starred/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 03:25:19 -04:00
Code Issues Packages Projects Releases Wiki Activity

Invert order of keys as per draft

Browse Source
This commit is contained in:
riccardom
2026-07-24 17:30:13 +02:00
parent 990b78a898
commit 7a103a83e1
1 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
client/internal/pqkem/kem.go
View File

@@ -12,10 +12,11 @@
// (their peer identity keys) so the derived key cannot be transplanted
// to a different peer pair even if the transport authentication were bypassed.
//
// Combiner note: this follows the IETF hybrid layout (X25519 ‖ ML-KEM on the
// wire; ML-KEM_ss ‖ X25519_ss into the KDF) from
// draft-kwiatkowski-tls-ecdhe-mlkem. The spike uses SHA-256 as the KDF; a
// production version should use HKDF with the RFC labels — see TODO below.
// Combiner note: this follows draft-ietf-tls-ecdhe-mlkem for X25519MLKEM768 — on
// the wire ML-KEM ‖ X25519 (the draft deliberately reversed the share order for
// this group), and ML-KEM_ss ‖ X25519_ss fed into the KDF. The spike uses SHA-256
// (also binding the transcript and peer identities); a production version should
// use HKDF — see TODO below.
package pqkem
import (
@@ -27,8 +28,9 @@ import (
)
const (
// OfferSize is the initiator message: X25519 public key ‖ ML-KEM-768 encapsulation key.
OfferSize = 32 + mlkem.EncapsulationKeySize768 // 1216
// OfferSize is the initiator message: ML-KEM-768 encapsulation key ‖ X25519 public key
// (share order per draft-ietf-tls-ecdhe-mlkem for X25519MLKEM768).
OfferSize = mlkem.EncapsulationKeySize768 + 32 // 1216
// AnswerSize is the responder message: ML-KEM-768 ciphertext ‖ X25519 public key.
AnswerSize = mlkem.CiphertextSize768 + 32 // 1120
@@ -64,8 +66,8 @@ func NewInitiator() (*Initiator, error) {
}
offer := make([]byte, 0, OfferSize)
offer = append(offer, x.PublicKey().Bytes()...)
offer = append(offer, dk.EncapsulationKey().Bytes()...)
offer = append(offer, x.PublicKey().Bytes()...)
return &Initiator{x25519: x, mlkemDK: dk, offer: offer}, nil
}
@@ -104,8 +106,8 @@ func Respond(offer []byte, b Binding) (answer []byte, psk PSK, err error) {
if len(offer) != OfferSize {
return nil, PSK{}, fmt.Errorf("offer: got %d bytes, want %d", len(offer), OfferSize)
}
peerX := offer[:32]
peerEK := offer[32:]
peerEK := offer[:mlkem.EncapsulationKeySize768]
peerX := offer[mlkem.EncapsulationKeySize768:]
ek, err := mlkem.NewEncapsulationKey768(peerEK)
if err != nil {