From c635e41d8576f5587d47e51a98dfd4a8920315f0 Mon Sep 17 00:00:00 2001 From: eunhhu Date: Sun, 27 Sep 2026 18:26:33 +0100 Subject: Seal delivered sends to the receiver's key (086) --seal OUTPUT=KEY seals each request's body whole to the receiving node's public key with HPKE (RFC 9180, base mode: X25519, HKDF-SHA256, AES-128-GCM where the CPU has AES, else ChaCha20-Poly1305), bound to the request's source, first number and count; X-Pure-Seal names the suite. A receiver's --key is a raw 32-byte file, made 0600 when missing, held in OpenSSL's secure heap; it opens the body where it lies (400 seal when it does not open) and zeroes the plain text when the request's ticket goes. --sealed-only refuses unsealed deliveries (403 unsealed). The check puts a recording relay between two apps: every order applies once, no body shows an item or a field name, a flipped bit is refused, a replayed request applies nothing twice, and a seal to another key does not open. Its hosts choose their own ports (--port 0). Sealed sends drain at 233-235k a second against 469-470k plain (Raspberry Pi 5): three X25519 operations a request, 164 us each. The plain request path measured the same as before. --- README.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index 681c230..6ba38db 100644 --- a/README.md +++ b/README.md @@ -7,10 +7,12 @@ terminal UI, a CLI, spoken sentences and a web page through [Vega](/srv/git/vega `pure-serve`: views are GETs and inputs are POSTs, with JSON bodies (groups included) read in place; answers are durable, a commit being one contiguous write and one sync; views are read from a snapshot of the last save, so reads never wait for a sync. What an app sends is saved with its event and delivered over HTTP in order and in -batches, and a receiving app applies each message once. Measurements against axum and drogon on a Raspberry Pi 5 +batches, and a receiving app applies each message once; sealed to the receiver's key (HPKE), no relay between +them can read or change it. Measurements against axum and drogon on a Raspberry Pi 5 are in [075](docs/research/075-http-host-against-axum.md), [077](docs/research/077-apps-as-http-services.md), [080](docs/research/080-snapshot-reads.md), [081](docs/research/081-tail-records.md), -[082](docs/research/082-json-in-place.md) and [083](docs/research/083-delivery-over-http.md); the status table is +[082](docs/research/082-json-in-place.md), [083](docs/research/083-delivery-over-http.md) and +[086](docs/research/086-sealed-sends.md); the status table is [CHECKPOINT.md](CHECKPOINT.md). The source follows the principle below, a small core with the rest selected around it -- cgit v1.2.3