2 files changed, 17 insertions, 4 deletions

diff --git a/link/link-protocol.c b/link/link-protocol.c
index 94a965b..c8b5118 100644
--- a/link/link-protocol.c
+++ b/link/link-protocol.c
@@ -656,16 +656,25 @@ PureLinkSender *pure_link_sender(const char *source, const char *input, uint32_t
     return l;
 }
 
-bool pure_link_sender_peer(PureLinkSender *l, const unsigned char peer[PURE_SEAL_KEY]) {
+/* The receiver's key, with the secret made (or given) into l->secret: the
+ * keys of packets to it. */
+static bool keyed(PureLinkSender *l, const unsigned char peer[PURE_SEAL_KEY], const unsigned char *secret) {
     memcpy(l->peer, peer, PURE_SEAL_KEY);
     l->peer_id = key_id(peer);
     pure_aead_free(l->out);
     pure_aead_free(l->in);
     l->out = l->in = NULL;
-    return l->own && pure_link_secret(l->own, l->peer, l->secret) &&
+    if (secret) memcpy(l->secret, secret, 32);
+    return (secret || (l->own && pure_link_secret(l->own, l->peer, l->secret))) &&
            (l->out = aead_of(l->secret, l->own_public, l->peer, l->run, 0, l->out_base));
 }
 
+bool pure_link_sender_peer(PureLinkSender *l, const unsigned char peer[PURE_SEAL_KEY]) { return keyed(l, peer, NULL); }
+
+bool pure_link_sender_shared(PureLinkSender *l, const unsigned char peer[PURE_SEAL_KEY], const unsigned char secret[32]) {
+    return keyed(l, peer, secret);
+}
+
 uint64_t pure_link_sender_queued(const PureLinkSender *l) { return l->queued; }
 
 uint64_t pure_link_sender_stored(const PureLinkSender *l) { return l->stored; }
diff --git a/link/link-protocol.h b/link/link-protocol.h
index b0f8ef3..3037926 100644
--- a/link/link-protocol.h
+++ b/link/link-protocol.h
@@ -67,14 +67,18 @@ typedef struct {
 /* ---- The sending side: one output's saved sends to a receiver's input, as
  * source (the receiver's name for it), their messages of shape (the
  * receiver's input must have the same: core/module.h's pure_module_shape),
- * from own (this node's key, whose public half is own_public). NULL when
- * the names are not 1 to PURE_LINK_NAME bytes, or memory runs out. */
+ * from own (this node's key, whose public half is own_public; NULL when
+ * the secret comes from elsewhere). NULL when the names are not 1 to
+ * PURE_LINK_NAME bytes, or memory runs out. */
 typedef struct PureLinkSender PureLinkSender;
 PureLinkSender *pure_link_sender(const char *source, const char *input, uint32_t shape, const PureSealKey *own,
                                  const unsigned char own_public[PURE_SEAL_KEY]);
 /* The receiver's public key: the keys made from it (one X25519). A sender
  * makes no packet before it has one. */
 bool pure_link_sender_peer(PureLinkSender *, const unsigned char peer[PURE_SEAL_KEY]);
+/* The same with the secret own's key shares with peer's made elsewhere (by
+ * a key kept in hardware, say, or a test's many keys): no X25519 here. */
+bool pure_link_sender_shared(PureLinkSender *, const unsigned char peer[PURE_SEAL_KEY], const unsigned char secret[32]);
 /* A saved send, numbered one past the last queued (any number when none
  * waits); false when it cannot be kept. */
 bool pure_link_sender_queue(PureLinkSender *, uint64_t seq, const unsigned char *bytes, size_t size);