try_into().unwrap();
+        assert_eq!(init_msg_type, MsgType::InitHello);
+
+        //B handles InitHello, sends RespHello
+        let HandleMsgResult { resp, .. } = b
+            .handle_msg(&a_to_b_buf.as_slice()[..init_hello_len], &mut *b_to_a_buf)
+            .unwrap();
+
+        let resp_hello_len = resp.unwrap();
+
+        let resp_msg_type: MsgType = b_to_a_buf.value[0].try_into().unwrap();
+        assert_eq!(resp_msg_type, MsgType::RespHello);
+
+        let HandleMsgResult {
+            resp,
+            exchanged_with,
+        } = a
+            .handle_msg(&b_to_a_buf[..resp_hello_len], &mut *a_to_b_buf)
+            .unwrap();
+
+        let init_conf_len = resp.unwrap();
+        let init_conf_msg_type: MsgType = a_to_b_buf.value[0].try_into().unwrap();
+
+        assert_eq!(exchanged_with, Some(PeerPtr(0)));
+        assert_eq!(init_conf_msg_type, MsgType::InitConf);
+
+        //B handles InitConf, sends EmptyData
+        let HandleMsgResult {
+            resp: _,
+            exchanged_with,
+        } = b
+            .handle_msg(&a_to_b_buf.as_slice()[..init_conf_len], &mut *b_to_a_buf)
+            .unwrap();
+
+        let empty_data_msg_type: MsgType = b_to_a_buf.value[0].try_into().unwrap();
+
+        assert_eq!(exchanged_with, Some(PeerPtr(0)));
+        assert_eq!(empty_data_msg_type, MsgType::EmptyData);
+    });
+}
+
+#[test]
+#[serial]
+fn test_regular_init_conf_retransmit_v02() {
+    test_regular_init_conf_retransmit(ProtocolVersion::V02)
+}
+
+#[test]
+#[serial]
+fn test_regular_init_conf_retransmit_v03() {
+    test_regular_init_conf_retransmit(ProtocolVersion::V03)
+}
+
+fn test_regular_init_conf_retransmit(protocol_version: ProtocolVersion) {
+    setup_logging();
+    rosenpass_secret_memory::secret_policy_try_use_memfd_secrets();
+    stacker::grow(8 * 1024 * 1024, || {
+        type MsgBufPlus = Public<MAX_MESSAGE_LEN>;
+        let (mut a, mut b) = make_server_pair(protocol_version).unwrap();
+
+        let mut a_to_b_buf = MsgBufPlus::zero();
+        let mut b_to_a_buf = MsgBufPlus::zero();
+
+        let ip_a: SocketAddrV4 = "127.0.0.1:8080".parse().unwrap();
+        let mut ip_addr_port_a = ip_a.ip().octets().to_vec();
+        ip_addr_port_a.extend_from_slice(&ip_a.port().to_be_bytes());
+
+        let _ip_b: SocketAddrV4 = "127.0.0.1:8081".parse().unwrap();
+
+        let init_hello_len = a.initiate_handshake(PeerPtr(0), &mut *a_to_b_buf).unwrap();
+
+        let init_msg_type: MsgType = a_to_b_buf.value[0].try_into().unwrap();
+        assert_eq!(init_msg_type, MsgType::InitHello);
+
+        //B handles InitHello, sends RespHello
+        let HandleMsgResult { resp, .. } = b
+            .handle_msg(&a_to_b_buf.as_slice()[..init_hello_len], &mut *b_to_a_buf)
+            .unwrap();
+
+        let resp_hello_len = resp.unwrap();
+
+        let resp_msg_type: MsgType = b_to_a_buf.value[0].try_into().unwrap();
+        assert_eq!(resp_msg_type, MsgType::RespHello);
+
+        //A handles RespHello, sends InitConf, exchanges keys
+        let HandleMsgResult {
+            resp,
+            exchanged_with,
+        } = a
+            .handle_msg(&b_to_a_buf[..resp_hello_len], &mut *a_to_b_buf)
+            .unwrap();
+
+        let init_conf_len = resp.unwrap();
+        let init_conf_msg_type: MsgType = a_to_b_buf.value[0].try_into().unwrap();
+
+        assert_eq!(exchanged_with, Some(PeerPtr(0)));
+        assert_eq!(init_conf_msg_type, MsgType::InitConf);
+
+        //B handles InitConf, sends EmptyData
+        let HandleMsgResult {
+            resp: _,
+            exchanged_with,
+        } = b
+            .handle_msg(&a_to_b_buf.as_slice()[..init_conf_len], &mut *b_to_a_buf)
+            .unwrap();
+
+        let empty_data_msg_type: MsgType = b_to_a_buf.value[0].try_into().unwrap();
+
+        assert_eq!(exchanged_with, Some(PeerPtr(0)));
+        assert_eq!(empty_data_msg_type, MsgType::EmptyData);
+
+        //B handles InitConf again, sends EmptyData
+        let HandleMsgResult {
+            resp: _,
+            exchanged_with,
+        } = b
+            .handle_msg(&a_to_b_buf.as_slice()[..init_conf_len], &mut *b_to_a_buf)
+            .unwrap();
+
+        let empty_data_msg_type: MsgType = b_to_a_buf.value[0].try_into().unwrap();
+
+        assert!(exchanged_with.is_none());
+        assert_eq!(empty_data_msg_type, MsgType::EmptyData);
+    });
+}
+
+#[test]
+#[serial]
+#[cfg(feature = "experiment_cookie_dos_mitigation")]
+fn cookie_reply_mechanism_responder_under_load_v02() {
+    cookie_reply_mechanism_initiator_bails_on_message_under_load(ProtocolVersion::V02)
+}
+
+#[test]
+#[serial]
+#[cfg(feature = "experiment_cookie_dos_mitigation")]
+fn cookie_reply_mechanism_responder_under_load_v03() {
+    cookie_reply_mechanism_initiator_bails_on_message_under_load(ProtocolVersion::V03)
+}
+
+#[cfg(feature = "experiment_cookie_dos_mitigation")]
+fn cookie_reply_mechanism_responder_under_load(protocol_version: ProtocolVersion) {
+    use std::{thread::sleep, time::Duration};
+
+    use super::{Lifecycle, MortalExt};
+
+    setup_logging();
+    rosenpass_secret_memory::secret_policy_try_use_memfd_secrets();
+    stacker::grow(8 * 1024 * 1024, || {
+        type MsgBufPlus = Public<MAX_MESSAGE_LEN>;
+        let (mut a, mut b) = make_server_pair(protocol_version.clone()).unwrap();
+
+        let mut a_to_b_buf = MsgBufPlus::zero();
+        let mut b_to_a_buf = MsgBufPlus::zero();
+
+        let ip_a: SocketAddrV4 = "127.0.0.1:8080".parse().unwrap();
+        let mut ip_addr_port_a = ip_a.ip().octets().to_vec();
+        ip_addr_port_a.extend_from_slice(&ip_a.port().to_be_bytes());
+
+        let _ip_b: SocketAddrV4 = "127.0.0.1:8081".parse().unwrap();
+
+        let init_hello_len = a.initiate_handshake(PeerPtr(0), &mut *a_to_b_buf).unwrap();
+        let socket_addr_a = std::net::SocketAddr::V4(ip_a);
+        let mut ip_addr_port_a = match socket_addr_a.ip() {
+            std::net::IpAddr::V4(ipv4) => ipv4.octets().to_vec(),
+            std::net::IpAddr::V6(ipv6) => ipv6.octets().to_vec(),
+        };
+
+        ip_addr_port_a.extend_from_slice(&socket_addr_a.port().to_be_bytes());
+
+        let ip_addr_port_a: VecHostIdentifier = ip_addr_port_a.into();
+
+        //B handles handshake under load, should send cookie reply message with invalid cookie
+        let HandleMsgResult { resp, .. } = b
+            .handle_msg_under_load(
+                &a_to_b_buf.as_slice()[..init_hello_len],
+                &mut *b_to_a_buf,
+                &ip_addr_port_a,
+            )
+            .unwrap();
+
+        let cookie_reply_len = resp.unwrap();
+
+        //A handles cookie reply message
+        a.handle_msg(&b_to_a_buf[..cookie_reply_len], &mut *a_to_b_buf)
+            .unwrap();
+
+        assert_eq!(PeerPtr(0).cv().lifecycle(&a), Lifecycle::Young);
+
+        let expected_cookie_value =
+            crate::hash_domains::cookie_value(protocol_version.keyed_hash())
+                .unwrap()
+                .mix(
+                    b.active_or_retired_cookie_secrets()[0]
+                        .unwrap()
+                        .get(&b)
+                        .value
+                        .secret(),
+                )
+                .unwrap()
+                .mix(ip_addr_port_a.encode())
+                .unwrap()
+                .into_value()[..16]
+                .to_vec();
+
+        assert_eq!(
+            PeerPtr(0).cv().get(&a).map(|x| &x.value.secret()[..]),
+            Some(&expected_cookie_value[..])
+        );
+
+        let retx_init_hello_len = loop {
+            match a.poll().unwrap() {
+                PollResult::SendRetransmission(peer) => {
+                    break a.retransmit_handshake(peer, &mut *a_to_b_buf).unwrap();
+                }
+                PollResult::Sleep(time) => {
+                    sleep(Duration::from_secs_f64(time));
+                }
+                _ => {}
+            }
+        };
+
+        let retx_msg_type: MsgType = a_to_b_buf.value[0].try_into().unwrap();
+        assert_eq!(retx_msg_type, MsgType::InitHello);
+
+        //B handles retransmitted message
+        let HandleMsgResult { resp, .. } = b
+            .handle_msg_under_load(
+                &a_to_b_buf.as_slice()[..retx_init_hello_len],
+                &mut *b_to_a_buf,
+                &ip_addr_port_a,
+            )
+            .unwrap();
+
+        let _resp_hello_len = resp.unwrap();
+
+        let resp_msg_type: MsgType = b_to_a_buf.value[0].try_into().unwrap();
+        assert_eq!(resp_msg_type, MsgType::RespHello);
+    });
+}
+
+#[test]
+#[serial]
+#[cfg(feature = "experiment_cookie_dos_mitigation")]
+fn cookie_reply_mechanism_initiator_bails_on_message_under_load_v02() {
+    cookie_reply_mechanism_initiator_bails_on_message_under_load(ProtocolVersion::V02)
+}
+
+#[test]
+#[serial]
+#[cfg(feature = "experiment_cookie_dos_mitigation")]
+fn cookie_reply_mechanism_initiator_bails_on_message_under_load_v03() {
+    cookie_reply_mechanism_initiator_bails_on_message_under_load(ProtocolVersion::V03)
+}
+
+#[cfg(feature = "experiment_cookie_dos_mitigation")]
+fn cookie_reply_mechanism_initiator_bails_on_message_under_load(protocol_version: ProtocolVersion) {
+    setup_logging();
+    rosenpass_secret_memory::secret_policy_try_use_memfd_secrets();
+    stacker::grow(8 * 1024 * 1024, || {
+        type MsgBufPlus = Public<MAX_MESSAGE_LEN>;
+        let (mut a, mut b) = make_server_pair(protocol_version).unwrap();
+
+        let mut a_to_b_buf = MsgBufPlus::zero();
+        let mut b_to_a_buf = MsgBufPlus::zero();
+
+        let ip_a: SocketAddrV4 = "127.0.0.1:8080".parse().unwrap();
+        let mut ip_addr_port_a = ip_a.ip().octets().to_vec();
+        ip_addr_port_a.extend_from_slice(&ip_a.port().to_be_bytes());
+        let ip_b: SocketAddrV4 = "127.0.0.1:8081".parse().unwrap();
+
+        //A initiates handshake
+        let init_hello_len = a.initiate_handshake(PeerPtr(0), &mut *a_to_b_buf).unwrap();
+
+        //B handles InitHello message, should respond with RespHello
+        let HandleMsgResult { resp, .. } = b
+            .handle_msg(&a_to_b_buf.as_slice()[..init_hello_len], &mut *b_to_a_buf)
+            .unwrap();
+
+        let resp_hello_len = resp.unwrap();
+        let resp_msg_type: MsgType = b_to_a_buf.value[0].try_into().unwrap();
+        assert_eq!(resp_msg_type, MsgType::RespHello);
+
+        let socket_addr_b = std::net::SocketAddr::V4(ip_b);
+        let mut ip_addr_port_b = [0u8; 18];
+        let mut ip_addr_port_b_len = 0;
+        match socket_addr_b.ip() {
+            std::net::IpAddr::V4(ipv4) => {
+                ip_addr_port_b[0..4].copy_from_slice(&ipv4.octets());
+                ip_addr_port_b_len += 4;
+            }
+            std::net::IpAddr::V6(ipv6) => {
+                ip_addr_port_b[0..16].copy_from_slice(&ipv6.octets());
+                ip_addr_port_b_len += 16;
+            }
+        };
+
+        ip_addr_port_b[ip_addr_port_b_len..ip_addr_port_b_len + 2]
+            .copy_from_slice(&socket_addr_b.port().to_be_bytes());
+        ip_addr_port_b_len += 2;
+
+        let ip_addr_port_b: VecHostIdentifier =
+            ip_addr_port_b[..ip_addr_port_b_len].to_vec().into();
+
+        //A handles RespHello message under load, should not send cookie reply
+        assert!(a
+            .handle_msg_under_load(
+                &b_to_a_buf[..resp_hello_len],
+                &mut *a_to_b_buf,
+                &ip_addr_port_b
+            )
+            .is_err());
+    });
+}
+
+#[test]
+fn init_conf_retransmission_v02() -> Result<()> {
+    init_conf_retransmission(ProtocolVersion::V02)
+}
+
+#[test]
+fn init_conf_retransmission_v03() -> Result<()> {
+    init_conf_retransmission(ProtocolVersion::V03)
+}
+
+fn init_conf_retransmission(protocol_version: ProtocolVersion) -> anyhow::Result<()> {
+    rosenpass_secret_memory::secret_policy_try_use_memfd_secrets();
+
+    fn keypair() -> Result<(SSk, SPk)> {
+        let (mut sk, mut pk) = (SSk::zero(), SPk::zero());
+        StaticKem.keygen(sk.secret_mut(), pk.deref_mut())?;
+        Ok((sk, pk))
+    }
+
+    fn proc_initiation(srv: &mut CryptoServer, peer: PeerPtr) -> Result<Envelope<InitHello>> {
+        let mut buf = MsgBuf::zero();
+        srv.initiate_handshake(peer, buf.as_mut_slice())?
+            .discard_result();
+        let msg = truncating_cast_into::<Envelope<InitHello>>(buf.borrow_mut())?;
+        Ok(msg.read())
+    }
+
+    fn proc_msg<Rx: AsBytes + FromBytes, Tx: AsBytes + FromBytes>(
+        srv: &mut CryptoServer,
+        rx: &Envelope<Rx>,
+    ) -> anyhow::Result<Envelope<Tx>> {
+        let mut buf = MsgBuf::zero();
+        srv.handle_msg(rx.as_bytes(), buf.as_mut_slice())?
+            .resp
+            .context("Failed to produce RespHello message")?
+            .discard_result();
+        let msg = truncating_cast_into::<Envelope<Tx>>(buf.borrow_mut())?;
+        Ok(msg.read())
+    }
+
+    fn proc_init_hello(
+        srv: &mut CryptoServer,
+        ih: &Envelope<InitHello>,
+    ) -> anyhow::Result<Envelope<RespHello>> {
+        proc_msg::<InitHello, RespHello>(srv, ih)
+    }
+
+    fn proc_resp_hello(
+        srv: &mut CryptoServer,
+        rh: &Envelope<RespHello>,
+    ) -> anyhow::Result<Envelope<InitConf>> {
+        proc_msg::<RespHello, InitConf>(srv, rh)
+    }
+
+    fn proc_init_conf(
+        srv: &mut CryptoServer,
+        rh: &Envelope<InitConf>,
+    ) -> anyhow::Result<Envelope<EmptyData>> {
+        proc_msg::<InitConf, EmptyData>(srv, rh)
+    }
+
+    fn poll(srv: &mut CryptoServer) -> anyhow::Result<()> {
+        // Discard all events; just apply the side effects
+        while !matches!(srv.poll()?, PollResult::Sleep(_)) {}
+        Ok(())
+    }
+
+    // TODO: Implement Clone on our message types
+    fn clone_msg<Msg: AsBytes + FromBytes>(msg: &Msg) -> anyhow::Result<Msg> {
+        Ok(truncating_cast_into_nomut::<Msg>(msg.as_bytes())?.read())
+    }
+
+    fn break_payload<Msg: AsBytes + FromBytes>(
+        srv: &mut CryptoServer,
+        peer: PeerPtr,
+        msg: &Envelope<Msg>,
+    ) -> anyhow::Result<Envelope<Msg>> {
+        let mut msg = clone_msg(msg)?;
+        msg.as_bytes_mut()[memoffset::offset_of!(Envelope<Msg>, payload)] ^= 0x01;
+        msg.seal(peer, srv)?; // Recalculate seal; we do not want to focus on "seal broken" errs
+        Ok(msg)
+    }
+
+    fn check_faulty_proc_init_conf(srv: &mut CryptoServer, ic_broken: &Envelope<InitConf>) {
+        let mut buf = MsgBuf::zero();
+        let res = srv.handle_msg(ic_broken.as_bytes(), buf.as_mut_slice());
+        assert!(res.is_err());
+    }
+
+    // we this as a closure in orer to use the protocol_version variable in it.
+    let check_retransmission = |srv: &mut CryptoServer,
+                                ic: &Envelope<InitConf>,
+                                ic_broken: &Envelope<InitConf>,
+                                rc: &Envelope<EmptyData>|
+     -> Result<()> {
+        // Processing the same RespHello package again leads to retransmission (i.e. exactly the
+        // same output)
+        let rc_dup = proc_init_conf(srv, ic)?;
+        assert_eq!(rc.as_bytes(), rc_dup.as_bytes());
+
+        // Though if we directly call handle_resp_hello() we get an error since
+        // retransmission is not being handled by the cryptographic code
+        let mut discard_resp_conf = EmptyData::new_zeroed();
+        let res = srv.handle_init_conf(
+            &ic.payload,
+            &mut discard_resp_conf,
+            protocol_version.clone().keyed_hash(),
+        );
+        assert!(res.is_err());
+
+        // Obviously, a broken InitConf message should still be rejected
+        check_faulty_proc_init_conf(srv, ic_broken);
+
+        Ok(())
+    };
+
+    let (ska, pka) = keypair()?;
+    let (skb, pkb) = keypair()?;
+
+    // initialize server and a pre-shared key
+    let mut a = CryptoServer::new(ska, pka.clone());
+    let mut b = CryptoServer::new(skb, pkb.clone());
+
+    // introduce peers to each other
+    let b_peer = a.add_peer(
+        None,
+        pkb,
+        protocol_version.clone(),
+        OskDomainSeparator::default(),
+    )?;
+    let a_peer = b.add_peer(
+        None,
+        pka,
+        protocol_version.clone(),
+        OskDomainSeparator::default(),
+    )?;
+
+    // Execute protocol up till the responder confirmation (EmptyData)
+    let ih1 = proc_initiation(&mut a, b_peer)?;
+    let rh1 = proc_init_hello(&mut b, &ih1)?;
+    let ic1 = proc_resp_hello(&mut a, &rh1)?;
+    let rc1 = proc_init_conf(&mut b, &ic1)?;
+
+    // Modified version of ic1 and rc1, for tests that require it
+    let ic1_broken = break_payload(&mut a, b_peer, &ic1)?;
+    assert_ne!(ic1.as_bytes(), ic1_broken.as_bytes());
+
+    // Modified version of rc1, for tests that require it
+    let rc1_broken = break_payload(&mut b, a_peer, &rc1)?;
+    assert_ne!(rc1.as_bytes(), rc1_broken.as_bytes());
+
+    // Retransmission works as designed
+    check_retransmission(&mut b, &ic1, &ic1_broken, &rc1)?;
+
+    // Even with a couple of poll operations in between (which clears the cache
+    // after a time out of two minutes…we should never hit this time out in this
+    // cache)
+    for _ in 0..4 {
+        poll(&mut b)?;
+        check_retransmission(&mut b, &ic1, &ic1_broken, &rc1)?;
+    }
+    // We can even validate that the data is coming out of the cache by changing the cache
+    // to use our broken messages. It does not matter that these messages are cryptographically
+    // broken since we insert them manually into the cache
+    // a_peer.known_init_conf_response()
+    KnownInitConfResponsePtr::insert_for_request_msg(
+        &mut b,
+        a_peer,
+        &ic1_broken,
+        rc1_broken.clone(),
+    );
+    check_retransmission(&mut b, &ic1_broken, &ic1, &rc1_broken)?;
+
+    // Lets reset to the correct message though
+    KnownInitConfResponsePtr::insert_for_request_msg(&mut b, a_peer, &ic1, rc1.clone());
+
+    // Again, nothing changes after calling poll
+    poll(&mut b)?;
+    check_retransmission(&mut b, &ic1, &ic1_broken, &rc1)?;
+
+    // Except if we jump forward into the future past the point where the responder
+    // starts to initiate rekeying; in this case, the automatic time out is triggered and the cache is cleared
+    super::testutils::time_travel_forward(&mut b, REKEY_AFTER_TIME_RESPONDER);
+
+    // As long as we do not call poll, everything is fine
+    check_retransmission(&mut b, &ic1, &ic1_broken, &rc1)?;
+
+    // But after we do, the response is gone and can not be recreated
+    // since the biscuit is stale
+    poll(&mut b)?;
+    check_faulty_proc_init_conf(&mut b, &ic1); // ic1 is now effectively broken
+    assert!(b.peers[0].known_init_conf_response.is_none()); // The cache is gone
+
+    Ok(())
+}

rosenpass/src/protocol/testutils.rs

@@ -0,0 +1,54 @@
+//! Helpers used in tests
+
+use std::ops::DerefMut;
+
+use rosenpass_cipher_traits::primitives::Kem;
+use rosenpass_ciphers::StaticKem;
+
+use super::{
+    basic_types::{SPk, SSk},
+    osk_domain_separator::OskDomainSeparator,
+    CryptoServer, PeerPtr, ProtocolVersion,
+};
+
+/// Helper for tests and examples
+pub struct ServerForTesting {
+    pub peer: PeerPtr,
+    pub peer_keys: (SSk, SPk),
+    pub srv: CryptoServer,
+}
+
+/// TODO: Document that the protocol version is only used for creating the peer for testing
+impl ServerForTesting {
+    pub fn new(protocol_version: ProtocolVersion) -> anyhow::Result<Self> {
+        let (mut sskm, mut spkm) = (SSk::zero(), SPk::zero());
+        StaticKem.keygen(sskm.secret_mut(), spkm.deref_mut())?;
+        let mut srv = CryptoServer::new(sskm, spkm);
+
+        let (mut sskt, mut spkt) = (SSk::zero(), SPk::zero());
+        StaticKem.keygen(sskt.secret_mut(), spkt.deref_mut())?;
+        let peer = srv.add_peer(
+            None,
+            spkt.clone(),
+            protocol_version,
+            OskDomainSeparator::default(),
+        )?;
+
+        let peer_keys = (sskt, spkt);
+        Ok(ServerForTesting {
+            peer,
+            peer_keys,
+            srv,
+        })
+    }
+
+    pub fn tuple(self) -> (PeerPtr, (SSk, SPk), CryptoServer) {
+        (self.peer, self.peer_keys, self.srv)
+    }
+}
+
+/// Time travel forward in time
+pub fn time_travel_forward(srv: &mut CryptoServer, secs: f64) {
+    let dur = std::time::Duration::from_secs_f64(secs);
+    srv.timebase.0 = srv.timebase.0.checked_sub(dur).unwrap();
+}

rosenpass/src/protocol/timing.rs

@@ -0,0 +1,46 @@
+//! Time-keeping related utilities for the Rosenpass protocol
+
+use super::constants::EVENT_GRACE;
+
+/// A type for time, e.g. for backoff before re-tries
+pub type Timing = f64;
+
+/// Magic time stamp to indicate some object is ancient; "Before Common Era"
+///
+/// This is for instance used as a magic time stamp indicating age when some
+/// cryptographic object certainly needs to be refreshed.
+///
+/// Using this instead of Timing::MIN or Timing::INFINITY to avoid floating
+/// point math weirdness.
+pub const BCE: Timing = -3600.0 * 24.0 * 356.0 * 10_000.0;
+
+/// Magic time stamp to indicate that some process is not time-limited
+///
+/// Actually it's eight hours; This is intentional to avoid weirdness
+/// regarding unexpectedly large numbers in system APIs as this is < i16::MAX
+pub const UNENDING: Timing = 3600.0 * 8.0;
+
+/// An even `ev` has happened relative to a point in time `now`
+/// if the `ev` does not lie in the future relative to now.
+///
+/// An event lies in the future relative to `now` if
+/// does not lie in the past or present.
+///
+/// An event `ev` lies in the past if `ev < now`. It lies in the
+/// present if the absolute difference between `ev` and `now` is
+/// smaller than [EVENT_GRACE].
+///
+/// Think of this as `ev <= now` for with [EVENT_GRACE] applied.
+///
+/// # Examples
+///
+/// ```
+/// use rosenpass::protocol::{timing::has_happened, constants::EVENT_GRACE};
+/// assert!(has_happened(EVENT_GRACE * -1.0, 0.0));
+/// assert!(has_happened(0.0, 0.0));
+/// assert!(has_happened(EVENT_GRACE * 0.999, 0.0));
+/// assert!(!has_happened(EVENT_GRACE * 1.001, 0.0));
+/// ```
+pub fn has_happened(ev: Timing, now: Timing) -> bool {
+    (ev - now) < EVENT_GRACE
+}

rosenpass/src/protocol/zerocopy.rs

@@ -0,0 +1,21 @@
+//! Helpers for working with the zerocopy crate
+
+use std::mem::size_of;
+
+use zerocopy::{FromBytes, Ref};
+
+use crate::RosenpassError;
+
+/// Used to parse a network message using [zerocopy]
+pub fn truncating_cast_into<T: FromBytes>(
+    buf: &mut [u8],
+) -> Result<Ref<&mut [u8], T>, RosenpassError> {
+    Ref::new(&mut buf[..size_of::<T>()]).ok_or(RosenpassError::BufferSizeMismatch)
+}
+
+/// Used to parse a network message using [zerocopy], mutably
+pub fn truncating_cast_into_nomut<T: FromBytes>(
+    buf: &[u8],
+) -> Result<Ref<&[u8], T>, RosenpassError> {
+    Ref::new(&buf[..size_of::<T>()]).ok_or(RosenpassError::BufferSizeMismatch)
+}

rosenpass/tests/api-integration-tests-api-setup.rs

@@ -14,6 +14,8 @@ use rosenpass::api::{
     self, add_listen_socket_response_status, add_psk_broker_response_status,
     supply_keypair_response_status,
 };
+use rosenpass::config::ProtocolVersion;
+use rosenpass::protocol::basic_types::SymKey;
 use rosenpass_util::{
     b64::B64Display,
     file::LoadValueB64,
@@ -27,8 +29,6 @@ use std::os::fd::{AsFd, AsRawFd};
 use tempfile::TempDir;
 use zerocopy::AsBytes;
 
-use rosenpass::protocol::SymKey;
-
 struct KillChild(std::process::Child);
 
 impl Drop for KillChild {
@@ -48,7 +48,16 @@ impl Drop for KillChild {
 }
 
 #[test]
-fn api_integration_api_setup() -> anyhow::Result<()> {
+fn api_integration_api_setup_v02() -> anyhow::Result<()> {
+    api_integration_api_setup(ProtocolVersion::V02)
+}
+
+#[test]
+fn api_integration_api_setup_v03() -> anyhow::Result<()> {
+    api_integration_api_setup(ProtocolVersion::V03)
+}
+
+fn api_integration_api_setup(protocol_version: ProtocolVersion) -> anyhow::Result<()> {
     rosenpass_secret_memory::policy::secret_policy_use_only_malloc_secrets();
 
     let dir = TempDir::with_prefix("rosenpass-api-integration-test")?;
@@ -96,6 +105,8 @@ fn api_integration_api_setup() -> anyhow::Result<()> {
                 peer: format!("{}", peer_b_wg_peer_id.fmt_b64::<8129>()),
                 extra_params: vec![],
             }),
+            protocol_version: protocol_version.clone(),
+            osk_domain_separator: Default::default(),
         }],
     };
 
@@ -116,6 +127,8 @@ fn api_integration_api_setup() -> anyhow::Result<()> {
             endpoint: Some(peer_a_endpoint.to_owned()),
             pre_shared_key: None,
             wg: None,
+            protocol_version: protocol_version.clone(),
+            osk_domain_separator: Default::default(),
         }],
     };
 

rosenpass/tests/api-integration-tests.rs

@@ -16,7 +16,8 @@ use rosenpass_util::{mem::DiscardResultExt, zerocopy::ZerocopySliceExt};
 use tempfile::TempDir;
 use zerocopy::AsBytes;
 
-use rosenpass::protocol::SymKey;
+use rosenpass::config::ProtocolVersion;
+use rosenpass::protocol::basic_types::SymKey;
 
 struct KillChild(std::process::Child);
 
@@ -37,7 +38,15 @@ impl Drop for KillChild {
 }
 
 #[test]
-fn api_integration_test() -> anyhow::Result<()> {
+fn api_integration_test_v02() -> anyhow::Result<()> {
+    api_integration_test(ProtocolVersion::V02)
+}
+
+fn api_integration_test_v03() -> anyhow::Result<()> {
+    api_integration_test(ProtocolVersion::V03)
+}
+
+fn api_integration_test(protocol_version: ProtocolVersion) -> anyhow::Result<()> {
     rosenpass_secret_memory::policy::secret_policy_use_only_malloc_secrets();
 
     let dir = TempDir::with_prefix("rosenpass-api-integration-test")?;
@@ -73,6 +82,8 @@ fn api_integration_test() -> anyhow::Result<()> {
             endpoint: None,
             pre_shared_key: None,
             wg: None,
+            protocol_version: protocol_version.clone(),
+            osk_domain_separator: Default::default(),
         }],
     };
 
@@ -93,6 +104,8 @@ fn api_integration_test() -> anyhow::Result<()> {
             endpoint: Some(peer_a_endpoint.to_owned()),
             pre_shared_key: None,
             wg: None,
+            protocol_version: protocol_version.clone(),
+            osk_domain_separator: Default::default(),
         }],
     };