Commit Graph
24 Commits
Author SHA1 Message Date
riccardom e6cc446877 pqkem: dedicated slog logger via NB_PQ_MLKEM_LOG_LEVEL 2026-08-07 10:24:01 +02:00
riccardom 09664e84aa Homogeneous logs prefix 2026-08-07 10:24:01 +02:00
riccardom 4d2037ccc9 Bit of renaming
peer -> peerAddrs
have types for remoteID and localID
t.Close log error
Manager SetTransport -> Start
2026-08-07 10:24:01 +02:00
riccardom f0eb275575 Typo 2026-08-07 10:24:01 +02:00
riccardom 341ed699d9 Race fix 2026-08-07 10:24:01 +02:00
riccardom 11d0ad13bb Makes Transport just a UDP socket.
Manager owns maps for remoteID <-> remote UDP addr
Engine talks to manager only
2026-08-07 10:24:01 +02:00
riccardom 8fa2a41888 Added enabled env var 2026-08-07 10:24:01 +02:00
riccardom 3059e7d141 Invert order of keys as per draft 2026-08-07 10:24:01 +02:00
riccardom 551145def6 Removes confirm. Uses next offer to deliver confirmation/ack of previous round
We clock the next Offer initiation to the OnDataPathRekeyed, so we have 2 minutes
ahead of us to do our attempts and stuff before to give up.
On failure, we will know because we will not receive a new answer.. but more importantly
the wg handshake will fail :D
2026-08-07 10:24:01 +02:00
riccardom 40016ae082 Leave signal offer/answer as a pull/push operation not as an actual transport 2026-08-07 10:24:01 +02:00
riccardom 9dbc7401c9 Assume two transports: initial "signal" (control plane) one (no data path established yet) + data path one
Define OnDataPathRekeyed event to transition from control plane path to data plane path over the WG tunnel.

Keep confirm ALWAYS on NEW established WG tunnel (posthandshake with rekeying). We keep an active method
irrelevant of the WG handshake (we might decide that the indirect wg handshake is sufficient in the future).

Optimistic commit on responder(when sending answer), while on initiator we set it on getting the answer
2026-08-07 10:24:01 +02:00
riccardom abe28c41ee Epurate wg refs 2026-08-07 10:24:01 +02:00
riccardom 56a8681b76 Collapse Driver and Manager in one.
- Have just one manager => one lock
 - Session state is needed in driver to => we have it available now.
 - Isomorphically align to rosenpass components and functionality

File	Role	                                  rosenpass equivalent
kem.go	primitive pure X25519MLKEM768	          crypto.go/handshake
message.go	Offer/Answer/Confirm + Encode/Decode  messages.go
manager.go	Manager stateful, single lock	      server logic
callbacks.go	WGCallbackHandler (seam output)	  Handler
Transport (interfaccia)	seam trasporto pluggable  Conn
2026-08-07 10:24:01 +02:00
riccardom 9c6b00125b [squash] isInitial and answered can be inferred without state variables 2026-08-07 10:24:01 +02:00
riccardom 090f97d3c4 Manages convergence 2026-08-07 10:24:01 +02:00
riccardom b0f5731699 Models reattempts 2026-08-07 10:24:01 +02:00
riccardom e69b9ccc18 Reuse answer, don't calculate again 2026-08-07 10:24:01 +02:00
riccardom cb3285a79b Adds driver to glue together manager and outside world 2026-08-07 10:24:01 +02:00
riccardom 14df9d75a3 Defines event callbacks 2026-08-07 10:24:01 +02:00
riccardom b23b757380 Admits possible errors on Encode 2026-08-07 10:24:01 +02:00
riccardom 744508f742 Bench key material boilerplate time/allocs
CGO_ENABLED=1 go test ./client/internal/pqkem/ -run '^$' -bench . -benchmem 2>&1 | grep -E "Benchmark|ns/op|PASS|ok" | head -20

BenchmarkX25519Keygen-14    	   33795	     34966 ns/op	     224 B/op	       5 allocs/op
BenchmarkX25519ECDH-14      	   33855	     33973 ns/op	      32 B/op	       1 allocs/op
BenchmarkMLKEMKeygen-14     	   21817	     67778 ns/op	    8200 B/op	       2 allocs/op
BenchmarkMLKEMEncaps-14     	   29918	     43235 ns/op	    1216 B/op	       2 allocs/op
BenchmarkMLKEMDecaps-14     	   26048	     56291 ns/op	      64 B/op	       2 allocs/op
PASS
ok  	github.com/netbirdio/netbird/client/internal/pqkem	9.751s
Shell cwd was reset to /home/riccardo/Desktop/Personal/netbirdio/netbird
2026-08-07 10:24:01 +02:00
riccardom d808ecf8dd Pure mechanics of manager 2026-08-07 10:24:01 +02:00
riccardom f5b350a812 Messages definition 2026-08-07 10:24:01 +02:00
riccardom acb8970346 ML-KEM encapsulate/decapsulate module 2026-08-07 10:24:01 +02:00