diff --git a/common/nym-lp-transport/src/traits.rs b/common/nym-lp-transport/src/traits.rs index 0fda371fb9..3cdbedc924 100644 --- a/common/nym-lp-transport/src/traits.rs +++ b/common/nym-lp-transport/src/traits.rs @@ -54,11 +54,11 @@ pub trait HandshakeMessage: Sized { fn try_from_bytes(bytes: Vec) -> Result; /// Expected size of this message based on the provided parameters - fn expected_size(mode: KKTMode, expected_kem: KEM) -> usize; + fn expected_size(mode: KKTMode, expected_kem: KEM, payload_size: usize) -> usize; /// Expected size of the response from the remote party. /// `None` if this is the final (PSQ msg2) message of the exchange - fn response_size(&self, expected_kem: KEM) -> Option; + fn response_size(&self, expected_kem: KEM, payload_size: usize) -> Option; } async fn write_all_and_flush_async_write( diff --git a/common/nym-lp/src/peer_config.rs b/common/nym-lp/src/peer_config.rs index 80e5542e78..e6a9af2e12 100644 --- a/common/nym-lp/src/peer_config.rs +++ b/common/nym-lp/src/peer_config.rs @@ -179,6 +179,14 @@ impl LpPeerConfig { } } + pub fn hop_id(&self) -> u8 { + self.hop_id + } + + pub fn seed(&self) -> &[u8; SEED_LEN] { + &self.seed + } + pub fn serialize(&self) -> [u8; LP_PEER_CONFIG_SIZE] { let mut output_bytes: [u8; LP_PEER_CONFIG_SIZE] = [0u8; LP_PEER_CONFIG_SIZE]; output_bytes[0..4].copy_from_slice(self.pack_config().as_slice()); diff --git a/common/nym-lp/src/psq/handshake_message.rs b/common/nym-lp/src/psq/handshake_message.rs index 430962b66a..ff127e84e9 100644 --- a/common/nym-lp/src/psq/handshake_message.rs +++ b/common/nym-lp/src/psq/handshake_message.rs @@ -34,12 +34,12 @@ impl HandshakeMessage for KKTRequest { )) } - fn expected_size(mode: KKTMode, expected_kem: KEM) -> usize { - nym_kkt::message::KKTRequest::size(mode, expected_kem) + fn expected_size(mode: KKTMode, expected_kem: KEM, payload_size: usize) -> usize { + nym_kkt::message::KKTRequest::size_excluding_payload(mode, expected_kem) + payload_size } - fn response_size(&self, expected_kem: KEM) -> Option { - Some(nym_kkt::message::KKTResponse::size(expected_kem)) + fn response_size(&self, expected_kem: KEM, payload_size: usize) -> Option { + Some(nym_kkt::message::KKTResponse::size_excluding_payload(expected_kem) + payload_size) } } @@ -68,12 +68,12 @@ impl HandshakeMessage for KKTResponse { ))) } - fn expected_size(_: KKTMode, expected_kem: KEM) -> usize { - nym_kkt::message::KKTResponse::size(expected_kem) + fn expected_size(_: KKTMode, expected_kem: KEM, payload_size: usize) -> usize { + nym_kkt::message::KKTResponse::size_excluding_payload(expected_kem) + payload_size } - fn response_size(&self, expected_kem: KEM) -> Option { - Some(psq_msg1_size(expected_kem)) + fn response_size(&self, expected_kem: KEM, payload_size: usize) -> Option { + Some(psq_msg1_size(expected_kem) + payload_size) } } @@ -101,12 +101,12 @@ impl HandshakeMessage for PSQMsg1 { Ok(PSQMsg1(bytes)) } - fn expected_size(_: KKTMode, expected_kem: KEM) -> usize { - psq_msg1_size(expected_kem) + fn expected_size(_: KKTMode, expected_kem: KEM, payload_size: usize) -> usize { + psq_msg1_size(expected_kem) + payload_size } - fn response_size(&self, _: KEM) -> Option { - Some(PSQ_MSG2_SIZE) + fn response_size(&self, _: KEM, payload_size: usize) -> Option { + Some(PSQ_MSG2_SIZE + payload_size) } } @@ -134,11 +134,11 @@ impl HandshakeMessage for PSQMsg2 { Ok(PSQMsg2(bytes)) } - fn expected_size(_: KKTMode, _: KEM) -> usize { - PSQ_MSG2_SIZE + fn expected_size(_: KKTMode, _: KEM, payload_size: usize) -> usize { + PSQ_MSG2_SIZE + payload_size } - fn response_size(&self, _: KEM) -> Option { + fn response_size(&self, _: KEM, _: usize) -> Option { None } } diff --git a/common/nym-lp/src/psq/initiator.rs b/common/nym-lp/src/psq/initiator.rs index b1b387d48c..e3000ade2f 100644 --- a/common/nym-lp/src/psq/initiator.rs +++ b/common/nym-lp/src/psq/initiator.rs @@ -2,6 +2,7 @@ // SPDX-License-Identifier: Apache-2.0 use crate::peer::{LpLocalPeer, LpRemotePeer}; +use crate::peer_config::{LP_PEER_CONFIG_SIZE, LpPeerConfig}; use crate::psq::handshake_message::{PSQMsg1, PSQMsg2}; use crate::psq::helpers::kem_to_ciphersuite; use crate::psq::{ @@ -89,7 +90,9 @@ where /// Attempt to receive a KKT response to the previously sent request async fn receive_kkt_response(&mut self) -> Result { - let packet_len = KKTResponse::size(self.inner_state.local_peer.ciphersuite.kem()); + // no response payload + let packet_len = + KKTResponse::size_excluding_payload(self.inner_state.local_peer.ciphersuite.kem()); let resp = self .inner_state @@ -116,6 +119,8 @@ where let ciphersuite = self.inner_state.local_peer.ciphersuite(); let kem = ciphersuite.kem(); + let lp_peer_config = LpPeerConfig::new_client_to_entry(rng, false); + // 1. retrieve the expected kem key hash. if we don't know it, let dir_hash = self .initiator_data @@ -129,6 +134,7 @@ where self.initiator_data.remote_peer.x25519(), &dir_hash, self.initiator_data.protocol_version, + Some(Vec::from(lp_peer_config.serialize())), )?; // derive the receiver index from the request // let receiver_index = kkt_request @@ -139,7 +145,9 @@ where // 3. receive and process KKT response let raw_response = self.receive_kkt_response().await?; debug!("received KKT response"); - let response = initiator.process_response(raw_response)?; + + // the responder does not send a payload + let response = initiator.process_response(raw_response, 0)?; // 4. generate and send PSQ request let protocol = self.initiator_data.protocol_version; @@ -257,13 +265,15 @@ mod tests { // 1. read KKT request let raw_kkt_req: handshake_message::KKTRequest = conn_resp - .receive_handshake_message(KKTRequest::size(KKTMode::OneWay, kem)) + .receive_handshake_message( + KKTRequest::size_excluding_payload(KKTMode::OneWay, kem) + LP_PEER_CONFIG_SIZE, + ) .timeboxed() .await??; let req = raw_kkt_req.into(); // 2. process - let processed_req = kkt_responder.process_request(req)?; + let processed_req = kkt_responder.process_request(req, LP_PEER_CONFIG_SIZE)?; conn_resp .send_handshake_message::( processed_req.response.into(), diff --git a/common/nym-lp/src/psq/mod.rs b/common/nym-lp/src/psq/mod.rs index 0de6bc8de7..dad838567a 100644 --- a/common/nym-lp/src/psq/mod.rs +++ b/common/nym-lp/src/psq/mod.rs @@ -112,6 +112,7 @@ mod tests { use super::*; use crate::codec::{decrypt_data, encrypt_data}; use crate::peer::mock_peers; + use crate::peer_config::{LP_PEER_CONFIG_SIZE, LpPeerConfig}; use libcrux_psq::handshake::types::Authenticator; use libcrux_psq::session::{Session, SessionBinding}; use libcrux_psq::{Channel, IntoSession}; @@ -228,6 +229,8 @@ mod tests { // SETUP END + let lp_peer_config = LpPeerConfig::new_client_to_entry(&mut rng, false); + // OneWay - MlKem let (mut initiator, request) = KKTInitiator::generate_one_way_request( &mut rng, @@ -235,12 +238,17 @@ mod tests { &responder_x25519_keypair.pk, &dir_hash, protocol_version, + Some(Vec::from(lp_peer_config.serialize())), ) .unwrap(); - let processed_req = kkt_responder.process_request(request.request).unwrap(); + let processed_req = kkt_responder + .process_request(request.request, LP_PEER_CONFIG_SIZE) + .unwrap(); - let response = initiator.process_response(processed_req.response).unwrap(); + let response = initiator + .process_response(processed_req.response, 0) + .unwrap(); let encapsulation_key = response.encapsulation_key; let mut payload_buf_responder = vec![0u8; 4096]; diff --git a/common/nym-lp/src/psq/responder.rs b/common/nym-lp/src/psq/responder.rs index e7295372f8..9789eb0a89 100644 --- a/common/nym-lp/src/psq/responder.rs +++ b/common/nym-lp/src/psq/responder.rs @@ -2,6 +2,7 @@ // SPDX-License-Identifier: Apache-2.0 use crate::peer::LpLocalPeer; +use crate::peer_config::LP_PEER_CONFIG_SIZE; use crate::psq::handshake_message::{PSQMsg1, PSQMsg2}; use crate::psq::helpers::kem_to_ciphersuite; use crate::psq::{ @@ -78,10 +79,10 @@ where { /// Attempt to receive a KKT request from a one-way client async fn receive_one_way_kkt_request(&mut self) -> Result { - let packet_len = KKTRequest::size( + let packet_len = KKTRequest::size_excluding_payload( KKTMode::OneWay, self.inner_state.local_peer.ciphersuite.kem(), - ); + ) + LP_PEER_CONFIG_SIZE; let req = self .inner_state @@ -108,7 +109,7 @@ where &self.responder_data.supported_signature_schemes, &self.responder_data.supported_outer_protocol_versions, )? - .process_request(kkt_request)?; + .process_request(kkt_request, LP_PEER_CONFIG_SIZE)?; Ok(processed_req) } @@ -216,6 +217,7 @@ mod tests { use super::*; use crate::codec::{decrypt_data, encrypt_data}; use crate::peer::mock_peers; + use crate::peer_config::LpPeerConfig; use crate::psq::initiator; use nym_kkt::initiator::KKTInitiator; use nym_kkt_ciphersuite::{Ciphersuite, IntoEnumIterator}; @@ -261,6 +263,8 @@ mod tests { let mut rng = deterministic_rng_09(); let dir_hash = resp_remote.expected_kem_key_hash(init.ciphersuite)?; + let lp_peer_config = LpPeerConfig::new_client_to_entry(&mut rng, false); + // OneWay - MlKem let (mut initiator, request) = KKTInitiator::generate_one_way_request( &mut rng, @@ -268,6 +272,7 @@ mod tests { &resp_remote.x25519_public, &dir_hash, 1, + Some(Vec::from(lp_peer_config.serialize())), )?; // 1. send kkt request @@ -280,14 +285,14 @@ mod tests { .await??; // 2. receive KKT response - let response_len = KKTResponse::size(kem); + let response_len = KKTResponse::size_excluding_payload(kem); let resp: handshake_message::KKTResponse = conn_init .receive_handshake_message(response_len) .timeboxed() .await??; let kkt_response = resp.into(); - let response = initiator.process_response(kkt_response)?; + let response = initiator.process_response(kkt_response, 0)?; let encapsulation_key = response.encapsulation_key; let initiator_ciphersuite =