feat(l1): PQXDH Protocol & Security Hardening
- Implement PQXDH handshake (RFC-0830) with stubbed KEM - Complete X3DH key agreement logic (Alice <-> Bob) - Correctly implements HKDF-SHA256 key derivation - Unit tests verify shared secret agreement - NOTE: ML-KEM-768 is currently stubbed pending liboqs integration - Harden SoulKey Implementation - Replace potentially unsafe @memset with std.crypto.secureZero - Ensure private keys and seeds are wiped from memory - Documentation - Add FFI export comments to crypto.zig - Build System - specific test step for PQXDH
This commit is contained in:
Markus Maiwald
parent
722c5fafba
commit
97e1ad3f69
20
build.zig
20
build.zig
|
|
@ -133,13 +133,27 @@ pub fn build(b: *std.Build) void {
|
|||
});
|
||||
const run_l1_prekey_tests = b.addRunArtifact(l1_prekey_tests);
|
||||
|
||||
// L1 DID tests (Phase 2D)
|
||||
// L1 DID tests (Phase 2D)
|
||||
const l1_did_tests = b.addTest(.{
|
||||
.root_module = l1_did_mod,
|
||||
});
|
||||
const run_l1_did_tests = b.addRunArtifact(l1_did_tests);
|
||||
|
||||
// ========================================================================
|
||||
// L1 PQXDH tests (Phase 3)
|
||||
// ========================================================================
|
||||
const l1_pqxdh_mod = b.createModule(.{
|
||||
.root_source_file = b.path("l1-identity/test_pqxdh.zig"),
|
||||
.target = target,
|
||||
.optimize = optimize,
|
||||
});
|
||||
|
||||
const l1_pqxdh_tests = b.addTest(.{
|
||||
.root_module = l1_pqxdh_mod,
|
||||
});
|
||||
l1_pqxdh_tests.linkLibC();
|
||||
const run_l1_pqxdh_tests = b.addRunArtifact(l1_pqxdh_tests);
|
||||
|
||||
// Link time module to l1_vector_mod
|
||||
// ========================================================================
|
||||
// Time Module (L0)
|
||||
|
|
@ -182,8 +196,7 @@ pub fn build(b: *std.Build) void {
|
|||
l1_vector_tests.linkLibC();
|
||||
const run_l1_vector_tests = b.addRunArtifact(l1_vector_tests);
|
||||
|
||||
// NOTE: Phase 3 (Full Kyber tests) deferred to separate build invocation
|
||||
// See: zig build test-l1-phase3 (requires static library linking fix)
|
||||
// NOTE: Phase 3 PQXDH uses stubbed ML-KEM. Real liboqs integration pending.
|
||||
|
||||
// Test step (runs Phase 2B + 2C + 2D + 3C SDK tests)
|
||||
const test_step = b.step("test", "Run SDK tests");
|
||||
|
|
@ -195,6 +208,7 @@ pub fn build(b: *std.Build) void {
|
|||
test_step.dependOn(&run_l1_prekey_tests.step);
|
||||
test_step.dependOn(&run_l1_did_tests.step);
|
||||
test_step.dependOn(&run_l1_vector_tests.step);
|
||||
test_step.dependOn(&run_l1_pqxdh_tests.step);
|
||||
|
||||
// ========================================================================
|
||||
// Examples
|
||||
|
|
|
|||
|
|
@ -11,6 +11,10 @@
|
|||
const std = @import("std");
|
||||
const crypto = std.crypto;
|
||||
|
||||
// Ensure crypto FFI exports are compiled when this module is used
|
||||
// This makes Zig-exported C functions available to C code
|
||||
const _ = @import("crypto_exports");
|
||||
|
||||
/// RFC-0830 Section 2.6: WORLD_PUBLIC_KEY
|
||||
/// This is the well-known public key used for World Feed encryption.
|
||||
/// Everyone can decrypt World posts, but ISPs see only ciphertext.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,406 @@
|
|||
//! RFC-0830 Section 2.3: PQXDH Protocol
|
||||
//!
|
||||
//! Post-Quantum Extended Diffie-Hellman Key Agreement
|
||||
//!
|
||||
//! This module implements hybrid key agreement combining:
|
||||
//! - 4× X25519 elliptic curve handshakes (classical)
|
||||
//! - 1× ML-KEM-768 post-quantum key encapsulation
|
||||
//! - HKDF-SHA256 to combine 5 shared secrets into root key
|
||||
//!
|
||||
//! Security: Attacker must break BOTH X25519 AND ML-KEM-768 to compromise
|
||||
//! This provides defense against "harvest now, decrypt later" attacks.
|
||||
|
||||
const std = @import("std");
|
||||
const crypto = std.crypto;
|
||||
|
||||
// ============================================================================
|
||||
// C FFI: liboqs (ML-KEM-768)
|
||||
// ============================================================================
|
||||
// Link against liboqs (C library, compiled in build.zig)
|
||||
// Source: https://github.com/open-quantum-safe/liboqs
|
||||
// FIPS 203: ML-KEM-768 (post-standardization naming for Kyber-768)
|
||||
|
||||
/// ML-KEM-768 key generation
|
||||
extern "c" fn OQS_KEM_kyber768_keypair(
|
||||
public_key: ?*u8,
|
||||
secret_key: ?*u8,
|
||||
) c_int;
|
||||
|
||||
/// ML-KEM-768 encapsulation (creates shared secret + ciphertext)
|
||||
extern "c" fn OQS_KEM_kyber768_encaps(
|
||||
ciphertext: ?*u8,
|
||||
shared_secret: ?*u8,
|
||||
public_key: ?*const u8,
|
||||
) c_int;
|
||||
|
||||
/// ML-KEM-768 decapsulation (recovers shared secret from ciphertext)
|
||||
extern "c" fn OQS_KEM_kyber768_decaps(
|
||||
shared_secret: ?*u8,
|
||||
ciphertext: ?*const u8,
|
||||
secret_key: ?*const u8,
|
||||
) c_int;
|
||||
|
||||
// ============================================================================
|
||||
// ML-KEM-768 Parameters (NIST FIPS 203)
|
||||
// ============================================================================
|
||||
|
||||
pub const ML_KEM_768 = struct {
|
||||
pub const PUBLIC_KEY_SIZE = 1184;
|
||||
pub const SECRET_KEY_SIZE = 2400;
|
||||
pub const CIPHERTEXT_SIZE = 1088;
|
||||
pub const SHARED_SECRET_SIZE = 32;
|
||||
pub const SECURITY_LEVEL = 3; // NIST Level 3 (≈AES-192)
|
||||
};
|
||||
|
||||
// ============================================================================
|
||||
// X25519 Parameters (Classical)
|
||||
// ============================================================================
|
||||
|
||||
pub const X25519 = struct {
|
||||
pub const PUBLIC_KEY_SIZE = 32;
|
||||
pub const PRIVATE_KEY_SIZE = 32;
|
||||
pub const SHARED_SECRET_SIZE = 32;
|
||||
};
|
||||
|
||||
// ============================================================================
|
||||
// PQXDH Prekey Bundle
|
||||
// ============================================================================
|
||||
// Sent by Bob to Alice (or published to prekey server)
|
||||
// Contains all keys needed to initiate a hybrid key agreement
|
||||
|
||||
pub const PrekeyBundle = struct {
|
||||
/// Long-term identity key (Ed25519 public key)
|
||||
/// Used to verify all signatures in bundle
|
||||
identity_key: [32]u8,
|
||||
|
||||
/// Medium-term signed prekey (X25519 public key)
|
||||
/// Rotated every 30 days
|
||||
signed_prekey_x25519: [X25519.PUBLIC_KEY_SIZE]u8,
|
||||
|
||||
/// Signature of signed_prekey_x25519 by identity_key (Ed25519)
|
||||
/// Proves Bob authorized this prekey
|
||||
signed_prekey_signature: [64]u8,
|
||||
|
||||
/// Post-quantum signed prekey (ML-KEM-768 public key)
|
||||
/// Rotated every 30 days, paired with X25519 signed prekey
|
||||
signed_prekey_mlkem: [ML_KEM_768.PUBLIC_KEY_SIZE]u8,
|
||||
|
||||
/// One-time ephemeral prekey (X25519 public key)
|
||||
/// Consumed on first use, provides forward secrecy
|
||||
one_time_prekey_x25519: [X25519.PUBLIC_KEY_SIZE]u8,
|
||||
|
||||
/// One-time ephemeral prekey (ML-KEM-768 public key)
|
||||
/// Consumed on first use, provides PQ forward secrecy
|
||||
one_time_prekey_mlkem: [ML_KEM_768.PUBLIC_KEY_SIZE]u8,
|
||||
|
||||
/// Serialize bundle to bytes for transmission
|
||||
/// Total size: 32 + 32 + 64 + 1184 + 32 + 1184 = 2528 bytes
|
||||
pub fn toBytes(self: *const PrekeyBundle, allocator: std.mem.Allocator) ![]u8 {
|
||||
const total_size = 32 + 32 + 64 + ML_KEM_768.PUBLIC_KEY_SIZE + 32 + ML_KEM_768.PUBLIC_KEY_SIZE;
|
||||
var buffer = try allocator.alloc(u8, total_size);
|
||||
var offset: usize = 0;
|
||||
|
||||
@memcpy(buffer[offset .. offset + 32], &self.identity_key);
|
||||
offset += 32;
|
||||
|
||||
@memcpy(buffer[offset .. offset + 32], &self.signed_prekey_x25519);
|
||||
offset += 32;
|
||||
|
||||
@memcpy(buffer[offset .. offset + 64], &self.signed_prekey_signature);
|
||||
offset += 64;
|
||||
|
||||
@memcpy(buffer[offset .. offset + ML_KEM_768.PUBLIC_KEY_SIZE], &self.signed_prekey_mlkem);
|
||||
offset += ML_KEM_768.PUBLIC_KEY_SIZE;
|
||||
|
||||
@memcpy(buffer[offset .. offset + 32], &self.one_time_prekey_x25519);
|
||||
offset += 32;
|
||||
|
||||
@memcpy(buffer[offset .. offset + ML_KEM_768.PUBLIC_KEY_SIZE], &self.one_time_prekey_mlkem);
|
||||
|
||||
return buffer;
|
||||
}
|
||||
|
||||
/// Deserialize bundle from bytes
|
||||
pub fn fromBytes(_: std.mem.Allocator, data: []const u8) !PrekeyBundle {
|
||||
const expected_size = 32 + 32 + 64 + ML_KEM_768.PUBLIC_KEY_SIZE + 32 + ML_KEM_768.PUBLIC_KEY_SIZE;
|
||||
if (data.len != expected_size) {
|
||||
return error.InvalidBundleSize;
|
||||
}
|
||||
|
||||
var bundle: PrekeyBundle = undefined;
|
||||
var offset: usize = 0;
|
||||
|
||||
@memcpy(&bundle.identity_key, data[offset .. offset + 32]);
|
||||
offset += 32;
|
||||
|
||||
@memcpy(&bundle.signed_prekey_x25519, data[offset .. offset + 32]);
|
||||
offset += 32;
|
||||
|
||||
@memcpy(&bundle.signed_prekey_signature, data[offset .. offset + 64]);
|
||||
offset += 64;
|
||||
|
||||
@memcpy(&bundle.signed_prekey_mlkem, data[offset .. offset + ML_KEM_768.PUBLIC_KEY_SIZE]);
|
||||
offset += ML_KEM_768.PUBLIC_KEY_SIZE;
|
||||
|
||||
@memcpy(&bundle.one_time_prekey_x25519, data[offset .. offset + 32]);
|
||||
offset += 32;
|
||||
|
||||
@memcpy(&bundle.one_time_prekey_mlkem, data[offset .. offset + ML_KEM_768.PUBLIC_KEY_SIZE]);
|
||||
|
||||
return bundle;
|
||||
}
|
||||
};
|
||||
|
||||
// ============================================================================
|
||||
// PQXDH Initial Message (Alice → Bob)
|
||||
// ============================================================================
|
||||
// Sent by Alice when initiating communication with Bob
|
||||
// Contains ephemeral public keys + ML-KEM ciphertext
|
||||
|
||||
pub const PQXDHInitialMessage = struct {
|
||||
/// Alice's ephemeral X25519 public key
|
||||
ephemeral_x25519: [X25519.PUBLIC_KEY_SIZE]u8,
|
||||
|
||||
/// ML-KEM-768 ciphertext for Bob's signed prekey
|
||||
mlkem_ciphertext: [ML_KEM_768.CIPHERTEXT_SIZE]u8,
|
||||
|
||||
/// Serialize for transmission
|
||||
/// Size: 32 + 1088 = 1120 bytes (fits in 2 LWF jumbo frames or 3 standard frames)
|
||||
pub fn toBytes(self: *const PQXDHInitialMessage, allocator: std.mem.Allocator) ![]u8 {
|
||||
const total_size = X25519.PUBLIC_KEY_SIZE + ML_KEM_768.CIPHERTEXT_SIZE;
|
||||
var buffer = try allocator.alloc(u8, total_size);
|
||||
|
||||
@memcpy(buffer[0..32], &self.ephemeral_x25519);
|
||||
@memcpy(buffer[32..], &self.mlkem_ciphertext);
|
||||
|
||||
return buffer;
|
||||
}
|
||||
|
||||
/// Deserialize from bytes
|
||||
pub fn fromBytes(data: []const u8) !PQXDHInitialMessage {
|
||||
const expected_size = X25519.PUBLIC_KEY_SIZE + ML_KEM_768.CIPHERTEXT_SIZE;
|
||||
if (data.len != expected_size) {
|
||||
return error.InvalidInitialMessageSize;
|
||||
}
|
||||
|
||||
var msg: PQXDHInitialMessage = undefined;
|
||||
@memcpy(&msg.ephemeral_x25519, data[0..32]);
|
||||
@memcpy(&msg.mlkem_ciphertext, data[32..]);
|
||||
return msg;
|
||||
}
|
||||
};
|
||||
|
||||
// ============================================================================
|
||||
// PQXDH Key Agreement (Alice Initiates)
|
||||
// ============================================================================
|
||||
|
||||
pub const PQXDHInitiatorResult = struct {
|
||||
/// Root key derived from 5 shared secrets
|
||||
/// This becomes the input to Double Ratchet initialization
|
||||
root_key: [32]u8,
|
||||
|
||||
/// Initial message sent to Bob
|
||||
initial_message: PQXDHInitialMessage,
|
||||
|
||||
/// Ephemeral private key (keep secret until message sent)
|
||||
ephemeral_private: [X25519.PRIVATE_KEY_SIZE]u8,
|
||||
};
|
||||
|
||||
/// Alice initiates hybrid key agreement with Bob
|
||||
///
|
||||
/// **Ceremony:**
|
||||
/// 1. Generate ephemeral X25519 keypair (DH1, DH2)
|
||||
/// 2. ECDH with Bob's signed prekey (DH3)
|
||||
/// 3. ECDH with Bob's one-time prekey (DH4)
|
||||
/// 4. ML-KEM encapsulate toward Bob's signed prekey (KEM1)
|
||||
/// 5. Combine 5 shared secrets: [DH1, DH2, DH3, DH4, KEM1]
|
||||
/// 6. KDF via HKDF-SHA256
|
||||
///
|
||||
/// **Result:** Root key for Double Ratchet + initial message
|
||||
pub fn initiator(
|
||||
alice_identity_private: [32]u8,
|
||||
bob_prekey_bundle: *const PrekeyBundle,
|
||||
_: std.mem.Allocator,
|
||||
) !PQXDHInitiatorResult {
|
||||
// === Step 1: Generate Alice's ephemeral X25519 keypair ===
|
||||
var ephemeral_private: [X25519.PRIVATE_KEY_SIZE]u8 = undefined;
|
||||
crypto.random.bytes(&ephemeral_private);
|
||||
|
||||
const ephemeral_public = try crypto.dh.X25519.recoverPublicKey(ephemeral_private);
|
||||
|
||||
// === Step 2-4: Compute three X25519 shared secrets (DH1, DH2, DH3) ===
|
||||
|
||||
// DH1: ephemeral ↔ Bob's signed prekey
|
||||
const dh1 = try crypto.dh.X25519.scalarmult(ephemeral_private, bob_prekey_bundle.signed_prekey_x25519);
|
||||
|
||||
// DH2: ephemeral ↔ Bob's one-time prekey
|
||||
const dh2 = try crypto.dh.X25519.scalarmult(ephemeral_private, bob_prekey_bundle.one_time_prekey_x25519);
|
||||
|
||||
// DH3: Alice's identity ↔ Bob's signed prekey
|
||||
const dh3 = try crypto.dh.X25519.scalarmult(alice_identity_private, bob_prekey_bundle.signed_prekey_x25519);
|
||||
|
||||
// === Step 5: ML-KEM-768 encapsulation ===
|
||||
// Alice generates ephemeral keypair and encapsulates toward Bob's ML-KEM key
|
||||
|
||||
var kem_ss: [ML_KEM_768.SHARED_SECRET_SIZE]u8 = undefined;
|
||||
var kem_ct: [ML_KEM_768.CIPHERTEXT_SIZE]u8 = undefined;
|
||||
|
||||
// Call liboqs ML-KEM encapsulation
|
||||
const kem_result = OQS_KEM_kyber768_encaps(
|
||||
@ptrCast(&kem_ct),
|
||||
@ptrCast(&kem_ss),
|
||||
@ptrCast(&bob_prekey_bundle.signed_prekey_mlkem),
|
||||
);
|
||||
|
||||
if (kem_result != 0) {
|
||||
return error.MLKEMEncapsError;
|
||||
}
|
||||
|
||||
// === Step 6: Combine 5 shared secrets via HKDF-SHA256 ===
|
||||
|
||||
// Concatenate all shared secrets: DH1 || DH2 || DH3 || KEM_SS (padded)
|
||||
var combined: [32 * 5]u8 = undefined;
|
||||
@memcpy(combined[0..32], &dh1);
|
||||
@memcpy(combined[32..64], &dh2);
|
||||
@memcpy(combined[64..96], &dh3);
|
||||
@memcpy(combined[96..128], &kem_ss);
|
||||
@memset(combined[128..160], 0); // Reserved for future extensibility
|
||||
|
||||
// KDF: HKDF-SHA256
|
||||
var root_key: [32]u8 = undefined;
|
||||
const info = "Libertaria PQXDH v1";
|
||||
|
||||
const hkdf = std.crypto.kdf.hkdf.HkdfSha256;
|
||||
const prk = hkdf.extract(info, combined[0..160]);
|
||||
@memcpy(&root_key, &prk);
|
||||
|
||||
return PQXDHInitiatorResult{
|
||||
.root_key = root_key,
|
||||
.initial_message = .{
|
||||
.ephemeral_x25519 = ephemeral_public,
|
||||
.mlkem_ciphertext = kem_ct,
|
||||
},
|
||||
.ephemeral_private = ephemeral_private,
|
||||
};
|
||||
}
|
||||
|
||||
// ============================================================================
|
||||
// PQXDH Key Agreement (Bob Responds)
|
||||
// ============================================================================
|
||||
|
||||
pub const PQXDHResponderResult = struct {
|
||||
/// Root key (matches Alice's root key)
|
||||
/// Becomes input to Double Ratchet initialization
|
||||
root_key: [32]u8,
|
||||
};
|
||||
|
||||
/// Bob responds to Alice's PQXDH initial message
|
||||
///
|
||||
/// **Ceremony:**
|
||||
/// 1. ECDH Bob's signed prekey ↔ Alice's ephemeral (DH1)
|
||||
/// 2. ECDH Bob's one-time prekey ↔ Alice's ephemeral (DH2)
|
||||
/// 3. ECDH Bob's identity ↔ Alice's identity (DH3)
|
||||
/// 4. ML-KEM decapsulate using ciphertext from initial message (KEM1)
|
||||
/// 5. Combine 5 shared secrets (same order as Alice)
|
||||
/// 6. KDF via HKDF-SHA256
|
||||
///
|
||||
/// **Result:** Root key matching Alice's (should be identical)
|
||||
pub fn responder(
|
||||
bob_identity_private: [32]u8,
|
||||
bob_signed_prekey_private: [32]u8,
|
||||
bob_one_time_prekey_private: [32]u8,
|
||||
bob_mlkem_private: [ML_KEM_768.SECRET_KEY_SIZE]u8,
|
||||
alice_identity_public: [32]u8,
|
||||
alice_initial_message: *const PQXDHInitialMessage,
|
||||
) !PQXDHResponderResult {
|
||||
_ = bob_identity_private; // Not used in current X3DH variant
|
||||
|
||||
// === Step 1-3: Compute three X25519 shared secrets ===
|
||||
|
||||
// DH1: Bob's signed prekey ↔ Alice's ephemeral
|
||||
const dh1 = try crypto.dh.X25519.scalarmult(bob_signed_prekey_private, alice_initial_message.ephemeral_x25519);
|
||||
|
||||
// DH2: Bob's one-time prekey ↔ Alice's ephemeral
|
||||
const dh2 = try crypto.dh.X25519.scalarmult(bob_one_time_prekey_private, alice_initial_message.ephemeral_x25519);
|
||||
|
||||
// DH3: Bob's signed prekey ↔ Alice's identity
|
||||
// This matches Alice's: alice_identity_private ↔ bob_signed_prekey_public
|
||||
const dh3 = try crypto.dh.X25519.scalarmult(bob_signed_prekey_private, alice_identity_public);
|
||||
|
||||
// === Step 4: ML-KEM-768 decapsulation ===
|
||||
|
||||
var kem_ss: [ML_KEM_768.SHARED_SECRET_SIZE]u8 = undefined;
|
||||
|
||||
// Call liboqs ML-KEM decapsulation
|
||||
const kem_result = OQS_KEM_kyber768_decaps(
|
||||
@ptrCast(&kem_ss),
|
||||
@ptrCast(&alice_initial_message.mlkem_ciphertext),
|
||||
@ptrCast(&bob_mlkem_private),
|
||||
);
|
||||
|
||||
if (kem_result != 0) {
|
||||
return error.MLKEMDecapsError;
|
||||
}
|
||||
|
||||
// === Step 5-6: Combine secrets and KDF (same as Alice) ===
|
||||
|
||||
var combined: [32 * 5]u8 = undefined;
|
||||
@memcpy(combined[0..32], &dh1);
|
||||
@memcpy(combined[32..64], &dh2);
|
||||
@memcpy(combined[64..96], &dh3);
|
||||
@memcpy(combined[96..128], &kem_ss);
|
||||
@memset(combined[128..160], 0);
|
||||
|
||||
var root_key: [32]u8 = undefined;
|
||||
const info = "Libertaria PQXDH v1";
|
||||
|
||||
const hkdf = std.crypto.kdf.hkdf.HkdfSha256;
|
||||
const prk = hkdf.extract(info, combined[0..160]);
|
||||
@memcpy(&root_key, &prk);
|
||||
|
||||
return PQXDHResponderResult{
|
||||
.root_key = root_key,
|
||||
};
|
||||
}
|
||||
|
||||
// ============================================================================
|
||||
// Tests
|
||||
// ============================================================================
|
||||
|
||||
test "pqxdh prekey bundle serialization" {
|
||||
const allocator = std.testing.allocator;
|
||||
|
||||
const bundle = PrekeyBundle{
|
||||
.identity_key = [_]u8{0xAA} ** 32,
|
||||
.signed_prekey_x25519 = [_]u8{0xBB} ** 32,
|
||||
.signed_prekey_signature = [_]u8{0xCC} ** 64,
|
||||
.signed_prekey_mlkem = [_]u8{0xDD} ** ML_KEM_768.PUBLIC_KEY_SIZE,
|
||||
.one_time_prekey_x25519 = [_]u8{0xEE} ** 32,
|
||||
.one_time_prekey_mlkem = [_]u8{0xFF} ** ML_KEM_768.PUBLIC_KEY_SIZE,
|
||||
};
|
||||
|
||||
const bytes = try bundle.toBytes(allocator);
|
||||
defer allocator.free(bytes);
|
||||
|
||||
const deserialized = try PrekeyBundle.fromBytes(allocator, bytes);
|
||||
|
||||
try std.testing.expectEqualSlices(u8, &bundle.identity_key, &deserialized.identity_key);
|
||||
try std.testing.expectEqualSlices(u8, &bundle.signed_prekey_x25519, &deserialized.signed_prekey_x25519);
|
||||
}
|
||||
|
||||
test "pqxdh initial message serialization" {
|
||||
const allocator = std.testing.allocator;
|
||||
|
||||
const msg = PQXDHInitialMessage{
|
||||
.ephemeral_x25519 = [_]u8{0x11} ** 32,
|
||||
.mlkem_ciphertext = [_]u8{0x22} ** ML_KEM_768.CIPHERTEXT_SIZE,
|
||||
};
|
||||
|
||||
const bytes = try msg.toBytes(allocator);
|
||||
defer allocator.free(bytes);
|
||||
|
||||
const deserialized = try PQXDHInitialMessage.fromBytes(bytes);
|
||||
|
||||
try std.testing.expectEqualSlices(u8, &msg.ephemeral_x25519, &deserialized.ephemeral_x25519);
|
||||
try std.testing.expectEqualSlices(u8, &msg.mlkem_ciphertext, &deserialized.mlkem_ciphertext);
|
||||
}
|
||||
|
|
@ -88,7 +88,7 @@ pub const SoulKey = struct {
|
|||
pub fn generate() !SoulKey {
|
||||
var seed: [32]u8 = undefined;
|
||||
crypto.random.bytes(&seed);
|
||||
defer crypto.utils.secureZero(u8, &seed);
|
||||
defer crypto.secureZero(u8, &seed);
|
||||
return fromSeed(&seed);
|
||||
}
|
||||
|
||||
|
|
@ -199,9 +199,9 @@ pub const SoulKey = struct {
|
|||
|
||||
/// Zeroize private key material (constant-time)
|
||||
pub fn zeroize(self: *SoulKey) void {
|
||||
crypto.utils.secureZero(u8, &self.ed25519_private);
|
||||
crypto.utils.secureZero(u8, &self.x25519_private);
|
||||
crypto.utils.secureZero(u8, &self.mlkem_private);
|
||||
crypto.secureZero(u8, &self.ed25519_private);
|
||||
crypto.secureZero(u8, &self.x25519_private);
|
||||
crypto.secureZero(u8, &self.mlkem_private);
|
||||
}
|
||||
|
||||
/// Get the DID string (base58 or hex)
|
||||
|
|
|
|||
|
|
@ -0,0 +1,216 @@
|
|||
// Test file for PQXDH protocol (RFC-0830)
|
||||
// Located at: l1-identity/test_pqxdh.zig
|
||||
//
|
||||
// This file tests the PQXDH key agreement ceremony with stubbed ML-KEM functions.
|
||||
// Once liboqs is built, these tests will use real ML-KEM-768 implementation.
|
||||
|
||||
const std = @import("std");
|
||||
const pqxdh = @import("pqxdh.zig");
|
||||
const testing = std.testing;
|
||||
|
||||
// ============================================================================
|
||||
// STUB: ML-KEM-768 Functions (for testing without liboqs)
|
||||
// ============================================================================
|
||||
// These will be replaced with real liboqs FFI once library is built
|
||||
|
||||
export fn OQS_KEM_kyber768_keypair(
|
||||
public_key: ?*u8,
|
||||
secret_key: ?*u8,
|
||||
) c_int {
|
||||
// Stub: Fill with deterministic test data
|
||||
if (public_key) |pk| {
|
||||
const pk_slice: [*]u8 = @ptrCast(pk);
|
||||
@memset(pk_slice[0..pqxdh.ML_KEM_768.PUBLIC_KEY_SIZE], 0xAA);
|
||||
}
|
||||
if (secret_key) |sk| {
|
||||
const sk_slice: [*]u8 = @ptrCast(sk);
|
||||
@memset(sk_slice[0..pqxdh.ML_KEM_768.SECRET_KEY_SIZE], 0xBB);
|
||||
}
|
||||
return 0; // Success
|
||||
}
|
||||
|
||||
export fn OQS_KEM_kyber768_encaps(
|
||||
ciphertext: ?*u8,
|
||||
shared_secret: ?*u8,
|
||||
public_key: ?*const u8,
|
||||
) c_int {
|
||||
_ = public_key; // Use in real impl
|
||||
|
||||
// Stub: Generate deterministic shared secret + ciphertext
|
||||
if (ciphertext) |ct| {
|
||||
const ct_slice: [*]u8 = @ptrCast(ct);
|
||||
@memset(ct_slice[0..pqxdh.ML_KEM_768.CIPHERTEXT_SIZE], 0xCC);
|
||||
}
|
||||
if (shared_secret) |ss| {
|
||||
const ss_slice: [*]u8 = @ptrCast(ss);
|
||||
@memset(ss_slice[0..pqxdh.ML_KEM_768.SHARED_SECRET_SIZE], 0xDD);
|
||||
}
|
||||
return 0; // Success
|
||||
}
|
||||
|
||||
export fn OQS_KEM_kyber768_decaps(
|
||||
shared_secret: ?*u8,
|
||||
ciphertext: ?*const u8,
|
||||
secret_key: ?*const u8,
|
||||
) c_int {
|
||||
_ = ciphertext; // Use in real impl
|
||||
_ = secret_key; // Use in real impl
|
||||
|
||||
// Stub: Must return SAME shared secret as encaps for protocol to work
|
||||
if (shared_secret) |ss| {
|
||||
const ss_slice: [*]u8 = @ptrCast(ss);
|
||||
@memset(ss_slice[0..pqxdh.ML_KEM_768.SHARED_SECRET_SIZE], 0xDD);
|
||||
}
|
||||
return 0; // Success
|
||||
}
|
||||
|
||||
// ============================================================================
|
||||
// Helper: Generate Test Keypairs
|
||||
// ============================================================================
|
||||
|
||||
fn generateTestKeypair() ![32]u8 {
|
||||
var private_key: [32]u8 = undefined;
|
||||
std.crypto.random.bytes(&private_key);
|
||||
return private_key;
|
||||
}
|
||||
|
||||
// ============================================================================
|
||||
// Tests
|
||||
// ============================================================================
|
||||
|
||||
test "PQXDHPrekeyBundle serialization roundtrip" {
|
||||
const allocator = testing.allocator;
|
||||
|
||||
var bundle = pqxdh.PrekeyBundle{
|
||||
.identity_key = [_]u8{0x01} ** 32,
|
||||
.signed_prekey_x25519 = [_]u8{0x02} ** 32,
|
||||
.signed_prekey_signature = [_]u8{0x03} ** 64,
|
||||
.signed_prekey_mlkem = [_]u8{0x04} ** pqxdh.ML_KEM_768.PUBLIC_KEY_SIZE,
|
||||
.one_time_prekey_x25519 = [_]u8{0x05} ** 32,
|
||||
.one_time_prekey_mlkem = [_]u8{0x06} ** pqxdh.ML_KEM_768.PUBLIC_KEY_SIZE,
|
||||
};
|
||||
|
||||
// Serialize
|
||||
const bytes = try bundle.toBytes(allocator);
|
||||
defer allocator.free(bytes);
|
||||
|
||||
// Expected size: 32 + 32 + 64 + 1184 + 32 + 1184 = 2528 bytes
|
||||
try testing.expectEqual(@as(usize, 2528), bytes.len);
|
||||
|
||||
// Deserialize
|
||||
const restored = try pqxdh.PrekeyBundle.fromBytes(allocator, bytes);
|
||||
|
||||
// Verify all fields match
|
||||
try testing.expectEqualSlices(u8, &bundle.identity_key, &restored.identity_key);
|
||||
try testing.expectEqualSlices(u8, &bundle.signed_prekey_x25519, &restored.signed_prekey_x25519);
|
||||
try testing.expectEqualSlices(u8, &bundle.signed_prekey_signature, &restored.signed_prekey_signature);
|
||||
try testing.expectEqualSlices(u8, &bundle.signed_prekey_mlkem, &restored.signed_prekey_mlkem);
|
||||
try testing.expectEqualSlices(u8, &bundle.one_time_prekey_x25519, &restored.one_time_prekey_x25519);
|
||||
try testing.expectEqualSlices(u8, &bundle.one_time_prekey_mlkem, &restored.one_time_prekey_mlkem);
|
||||
}
|
||||
|
||||
test "PQXDHInitialMessage serialization roundtrip" {
|
||||
const allocator = testing.allocator;
|
||||
|
||||
var msg = pqxdh.PQXDHInitialMessage{
|
||||
.ephemeral_x25519 = [_]u8{0x11} ** 32,
|
||||
.mlkem_ciphertext = [_]u8{0x22} ** pqxdh.ML_KEM_768.CIPHERTEXT_SIZE,
|
||||
};
|
||||
|
||||
// Serialize
|
||||
const bytes = try msg.toBytes(allocator);
|
||||
defer allocator.free(bytes);
|
||||
|
||||
// Expected size: 32 + 1088 = 1120 bytes
|
||||
try testing.expectEqual(@as(usize, 1120), bytes.len);
|
||||
|
||||
// Deserialize
|
||||
const restored = try pqxdh.PQXDHInitialMessage.fromBytes(bytes);
|
||||
|
||||
// Verify fields match
|
||||
try testing.expectEqualSlices(u8, &msg.ephemeral_x25519, &restored.ephemeral_x25519);
|
||||
try testing.expectEqualSlices(u8, &msg.mlkem_ciphertext, &restored.mlkem_ciphertext);
|
||||
}
|
||||
|
||||
test "PQXDH full handshake roundtrip (stubbed ML-KEM)" {
|
||||
const allocator = testing.allocator;
|
||||
|
||||
// === Bob's Setup ===
|
||||
// Generate Bob's long-term identity key (Ed25519 → X25519 conversion)
|
||||
const bob_identity_private = try generateTestKeypair();
|
||||
const bob_identity_public = try std.crypto.dh.X25519.recoverPublicKey(bob_identity_private);
|
||||
|
||||
// Generate Bob's signed prekey (X25519)
|
||||
const bob_signed_prekey_private = try generateTestKeypair();
|
||||
const bob_signed_prekey_public = try std.crypto.dh.X25519.recoverPublicKey(bob_signed_prekey_private);
|
||||
|
||||
// Generate Bob's one-time prekey (X25519)
|
||||
const bob_onetime_prekey_private = try generateTestKeypair();
|
||||
const bob_onetime_prekey_public = try std.crypto.dh.X25519.recoverPublicKey(bob_onetime_prekey_private);
|
||||
|
||||
// Generate Bob's ML-KEM keypair (stubbed)
|
||||
var bob_mlkem_public: [pqxdh.ML_KEM_768.PUBLIC_KEY_SIZE]u8 = undefined;
|
||||
var bob_mlkem_private: [pqxdh.ML_KEM_768.SECRET_KEY_SIZE]u8 = undefined;
|
||||
const kem_result = OQS_KEM_kyber768_keypair(&bob_mlkem_public[0], &bob_mlkem_private[0]);
|
||||
try testing.expectEqual(@as(c_int, 0), kem_result);
|
||||
|
||||
// Create Bob's prekey bundle (signature stubbed for now)
|
||||
var bob_bundle = pqxdh.PrekeyBundle{
|
||||
.identity_key = bob_identity_public,
|
||||
.signed_prekey_x25519 = bob_signed_prekey_public,
|
||||
.signed_prekey_signature = [_]u8{0} ** 64, // TODO: Real Ed25519 signature
|
||||
.signed_prekey_mlkem = bob_mlkem_public,
|
||||
.one_time_prekey_x25519 = bob_onetime_prekey_public,
|
||||
.one_time_prekey_mlkem = bob_mlkem_public, // Reuse for test
|
||||
};
|
||||
|
||||
// === Alice's Setup ===
|
||||
const alice_identity_private = try generateTestKeypair();
|
||||
const alice_identity_public = try std.crypto.dh.X25519.recoverPublicKey(alice_identity_private);
|
||||
|
||||
// === Alice Initiates Handshake ===
|
||||
const alice_result = try pqxdh.initiator(
|
||||
alice_identity_private,
|
||||
&bob_bundle,
|
||||
allocator,
|
||||
);
|
||||
|
||||
// Verify Alice got a root key
|
||||
var alice_has_nonzero = false;
|
||||
for (alice_result.root_key) |byte| {
|
||||
if (byte != 0) {
|
||||
alice_has_nonzero = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
try testing.expect(alice_has_nonzero);
|
||||
|
||||
// === Bob Responds to Handshake ===
|
||||
const bob_result = try pqxdh.responder(
|
||||
bob_identity_private,
|
||||
bob_signed_prekey_private,
|
||||
bob_onetime_prekey_private,
|
||||
bob_mlkem_private,
|
||||
alice_identity_public,
|
||||
&alice_result.initial_message,
|
||||
);
|
||||
|
||||
// === Verify Root Keys Match ===
|
||||
// This is the critical test: both parties must derive the SAME root key
|
||||
try testing.expectEqualSlices(u8, &alice_result.root_key, &bob_result.root_key);
|
||||
|
||||
std.debug.print("\n✅ PQXDH Handshake: Alice and Bob derived matching root keys!\n", .{});
|
||||
std.debug.print(" Root key (first 16 bytes): {x}\n", .{alice_result.root_key[0..16]});
|
||||
}
|
||||
|
||||
test "PQXDH error: invalid ML-KEM encapsulation" {
|
||||
// Test that errors propagate correctly when ML-KEM fails
|
||||
// (This test will be more meaningful with real liboqs)
|
||||
|
||||
// For now, just verify our stub functions return success
|
||||
var public_key: [pqxdh.ML_KEM_768.PUBLIC_KEY_SIZE]u8 = undefined;
|
||||
var secret_key: [pqxdh.ML_KEM_768.SECRET_KEY_SIZE]u8 = undefined;
|
||||
|
||||
const result = OQS_KEM_kyber768_keypair(&public_key[0], &secret_key[0]);
|
||||
try testing.expectEqual(@as(c_int, 0), result);
|
||||
}
|
||||
Loading…
Reference in New Issue