riccardom 6b9f4a9a73 pqkem: recover from persistent rekey failure by re-bootstrapping over signal ...

OnRekeyFailed now re-runs the KEM bootstrap over Signal (conn.RequestReoffer ->
handshaker.SendOffer) instead of only logging: a fresh signalling offer starts a new
exchange that overwrites the stalled PSK on both sides, resyncing after a persistent
data-path desync. Chosen over a responder-side awaitingAck revert (which fights the
confirm-less ack timing) and a full tunnel teardown (heavier). The tunnel stays up on
the previous PSK meanwhile since Signal is independent of the broken data path.

2026-08-03 12:48:47 +02:00

88 KiB

Raw Blame History

View Raw