From 28c16371981e9b3cbdedbe27de9aee7a8ea92828 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C4=99drzej=20Stuczy=C5=84ski?= Date: Tue, 3 Mar 2026 14:42:48 +0000 Subject: [PATCH] addressing LP PR comments --- Cargo.lock | 2 +- Cargo.toml | 2 + common/crypto/src/asymmetric/x25519/mod.rs | 6 +- common/nym-kkt/Cargo.toml | 4 +- common/nym-kkt/src/carrier.rs | 5 +- common/nym-kkt/src/error.rs | 8 +- common/nym-kkt/src/message.rs | 4 +- common/nym-kkt/src/rekey.rs | 8 +- common/nym-kkt/src/responder.rs | 2 +- common/nym-lp/Cargo.toml | 20 +++-- common/nym-lp/src/config.rs | 79 ------------------- common/nym-lp/src/peer.rs | 5 +- common/nym-lp/src/peer_config.rs | 45 ++++++----- common/nym-lp/src/session.rs | 2 +- common/nym-lp/src/session_manager.rs | 7 +- common/nym-lp/src/transport/traits.rs | 3 +- gateway/src/node/mod.rs | 4 +- nym-gateway-probe/src/common/probe_tests.rs | 11 +-- nym-node/Cargo.toml | 4 +- nym-node/src/node/lp/control/handler.rs | 4 +- nym-node/src/node/mod.rs | 6 +- nym-registration-client/src/clients/lp.rs | 5 +- .../src/lp_client/client.rs | 1 - nym-registration-client/src/types.rs | 8 ++ 24 files changed, 84 insertions(+), 161 deletions(-) delete mode 100644 common/nym-lp/src/config.rs diff --git a/Cargo.lock b/Cargo.lock index 937a30240a..f36a3c1716 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -6875,7 +6875,7 @@ dependencies = [ [[package]] name = "nym-lp" -version = "0.1.0" +version = "1.20.4" dependencies = [ "anyhow", "bs58", diff --git a/Cargo.toml b/Cargo.toml index 4f7ebfae70..f59f5d08da 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -448,8 +448,10 @@ nym-http-api-common = { version = "1.20.4", path = "common/http-api-common", def nym-id = { version = "1.20.4", path = "common/nym-id" } nym-ip-packet-client = { version = "1.20.4", path = "nym-ip-packet-client" } nym-ip-packet-requests = { version = "1.20.4", path = "common/ip-packet-requests" } +nym-lp = { version = "1.20.4", path = "common/nym-lp" } nym-kkt = { version = "0.1.0", path = "common/nym-kkt" } nym-kkt-ciphersuite = { version = "1.20.4", path = "common/nym-kkt-ciphersuite" } +nym-kkt-context = { version = "1.20.4", path = "common/nym-kkt-context" } nym-metrics = { version = "1.20.4", path = "common/nym-metrics" } nym-mixnet-client = { version = "1.20.4", path = "common/client-libs/mixnet-client" } nym-mixnet-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/mixnet-contract" } diff --git a/common/crypto/src/asymmetric/x25519/mod.rs b/common/crypto/src/asymmetric/x25519/mod.rs index 8b88f6325a..906d7e739d 100644 --- a/common/crypto/src/asymmetric/x25519/mod.rs +++ b/common/crypto/src/asymmetric/x25519/mod.rs @@ -511,14 +511,12 @@ mod tests { #[test] fn test_key_conversion() { - let dalek_kp = super::KeyPair::new(&mut rand::thread_rng()); + let dalek_kp = KeyPair::new(&mut rand::thread_rng()); let mut dalek_private_key_bytes = dalek_kp.private_key().as_bytes().to_owned(); libcrux_curve25519::clamp(&mut dalek_private_key_bytes); - let libcrux_private_key = - libcrux_psq::handshake::types::DHPrivateKey::from_bytes(&dalek_private_key_bytes) - .unwrap(); + let libcrux_private_key = DHPrivateKey::from_bytes(&dalek_private_key_bytes).unwrap(); let libcrux_public_key = libcrux_private_key.to_public(); assert_eq!(libcrux_public_key.as_ref(), dalek_kp.public_key.as_bytes()); diff --git a/common/nym-kkt/Cargo.toml b/common/nym-kkt/Cargo.toml index 207b1f00ed..38ddd37582 100644 --- a/common/nym-kkt/Cargo.toml +++ b/common/nym-kkt/Cargo.toml @@ -12,9 +12,9 @@ num_enum = { workspace = true } strum = { workspace = true } # internal -nym-crypto = { path = "../crypto", features = ["hashing"] } +nym-crypto = { workspace = true, features = ["hashing"] } nym-kkt-ciphersuite = { workspace = true, features = ["digests"] } -nym-kkt-context = { path = "../nym-kkt-context" } +nym-kkt-context = { workspace = true } nym-pemstore = { workspace = true } libcrux-kem = { workspace = true } diff --git a/common/nym-kkt/src/carrier.rs b/common/nym-kkt/src/carrier.rs index 001c10b609..b1faf4bd21 100644 --- a/common/nym-kkt/src/carrier.rs +++ b/common/nym-kkt/src/carrier.rs @@ -10,6 +10,7 @@ use crate::error::KKTError; pub const MAX_PAYLOAD_LEN: usize = 1_000_000; const CARRIER_KDF_INFO_TX: &str = "CARRIER_V1_KDF_TX"; const CARRIER_KDF_INFO_RX: &str = "CARRIER_V1_KDF_RX"; +const CARRIER_KKT_AAD: &[u8] = b"kkt-carrier-v1"; #[derive(Zeroize, ZeroizeOnDrop)] pub struct Carrier { @@ -107,7 +108,7 @@ impl Carrier { &self.tx_key, plaintext, &mut output_buffer, - b"kkt-carrier-v1", + CARRIER_KKT_AAD, &as_nonce_bytes(self.tx_counter), )?; @@ -126,7 +127,7 @@ impl Carrier { &self.rx_key, &mut output_buffer, ciphertext, - b"kkt-carrier-v1", + CARRIER_KKT_AAD, &as_nonce_bytes(self.rx_counter), )?; diff --git a/common/nym-kkt/src/error.rs b/common/nym-kkt/src/error.rs index de624f3021..0a733d572d 100644 --- a/common/nym-kkt/src/error.rs +++ b/common/nym-kkt/src/error.rs @@ -40,16 +40,16 @@ pub enum KKTError { #[error("Local Function Input Error: {}", info)] FunctionInputError { info: &'static str }, - #[error("{}", info)] + #[error("{info}")] X25519Error { info: &'static str }, - #[error("{}", info)] + #[error("{info}")] AEADError { info: &'static str }, - #[error("{}", info)] + #[error("{info}")] DecodingError { info: &'static str }, - #[error("{}", info)] + #[error("{info}")] UnsupportedAlgorithm { info: &'static str }, #[error("Generic libcrux error")] diff --git a/common/nym-kkt/src/message.rs b/common/nym-kkt/src/message.rs index 2d2e6f3361..edb0559dad 100644 --- a/common/nym-kkt/src/message.rs +++ b/common/nym-kkt/src/message.rs @@ -114,14 +114,14 @@ impl KKTRequestPlaintext { } pub(crate) fn to_bytes(&self) -> Vec { - let mut out = Vec::with_capacity(x25519::PUBLIC_KEY_LENGTH + MASKED_BYTE_LEN); + let mut out = Vec::with_capacity(Self::SIZE); out.extend_from_slice(self.dh_pubkey.as_ref()); out.extend_from_slice(self.masked_version_bytes.as_slice()); out } pub(crate) fn try_from_bytes(b: &[u8]) -> Result { - if b.len() != x25519::PUBLIC_KEY_LENGTH + MASKED_BYTE_LEN { + if b.len() != Self::SIZE { return Err(KKTError::FrameDecodingError { info: "the KKTRequest frame has invalid length".to_string(), }); diff --git a/common/nym-kkt/src/rekey.rs b/common/nym-kkt/src/rekey.rs index dc8fb273df..30b99ad1f8 100644 --- a/common/nym-kkt/src/rekey.rs +++ b/common/nym-kkt/src/rekey.rs @@ -4,15 +4,13 @@ //! Post-Quantum Re-Key Protocol /// This module implements a stateless post-quantum re-keying protocol in one round-trip. -/// We currently support MlKem768 and XWing. +/// We currently support MlKem768. /// /// This protocol is safe if it runs under a trusted secure channel. /// /// Bandwidth costs: /// Request (MlKem768): 1216 bytes /// Response (MlKem768): 1088 bytes -/// Request (XWing): 1248 bytes -/// Response (XWing): 1120 bytes use libcrux_kem::*; use nym_crypto::hkdf::blake3::derive_key_blake3; use nym_kkt_ciphersuite::{KEM, mceliece, ml_kem768, x25519, xwing}; @@ -60,7 +58,7 @@ impl RekeyInitiator { /// /// Inputs: /// rng: something that implements CryptoRng + RngCore - /// kem: a KEM algorithm (we currently support MlKem768 and XWing) + /// kem: a KEM algorithm (we currently support MlKem768 only) /// /// Outputs: /// RekeyInitiator: A struct which contains the decapsulation key, the salt and the kem algorithm in use. @@ -171,7 +169,7 @@ where Some(num) => match num { // If message length is 1216 (32 + 1184) then the algorithm should be MlKem768 ml_kem768::PUBLIC_KEY_LENGTH => Algorithm::MlKem768, - // If message length is 1248 (32 + 1216) then the algorithm should be MlKem768 + // If message length is 1248 (32 + 1216) then the algorithm should be xwing xwing::PUBLIC_KEY_LENGTH => Algorithm::XWingKemDraft06, // We don't support McEliece because the keys are massive. // If this is a deal-breaker, users can start a new session with PSQ which can use McEliece. diff --git a/common/nym-kkt/src/responder.rs b/common/nym-kkt/src/responder.rs index 0a85f1832e..b5a2ea338b 100644 --- a/common/nym-kkt/src/responder.rs +++ b/common/nym-kkt/src/responder.rs @@ -146,7 +146,7 @@ impl<'a> KKTResponder<'a> { }; // for now the response payload is empty - let response_payload = Vec::with_capacity(0); + let response_payload = Vec::new(); let frame = KKTFrame::new(local_context, kem_key, response_payload); diff --git a/common/nym-lp/Cargo.toml b/common/nym-lp/Cargo.toml index cbfaf75bbd..645b8f8ef2 100644 --- a/common/nym-lp/Cargo.toml +++ b/common/nym-lp/Cargo.toml @@ -1,8 +1,14 @@ [package] name = "nym-lp" -version = "0.1.0" -edition = { workspace = true } -license = { workspace = true } +authors.workspace = true +repository.workspace = true +homepage.workspace = true +documentation.workspace = true +edition.workspace = true +license.workspace = true +rust-version.workspace = true +readme.workspace = true +version.workspace = true publish = false [dependencies] @@ -11,11 +17,11 @@ bs58 = { workspace = true } bytes = { workspace = true } tracing = { workspace = true } rand09 = { workspace = true } -tls_codec = { workspace = true } +tls_codec = { workspace = true } tokio = { workspace = true, features = ["net", "io-util"] } -nym-crypto = { path = "../crypto", features = ["hashing"] } -nym-kkt = { path = "../nym-kkt" } +nym-crypto = { workspace = true, features = ["hashing"] } +nym-kkt = { workspace = true } nym-kkt-ciphersuite = { workspace = true } # libcrux dependencies for PSQ (Post-Quantum PSK derivation) @@ -28,7 +34,7 @@ zeroize = { workspace = true, features = ["zeroize_derive"] } nym-test-utils = { workspace = true, optional = true } [dev-dependencies] -criterion = { version = "0.5", features = ["html_reports"] } +criterion = { workspace = true, features = ["html_reports"] } nym-test-utils = { workspace = true } anyhow = { workspace = true } tokio = { workspace = true, features = ["rt-multi-thread", "macros"] } diff --git a/common/nym-lp/src/config.rs b/common/nym-lp/src/config.rs deleted file mode 100644 index bc6a0ab987..0000000000 --- a/common/nym-lp/src/config.rs +++ /dev/null @@ -1,79 +0,0 @@ -// Copyright 2025 - Nym Technologies SA -// SPDX-License-Identifier: Apache-2.0 - -//! Configuration for LP protocol. -//! -//! LP security stack = KKT (key fetch) → PSQ (PQ PSK) → Noise (transport). -//! KEM algorithm selection affects only PSQ layer. Noise always uses X25519 DH. -//! Migration to PQ KEMs (MlKem768, XWing) requires only config change. - -use nym_kkt::ciphersuite::KEM; -use serde::{Deserialize, Serialize}; -use std::time::Duration; - -/// Default PSK time-to-live (1 hour, matches psk.rs implementation). -pub const DEFAULT_PSK_TTL_SECS: u64 = 3600; - -/// Configuration for LP protocol. -#[derive(Debug, Clone, Serialize, Deserialize)] -pub struct LpConfig { - /// KEM algorithm for PSQ key encapsulation. - /// Supported KEMs: MlKem768, McEliece - #[serde(with = "kem_serde")] - pub kem_algorithm: KEM, - - /// PSK time-to-live in seconds. - pub psk_ttl_secs: u64, - - /// Enable KKT for authenticated key distribution. - pub enable_kkt: bool, -} - -impl Default for LpConfig { - fn default() -> Self { - Self { - kem_algorithm: KEM::MlKem768, - psk_ttl_secs: DEFAULT_PSK_TTL_SECS, - enable_kkt: true, - } - } -} - -impl LpConfig { - /// Returns PSK TTL as Duration. - pub fn psk_ttl(&self) -> Duration { - Duration::from_secs(self.psk_ttl_secs) - } -} - -mod kem_serde { - use nym_kkt::ciphersuite::KEM; - use serde::{Deserialize, Deserializer, Serialize, Serializer}; - - pub fn serialize(kem: &KEM, serializer: S) -> Result - where - S: Serializer, - { - match kem { - KEM::MlKem768 => "MlKem768", - KEM::McEliece => "McEliece", - KEM::X25519 => return Err(serde::ser::Error::custom("Unsupported KEM: X25519")), - KEM::XWing => return Err(serde::ser::Error::custom("Unsupported KEM: XWing")), - } - .serialize(serializer) - } - - pub fn deserialize<'de, D>(deserializer: D) -> Result - where - D: Deserializer<'de>, - { - let s = String::deserialize(deserializer)?; - match s.as_str() { - "MlKem768" => Ok(KEM::MlKem768), - "McEliece" => Ok(KEM::McEliece), - "X25519" => Err(serde::de::Error::custom("Unsupported KEM: X25519")), - "XWing" => Err(serde::de::Error::custom("Unsupported KEM: XWing")), - _ => Err(serde::de::Error::custom(format!("Unknown KEM: {}", s))), - } - } -} diff --git a/common/nym-lp/src/peer.rs b/common/nym-lp/src/peer.rs index 3ce077ea06..3cfe665ee8 100644 --- a/common/nym-lp/src/peer.rs +++ b/common/nym-lp/src/peer.rs @@ -82,7 +82,10 @@ impl Debug for LpLocalPeer { fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { f.debug_struct("LpLocalPeer") .field("ciphersuite", &self.ciphersuite) - .field("x25519", &self.x25519.pk) + .field( + "x25519", + &bs58::encode(self.x25519.pk.as_ref()).into_string(), + ) .field("kem_keypairs", &self.kem_keypairs) .finish() } diff --git a/common/nym-lp/src/peer_config.rs b/common/nym-lp/src/peer_config.rs index 19c4e8e608..02b1af34a4 100644 --- a/common/nym-lp/src/peer_config.rs +++ b/common/nym-lp/src/peer_config.rs @@ -29,7 +29,7 @@ pub struct LpPeerConfig { // Determine the hop id. // Should be 0 if node_initiator is true - // Should be > 1 if is_exit is true + // Should be > 1 && < 16 if is_exit is true hop_id: u8, // Determine if the recipient should be an exit node @@ -198,37 +198,36 @@ impl LpPeerConfig { } pub fn serialize(&self) -> [u8; LP_PEER_CONFIG_SIZE] { - let mut output_bytes: [u8; LP_PEER_CONFIG_SIZE] = [0u8; LP_PEER_CONFIG_SIZE]; - output_bytes[0..4].copy_from_slice(self.pack_config().as_slice()); + let mut output_bytes = [0u8; LP_PEER_CONFIG_SIZE]; + output_bytes[0..4].copy_from_slice(&self.pack_config()); output_bytes[4..].copy_from_slice(&self.seed); output_bytes } pub fn deserialize(bytes: &[u8]) -> Result { if bytes.len() != LP_PEER_CONFIG_SIZE { - Err(LpError::DeserializationError(format!( + return Err(LpError::DeserializationError(format!( "Invalid Lp Config Length ({}), expected ({})", bytes.len(), LP_PEER_CONFIG_SIZE - ))) - } else { - let (hop_id, is_exit, node_initiator, censorship_resistance) = - Self::unpack_first_byte(bytes[0]); - - let mut filler: [u8; FILLER_LEN] = [0u8; FILLER_LEN]; - filler.copy_from_slice(&bytes[CONFIG_LEN..CONFIG_LEN + FILLER_LEN]); - - let mut seed: [u8; SEED_LEN] = [0u8; SEED_LEN]; - seed.copy_from_slice(&bytes[CONFIG_LEN + FILLER_LEN..LP_PEER_CONFIG_SIZE]); - - Self::build_checked( - hop_id, - is_exit, - node_initiator, - censorship_resistance, - seed, - filler, - ) + ))); } + let (hop_id, is_exit, node_initiator, censorship_resistance) = + Self::unpack_first_byte(bytes[0]); + + let mut filler = [0u8; FILLER_LEN]; + filler.copy_from_slice(&bytes[CONFIG_LEN..CONFIG_LEN + FILLER_LEN]); + + let mut seed = [0u8; SEED_LEN]; + seed.copy_from_slice(&bytes[CONFIG_LEN + FILLER_LEN..LP_PEER_CONFIG_SIZE]); + + Self::build_checked( + hop_id, + is_exit, + node_initiator, + censorship_resistance, + seed, + filler, + ) } fn pack_config(&self) -> [u8; 4] { diff --git a/common/nym-lp/src/session.rs b/common/nym-lp/src/session.rs index d7b8d29999..3d0d51efdd 100644 --- a/common/nym-lp/src/session.rs +++ b/common/nym-lp/src/session.rs @@ -44,7 +44,7 @@ pub enum LpAction { pub type SessionId = [u8; 32]; -/// A session in the Lewes Protocol, handling connection state with Noise. +/// A session in the Lewes Protocol.. /// /// Sessions manage connection state, including LP replay protection. /// Each session has a unique receiving index and sending index for connection identification. diff --git a/common/nym-lp/src/session_manager.rs b/common/nym-lp/src/session_manager.rs index a005b30cdd..8e5dfd2dec 100644 --- a/common/nym-lp/src/session_manager.rs +++ b/common/nym-lp/src/session_manager.rs @@ -17,17 +17,12 @@ use crate::session::{LpAction, LpInput}; /// Manages the lifecycle of Lewes Protocol sessions. /// /// The SessionManager is responsible for creating, storing, and retrieving sessions +#[derive(Default)] pub struct SessionManager { /// Manages state machines directly, keyed by lp_id sessions: HashMap, } -impl Default for SessionManager { - fn default() -> Self { - Self::new() - } -} - impl SessionManager { /// Creates a new session manager with empty session storage. pub fn new() -> Self { diff --git a/common/nym-lp/src/transport/traits.rs b/common/nym-lp/src/transport/traits.rs index f3c39af0af..0d71632cf5 100644 --- a/common/nym-lp/src/transport/traits.rs +++ b/common/nym-lp/src/transport/traits.rs @@ -79,10 +79,11 @@ async fn read_n_bytes_async_read(reader: &mut R, n: usize) -> Result, where R: AsyncRead + Unpin, { - let mut buf = vec![0u8; n]; if n > MAX_HANDSHAKE_PACKET_SIZE { return Err(LpTransportError::PacketTooBig { size: n }); } + let mut buf = vec![0u8; n]; + reader .read_exact(&mut buf) .await diff --git a/gateway/src/node/mod.rs b/gateway/src/node/mod.rs index eacd7cf658..cd9e3dfe4b 100644 --- a/gateway/src/node/mod.rs +++ b/gateway/src/node/mod.rs @@ -105,9 +105,9 @@ pub struct GatewayTasksBuilder { shutdown_tracker: ShutdownTracker, - // populated and cached as necessary use_mock_ecash: bool, + // populated and cached as necessary ecash_manager: Option>, @@ -226,7 +226,7 @@ impl GatewayTasksBuilder { > { // Check if we should use mock ecash for testing if self.use_mock_ecash { - warn!("Using MockEcashManager for LP testing (credentials NOT verified)"); + warn!("Using MockEcashManager for testing (credentials NOT verified)"); let mock_manager = MockEcashManager::new(Box::new(self.storage.clone())); return Ok(Arc::new(mock_manager) as Arc< diff --git a/nym-gateway-probe/src/common/probe_tests.rs b/nym-gateway-probe/src/common/probe_tests.rs index 158cbfc011..4b93a7cdf4 100644 --- a/nym-gateway-probe/src/common/probe_tests.rs +++ b/nym-gateway-probe/src/common/probe_tests.rs @@ -172,13 +172,11 @@ pub async fn lp_registration_probe( let mut lp_outcome = LpProbeResults::default(); - // Generate Ed25519 keypair for this connection (X25519 will be derived internally by LP) + // Generate X25519 keypair for this connection let mut rng09 = rand09::rngs::StdRng::from_os_rng(); let client_x25519_keypair = Arc::new(DHKeyPair::new(&mut rng09)); - // Step 0: Derive X25519 keys from Ed25519 for the gateways - - // Create LP registration client (uses Ed25519 keys directly, derives X25519 internally) + // Create LP registration client let mut client = LpRegistrationClient::::new_with_default_config( client_x25519_keypair, peer, @@ -212,16 +210,13 @@ pub async fn lp_registration_probe( let mut rng = rand::thread_rng(); let wg_keypair = nym_crypto::asymmetric::x25519::KeyPair::new(&mut rng); - // Convert gateway identity to ed25519 public key - let gateway_ed25519_pubkey = gateway_identity; - // Register using the new packet-per-connection API (returns GatewayData directly) let ticket_type = TicketType::V1WireguardEntry; let gateway_data = match client .register_dvpn( &mut rng09, &wg_keypair, - &gateway_ed25519_pubkey, + &gateway_identity, bandwidth_controller, ticket_type, ) diff --git a/nym-node/Cargo.toml b/nym-node/Cargo.toml index b17f5272f5..28e7904007 100644 --- a/nym-node/Cargo.toml +++ b/nym-node/Cargo.toml @@ -13,8 +13,6 @@ license = "GPL-3.0" publish = false # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html -[lib] -path = "src/lib.rs" [dependencies] async-trait = { workspace = true } @@ -117,7 +115,7 @@ nym-network-requester = { path = "../service-providers/network-requester" } nym-ip-packet-router = { path = "../service-providers/ip-packet-router" } # LP dependencies -nym-lp = { path = "../common/nym-lp" } +nym-lp = { workspace = true } nym-registration-common = { path = "../common/registration" } bincode = { workspace = true } diff --git a/nym-node/src/node/lp/control/handler.rs b/nym-node/src/node/lp/control/handler.rs index e84d300399..8d5ceb0249 100644 --- a/nym-node/src/node/lp/control/handler.rs +++ b/nym-node/src/node/lp/control/handler.rs @@ -12,7 +12,7 @@ use nym_lp::session::{LpAction, LpInput}; use nym_lp::transport::LpHandshakeChannel; use nym_lp::transport::traits::LpTransportChannel; use nym_lp::{LpTransportSession, packet::message::ExpectedResponseSize}; -use nym_metrics::{add_histogram_obs, inc}; +use nym_metrics::{add_histogram_obs, inc, inc_by}; use nym_registration_common::{LpRegistrationRequest, RegistrationStatus}; use std::net::SocketAddr; use std::time::Duration; @@ -625,8 +625,6 @@ where /// Emit connection lifecycle metrics fn emit_lifecycle_metrics(&self, graceful: bool) { - use nym_metrics::inc_by; - // Track connection duration let duration = self.stats.start_time.elapsed().as_secs_f64(); add_histogram_obs!( diff --git a/nym-node/src/node/mod.rs b/nym-node/src/node/mod.rs index a0bb5b9eb8..6fdd5095ac 100644 --- a/nym-node/src/node/mod.rs +++ b/nym-node/src/node/mod.rs @@ -453,16 +453,16 @@ impl NymNode { &config.storage_paths.keys.x25519_noise_storage_paths(), )?; - trace!("attempting to x25519 lp keypair"); + trace!("attempting to store x25519 lp keypair"); store_x25519_lp_keypair( &x25519_lp_keys, &config.storage_paths.keys.x25519_lp_key_paths(), )?; - trace!("attempting to mlkem768 keypair"); + trace!("attempting to store mlkem768 keypair"); store_mlkem768_keypair(&mlkem, &config.storage_paths.keys.mlkem768_key_paths())?; - trace!("attempting to mceliece keypair"); + trace!("attempting to store mceliece keypair"); store_mceliece_keypair(&mceliece, &config.storage_paths.keys.mceliece_key_paths())?; trace!("creating description file"); diff --git a/nym-registration-client/src/clients/lp.rs b/nym-registration-client/src/clients/lp.rs index 3b6131db76..ad1766c227 100644 --- a/nym-registration-client/src/clients/lp.rs +++ b/nym-registration-client/src/clients/lp.rs @@ -64,7 +64,6 @@ impl LpBasedRegistrationClient { tracing::debug!("Exit gateway LP address: {exit_address}"); // Generate fresh x25519 keypairs for LP registration - // TODO: persist them for the duration of the sessions let entry_lp_keypair = Arc::new(DHKeyPair::new(&mut rand09::rng())); let exit_lp_keypair = Arc::new(DHKeyPair::new(&mut rand09::rng())); @@ -100,7 +99,7 @@ impl LpBasedRegistrationClient { tracing::info!("Registering with exit gateway via entry forwarding"); let mut nested_session = NestedLpSession::new( exit_address, - exit_lp_keypair, + exit_lp_keypair.clone(), exit_peer, exit_ciphersuite, exit_lp_protocol, @@ -153,6 +152,8 @@ impl LpBasedRegistrationClient { Ok(RegistrationResult::Lp(Box::new(LpRegistrationResult { entry_gateway_data, exit_gateway_data, + entry_lp_keypair, + exit_lp_keypair, bw_controller: self.bandwidth_controller, }))) } diff --git a/nym-registration-client/src/lp_client/client.rs b/nym-registration-client/src/lp_client/client.rs index 2daa774f07..b770134d96 100644 --- a/nym-registration-client/src/lp_client/client.rs +++ b/nym-registration-client/src/lp_client/client.rs @@ -391,7 +391,6 @@ where let protocol_version = self.gateway_supported_lp_protocol_version; let connection = self.stream_mut()?; - // TODO: let session = LpTransportSession::psq_handshake_initiator( connection, local_peer, diff --git a/nym-registration-client/src/types.rs b/nym-registration-client/src/types.rs index 9d38bebc59..19725934b3 100644 --- a/nym-registration-client/src/types.rs +++ b/nym-registration-client/src/types.rs @@ -3,8 +3,10 @@ use nym_authenticator_client::{AuthClientMixnetListenerHandle, AuthenticatorClient}; use nym_bandwidth_controller::BandwidthTicketProvider; +use nym_lp::peer::DHKeyPair; use nym_registration_common::{AssignedAddresses, WireguardConfiguration}; use nym_sdk::mixnet::{EventReceiver, MixnetClient}; +use std::sync::Arc; pub enum RegistrationResult { Mixnet(Box), @@ -44,6 +46,12 @@ pub struct LpRegistrationResult { /// Gateway configuration data from exit gateway pub exit_gateway_data: WireguardConfiguration, + /// x25519 keypair used on the entry channel + pub entry_lp_keypair: Arc, + + /// x25519 keypair used on the exit channel + pub exit_lp_keypair: Arc, + /// Bandwidth controller for credential management pub bw_controller: Box, }