temp: use jstuczyn's libcrux fork

2026-01-27 10:16:31 +00:00
parent 0629e37c1b
commit cef9534dce
5 changed files with 91 additions and 100 deletions
@@ -1477,7 +1477,7 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 [[package]]
 name = "core-models"
 version = "0.0.5"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "hax-lib",
 "pastey 0.2.1",
@@ -4455,7 +4455,7 @@ checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
 [[package]]
 name = "libcrux-aesgcm"
 version = "0.0.6"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libcrux-intrinsics",
 "libcrux-platform",
@@ -4466,7 +4466,7 @@ dependencies = [
 [[package]]
 name = "libcrux-chacha20poly1305"
 version = "0.0.5"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libcrux-hacl-rs",
 "libcrux-macros",
@@ -4478,7 +4478,7 @@ dependencies = [
 [[package]]
 name = "libcrux-curve25519"
 version = "0.0.5"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libcrux-hacl-rs",
 "libcrux-macros",
@@ -4489,7 +4489,7 @@ dependencies = [
 [[package]]
 name = "libcrux-ecdh"
 version = "0.0.5"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libcrux-curve25519",
 "libcrux-p256",
@@ -4500,7 +4500,7 @@ dependencies = [
 [[package]]
 name = "libcrux-ed25519"
 version = "0.0.5"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libcrux-hacl-rs",
 "libcrux-macros",
@@ -4512,7 +4512,7 @@ dependencies = [
 [[package]]
 name = "libcrux-hacl-rs"
 version = "0.0.4"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libcrux-macros",
 ]
@@ -4520,7 +4520,7 @@ dependencies = [
 [[package]]
 name = "libcrux-hkdf"
 version = "0.0.5"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libcrux-hacl-rs",
 "libcrux-hmac",
@@ -4530,7 +4530,7 @@ dependencies = [
 [[package]]
 name = "libcrux-hmac"
 version = "0.0.5"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libcrux-hacl-rs",
 "libcrux-macros",
@@ -4540,7 +4540,7 @@ dependencies = [
 [[package]]
 name = "libcrux-intrinsics"
 version = "0.0.5"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "core-models",
 "hax-lib",
@@ -4549,7 +4549,7 @@ dependencies = [
 [[package]]
 name = "libcrux-kem"
 version = "0.0.5"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libcrux-curve25519",
 "libcrux-ecdh",
@@ -4564,7 +4564,7 @@ dependencies = [
 [[package]]
 name = "libcrux-macros"
 version = "0.0.3"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "quote",
 "syn 2.0.114",
@@ -4573,7 +4573,7 @@ dependencies = [
 [[package]]
 name = "libcrux-ml-dsa"
 version = "0.0.6"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "core-models",
 "hax-lib",
@@ -4587,7 +4587,7 @@ dependencies = [
 [[package]]
 name = "libcrux-ml-kem"
 version = "0.0.6"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "hax-lib",
 "libcrux-intrinsics",
@@ -4602,7 +4602,7 @@ dependencies = [
 [[package]]
 name = "libcrux-p256"
 version = "0.0.5"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libcrux-hacl-rs",
 "libcrux-macros",
@@ -4614,7 +4614,7 @@ dependencies = [
 [[package]]
 name = "libcrux-platform"
 version = "0.0.3"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libc",
 ]
@@ -4622,7 +4622,7 @@ dependencies = [
 [[package]]
 name = "libcrux-poly1305"
 version = "0.0.4"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libcrux-hacl-rs",
 "libcrux-macros",
@@ -4631,7 +4631,7 @@ dependencies = [
 [[package]]
 name = "libcrux-psq"
 version = "0.0.6"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "classic-mceliece-rust",
 "libcrux-aesgcm",
@@ -4653,7 +4653,7 @@ dependencies = [
 [[package]]
 name = "libcrux-secrets"
 version = "0.0.5"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "hax-lib",
 ]
@@ -4661,7 +4661,7 @@ dependencies = [
 [[package]]
 name = "libcrux-sha2"
 version = "0.0.5"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libcrux-hacl-rs",
 "libcrux-macros",
@@ -4671,7 +4671,7 @@ dependencies = [
 [[package]]
 name = "libcrux-sha3"
 version = "0.0.6"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "hax-lib",
 "libcrux-intrinsics",
@@ -4682,7 +4682,7 @@ dependencies = [
 [[package]]
 name = "libcrux-traits"
 version = "0.0.5"
-source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7"
+source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1"
 dependencies = [
 "libcrux-secrets",
 "rand 0.9.2",
@@ -401,6 +401,7 @@ libcrux-sha3 = { git = "https://github.com/cryspen/libcrux" }
 libcrux-traits = { git = "https://github.com/cryspen/libcrux" }


+
 # Workspace dep definitions required by crates.io publication - we need a workspace version since `cargo workspaces` doesn't work with path imports from crate manifests
 nym-api-requests = { version = "1.20.1", path = "nym-api/nym-api-requests" }
 nym-authenticator-requests = { version = "1.20.1", path = "common/authenticator-requests" }
@@ -551,6 +552,17 @@ wasm-bindgen-test = "0.3.49"
 wasmtimer = "0.4.1"
 web-sys = "0.3.76"

+# temporary workaround until relevant changes are merged upstream
+[patch."https://github.com/cryspen/libcrux"]
+libcrux-kem = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" }
+libcrux-ecdh = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" }
+libcrux-chacha20poly1305 = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" }
+libcrux-psq = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" }
+libcrux-ml-kem = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" }
+libcrux-sha3 = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" }
+libcrux-traits = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" }
+
+
 # for local development:
 #[patch.crates-io]
 #sphinx-packet = { path = "../sphinx" }
@@ -48,15 +48,18 @@ impl KKTSessionSecret {
    }

    pub fn derive(private_key: &DHPrivateKey, public_key: &DHPublicKey) -> Self {
-        unimplemented!("unexposed in libcrux")
-        // let mut shared_secret = private_key.diffie_hellman(public_key);
-        //
-        // let mut hasher = Hasher::new();
-        //
-        // hasher.update(&shared_secret);
+        let mut shared_secret = private_key
+            .diffie_hellman(public_key)
+            .expect("TODO: error handling");
+
+        let mut hasher = Hasher::new();
+
+        hasher.update(shared_secret.as_ref());
+
+        // TODO: zeroize
        // shared_secret.zeroize();
-        //
-        // Self(hasher.finalize().as_bytes().to_owned())
+
+        Self(hasher.finalize().as_bytes().to_owned())
    }
    pub fn as_bytes(&self) -> &[u8; 32] {
        &self.0
@@ -29,16 +29,6 @@ pub struct LpLocalPeer {
    pub(crate) mceliece: Option<(Arc<DecapsulationKey>, Arc<EncapsulationKey>)>,
 }

-pub(crate) trait Placeholder {
-    fn PLACEHOLDER_UNIMPLEMENTED_private_key(&self) -> &DHPrivateKey;
-}
-
-impl Placeholder for DHKeyPair {
-    fn PLACEHOLDER_UNIMPLEMENTED_private_key(&self) -> &DHPrivateKey {
-        unimplemented!("need to ask libcrux to expose it")
-    }
-}
-
 impl LpLocalPeer {
    pub fn new(ed25519: Arc<ed25519::KeyPair>, x25519: Arc<x25519::KeyPair>) -> Self {
        // TODO: make nicer conversion (without cloning) + error handling
@@ -11,7 +11,7 @@ use crate::message::{EncryptedDataPayload, HandshakeData};
 // noiserm
 use crate::noise_protocol::{NoiseError, NoiseProtocol, ReadResult};
 use crate::packet::LpHeader;
-use crate::peer::{LpLocalPeer, LpRemotePeer, Placeholder};
+use crate::peer::{LpLocalPeer, LpRemotePeer};
 use crate::psk::{
    derive_subsession_psk, psq_initiator_create_message, psq_responder_process_message,
 };
@@ -397,10 +397,7 @@ impl LpSession {
        let params = pattern_name.parse()?;
        let builder = Builder::new(params);

-        let local_key_bytes = local_peer
-            .x25519
-            .PLACEHOLDER_UNIMPLEMENTED_private_key()
-            .as_ref();
+        let local_key_bytes = local_peer.x25519.sk().as_ref();
        // noiserm
        let builder = builder.local_private_key(local_key_bytes);

@@ -759,17 +756,14 @@ impl LpSession {

        let mut kkt_state = self.kkt_state.lock();

-        let response_bytes = match decrypt_initial_kkt_frame(
-            self.local_peer
-                .x25519()
-                .PLACEHOLDER_UNIMPLEMENTED_private_key(),
-            request_bytes,
-        ) {
-            Ok((session_secret, request_frame, remote_context)) => {
-                match responder_ingest_message(&remote_context, None, None, &request_frame) {
-                    Ok((mut context, _)) => {
-                        let local_kem_key: Arc<EncapsulationKey> =
-                            match self.local_kem_encapsulation_key(&context.ciphersuite().kem()) {
+        let response_bytes =
+            match decrypt_initial_kkt_frame(self.local_peer.x25519().sk(), request_bytes) {
+                Ok((session_secret, request_frame, remote_context)) => {
+                    match responder_ingest_message(&remote_context, None, None, &request_frame) {
+                        Ok((mut context, _)) => {
+                            let local_kem_key: Arc<EncapsulationKey> = match self
+                                .local_kem_encapsulation_key(&context.ciphersuite().kem())
+                            {
                                Some(key) => key.clone(),
                                None => {
                                    return Err(LpError::Internal(format!(
@@ -779,49 +773,49 @@ impl LpSession {
                                }
                            };

-                        match responder_process(
-                            &mut context,
-                            request_frame.session_id(),
-                            self.local_peer.ed25519().private_key(),
-                            &local_kem_key,
-                        ) {
-                            Ok(response_frame) => match encrypt_kkt_frame(
-                                &mut rng,
-                                &session_secret,
-                                &response_frame,
-                                KKT_RESPONSE_AAD,
+                            match responder_process(
+                                &mut context,
+                                request_frame.session_id(),
+                                self.local_peer.ed25519().private_key(),
+                                &local_kem_key,
                            ) {
-                                Ok(response_bytes) => response_bytes,
+                                Ok(response_frame) => match encrypt_kkt_frame(
+                                    &mut rng,
+                                    &session_secret,
+                                    &response_frame,
+                                    KKT_RESPONSE_AAD,
+                                ) {
+                                    Ok(response_bytes) => response_bytes,
+                                    Err(e) => {
+                                        return Err(LpError::Internal(format!(
+                                            "KKT response encryption failure : {:?}",
+                                            e
+                                        )));
+                                    }
+                                },
                                Err(e) => {
                                    return Err(LpError::Internal(format!(
-                                        "KKT response encryption failure : {:?}",
+                                        "KKT response generation failure : {:?}",
                                        e
                                    )));
                                }
-                            },
-                            Err(e) => {
-                                return Err(LpError::Internal(format!(
-                                    "KKT response generation failure : {:?}",
-                                    e
-                                )));
                            }
                        }
-                    }
-                    Err(e) => {
-                        return Err(LpError::Internal(format!(
-                            "KKT request handling failure: {:?}",
-                            e
-                        )));
+                        Err(e) => {
+                            return Err(LpError::Internal(format!(
+                                "KKT request handling failure: {:?}",
+                                e
+                            )));
+                        }
                    }
                }
-            }
-            Err(e) => {
-                return Err(LpError::Internal(format!(
-                    "KKT request decryption failure: {:?}",
-                    e
-                )));
-            }
-        };
+                Err(e) => {
+                    return Err(LpError::Internal(format!(
+                        "KKT request decryption failure: {:?}",
+                        e
+                    )));
+                }
+            };

        // Mark KKT as processed
        // Responder doesn't store the kem_pk since they already have their own KEM keypair
@@ -870,9 +864,7 @@ impl LpSession {
            let session_context = self.id.to_le_bytes();

            let psq_result = match psq_initiator_create_message(
-                self.local_peer
-                    .x25519
-                    .PLACEHOLDER_UNIMPLEMENTED_private_key(),
+                self.local_peer.x25519.sk(),
                &self.remote_peer.x25519_public,
                remote_kem,
                self.local_peer.ed25519.private_key(),
@@ -1018,9 +1010,7 @@ impl LpSession {
                    let session_context = self.id.to_le_bytes();

                    let psq_result = match psq_responder_process_message(
-                        self.local_peer
-                            .x25519
-                            .PLACEHOLDER_UNIMPLEMENTED_private_key(),
+                        self.local_peer.x25519.sk(),
                        &self.remote_peer.x25519_public,
                        (&dec_key, &enc_key),
                        &self.remote_peer.ed25519_public,
@@ -1279,11 +1269,7 @@ impl LpSession {
        let pattern_name = "Noise_KKpsk0_25519_ChaChaPoly_SHA256";
        let params = pattern_name.parse()?;

-        let local_key_bytes = self
-            .local_peer
-            .x25519
-            .PLACEHOLDER_UNIMPLEMENTED_private_key()
-            .as_ref();
+        let local_key_bytes = self.local_peer.x25519.sk().as_ref();
        let remote_key_bytes = self.remote_x25519_public().as_ref();

        let builder = Builder::new(params)