zeolite

README

go-zeolite

Zeolite: simple & secure communications based on libsodium with perfect forward secrecy, XChaCha20-Poly1305 and a mirrored protocol (no distinction between client & server).

Protocol design

The protocol is completely identical for server & client.

Handshake (performed in lockstep by both participants)

1. Protocol version (currently zeolite1, so 8 bytes)
2. Public key (32 bytes)
3. Ephemeral key (for PFS) signed with public key (96 bytes)
4. Symmetric key (for communication) encrypted with ephemeral key (72 bytes)
5. Stream header (24 bytes)

Total: 232 bytes

Data Transmission

1. Message size (4 bytes)
2. Encrypted message (17 bytes + message size)

Total: 21 bytes + message size

Documentation

Index

• Constants
• Variables
• func Base64Dec(b64 string) ([]byte, error)
• func Base64Enc(data []byte) string
• func BlockCopy(dst io.Writer, src BlockReader) (written int64, err error)
• func Init() error
• type BlockReader
• type EphPK
• type EphSK
• type Identity
  • func NewIdentity() (ret Identity, err error)
  • func (identity Identity) NewStream(conn io.ReadWriter, cb TrustCB) (ret *Stream, err error)
• type SignPK
• type SignSK
• type Stream
  • func (stream *Stream) BlockRead() (p []byte, err error)
  • func (stream *Stream) Recv() (ret []byte, err error)
  • func (stream *Stream) Send(msg []byte) error
  • func (stream *Stream) Write(msg []byte) (n int, err error)
• type SymK
• type TrustCB

Constants

const Protocol = "zeolite1"

Variables

var (
	ErrInit    = errors.New("could not initialize libsodium")
	ErrEOS     = errors.New("end of stream reached")
	ErrRecv    = errors.New("could not receive")
	ErrSend    = errors.New("could not send")
	ErrProto   = errors.New("protocol violation")
	ErrKeygen  = errors.New("key generation failed")
	ErrTrust   = errors.New("no trust")
	ErrSign    = errors.New("could not sign")
	ErrVerify  = errors.New("could not verify")
	ErrEncrypt = errors.New("could not encrypt")
	ErrDecrypt = errors.New("could not decrypt")
)

Functions

func Base64Dec

func Base64Dec(b64 string) ([]byte, error)

func Base64Enc

func Base64Enc(data []byte) string

func BlockCopy

func BlockCopy(dst io.Writer, src BlockReader) (written int64, err error)

func Init

func Init() error

Types

type BlockReader

type BlockReader interface {
	BlockRead() (p []byte, err error)
}

type EphPK

type EphPK [C.crypto_box_PUBLICKEYBYTES]byte

type EphSK

type EphSK [C.crypto_box_SECRETKEYBYTES]byte

type Identity

type Identity struct {
	Public SignPK
	Secret SignSK
}

func NewIdentity

func NewIdentity() (ret Identity, err error)

func (Identity) NewStream

func (identity Identity) NewStream(conn io.ReadWriter, cb TrustCB) (ret *Stream, err error)

type SignPK

type SignPK [C.crypto_sign_PUBLICKEYBYTES]byte

type SignSK

type SignSK [C.crypto_sign_SECRETKEYBYTES]byte

type Stream

type Stream struct {
	Conn      io.ReadWriter
	OtherPK   SignPK
	SendState C.crypto_secretstream_xchacha20poly1305_state
	RecvState C.crypto_secretstream_xchacha20poly1305_state
}

func (*Stream) BlockRead

func (stream *Stream) BlockRead() (p []byte, err error)

func (*Stream) Recv

func (stream *Stream) Recv() (ret []byte, err error)

func (*Stream) Send

func (stream *Stream) Send(msg []byte) error

func (*Stream) Write

func (stream *Stream) Write(msg []byte) (n int, err error)

type SymK

type SymK [C.crypto_secretstream_xchacha20poly1305_KEYBYTES]byte

type TrustCB

type TrustCB func(otherPK SignPK) (bool, error)