Seal in one session a wire, authenticated by the sender's key (088)

A sealed request cost three X25519 operations (about 0.5 ms), so sealed
sends drained at half the plain rate. A wire now keeps one HPKE context,
encapsulated at its first seal, and seals each request as the context's
next number (a failed seal or a restart starts a new session); the
header carries the session's encapsulated key and the number, so a
receiver opens a session once per connection thread (16 remembered, the
least used replaced) and each seal by its number, also after it restarts,
unasked. A sender with a key of its own seals in HPKE auth mode and names
that key in the header; a receiver started with --sender NAME=KEY takes
deliveries only from the senders it names, each sealed with its key
(403 sender otherwise). The body is now the ciphertext and its tag.

Sealed sends, sender authenticated, drain at 461-464k a second against
462-470k plain and 207-234k sealed a request at a time (Raspberry Pi 5).
The check adds: a wire's requests share one session numbered from 0; a
changed number or sender key does not open; a receiver restarted naming
its sender opens the same session again; another node claiming that
sender's name with its own key is refused and applies nothing.

1 files changed, 6 insertions, 3 deletions

diff --git a/serve/deliver.h b/serve/deliver.h
index 70b03b9..f7427c5 100644
--- a/serve/deliver.h
+++ b/serve/deliver.h
@@ -1,6 +1,7 @@
 #ifndef PURE_DELIVER_H
 #define PURE_DELIVER_H
 #include "module.h"
+#include "seal.h"
 
 /* Delivering an app's saved sends over HTTP (docs/research/083-delivery-over-http.md).
  * A wire takes one output's sends in order: each goes as a JSON object of
@@ -23,10 +24,12 @@ void pure_wire_trust(const char *ca_file);
 PureWire *pure_wire_open(const PureModule *m, const char *output, const char *url, const char *source,
                          char *error, size_t size);
 uint32_t pure_wire_output(const PureWire *);
-/* Seal the wire's sends to the receiver's public key (serve/seal.h): each
+/* Seal the wire's sends to the receiver's public key (serve/seal.h),
+ * authenticated by own (whose public half is from) when given: each
  * request's body, bound to its source, first number and count, goes with
- * X-Pure-Seal naming the suite. Before pure_wire_start. */
-void pure_wire_seal(PureWire *, const unsigned char peer[32]);
+ * X-Pure-Seal naming the suite, the session, the seal's number and the
+ * sender's key. Before pure_wire_start. */
+void pure_wire_seal(PureWire *, const unsigned char peer[32], const PureSealKey *own, const unsigned char *from);
 /* The owner's side: queue a saved send numbered after the last queued one
  * (it is encoded now); false when it cannot be (a bytes field that is not
  * UTF-8 has no JSON form), and the wire then stops at it. */